1686 files changed, 58923 insertions, 17867 deletions

diff --git a/Source/WebCore/CMakeLists.txt b/Source/WebCore/CMakeLists.txt
index 90efc6dba..2fcc26557 100644
--- a/Source/WebCore/CMakeLists.txt
+++ b/Source/WebCore/CMakeLists.txt
@@ -1,6 +1,9 @@
 SET(WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}"
     "${WEBCORE_DIR}/Modules/geolocation"
+    "${WEBCORE_DIR}/Modules/indexeddb"
+    "${WEBCORE_DIR}/Modules/webdatabase"
+    "${WEBCORE_DIR}/Modules/websockets"
     "${WEBCORE_DIR}/accessibility"
     "${WEBCORE_DIR}/bindings"
     "${WEBCORE_DIR}/bindings/generic"
@@ -90,6 +93,9 @@ SET(WebCore_INCLUDE_DIRECTORIES
 
 SET(WebCore_IDL_INCLUDES
     Modules/geolocation
+    Modules/indexeddb
+    Modules/webdatabase
+    Modules/websockets
     bindings/generic
     css
     dom
@@ -115,6 +121,9 @@ SET(WebCore_IDL_FILES
     Modules/geolocation/PositionError.idl
     Modules/geolocation/PositionErrorCallback.idl
 
+    Modules/websockets/CloseEvent.idl
+    Modules/websockets/DOMWindowWebSocket.idl
+
     css/Counter.idl
     css/CSSCharsetRule.idl
     css/CSSFontFaceRule.idl
@@ -216,7 +225,6 @@ SET(WebCore_IDL_FILES
     html/DOMSettableTokenList.idl
     html/DOMTokenList.idl
     html/DOMURL.idl
-    html/DOMWindowHTML.idl
     html/HTMLAllCollection.idl
     html/HTMLAnchorElement.idl
     html/HTMLAppletElement.idl
@@ -388,10 +396,6 @@ SET(WebCore_IDL_FILES
     webaudio/LowPass2FilterNode.idl
     webaudio/RealtimeAnalyserNode.idl
 
-    websockets/CloseEvent.idl
-    websockets/DOMWindowWebSocket.idl
-
-    xml/DOMWindowXML.idl
     xml/DOMParser.idl
     xml/XMLHttpRequest.idl
     xml/XMLHttpRequestException.idl
@@ -506,6 +510,7 @@ SET(WebCore_SOURCES
     css/ShadowValue.cpp
     css/StyleMedia.cpp
     css/StylePropertySet.cpp
+    css/StyleRule.cpp
     css/StyleSheet.cpp
     css/StyleSheetList.cpp
     css/WebKitCSSFilterValue.cpp
@@ -533,6 +538,7 @@ SET(WebCore_SOURCES
     dom/Comment.cpp
     dom/CompositionEvent.cpp
     dom/ContainerNode.cpp
+    dom/ContextDestructionObserver.cpp
     dom/CustomEvent.cpp
     dom/DatasetDOMStringMap.cpp
     dom/DecodedDataDocumentParser.cpp
@@ -603,6 +609,7 @@ SET(WebCore_SOURCES
     dom/QualifiedName.cpp
     dom/Range.cpp
     dom/RangeException.cpp
+    dom/RegionNodeList.cpp
     dom/RegisteredEventListener.cpp
     dom/ScopedEventQueue.cpp
     dom/ScriptableDocumentParser.cpp
@@ -612,7 +619,7 @@ SET(WebCore_SOURCES
     dom/SecurityContext.cpp
     dom/SelectorQuery.cpp
     dom/ShadowRoot.cpp
-    dom/ShadowRootList.cpp
+    dom/ShadowTree.cpp
     dom/SpaceSplitString.cpp
     dom/StaticHashSetNodeList.cpp
     dom/StaticNodeList.cpp
@@ -716,6 +723,7 @@ SET(WebCore_SOURCES
 
     html/BaseButtonInputType.cpp
     html/BaseCheckableInputType.cpp
+    html/BaseClickableWithKeyInputType.cpp
     html/BaseDateAndTimeInputType.cpp
     html/BaseTextInputType.cpp
     html/ButtonInputType.cpp
@@ -821,6 +829,7 @@ SET(WebCore_SOURCES
     html/ImageDocument.cpp
     html/ImageInputType.cpp
     html/InputType.cpp
+    html/LabelableElement.cpp
     html/LabelsNodeList.cpp
     html/LinkRelAttribute.cpp
     html/MediaController.cpp
@@ -1034,13 +1043,11 @@ SET(WebCore_SOURCES
     page/Navigator.cpp
     page/NavigatorBase.cpp
     page/NavigatorRegisterProtocolHandler.cpp
-    page/NavigatorSupplement.cpp
     page/OriginAccessEntry.cpp
     page/Page.cpp
     page/PageGroup.cpp
     page/PageGroupLoadDeferrer.cpp
     page/PageSerializer.cpp
-    page/PageSupplement.cpp
     page/PageVisibilityState.cpp
     page/Performance.cpp
     page/PerformanceNavigation.cpp
@@ -1091,6 +1098,7 @@ SET(WebCore_SOURCES
     platform/MIMETypeRegistry.cpp
     platform/MemoryPressureHandler.cpp
     platform/PlatformEvent.cpp
+    platform/RunLoop.cpp
     platform/RuntimeApplicationChecks.cpp
     platform/ScrollAnimator.cpp
     platform/ScrollableArea.cpp
@@ -1113,7 +1121,6 @@ SET(WebCore_SOURCES
     platform/graphics/BitmapImage.cpp
     platform/graphics/Color.cpp
     platform/graphics/CrossfadeGeneratedImage.cpp
-    platform/graphics/FractionalLayoutSize.cpp
     platform/graphics/FloatPoint.cpp
     platform/graphics/FloatPoint3D.cpp
     platform/graphics/FloatQuad.cpp
@@ -1127,6 +1134,8 @@ SET(WebCore_SOURCES
     platform/graphics/FontFamily.cpp
     platform/graphics/FontFastPath.cpp
     platform/graphics/FontFeatureSettings.cpp
+    platform/graphics/FractionalLayoutRect.cpp
+    platform/graphics/FractionalLayoutSize.cpp  
     platform/graphics/GeneratorGeneratedImage.cpp
     platform/graphics/GlyphPageTreeNode.cpp
     platform/graphics/Gradient.cpp
@@ -1289,7 +1298,6 @@ SET(WebCore_SOURCES
     rendering/RenderCombineText.cpp
     rendering/RenderCounter.cpp
     rendering/RenderDeprecatedFlexibleBox.cpp
-    rendering/RenderDetails.cpp
     rendering/RenderDetailsMarker.cpp
     rendering/RenderEmbeddedObject.cpp
     rendering/RenderFieldset.cpp
@@ -1332,7 +1340,6 @@ SET(WebCore_SOURCES
     rendering/RenderScrollbarPart.cpp
     rendering/RenderScrollbarTheme.cpp
     rendering/RenderSlider.cpp
-    rendering/RenderSummary.cpp
     rendering/RenderTable.cpp
     rendering/RenderTableCaption.cpp
     rendering/RenderTableCell.cpp
@@ -1369,6 +1376,7 @@ SET(WebCore_SOURCES
     rendering/style/StyleFlexibleBoxData.cpp
     rendering/style/StyleGeneratedImage.cpp
     rendering/style/StyleGridData.cpp
+    rendering/style/StyleGridItemData.cpp
     rendering/style/StyleInheritedData.cpp
     rendering/style/StyleMarqueeData.cpp
     rendering/style/StyleMultiColData.cpp
@@ -1378,45 +1386,8 @@ SET(WebCore_SOURCES
     rendering/style/StyleTransformData.cpp
     rendering/style/StyleVisualData.cpp
 
-    storage/AbstractDatabase.cpp
-    storage/ChangeVersionWrapper.cpp
-    storage/DOMWindowSQLDatabase.cpp
-    storage/Database.cpp
-    storage/DatabaseAuthorizer.cpp
-    storage/DatabaseSync.cpp
-    storage/DatabaseTask.cpp
-    storage/DatabaseThread.cpp
-    storage/DatabaseTracker.cpp
-    storage/IDBAny.cpp
-    storage/IDBDatabase.cpp
-    storage/IDBDatabaseBackendImpl.cpp
-    storage/IDBCursor.cpp
-    storage/IDBCursorBackendImpl.cpp
-    storage/IDBDatabaseException.cpp
-    storage/IDBEventDispatcher.cpp
-    storage/IDBIndex.cpp
-    storage/IDBIndexBackendImpl.cpp
-    storage/IDBKey.cpp
-    storage/IDBKeyRange.cpp
-    storage/IDBRequest.cpp
-    storage/IDBObjectStore.cpp
-    storage/IDBObjectStoreBackendImpl.cpp
-    storage/IDBFactory.cpp
-    storage/IDBFactoryBackendInterface.cpp
-    storage/IDBFactoryBackendImpl.cpp
     storage/StorageTask.cpp
     storage/StorageThread.cpp
-    storage/OriginQuotaManager.cpp
-    storage/OriginUsageRecord.cpp
-    storage/SQLException.cpp
-    storage/SQLResultSet.cpp
-    storage/SQLResultSetRowList.cpp
-    storage/SQLStatement.cpp
-    storage/SQLStatementSync.cpp
-    storage/SQLTransaction.cpp
-    storage/SQLTransactionClient.cpp
-    storage/SQLTransactionCoordinator.cpp
-    storage/SQLTransactionSync.cpp
     storage/Storage.cpp
     storage/StorageAreaImpl.cpp
     storage/StorageAreaSync.cpp
@@ -1485,36 +1456,72 @@ SET(WebCore_USER_AGENT_STYLE_SHEETS
 
 IF (ENABLE_BLOB)
     LIST(APPEND WebCore_SOURCES
+        fileapi/AsyncFileStream.cpp
         fileapi/FileReader.cpp
         fileapi/FileReaderLoader.cpp
         fileapi/FileReaderSync.cpp
         fileapi/FileThread.cpp
-        fileapi/FileStreamProxy.cpp
         platform/FileStream.cpp
     )
 
     LIST(APPEND WebCore_IDL_FILES
+        fileapi/FileException.idl
         fileapi/FileReaderSync.idl
+        fileapi/OperationNotAllowedException.idl
     )
 ENDIF ()
 
 IF (ENABLE_SQL_DATABASE)
+    LIST(APPEND WebCore_SOURCES
+        Modules/webdatabase/AbstractDatabase.cpp
+        Modules/webdatabase/ChangeVersionWrapper.cpp
+        Modules/webdatabase/DOMWindowSQLDatabase.cpp
+        Modules/webdatabase/Database.cpp
+        Modules/webdatabase/DatabaseAuthorizer.cpp
+        Modules/webdatabase/DatabaseContext.cpp
+        Modules/webdatabase/DatabaseSync.cpp
+        Modules/webdatabase/DatabaseTask.cpp
+        Modules/webdatabase/DatabaseThread.cpp
+        Modules/webdatabase/DatabaseTracker.cpp
+        Modules/webdatabase/OriginQuotaManager.cpp
+        Modules/webdatabase/OriginUsageRecord.cpp
+        Modules/webdatabase/SQLException.cpp
+        Modules/webdatabase/SQLResultSet.cpp
+        Modules/webdatabase/SQLResultSetRowList.cpp
+        Modules/webdatabase/SQLStatement.cpp
+        Modules/webdatabase/SQLStatementSync.cpp
+        Modules/webdatabase/SQLTransaction.cpp
+        Modules/webdatabase/SQLTransactionClient.cpp
+        Modules/webdatabase/SQLTransactionCoordinator.cpp
+        Modules/webdatabase/SQLTransactionSync.cpp
+    )
+
     LIST(APPEND WebCore_IDL_FILES
-        storage/DOMWindowSQLDatabase.idl
-        storage/Database.idl
-        storage/DatabaseCallback.idl
-        storage/DatabaseSync.idl
-        storage/SQLError.idl
-        storage/SQLException.idl
-        storage/SQLResultSet.idl
-        storage/SQLResultSetRowList.idl
-        storage/SQLStatementCallback.idl
-        storage/SQLStatementErrorCallback.idl
-        storage/SQLTransaction.idl
-        storage/SQLTransactionCallback.idl
-        storage/SQLTransactionErrorCallback.idl
-        storage/SQLTransactionSync.idl
-        storage/SQLTransactionSyncCallback.idl
+        Modules/webdatabase/DOMWindowSQLDatabase.idl
+        Modules/webdatabase/Database.idl
+        Modules/webdatabase/DatabaseCallback.idl
+        Modules/webdatabase/DatabaseSync.idl
+        Modules/webdatabase/SQLError.idl
+        Modules/webdatabase/SQLException.idl
+        Modules/webdatabase/SQLResultSet.idl
+        Modules/webdatabase/SQLResultSetRowList.idl
+        Modules/webdatabase/SQLStatementCallback.idl
+        Modules/webdatabase/SQLStatementErrorCallback.idl
+        Modules/webdatabase/SQLTransaction.idl
+        Modules/webdatabase/SQLTransactionCallback.idl
+        Modules/webdatabase/SQLTransactionErrorCallback.idl
+        Modules/webdatabase/SQLTransactionSync.idl
+        Modules/webdatabase/SQLTransactionSyncCallback.idl
+    )
+ENDIF ()
+
+IF (ENABLE_SQL_DATABASE AND ENABLE_WORKERS)
+    LIST(APPEND WebCore_SOURCES
+        Modules/webdatabase/WorkerContextSQLDatabase.cpp
+    )
+
+    LIST(APPEND WebCore_IDL_FILES
+        Modules/webdatabase/WorkerContextSQLDatabase.idl
     )
 ENDIF ()
 
@@ -1530,19 +1537,52 @@ IF (ENABLE_DATA_TRANSFER_ITEMS)
 ENDIF ()
 
 IF (ENABLE_INDEXED_DATABASE)
+    LIST(APPEND WebCore_SOURCES
+        Modules/indexeddb/DOMWindowIndexedDatabase.cpp
+        Modules/indexeddb/IDBAny.cpp
+        Modules/indexeddb/IDBDatabase.cpp
+        Modules/indexeddb/IDBDatabaseBackendImpl.cpp
+        Modules/indexeddb/IDBCursor.cpp
+        Modules/indexeddb/IDBCursorBackendImpl.cpp
+        Modules/indexeddb/IDBDatabaseException.cpp
+        Modules/indexeddb/IDBEventDispatcher.cpp
+        Modules/indexeddb/IDBIndex.cpp
+        Modules/indexeddb/IDBIndexBackendImpl.cpp
+        Modules/indexeddb/IDBKey.cpp
+        Modules/indexeddb/IDBKeyRange.cpp
+        Modules/indexeddb/IDBRequest.cpp
+        Modules/indexeddb/IDBObjectStore.cpp
+        Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
+        Modules/indexeddb/IDBFactory.cpp
+        Modules/indexeddb/IDBFactoryBackendInterface.cpp
+        Modules/indexeddb/IDBFactoryBackendImpl.cpp
+        Modules/indexeddb/PageGroupIndexedDatabase.cpp
+    )
+
+    LIST(APPEND WebCore_IDL_FILES
+        Modules/indexeddb/DOMWindowIndexedDatabase.idl
+        Modules/indexeddb/IDBAny.idl
+        Modules/indexeddb/IDBCursor.idl
+        Modules/indexeddb/IDBDatabaseError.idl
+        Modules/indexeddb/IDBDatabaseException.idl
+        Modules/indexeddb/IDBDatabase.idl
+        Modules/indexeddb/IDBFactory.idl
+        Modules/indexeddb/IDBIndex.idl
+        Modules/indexeddb/IDBKey.idl
+        Modules/indexeddb/IDBKeyRange.idl
+        Modules/indexeddb/IDBObjectStore.idl
+        Modules/indexeddb/IDBRequest.idl
+        Modules/indexeddb/IDBTransaction.idl
+    )
+ENDIF ()
+
+IF (ENABLE_INDEXED_DATABASE AND ENABLE_WORKERS)
+    LIST(APPEND WebCore_SOURCES
+        Modules/indexeddb/WorkerContextIndexedDatabase.cpp
+    )
+
     LIST(APPEND WebCore_IDL_FILES
-        storage/IDBAny.idl
-        storage/IDBCursor.idl
-        storage/IDBDatabaseError.idl
-        storage/IDBDatabaseException.idl
-        storage/IDBDatabase.idl
-        storage/IDBFactory.idl
-        storage/IDBIndex.idl
-        storage/IDBKey.idl
-        storage/IDBKeyRange.idl
-        storage/IDBObjectStore.idl
-        storage/IDBRequest.idl
-        storage/IDBTransaction.idl
+        Modules/indexeddb/WorkerContextIndexedDatabase.idl
     )
 ENDIF ()
 
@@ -1617,6 +1657,7 @@ if (ENABLE_FILE_SYSTEM)
         fileapi/FileWriterBase.cpp
         fileapi/FileWriterSync.cpp
         fileapi/LocalFileSystem.cpp
+        fileapi/WorkerContextFileSystem.cpp
         platform/AsyncFileSystem.cpp
     )
     LIST(APPEND WebCore_IDL_FILES
@@ -1643,13 +1684,7 @@ if (ENABLE_FILE_SYSTEM)
         fileapi/FileWriterSync.idl
         fileapi/Metadata.idl
         fileapi/MetadataCallback.idl
-    )
-ENDIF ()
-
-IF (ENABLE_BLOB OR ENABLE_FILE_SYSTEM)
-    LIST(APPEND WebCore_IDL_FILES
-        fileapi/FileException.idl
-        fileapi/OperationNotAllowedException.idl
+        fileapi/WorkerContextFileSystem.idl
     )
 ENDIF ()
 
@@ -1686,7 +1721,6 @@ IF (ENABLE_SVG)
         rendering/svg/RenderSVGResourceRadialGradient.cpp
         rendering/svg/RenderSVGResourceSolidColor.cpp
         rendering/svg/RenderSVGRoot.cpp
-        rendering/svg/RenderSVGShadowTreeRootContainer.cpp
         rendering/svg/RenderSVGShape.cpp
         rendering/svg/RenderSVGTSpan.cpp
         rendering/svg/RenderSVGText.cpp
@@ -1700,11 +1734,11 @@ IF (ENABLE_SVG)
         rendering/svg/SVGPathData.cpp
         rendering/svg/SVGRenderSupport.cpp
         rendering/svg/SVGRenderTreeAsText.cpp
+        rendering/svg/SVGRenderingContext.cpp
         rendering/svg/SVGResources.cpp
         rendering/svg/SVGResourcesCache.cpp
         rendering/svg/SVGResourcesCycleSolver.cpp
         rendering/svg/SVGRootInlineBox.cpp
-        rendering/svg/SVGShadowTreeElements.cpp
         rendering/svg/SVGTextChunk.cpp
         rendering/svg/SVGTextChunkBuilder.cpp
         rendering/svg/SVGTextLayoutAttributes.cpp
@@ -1717,7 +1751,6 @@ IF (ENABLE_SVG)
         rendering/svg/SVGTextMetricsBuilder.cpp
         rendering/svg/SVGTextQuery.cpp
         svg/ColorDistance.cpp
-        svg/DOMWindowSVG.idl
         svg/SVGAElement.cpp
         svg/SVGAltGlyphDefElement.cpp
         svg/SVGAltGlyphElement.cpp
@@ -2058,24 +2091,26 @@ ENDIF()
 
 IF (ENABLE_WEB_SOCKETS)
     LIST(APPEND WebCore_SOURCES
-        websockets/ThreadableWebSocketChannel.cpp
-        websockets/ThreadableWebSocketChannelClientWrapper.cpp
-        websockets/WebSocket.cpp
-        websockets/WebSocketChannel.cpp
-        websockets/WebSocketExtensionDispatcher.cpp
-        websockets/WebSocketHandshake.cpp
-        websockets/WebSocketHandshakeRequest.cpp
-        websockets/WebSocketHandshakeResponse.cpp
+        Modules/websockets/ThreadableWebSocketChannel.cpp
+        Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp
+        Modules/websockets/WebSocket.cpp
+        Modules/websockets/WebSocketChannel.cpp
+        Modules/websockets/WebSocketDeflater.cpp
+        Modules/websockets/WebSocketDeflateFramer.cpp
+        Modules/websockets/WebSocketExtensionDispatcher.cpp
+        Modules/websockets/WebSocketHandshake.cpp
+        Modules/websockets/WebSocketHandshakeRequest.cpp
+        Modules/websockets/WebSocketHandshakeResponse.cpp
     )
 
     LIST(APPEND WebCore_IDL_FILES
-        websockets/WebSocket.idl
+        Modules/websockets/WebSocket.idl
     )
 ENDIF ()
 
 IF (ENABLE_WEB_SOCKETS AND ENABLE_WORKERS)
     LIST(APPEND WebCore_SOURCES
-         websockets/WorkerThreadableWebSocketChannel.cpp
+        Modules/websockets/WorkerThreadableWebSocketChannel.cpp
     )
 ENDIF ()
 
@@ -2123,12 +2158,6 @@ IF (ENABLE_SHARED_WORKERS)
     )
 ENDIF ()
 
-IF (ENABLE_WORKERS OR ENABLE_SHARED_WORKERS)
-    LIST(APPEND WebCore_IDL_FILES
-        workers/DOMWindowWorker.idl
-    )
-ENDIF ()
-
 IF (ENABLE_VIDEO_TRACK)
     LIST(APPEND WebCore_SOURCES
         html/HTMLTrackElement.cpp
@@ -2232,6 +2261,7 @@ IF (ENABLE_WEBGL)
         html/canvas/WebGLUniformLocation.cpp
         html/canvas/WebGLVertexArrayObjectOES.cpp
         html/canvas/WebGLExtension.cpp
+        html/canvas/EXTTextureFilterAnisotropic.cpp
         html/canvas/OESStandardDerivatives.cpp
         html/canvas/OESTextureFloat.cpp
         html/canvas/OESVertexArrayObject.cpp
@@ -2240,6 +2270,7 @@ IF (ENABLE_WEBGL)
         platform/graphics/gpu/DrawingBuffer.cpp
     )
     LIST(APPEND WebCore_IDL_FILES
+        html/canvas/EXTTextureFilterAnisotropic.idl
         html/canvas/OESStandardDerivatives.idl
         html/canvas/OESTextureFloat.idl
         html/canvas/OESVertexArrayObject.idl
@@ -2284,6 +2315,25 @@ IF (ENABLE_VIBRATION)
     )
 ENDIF ()
 
+SET(WebCoreTestSupport_INCLUDE_DIRECTORIES
+    "${WebCore_INCLUDE_DIRECTORIES}"
+    "${WEBCORE_DIR}/testing"
+)
+
+SET(WebCoreTestSupport_IDL_INCLUDES
+    testing
+)
+
+SET(WebCoreTestSupport_IDL_FILES
+    testing/Internals.idl
+    testing/InternalSettings.idl
+)
+
+SET(WebCoreTestSupport_SOURCES
+    testing/Internals.cpp
+    testing/InternalSettings.cpp
+)
+
 # Modules that the bindings generator scripts may use
 SET(SCRIPTS_RESOLVE_SUPPLEMENTAL
     ${WEBCORE_DIR}/bindings/scripts/IDLParser.pm
@@ -2300,7 +2350,7 @@ SET(IDL_ATTRIBUTES_FILE ${WEBCORE_DIR}/bindings/scripts/IDLAttributes.txt)
 
 INCLUDE(${WEBCORE_DIR}/UseJSC.cmake)
 
-SET(WebCore_LIBRARIES ${JavaScriptCore_LIBRARY_NAME})
+SET(WebCore_LIBRARIES ${WTF_LIBRARY_NAME} ${JavaScriptCore_LIBRARY_NAME})
 SET(WebCore_LINK_FLAGS "")
 WEBKIT_INCLUDE_CONFIG_FILES_IF_EXISTS()
 
@@ -2443,7 +2493,7 @@ GENERATE_DOM_NAMES(HTML ${WEBCORE_DIR}/html/HTMLAttributeNames.in ${WEBCORE_DIR}
 LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/HTMLNames.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/HTMLElementFactory.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/JSHTMLElementWrapperFactory.cpp)
 
 
-GENERATE_EVENT_FACTORY(${WEBCORE_DIR}/dom/EventFactory.in EventFactory.cpp)
+GENERATE_EVENT_FACTORY(${WEBCORE_DIR}/dom/EventNames.in EventFactory.cpp)
 LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/EventFactory.cpp)
 
 
@@ -2492,20 +2542,28 @@ ADD_CUSTOM_COMMAND(
     VERBATIM)
 LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/WebKitVersion.h)
 
-
-
 WEBKIT_WRAP_SOURCELIST(${WebCore_IDL_FILES} ${WebCore_SOURCES})
+WEBKIT_WRAP_SOURCELIST(${WebCoreTestSupport_IDL_FILES} ${WebCoreTestSupport_SOURCES})
+
 ADD_DEFINITIONS(-DBUILDING_WebCore)
-INCLUDE_DIRECTORIES(${WebCore_INCLUDE_DIRECTORIES})
+INCLUDE_DIRECTORIES(${WebCore_INCLUDE_DIRECTORIES} ${WebCoreTestSupport_INCLUDE_DIRECTORIES})
+
 ADD_LIBRARY(${WebCore_LIBRARY_NAME} ${WebCore_LIBRARY_TYPE} ${WebCore_SOURCES})
+SET_TARGET_PROPERTIES(${WebCore_LIBRARY_NAME} PROPERTIES LINK_INTERFACE_LIBRARIES "")
+
+ADD_LIBRARY(${WebCoreTestSupport_LIBRARY_NAME} ${WebCoreTestSupport_LIBRARY_TYPE} ${WebCoreTestSupport_SOURCES})
+
 ADD_DEPENDENCIES(${WebCore_LIBRARY_NAME} ${JavaScriptCore_LIBRARY_NAME})
+ADD_DEPENDENCIES(${WebCoreTestSupport_LIBRARY_NAME} ${WebCore_LIBRARY_NAME})
+
 TARGET_LINK_LIBRARIES(${WebCore_LIBRARY_NAME} ${WebCore_LIBRARIES})
 
 IF (WebCore_LINK_FLAGS)
     ADD_TARGET_PROPERTIES(${WebCore_LIBRARY_NAME} LINK_FLAGS "${WebCore_LINK_FLAGS}")
+    ADD_TARGET_PROPERTIES(${WebCoreTestSupport_LIBRARY_NAME} LINK_FLAGS "${WebCore_LINK_FLAGS}")
 ENDIF ()
 
 IF (SHARED_CORE)
     SET_TARGET_PROPERTIES(${WebCore_LIBRARY_NAME} PROPERTIES VERSION ${PROJECT_VERSION} SOVERSION ${PROJECT_VERSION_MAJOR})
-    INSTALL(TARGETS ${WebCore_LIBRARY_NAME} DESTINATION lib)
+    INSTALL(TARGETS ${WebCore_LIBRARY_NAME} DESTINATION "${LIB_INSTALL_DIR}")
 ENDIF ()
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
index b0b5bdf70..d6dd04c4a 100644
--- a/Source/WebCore/ChangeLog
+++ b/Source/WebCore/ChangeLog
@@ -1,3 +1,18636 @@
+2012-03-12  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Fix build with newer Qt 5.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::fileListNameForWidth): Use DefaultCodec instead of the
+        deprecated CodecForTR.
+
+2012-03-12  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: SpeechRecognitionEvent
+        https://bugs.webkit.org/show_bug.cgi?id=80513
+
+        Reviewed by Adam Barth.
+
+        Implement SpeechRecognitionEvent.
+        (Spec: http://speech-javascript-api-spec.googlecode.com/git/speechapi.html)
+
+        Test: fast/events/constructors/speech-recognition-event-constructor.html
+
+        * Modules/speech/DOMWindowSpeech.idl:
+        * Modules/speech/SpeechRecognitionEvent.cpp: Added.
+        (WebCore):
+        (WebCore::SpeechRecognitionEventInit::SpeechRecognitionEventInit):
+        (WebCore::SpeechRecognitionEvent::create):
+        (WebCore::SpeechRecognitionEvent::createResult):
+        (WebCore::SpeechRecognitionEvent::createNoMatch):
+        (WebCore::SpeechRecognitionEvent::createResultDeleted):
+        (WebCore::SpeechRecognitionEvent::createError):
+        (WebCore::SpeechRecognitionEvent::interfaceName):
+        (WebCore::SpeechRecognitionEvent::SpeechRecognitionEvent):
+        * Modules/speech/SpeechRecognitionEvent.h: Added.
+        (WebCore):
+        (SpeechRecognitionEventInit):
+        (SpeechRecognitionEvent):
+        (WebCore::SpeechRecognitionEvent::result):
+        (WebCore::SpeechRecognitionEvent::error):
+        (WebCore::SpeechRecognitionEvent::resultIndex):
+        (WebCore::SpeechRecognitionEvent::resultHistory):
+        * Modules/speech/SpeechRecognitionEvent.idl:
+        * WebCore.gypi:
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::webkitSpeechRecognitionEventEnabled):
+        * bindings/v8/OptionsObject.cpp:
+        (WebCore::OptionsObject::get):
+        (WebCore):
+        * bindings/v8/OptionsObject.h:
+        (WebCore):
+        (OptionsObject):
+        * dom/EventNames.h:
+        (WebCore):
+        * dom/EventNames.in:
+
+2012-03-12  Kent Tamura  <tkent@chromium.org>
+
+        Use ICU C API instead of C++ API in LocalizedNumberICU
+        https://bugs.webkit.org/show_bug.cgi?id=80815
+        https://bugs.gentoo.org/show_bug.cgi?id=407401
+
+        Reviewed by Hajime Morita.
+
+        ICU 4.8 doesn't have kNumberStyle. We had better to use ICU C API in
+        general to avoid such issues.
+
+        This patch should not make any behavior change.
+
+        * platform/text/LocalizedNumberICU.cpp:
+        (WebCore::ICULocale::ICULocale):
+        Change the argument type: icu::Locale -> const char*
+        (WebCore::ICULocale::~ICULocale): Delete m_numberFormat with unum_close().
+        (WebCore::ICULocale::create): Do not create icu::Locale.
+        (WebCore::ICULocale::createForCurrentLocale): ditto.
+        (WebCore::ICULocale::setDecimalSymbol):
+        Use unum_getSymbol() instead of DecimalFormatSymbols::getSymbol().
+        (WebCore::ICULocale::setDecimalTextAttribute):
+        Added. A utility function to store prefixes and suffixes.
+        (WebCore::ICULocale::initializeDecimalFormat):
+        - unum_open(), instead of NumberFormat::createInstance().
+        - Use C API symbols.
+        - Cache positive/negative prefixes/suffixes.
+        (WebCore::ICULocale::convertToLocalizedNumber): Use cached prefixes and suffixes.
+        (WebCore::matches): Stop using template because we don't use UString anymore.
+        (WebCore::ICULocale::detectSignAndGetDigitRange):
+        - Use cached prefixes and suffixes.
+        - Use String::startsWith() and endsWith().
+        (WebCore::ICULocale::convertFromLocalizedNumber):
+        * platform/text/LocalizedNumberICU.h:
+        (ICULocale):
+
+2012-03-11  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: decouple LiveLocation from RawSourceCode.
+        https://bugs.webkit.org/show_bug.cgi?id=80785
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.createPlacard):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerPaused):
+        (WebInspector.PresentationCallFrame):
+        (WebInspector.PresentationCallFrame.prototype.uiLocation):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard):
+        * inspector/front-end/RawSourceCode.js:
+        * inspector/front-end/ScriptMapping.js:
+        (WebInspector.MainScriptMapping):
+        (WebInspector.MainScriptMapping.prototype.createLiveLocation):
+        (WebInspector.MainScriptMapping.prototype._registerLiveLocation):
+        (WebInspector.MainScriptMapping.prototype._unregisterLiveLocation):
+        (WebInspector.MainScriptMapping.prototype._updateLiveLocations):
+        (WebInspector.MainScriptMapping.prototype._uiSourceCodeListChanged):
+        (WebInspector.MainScriptMapping.prototype.reset):
+        (WebInspector.LiveLocation):
+        (WebInspector.LiveLocation.prototype.init):
+        (WebInspector.LiveLocation.prototype.dispose):
+        (WebInspector.LiveLocation.prototype._update):
+
+2012-03-11  Victor Carbune  <vcarbune@adobe.com>
+
+        The main code structure for placing future text track cue rendering
+        code and main outer rendering steps.
+        https://bugs.webkit.org/show_bug.cgi?id=79746
+
+        Reviewed by Eric Carlson.
+
+        No new tests. Only refactoring, but some chromium tests require rebaselining
+        and have been marked accordingly.
+
+        * css/mediaControls.css:
+        (::-webkit-media-controls): Changed the default display to -webkit-box, as
+        captions need to always be rendered on top of the controls, if they are visible.
+        (audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel):
+        Default position attribute is now relative, handled by the parent -webkit-box
+        (video::-webkit-media-text-track-container): The position of the container is
+        now relative, handled by -webkit-box.
+        (video::-webkit-media-text-track-display): Adjusted text color to match
+        the color required in the WebVTT spec (section 3.5.1 'color' property)
+        * css/mediaControlsChromium.css:
+        (audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel):
+        Default position attribute is now relative, handled by the parent -webkit-box
+
+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::MediaControlPanelElement::MediaControlPanelElement): Added a timer
+        for the webkit fade out transition event. This timer is required for setting
+        the display property to 'none', when the fade out transition is over. Otherwise,
+        captions would not be displayed at the bottom of the video.
+        (WebCore::MediaControlPanelElement::startTimer): Added.
+        (WebCore):
+        (WebCore::MediaControlPanelElement::stopTimer): Added.
+        (WebCore::MediaControlPanelElement::transitionTimerFired): Added. If the current
+        state of the controls is transparent, the display property is set to 'none'.
+        (WebCore::MediaControlPanelElement::makeOpaque): The inline display:'none' property
+        is removed before the fade in transition.
+        (WebCore::MediaControlPanelElement::makeTransparent): Added the timer start.
+        (WebCore::MediaControlTextTrackContainerElement::MediaControlTextTrackContainerElement):
+        Removed m_bottom as it is not needed anymore.
+        (WebCore::MediaControlTextTrackContainerElement::updateDisplay): Added. Main
+        function for the rendering rules.
+        (WebCore::MediaControlTextTrackContainerElement::updateSizes): The bottom position
+        needs not to be set anymore.
+        * html/shadow/MediaControlElements.h:
+        (MediaControlPanelElement): Added timer internals.
+        (MediaControlTextTrackContainerElement): Added updateDisplay() and removed unused
+        variables.
+
+        (WebCore):
+        * html/shadow/MediaControlRootElement.cpp: Removed m_textTrackDisplay
+        and duplicated code with MediaControlRootElementChromium (only minimum
+        function calls to the main text track container)
+        (WebCore::MediaControlRootElement::MediaControlRootElement):
+        (WebCore::MediaControlRootElement::setMediaController):
+        (WebCore::MediaControlRootElement::createTextTrackDisplay):
+        (WebCore::MediaControlRootElement::updateTextTrackDisplay):
+
+        * html/shadow/MediaControlRootElementChromium.cpp: Removed m_textTrackDisplay
+        and duplicate code with MediaControlRootElement (only minimum function calls
+        to the main text track container remained)
+        (WebCore::MediaControlRootElementChromium::MediaControlRootElementChromium):
+        (WebCore::MediaControlRootElementChromium::setMediaController):
+        (WebCore::MediaControlRootElementChromium::createTextTrackDisplay):
+        (WebCore::MediaControlRootElementChromium::updateTextTrackDisplay):
+
+        (WebCore):
+        * html/track/TextTrackCue.cpp: Enhanced structure for supporting more complex
+        rendering required by the WebVTT spec.
+        (WebCore::TextTrackCue::TextTrackCue):
+        (WebCore::TextTrackCue::cueDidChange): Mark the display tree as obsolete, so that
+        it needs to be re-computed.
+        (WebCore::TextTrackCue::setIsActive): The display tree needs to be removed as
+        soon as the cue becomes inactive. Adjusted this method to support the functionality.
+        (WebCore):
+        (WebCore::TextTrackCue::determineDisplayParameters): Added. This method will hold
+        main positioning parameter computations for a TextTrackCue
+        (WebCore):
+        (WebCore::TextTrackCue::getDisplayTree): Added. This method returns the root node
+        of the CSS boxes that need to be displayed on top of the video, for the current
+        instance.
+        * html/track/TextTrackCue.h:
+        (WebCore):
+        (TextTrackCue):
+
+2012-03-11  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110359.
+        http://trac.webkit.org/changeset/110359
+        https://bugs.webkit.org/show_bug.cgi?id=80799
+
+        SelectPopupMenuTest.ClickItem failure (Requested by ukai on
+        #webkit).
+
+        * platform/chromium/PopupListBox.cpp:
+        (WebCore::PopupListBox::paint):
+        (WebCore::PopupListBox::paintRow):
+        (WebCore::PopupListBox::getRowHeight):
+        * platform/chromium/PopupListBox.h:
+        (PopupContainerSettings):
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore):
+        (WebCore::PopupMenuChromium::show):
+        * platform/chromium/PopupMenuChromium.h:
+        (PopupMenuChromium):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::showPopup):
+
+2012-03-11  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a crash opening the Web Inspector in WebKit1 clients.
+
+        The call to InspectorFrontendClientLocal::setAttachedWindow is preformed really early in the process,
+        causing it to crash almost every time. It should use evaluateOnLoad instead of evaluateAsBoolean.
+
+        <rdar://problem/10951109> Crash when bringing up Web Inspector in WebKit1 client
+        https://bugs.webkit.org/show_bug.cgi?id=80796
+
+        Reviewed by Brian Weinstein.
+
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::setAttachedWindow): Use evaluateOnLoad instead of evaluateAsBoolean.
+
+2012-03-11  Shawn Singh  <shawnsingh@chromium.org>
+
+        REGRESSION (r93614): scrolling div does not repaint
+        https://bugs.webkit.org/show_bug.cgi?id=80641
+
+        Reviewed by Simon Fraser.
+
+        Test: compositing/repaint/newly-composited-repaint-rect.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking): When a layer
+        becomes newly composited and creates its backing, the repaintRect
+        may become invalid. This patch recomputes repaintRects in this
+        case.
+
+2012-03-11  George Staikos  <staikos@webkit.org>
+
+        Enable JPEG encoding for BlackBerry.
+        https://bugs.webkit.org/show_bug.cgi?id=80792
+
+        Reviewed by Antonio Gomes.
+
+        * PlatformBlackBerry.cmake:
+
+2012-03-11  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: console.log attempts to substitute any "%" character in the message.
+        https://bugs.webkit.org/show_bug.cgi?id=80504
+
+        Reviewed by Vsevolod Vlasov.
+
+        Test: inspector/console/console-string-format.html
+
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.UnusedCssRule.prototype.doRun.evalCallback.selectorsCallback):
+        * inspector/front-end/ProfileDataGridTree.js:
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._reportHeapSnapshotProgress):
+        * inspector/front-end/utilities.js:
+
+2012-03-11  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: use monotonically increasing time in timeline agent
+        https://bugs.webkit.org/show_bug.cgi?id=80786
+
+        Reviewed by Pavel Feldman.
+
+        * bindings/v8/ScriptGCEvent.cpp:
+        (WebCore::ScriptGCEvent::gcPrologueCallback):
+        (WebCore::ScriptGCEvent::gcEpilogueCallback):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::pushGCEventRecords):
+        (WebCore::InspectorTimelineAgent::willSendResourceRequest):
+        (WebCore::InspectorTimelineAgent::didCompleteCurrentRecord):
+        (WebCore::InspectorTimelineAgent::appendRecord):
+        (WebCore::InspectorTimelineAgent::pushCurrentRecord):
+        (WebCore::InspectorTimelineAgent::timestamp):
+        (WebCore):
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::timestamp):
+
+2012-03-11  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Network panel does not show responses for application/json data
+        https://bugs.webkit.org/show_bug.cgi?id=80684
+
+        Reviewed by Pavel Feldman.
+
+        Test: http/tests/inspector/network/async-xhr-json-mime-type.html
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::createXHRTextDecoder):
+        (WebCore::InspectorPageAgent::cachedResourceContent):
+        * inspector/InspectorPageAgent.h:
+        * inspector/NetworkResourcesData.cpp:
+        (WebCore::createOtherResourceTextDecoder):
+        (WebCore):
+        (WebCore::NetworkResourcesData::responseReceived):
+
+2012-03-11  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: CSS content is not shown when stylesheet is loaded with invalid mime type in quirks mode.
+        https://bugs.webkit.org/show_bug.cgi?id=80528
+
+        Reviewed by Pavel Feldman.
+
+        Test: http/tests/inspector/resource-tree/resource-tree-invalid-mime-type-css-content.html
+
+        * inspector/InspectorPageAgent.cpp:
+        (WebCore::InspectorPageAgent::cachedResourceContent):
+
+2012-03-11  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        [Qt] [WK2] Support threaded renderer in WK2
+        https://bugs.webkit.org/show_bug.cgi?id=76661
+
+        Reviewed by Noam Rosenthal.
+
+        Add TransformationMatrix conversions from/to Qt QMatrix4x4. Used by Qt WebKit2
+        rendering and tested by Qt WebKit2 API tests.
+
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        (WebCore::TransformationMatrix::operator QMatrix4x4):
+        (WebCore):
+        (WebCore::TransformationMatrix::TransformationMatrix):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (TransformationMatrix):
+
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Rename NotificationPresenter to NotificationClient
+        https://bugs.webkit.org/show_bug.cgi?id=80488
+        <rdar://problem/10965558>
+
+        Reviewed by Kentaro Hara.
+
+        * notifications/NotificationCenter.h: Renamed from notifications/NotificationPresenter.h.
+
+        Refactor to use renamed WebCore::NotificationClient.
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * notifications/Notification.cpp:
+        (WebCore::Notification::Notification):
+        (WebCore::Notification::show):
+        (WebCore::Notification::cancel):
+        (WebCore::Notification::contextDestroyed):
+        (WebCore::Notification::finishLoading):
+        * notifications/NotificationCenter.cpp:
+        (WebCore::NotificationCenter::create):
+        (WebCore::NotificationCenter::NotificationCenter):
+        (WebCore::NotificationCenter::checkPermission):
+        (WebCore::NotificationCenter::requestPermission):
+        (WebCore::NotificationCenter::disconnectFrame):
+        * notifications/NotificationController.cpp:
+        (WebCore::NotificationController::NotificationController):
+        (WebCore::NotificationController::create):
+        (WebCore::NotificationController::clientFrom):
+        (WebCore::provideNotification):
+        * notifications/NotificationController.h:
+        (WebCore):
+        (NotificationController):
+        (WebCore::NotificationController::client):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitNotifications):
+        * page/DOMWindow.h:
+        (DOMWindow):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::webkitNotifications):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        * workers/WorkerThread.h:
+        (WebCore):
+        (WebCore::WorkerThread::getNotificationClient):
+        (WebCore::WorkerThread::setNotificationClient):
+        (WorkerThread):
+
+2012-03-10  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        RenderObject with 'resize' different from 'none' should have a RenderLayer
+        https://bugs.webkit.org/show_bug.cgi?id=80738
+
+        Reviewed by James Robinson.
+
+        Covered by fast/css/resize-single-axis.html.
+
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::requiresLayerForOverflowClip):
+        The resizer logic is tied to RenderLayer so force a RenderLayer to be allocated if resize() != RESIZE_NONE.
+
+2012-03-10  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r110358.
+        http://trac.webkit.org/changeset/110358
+        https://bugs.webkit.org/show_bug.cgi?id=80706
+
+        No improvement on specified benchmarks.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::collectNodes):
+        (WebCore::collectTargetNodes):
+
+2012-03-10  MORITA Hajime  <morrita@google.com>
+
+        ShadowTree uses weak iteration patterns
+        https://bugs.webkit.org/show_bug.cgi?id=80572
+
+        Reviewed by Dimitri Glazkov.
+
+        Patch by Adam Barth.
+
+        This patch moves various ShadowTree to using a better iteration pattern
+        in which we collect all the ShadowRoots we're planning to iterate into
+        a vector and then iterate over them.
+
+        * dom/ShadowTree.cpp:
+        (ShadowRootVector):
+        (WebCore::ShadowRootVector::ShadowRootVector):
+        (WebCore):
+        (WebCore::ShadowTree::removeAllShadowRoots):
+        (WebCore::ShadowTree::insertedIntoDocument):
+        (WebCore::ShadowTree::removedFromDocument):
+        (WebCore::ShadowTree::insertedIntoTree):
+        (WebCore::ShadowTree::removedFromTree):
+        (WebCore::ShadowTree::willRemove):
+
+2012-03-10  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110363.
+        http://trac.webkit.org/changeset/110363
+        https://bugs.webkit.org/show_bug.cgi?id=80757
+
+        link error in chromium: unresolved external symbol
+        webkit_support::CreateScopedTempDirectory(void) (Requested by
+        ukai_home on #webkit).
+
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
+        (WebCore::IDBLevelDBBackingStore::open):
+        * platform/leveldb/LevelDBDatabase.cpp:
+        * platform/leveldb/LevelDBDatabase.h:
+        (LevelDBDatabase):
+
+2012-03-09  Robert Kroeger  <rjkroege@chromium.org>
+
+        Handle more Gesture* events by performing scrolls on the correct target ScrollableArea 
+        https://bugs.webkit.org/show_bug.cgi?id=80311
+
+        Implement GestureScroll* events via re-use of WheelEvent dispatch.
+
+        Reviewed by James Robinson.
+
+        Layout tests previously submited as https://bugs.webkit.org/show_bug.cgi?id=80201 and unit
+        test added as part of this patch.
+
+        * page/EventHandler.cpp:
+        (WebCore::wheelGranularityToScrollGranularity): Refactoring.
+        (WebCore):
+        (WebCore::scrollNode):
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::defaultWheelEventHandler):
+        (WebCore::EventHandler::handleGestureEvent): Added GestureScrollBegin & End.
+        (WebCore::EventHandler::handleGestureTap):
+        (WebCore::EventHandler::handleGestureScrollUpdate):
+        (WebCore::EventHandler::handleGestureScrollCore): Refactoring.
+        * page/EventHandler.h:
+        (EventHandler):
+        * platform/PlatformWheelEvent.h: Added additional scroll type.
+        * platform/ScrollAnimator.cpp:
+        (WebCore::ScrollAnimator::handleWheelEvent): Forward additional scroll type.
+        * platform/ScrollAnimator.h:
+        (WebCore):
+        * platform/ScrollAnimatorNone.cpp:
+        (WebCore::ScrollAnimatorNone::ScrollAnimatorNone): Handle additional scroll type.
+        (WebCore::ScrollAnimatorNone::fireUpAnAnimation): 
+        (WebCore):
+        (WebCore::ScrollAnimatorNone::scroll):
+        * platform/ScrollAnimatorNone.h:
+        (ScrollAnimatorNone):
+        * platform/ScrollTypes.h: Added an additional scroll type.
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::scroll):
+
+2012-03-09  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Fix a fixme in v8 bindings
+        https://bugs.webkit.org/show_bug.cgi?id=80734
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. Covered by existing tests.
+
+        * bindings/v8/V8Binding.cpp:
+        (WebCore::toInt32):
+        (WebCore::toUInt32):
+
+2012-03-09  Lauro Neto  <lauro.neto@openbossa.org>
+
+        [Qt] WebCore/Target.pri contains obsolete FileStreamProxy.h reference.
+        https://bugs.webkit.org/show_bug.cgi?id=80730
+
+        Reviewed by Tor Arne Vestbø.
+
+        Build fix. Target.pri was still including old FileStreamProxy.h.
+
+        * Target.pri:
+
+2012-03-05 Cem Kocagil  <cem.kocagil@gmail.com>
+
+        Pan scroll icon is painted at incorrect coordinates in frames
+        https://bugs.webkit.org/show_bug.cgi?id=79378
+
+        Convert client coordinates to parent ScrollView coordinates
+
+        Reviewed by Antonio Gomes
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::paintPanScrollIcon):
+
+2012-03-09  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Handle LevelDB database corruption
+        https://bugs.webkit.org/show_bug.cgi?id=79413
+
+        Add LevelDBDatabase::destroy() method so that clients can retry if open() fails.
+
+        Reviewed by Tony Chang.
+
+        Test: webkit_unit_tests --gtest_filter='LevelDBDatabaseTest.CorruptionTest'
+
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp: Implement open/destroy/open strategy.
+        (WebCore::IDBLevelDBBackingStore::open):
+        * platform/leveldb/LevelDBDatabase.cpp:
+        (WebCore::LevelDBDatabase::destroy):
+        (WebCore):
+        * platform/leveldb/LevelDBDatabase.h:
+        (LevelDBDatabase):
+
+2012-03-09  Jessie Berlin  <jberlin@apple.com>
+
+        Fix one of the Windows build warnings.
+
+        * html/track/TextTrackCueList.idl:
+        Add a newline to the end of the file.
+
+2012-03-09  Tyler Abbott  <tabbott@rim.com>
+
+        BlackBerry PlayBook doesn't sniff mime types
+        https://bugs.webkit.org/show_bug.cgi?id=73869
+
+        Reviewed by Rob Buis.
+
+        Hook up MIMESniffing for BlackBerry. Override Content-Types will
+        not be overriden. File extensions will be trusted when content
+        is loaded from disk.
+
+        No tests, BlackBerry tests are not yet present in webkit.org codebase.
+
+        * PlatformBlackBerry.cmake:
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::NetworkJob):
+        (WebCore::NetworkJob::initialize):
+        (WebCore::NetworkJob::handleNotifyDataReceived):
+        (WebCore::NetworkJob::sendResponseIfNeeded):
+        * platform/network/blackberry/NetworkJob.h:
+        (NetworkJob):
+
+2012-03-09  Enrica Casucci  <enrica@apple.com>
+
+        Move WebNSURLExtras code down to WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=80611
+
+        Reviewed by Alexey Proskuryakov.
+
+        * WebCore.exp.in: Added new exported functions.
+        * WebCore.xcodeproj/project.pbxproj: Added WebCoreNSURLExtras.*
+        * platform/FileSystem.h: Added setMetadataURL.
+        * platform/mac/FileSystemMac.mm:
+        (WebCore::setMetaData): Added.
+        (WebCore::setMetadataURL): Added.
+        * platform/mac/WebCoreNSStringExtras.h:
+        * platform/mac/WebCoreNSStringExtras.mm:
+        (hasCaseInsensitivePrefix): Added.
+        * platform/mac/WebCoreNSURLExtras.h: Added.
+        * platform/mac/WebCoreNSURLExtras.mm: Added.
+        * platform/mac/WebCoreObjCExtras.h:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2012-03-09  Tim Dresser  <tdresser@chromium.org>
+
+        [chromium] Increase size of Combo Box Options for touch and high DPI devices
+        https://bugs.webkit.org/show_bug.cgi?id=80027
+
+        Reviewed by Darin Fisher.
+
+        Scale Combo box popups by defaultDeviceScaleFactor, and add padding to
+        <option> elements when touch is enabled.
+
+        Manually tested with --default-device-scale-factor=1,2 and unset.
+        Each of these were tested with RuntimeEnabledFeatures::touchEnabled
+        set to true and false.
+
+        * platform/chromium/PopupListBox.cpp:
+        (WebCore::PopupListBox::paint):
+        (WebCore::PopupListBox::paintRow):
+        (WebCore::PopupListBox::getRowHeight):
+        * platform/chromium/PopupListBox.h:
+        (PopupContainerSettings):
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore):
+        (WebCore::PopupMenuChromium::show):
+        * platform/chromium/PopupMenuChromium.h:
+        (WebCore::PopupMenuChromium::optionPaddingForTouch):
+        (WebCore::PopupMenuChromium::setOptionPaddingForTouch):
+        (PopupMenuChromium):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::showPopup):
+
+2012-03-09  Stephen White  <senorblanco@chromium.org>
+
+        Improve ContainerNode collectNode() performance by reserving vector
+        capacity up front.
+        https://bugs.webkit.org/show_bug.cgi?id=80706
+
+        Reviewed by Ryosuke Niwa.
+
+        Covered by existing tests.  Performance will be evaluated based on
+        Chromium's page_cycler_bloat-http, page_cycler_intl1, and
+        dromaeo_domcore suites.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::collectNodes):
+
+2012-03-09  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/11018851> Crash in DisplayRefreshMonitor::notifyClients()
+        https://bugs.webkit.org/show_bug.cgi?id=80740
+
+        Reviewed by Sam Weinig.
+
+        No test, since this race condition cannot be reproduced reliably.
+
+        * platform/graphics/mac/DisplayRefreshMonitorMac.cpp:
+        (WebCore::DisplayRefreshMonitor::~DisplayRefreshMonitor): Changed to stop the display link
+        first, then cancel any outstanding calls to refreshDisplayOnMainThread(). When doing things
+        the other way around, the display link can fire after outstanding calls have been canceled,
+        and enqueue new calls on the main thread, which will be dispatched after monitor destruction.
+
+2012-03-09  Pratik Solanki  <psolanki@apple.com>
+
+        Assertion failure in ResourceHandle::setDefersLoading(): d->m_defersLoading != defers
+        https://bugs.webkit.org/show_bug.cgi?id=80543
+
+        Reviewed by Geoffrey Garen.
+
+        Reset m_defersLoading flag to the value from Page::defersCallbacks() in
+        ResourceLoader::init(). This is because the resource could have been in the pending requests
+        queue in ResourceLoadScheduler and would have missed out on state changes to this flag
+        happening from DocumentLoader::setDefersCallbacks().
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::init):
+
+2012-03-09  Emil A Eklund  <eae@chromium.org>
+
+        Add roundedPoint to HitTestResult and change platform code to use it
+        https://bugs.webkit.org/show_bug.cgi?id=80715
+
+        Reviewed by James Robinson.
+
+        Change ports to use roundedPoint to avoid exposing subpixel types to
+        platform code.
+
+        No new tests.
+
+        * rendering/HitTestResult.h:
+        (WebCore::HitTestResult::roundedPoint):
+
+2012-03-09  Kentaro Hara  <haraken@chromium.org>
+
+        [V8][Performance] Inline hot methods in V8Bindings.h
+        https://bugs.webkit.org/show_bug.cgi?id=80685
+
+        Reviewed by Adam Barth.
+
+        This patch slightly improves DOM binding performance by inlining hot
+        methods in V8Binding.cpp, e.g. isUndefinedOrNull(), v8StringOrNull(), v8Boolean().
+        For example, this patch improves div.nodeName by 5.0%, and div.nodeValue by 4.1%.
+
+        Performance tests: https://bugs.webkit.org/attachment.cgi?id=131006
+
+        The performance test results in my Mac environment are as follows:
+
+        Chromium/V8 without this patch:
+        div.nodeName : 3417.4 ms
+        div.nodeValue : 2069.6 ms
+
+        Chromium/V8 with this patch:
+        div.nodeName : 3245.6 ms
+        div.nodeValue : 1983.1 ms
+
+        No tests. No change in behavior.
+
+        * bindings/v8/V8Binding.cpp:
+        * bindings/v8/V8Binding.h:
+        (WebCore::toWebCoreString):
+        (WebCore::isUndefinedOrNull):
+        (WebCore::isHostObject):
+        (WebCore::v8Boolean):
+        (WebCore::toWebCoreStringWithNullCheck):
+        (WebCore::toAtomicWebCoreStringWithNullCheck):
+        (WebCore::toWebCoreStringWithNullOrUndefinedCheck):
+        (WebCore::v8UndetectableString):
+        (WebCore::v8StringOrNull):
+        (WebCore::v8StringOrUndefined):
+        (WebCore::v8StringOrFalse):
+        (WebCore::toWebCoreDate):
+        (WebCore::v8DateOrNull):
+
+2012-03-09  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Implement scroll physics architecture for impl/main thread
+        https://bugs.webkit.org/show_bug.cgi?id=79827
+
+        Reviewed by James Robinson.
+
+        Unittests added, plus follow-on patch from rjkroege will add layout tests.
+
+        PlatformGestureCurve is a framework to separate the physical simulation from for gesture
+        animation from control concerns. This allows the physics to be reused in alternate places.
+        At present, the framework will be applied in ScrollAnimatorNone and the Chrome Compositor.
+
+        * WebCore.gypi:
+        * platform/ActivePlatformGestureAnimation.cpp: Added.
+        (WebCore):
+        (WebCore::ActivePlatformGestureAnimation::create):
+        (WebCore::ActivePlatformGestureAnimation::~ActivePlatformGestureAnimation):
+        (WebCore::ActivePlatformGestureAnimation::ActivePlatformGestureAnimation):
+        (WebCore::ActivePlatformGestureAnimation::animate):
+        * platform/ActivePlatformGestureAnimation.h: Added.
+        (WebCore):
+        (ActivePlatformGestureAnimation):
+        * platform/PlatformGestureCurve.h: Added.
+        (WebCore):
+        (PlatformGestureCurve):
+        (WebCore::PlatformGestureCurve::~PlatformGestureCurve):
+        * platform/PlatformGestureCurveTarget.h: Added.
+        (WebCore):
+        (PlatformGestureCurveTarget):
+        (WebCore::PlatformGestureCurveTarget::~PlatformGestureCurveTarget):
+        * platform/TouchFlingPlatformGestureCurve.cpp: Added.
+        (WebCore):
+        (WebCore::TouchFlingPlatformGestureCurve::create):
+        (WebCore::TouchFlingPlatformGestureCurve::TouchFlingPlatformGestureCurve):
+        (WebCore::TouchFlingPlatformGestureCurve::~TouchFlingPlatformGestureCurve):
+        (WebCore::TouchFlingPlatformGestureCurve::apply):
+        * platform/TouchFlingPlatformGestureCurve.h: Added.
+        (WebCore):
+        (TouchFlingPlatformGestureCurve):
+        * platform/WheelFlingPlatformGestureCurve.cpp: Added.
+        (WebCore):
+        (WebCore::WheelFlingPlatformGestureCurve::create):
+        (WebCore::WheelFlingPlatformGestureCurve::WheelFlingPlatformGestureCurve):
+        (WebCore::WheelFlingPlatformGestureCurve::~WheelFlingPlatformGestureCurve):
+        (WebCore::WheelFlingPlatformGestureCurve::apply):
+        * platform/WheelFlingPlatformGestureCurve.h: Added.
+        (WebCore):
+        (WheelFlingPlatformGestureCurve):
+        * platform/graphics/chromium/cc/CCActiveGestureAnimation.cpp: Added.
+        (WebCore):
+        (WebCore::CCActiveGestureAnimation::create):
+        (WebCore::CCActiveGestureAnimation::CCActiveGestureAnimation):
+        (WebCore::CCActiveGestureAnimation::~CCActiveGestureAnimation):
+        (WebCore::CCActiveGestureAnimation::animate):
+        * platform/graphics/chromium/cc/CCActiveGestureAnimation.h: Added.
+        (WebCore):
+        (CCActiveGestureAnimation):
+        * platform/graphics/chromium/cc/CCGestureCurve.h: Added.
+        (WebCore):
+        (CCGestureCurveTarget):
+        (WebCore::CCGestureCurveTarget::~CCGestureCurveTarget):
+        (CCGestureCurve):
+        (WebCore::CCGestureCurve::~CCGestureCurve):
+
+2012-03-09  Alexis Menard  <alexis.menard@openbossa.org>
+
+        Implement selectedOptions attribute of <select>.
+        https://bugs.webkit.org/show_bug.cgi?id=80631
+
+        Reviewed by Benjamin Poulain.
+
+        Add a new collection as a member of HTMLSelectElement which is
+        used to store the selected elements. Extend HTMLCollection to
+        support the new collection type needed by this feature.
+
+        Reference : http://www.whatwg.org/specs/web-apps/current-work/multipage/the-button-element.html#dom-select-selectedoptions
+
+        Test: fast/dom/select-selectedOptions.html
+
+        * html/CollectionType.h:
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::shouldIncludeChildren):
+        (WebCore::HTMLCollection::isAcceptableElement):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::selectedOptions):
+        (WebCore):
+        * html/HTMLSelectElement.h:
+        (HTMLSelectElement):
+        * html/HTMLSelectElement.idl:
+
+2012-03-09  Tien-Ren Chen  <trchen@chromium.org>
+
+        [chromium] ScrollbarLayerChromium/CCScrollbarLayerImpl for CC-side scrollbar painting
+        https://bugs.webkit.org/show_bug.cgi?id=78872
+
+        Reviewed by James Robinson.
+
+        New test ScrollbarLayerChromiumTest.resolveScrollLayerPointer
+
+        * WebCore.gypi:
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (WebCore::scrollLayerForFrameView):
+        (WebCore::scrollbarLayerDidChange):
+        (WebCore):
+        (WebCore::ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange):
+        (WebCore::ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange):
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::invalidateScrollbar):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        (WebCore::GraphicsLayerChromium::hasContentsLayer):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore):
+        (WebCore::LayerChromium::toScrollbarLayerChromium):
+        (LayerChromium):
+        * platform/graphics/chromium/ScrollbarLayerChromium.cpp: Added.
+        (WebCore):
+        (WebCore::ScrollbarLayerChromium::createCCLayerImpl):
+        (WebCore::ScrollbarLayerChromium::create):
+        (WebCore::ScrollbarLayerChromium::ScrollbarLayerChromium):
+        (WebCore::ScrollbarLayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/ScrollbarLayerChromium.h: Added.
+        (WebCore):
+        (ScrollbarLayerChromium):
+        (WebCore::ScrollbarLayerChromium::scrollLayerId):
+        (WebCore::ScrollbarLayerChromium::toScrollbarLayerChromium):
+        * platform/graphics/chromium/TreeSynchronizer.cpp:
+        (WebCore::TreeSynchronizer::synchronizeTrees):
+        (WebCore::TreeSynchronizer::collectExistingCCLayerImplRecursive):
+        (WebCore::TreeSynchronizer::reuseOrCreateCCLayerImpl):
+        (WebCore::TreeSynchronizer::synchronizeTreeRecursive):
+        (WebCore::TreeSynchronizer::updateScrollbarLayerPointersRecursive):
+        (WebCore):
+        * platform/graphics/chromium/TreeSynchronizer.h:
+        (TreeSynchronizer):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::updateMaxScrollPosition):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp: Added.
+        (WebCore):
+        (WebCore::CCScrollbarLayerImpl::create):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbarLayerImpl):
+        (WebCore::CCScrollbarLayerImpl::willDraw):
+        (WebCore::CCScrollbarLayerImpl::appendQuads):
+        (WebCore::CCScrollbarLayerImpl::didDraw):
+        (WebCore::CCScrollbarLayerImpl::paint):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::x):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::y):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::width):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::height):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::size):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::location):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::parent):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::root):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::setFrameRect):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::frameRect):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::invalidate):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::invalidateRect):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::scrollbarOverlayStyle):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::getTickmarks):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::isScrollableAreaActive):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::isScrollViewScrollbar):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::convertFromContainingWindow):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::isCustomScrollbar):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::orientation):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::value):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::currentPos):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::visibleSize):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::totalSize):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::maximum):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::controlSize):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::lineStep):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::pageStep):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::pressedPart):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::hoveredPart):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::styleChanged):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::enabled):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::setEnabled):
+        * platform/graphics/chromium/cc/CCScrollbarLayerImpl.h: Added.
+        (WebCore):
+        (CCScrollbarLayerImpl):
+        (WebCore::CCScrollbarLayerImpl::setScrollbarOverlayStyle):
+        (WebCore::CCScrollbarLayerImpl::setTickmarks):
+        (WebCore::CCScrollbarLayerImpl::setIsScrollableAreaActive):
+        (WebCore::CCScrollbarLayerImpl::setIsScrollViewScrollbar):
+        (WebCore::CCScrollbarLayerImpl::setOrientation):
+        (WebCore::CCScrollbarLayerImpl::setControlSize):
+        (WebCore::CCScrollbarLayerImpl::setPressedPart):
+        (WebCore::CCScrollbarLayerImpl::setHoveredPart):
+        (WebCore::CCScrollbarLayerImpl::setEnabled):
+        (WebCore::CCScrollbarLayerImpl::scrollLayer):
+        (WebCore::CCScrollbarLayerImpl::setScrollLayer):
+        (CCScrollbar):
+        (WebCore::CCScrollbarLayerImpl::CCScrollbar::CCScrollbar):
+
+2012-03-09  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Split the extra logical height distribution logic out of RenderTableSection::layoutRows
+        https://bugs.webkit.org/show_bug.cgi?id=80671
+
+        Reviewed by Adrienne Walker.
+
+        Refactoring only, no change in behavior expected.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+        Split the logic from here...
+
+        (WebCore::RenderTableSection::distributeExtraLogicalHeightToPercentRows):
+        (WebCore::RenderTableSection::distributeExtraLogicalHeightToAutoRows):
+        (WebCore::RenderTableSection::distributeRemainingExtraLogicalHeight):
+        (WebCore::RenderTableSection::distributeExtraLogicalHeightToRows):
+        ... to those functions. Cleaned up the variable naming while at it and
+        made them follow the same signature as this may be useful to fix another
+        bug I have.
+
+        * rendering/RenderTableSection.h:
+        (RenderTableSection):
+        Added the previous 4 new functions.
+
+2012-03-09  Rob Buis  <rbuis@rim.com>
+
+        Remove unused file FrameBlackBerry.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=80731
+
+        Reviewed by Antonio Gomes.
+
+        This is not needed anymore since there is an implementation elsewhere.
+
+        * PlatformBlackBerry.cmake:
+        * page/blackberry/FrameBlackBerry.cpp: Removed.
+
+2012-03-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110309.
+        http://trac.webkit.org/changeset/110309
+        https://bugs.webkit.org/show_bug.cgi?id=80732
+
+        Seems to have caused a number of SVG crashes (thorton will
+        investigate further) (Requested by abarth|gardener on
+        #webkit).
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::deferredRepaintTimerFired):
+        * page/FrameView.h:
+        (FrameView):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::shouldRepaint):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::drawSVGToImageBuffer):
+        (WebCore::SVGImage::draw):
+        * svg/graphics/SVGImage.h:
+        * svg/graphics/SVGImageCache.cpp:
+        (WebCore::SVGImageCache::imageContentChanged):
+        (WebCore::SVGImageCache::redrawTimerFired):
+        * svg/graphics/SVGImageCache.h:
+        (SVGImageCache):
+
+2012-03-09  Ken Buchanan  <kenrb@chromium.org>
+
+        Crash due to inserting letter into div with first-letter
+        https://bugs.webkit.org/show_bug.cgi?id=78534
+
+        Reviewed by David Hyatt.
+
+        This fixes an issue in RenderTextFragment with setTextInternal
+        getting called with different intents. While most calls to it
+        are intended to change the underlying DOM node string, it can
+        also be called as a result of styleDidChange just for transforms
+        on the substring text fragment. This adds a mechanism for internal
+        callers to specify if the internal text is being updated without
+        a DOM node text change.
+
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::styleDidChange)
+        (WebCore::RenderTextFragment::setTextInternal)
+        * rendering/RenderTextFragment.h:
+        (WebCore::RenderTextFragment)
+
+2012-03-09  Chris Rogers  <crogers@google.com>
+
+        Fix uninitialized variable in DynamicsCompressor
+        https://bugs.webkit.org/show_bug.cgi?id=80724
+
+        Reviewed by James Robinson.
+
+        * platform/audio/DynamicsCompressor.cpp:
+        (WebCore::DynamicsCompressor::DynamicsCompressor):
+
+2012-03-09  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Undo text position adjustment for attribute event handlers
+        https://bugs.webkit.org/show_bug.cgi?id=80725
+
+        Reviewed by Adam Barth.
+
+        No new tests. Needs rebaseline.
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+
+2012-03-09  Tom Sepez  <tsepez@chromium.org>
+
+        Hold cached images with a CachedResourceHandle rather than a raw pointer for CSSCrossfadeValue
+        https://bugs.webkit.org/show_bug.cgi?id=80186
+
+        Reviewed by Simon Fraser.
+
+        Test: http/tests/css/cross-fade-reload.html
+
+        * css/CSSCrossfadeValue.h:
+        (CSSCrossfadeValue):
+
+2012-03-09  Abhishek Arya  <inferno@chromium.org>
+
+        Crash when splitting an anonymous block in multi-column layout.
+        https://bugs.webkit.org/show_bug.cgi?id=80432
+
+        Reviewed by David Hyatt.
+
+        Calculating currChild->nextSibling() is risky after destroying :after content
+        because it can blow away currChild if it is a left over empty anonymous block.
+        We need to calculate next sibling upfront, using the same trick, we do in
+        RenderBlock::addChildIgnoringAnonymousColumnBlock to reset beforeChild (check
+        out the line before splitFlow call).
+
+        Test: fast/multicol/anonymous-block-split-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::splitBlocks):
+
+2012-03-09  Abhishek Arya  <inferno@chromium.org>
+
+        Crash due to accessing removed parent lineboxes when clearing selection.
+        https://bugs.webkit.org/show_bug.cgi?id=79264
+
+        Reviewed by Dave Hyatt.
+
+        Test: editing/selection/first-letter-selection-crash.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::setSelectionState):
+        1. No need of checking if we are being set to same selection state.
+        Now tested by setSelectionStateIfNeeded. Rename 's' with 'state' and
+        'cb' with 'containingBlock'.
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::setSelectionState):
+        1. Add check to canUpdateSelectionOnRootLineBoxes to make sure our
+        root line boxes are still valid before setting them.
+        2. No need of calling setSelectionState on containing block since our base
+        class call to RenderBox::setSelectionState covers it. Added a comment to indicate that.
+        3. Use m_inlineBoxWrapper variable directly to simplify the ifs.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::canUpdateSelectionOnRootLineBoxes):
+        (WebCore): helper function to tell if we can update selection information
+        on our root line boxes. This returns false if our containing block is pending layout.
+        * rendering/RenderObject.h:
+        (RenderObject):
+        (WebCore::RenderObject::setSelectionStateIfNeeded):
+        (WebCore): helper to set selection state only if it is different from our
+        current selection state.
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::setSelectionState):
+        1. Rename 's' to 'state', 'line' to 'root' and use m_inlineBoxWrapper directly
+        to simplify ifs.
+        2. Add check to canUpdateSelectionOnRootLineBoxes to make sure our
+        root line boxes are still valid before setting them.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setSelectionState):
+        1. Add check to canUpdateSelectionOnRootLineBoxes to make sure our
+        root line boxes are still valid before setting them.
+        2. Rename 'cb' to 'containingBlock', 'line' to 'root', move InlineTextBox
+        declaration to local.
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Replace all calls to setSelectionState
+        with setSelectionStateIfNeeded.
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setSelectionState):
+        1. No need of checking if we are being set to same selection state.
+        Now tested by setSelectionStateIfNeeded.
+
+2012-03-09  Levi Weintraub  <leviw@chromium.org>
+
+        Move TransformationMatrix and TransformState to LayoutUnits.
+        https://bugs.webkit.org/show_bug.cgi?id=80632
+
+        Reviewed by Simon Fraser.
+
+        When we move layout to sub-pixel precision, we want to preserve that precision through
+        transformations. This change readies TransformState and TransformationMatrix to make
+        use of this additional precision in accumulating transforms, and in returning rects that
+        preserve it.
+
+        No new tests. No change in behavior.
+
+        * platform/graphics/transforms/TransformState.cpp:
+        (WebCore::TransformState::move): Changed to pass along LayoutUnits to the contained
+        TransformationMatrix. The values of the LayoutUnits will be implicitly converted to
+        floats to be applied.
+        * platform/graphics/transforms/TransformState.h:
+        (WebCore::TransformState::move): Ditto.
+        (TransformState):
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::clampEdgeValue): Limiting edges to the maximum LayoutUnit value to prevent
+        overflow..
+        (WebCore::TransformationMatrix::clampedBoundsOfProjectedQuad): Same as above, but also
+        returning a LayoutRect which preserves additional precision than the previous IntRect.
+        (WebCore::TransformationMatrix::mapRect): Adding a version of this method that operates
+        specifically on FractionalLayoutRects.
+        (WebCore):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore):
+        (TransformationMatrix):
+        * rendering/LayoutTypes.h:
+        (WebCore::clampToLayoutUnit):
+        (WebCore):
+
+2012-03-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Remove a bogus assertion. This condition is no longer true for non-document tree scopes.
+
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::activeElement):
+
+2012-03-09  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Cleanup incDOMTreeVersion callers
+        https://bugs.webkit.org/show_bug.cgi?id=80452
+
+        Reviewed by Andreas Kling.
+
+        Unify various calls to incDOMTreeVersion and namely remove the call inside dispatchSubtreeModifiedEvent.
+        There should be no behavioral change and therefore there is no new test.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::parserAppendData):
+        (WebCore::CharacterData::setDataAndUpdate):
+        * dom/ContainerNode.cpp:
+        (WebCore::willRemoveChild):
+        (WebCore::willRemoveChildren):
+        (WebCore::ContainerNode::removeChild):
+        (WebCore::ContainerNode::removeChildren):
+        (WebCore::ContainerNode::childrenChanged):
+        (WebCore::notifyChildInserted):
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+        (WebCore::Element::parserSetAttributes):
+        (WebCore::Element::willModifyAttribute):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        * html/HTMLOutputElement.cpp:
+        (WebCore::HTMLOutputElement::childrenChanged):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::childrenChanged):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::childrenChanged):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::childrenChanged):
+        * html/HTMLTitleElement.cpp:
+        (WebCore::HTMLTitleElement::childrenChanged):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::childrenChanged):
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::childrenChanged):
+
+2012-03-09  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix for !ENABLE(FILTERS) after r110285.
+
+        * rendering/svg/SVGRenderingContext.h:
+        (WebCore::SVGRenderingContext::SVGRenderingContext):
+
+2012-03-09  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Use opaque paints in CCOcclusionTracker
+        https://bugs.webkit.org/show_bug.cgi?id=80173
+
+        Reviewed by Adrienne Walker.
+
+        Use tracked opaque paints in the tiles when tracking occlusion in
+        CCOcclusionTracker. Moves the Tile::m_opaqueRect up to the super-
+        class in CCLayerTilingData rather than having it declared in both
+        TiledLayerChromium and CCTiledLayerImpl. This lets the CCLayerTilingData
+        class compute the opaque region for its tiles, sharing code between the
+        two tiled layer implementations.
+
+        Use of this feature is guarded behind a runtime flag and turned off for
+        paint culling. We will enable it in the future once we're comfortable
+        with the paint culling.
+
+        Unit test: CCOcclusionTrackerTest.opaqueContentsRegionEmpty
+                   CCOcclusionTrackerTest.opaqueContentsRegionNonEmpty
+                   TiledLayerChromiumTest.opaqueContentsRegion
+
+        All existing CCOcclusionTrackerTest.* duplicated with opaque painted
+        rects.
+
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::opaqueContentsRegion):
+        (LayerChromium):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (UpdatableTile):
+        (WebCore::TiledLayerChromium::pushPropertiesTo):
+        (WebCore::TiledLayerChromium::prepareToUpdateTiles):
+        (WebCore::TiledLayerChromium::addSelfToOccludedScreenSpace):
+        (WebCore::TiledLayerChromium::opaqueContentsRegion):
+        (WebCore):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::opaqueContentsRegion):
+        (CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerTilingData.cpp:
+        (WebCore::CCLayerTilingData::opaqueRegionInLayerRect):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTilingData.h:
+        (WebCore):
+        (Tile):
+        (WebCore::CCLayerTilingData::Tile::opaqueRect):
+        (WebCore::CCLayerTilingData::Tile::setOpaqueRect):
+        (CCLayerTilingData):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::::CCOcclusionTrackerBase):
+        (WebCore::computeOcclusionBehindLayer):
+        (WebCore::::markOccludedBehindLayer):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
+        (CCOcclusionTrackerBase):
+        (WebCore::CCOcclusionTrackerBase::setUsePaintTracking):
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.cpp:
+        (DrawableTile):
+        (WebCore::CCTiledLayerImpl::opaqueContentsRegion):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
+        (CCTiledLayerImpl):
+
+2012-03-09  Antti Koivisto  <antti@apple.com>
+
+        Presentation attribute cache
+        https://bugs.webkit.org/show_bug.cgi?id=80707
+        
+        Reviewed by Andreas Kling.
+
+        It is common for the same presentation attribute values repeat. We should introduce a cache that uses 
+        presentation attribute names and values as key. This will help to avoid repeated parsing of the 
+        same attribute values, reduce memory consumption and speed up the style resolve.
+        
+        This patch introduces a simple and small (128 entries) global cache. In general web browsing it seems
+        to give sharing rate of >75% (an average presentation attribute property set is shared between >4 elements).
+
+        * dom/StyledElement.cpp:
+        (WebCore::PresentationAttributeCacheKey::PresentationAttributeCacheKey):
+        (PresentationAttributeCacheKey):
+        (WebCore):
+        (WebCore::operator!=):
+        (PresentationAttributeCacheEntry):
+        (WebCore::presentationAttributeCache):
+        (WebCore::attributeNameSort):
+        (WebCore::StyledElement::makePresentationAttributeCacheKey):
+        (WebCore::computePresentationAttributeCacheHash):
+        (WebCore::StyledElement::updateAttributeStyle):
+        * dom/StyledElement.h:
+        (WebCore):
+        (StyledElement):
+
+2012-03-08  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Fix object scope for inline event attribute handlers
+        https://bugs.webkit.org/show_bug.cgi?id=80329
+
+        Reviewed by Ojan Vafai.
+
+        We now create the funciton inside the with-statements with the current scope objects.
+        This is important for a few reasons:
+
+        - We need to use the real objects and not just lookup the JS properties because these might have been overridden.
+        - We need to use the node, form and document at the time of the preparation and not at the time of calling.
+        - We need to ensure that event/evt is bound closer than a property with the same name in the object environment
+          created by the with-statements.
+
+        Tests: fast/dom/inline-event-attributes-lookup-removed-form.html
+               fast/dom/inline-event-attributes-lookup-removed.html
+               fast/dom/inline-event-attributes-lookup.html
+
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::eventParameterName):
+        (WebCore):
+        (WebCore::createAttributeEventListener):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        (WebCore):
+        (WebCore::toObjectWrapper):
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore):
+        (WebCore::V8LazyEventListener::create):
+        (V8LazyEventListener):
+
+2012-03-09  Stephen Chenney  <schenney@chromium.org>
+
+        Crash in WebCore::SVGUseElement::instanceForShadowTreeElement
+        https://bugs.webkit.org/show_bug.cgi?id=80406
+
+        Reviewed by Nikolas Zimmermann.
+
+        Code assumes that an object that is an SVG Element and in a shadow
+        tree must be in an SVG use shadow tree, and casts the shadow host with
+        a static_cast. It may be that an SVG element appears in a non-use
+        shadow tree, in which case bad things happen. While it appears that
+        the current code prevents such a situation from arising (checks are
+        made within the shadow tree code to prevent it) there are also
+        indications that the situation may change.
+
+        No new tests. I believe that the problem here cannot currently be
+        reproduced. That is, other code prevents SVG elements from appearing
+        in non-svg shadow trees.
+
+        * dom/EventDispatcher.cpp:
+        (WebCore::eventTargetRespectingSVGTargetRules):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::title):
+
+2012-03-09  Jon Lee  <jonlee@apple.com>
+
+        Add support for ENABLE(LEGACY_NOTIFICATIONS)
+        https://bugs.webkit.org/show_bug.cgi?id=80497
+
+        Reviewed by Adam Barth.
+
+        Prep for b80472: Update API for Web Notifications
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+
+2012-03-09  Kaustubh Atrawalkar  <kaustubh@motorola.com>
+
+        ShadowRoot should implement activeElement.
+        https://bugs.webkit.org/show_bug.cgi?id=79886
+
+        Reviewed by Ryosuke Niwa.
+
+        Implement the activeElement attribute for ShadowRoot to return the
+        currently focused element in the shadow DOM subtree.
+
+        Test: fast/dom/shadow/shadow-root-activeElement.html
+
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::activeElement):
+        (WebCore):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        * dom/ShadowRoot.idl:
+        * dom/TreeScope.cpp:
+        (WebCore::TreeScope::adoptIfNeeded):
+        (WebCore):
+        (WebCore::focusedFrameOwnerElement):
+        (WebCore::TreeScope::activeElement):
+        * dom/TreeScope.h:
+        (TreeScope):
+        * html/HTMLDocument.cpp:
+        (WebCore):
+        (WebCore::HTMLDocument::activeElement):
+
+2012-03-09  Tim Horton  <timothy_horton@apple.com>
+
+        Infinite repaint loop with SVGImageCache and deferred repaint timers
+        https://bugs.webkit.org/show_bug.cgi?id=78315
+        <rdar://problem/10651634>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Only defer image redraw on a timer if we're in layout. This breaks
+        the repaint loop while still preventing us from drawing inside layout.
+
+        Completely disable repaint during relayout inside SVGImage::drawSVGToImageBuffer,
+        preventing deferred repaint timers from being started during that process.
+
+        No new tests, as the problem only occurs in a nonstandard configuration.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::draw):
+        (WebCore::SVGImage::frameView):
+        (WebCore):
+        * svg/graphics/SVGImage.h:
+        (WebCore):
+        * svg/graphics/SVGImageCache.cpp:
+        (WebCore::SVGImageCache::imageContentChanged):
+        (WebCore::SVGImageCache::redraw):
+        (WebCore::SVGImageCache::redrawTimerFired):
+        (WebCore):
+        * svg/graphics/SVGImageCache.h:
+        (SVGImageCache):
+
+2012-03-09  Victor Carbune  <vcarbune@adobe.com>
+
+        The method TextTrackCue::getCueAsHTML() should return different
+        fragments on different calls.
+
+        https://bugs.webkit.org/show_bug.cgi?id=80701
+
+        Reviewed by Eric Carlson.
+
+        Test: media/track/track-cue-mutable-fragment.html
+
+        * html/track/TextTrackCue.cpp: Removed setCueHTML(), since it is sufficient
+        to create apply the DOM rules only when the fragment is first requested.
+        (WebCore::TextTrackCue::getCueAsHTML): Changed the method such that a
+        a clone of the cached document fragment is returned.
+        * html/track/TextTrackCue.h: Removed setCueHTML() as the document fragment
+        of the cue should be created only within the class, from the cue text.
+        (TextTrackCue):
+        * html/track/WebVTTParser.cpp:
+        (WebCore::WebVTTParser::createNewCue): removed usage of setCueHTML()
+
+2012-03-09  Tim Horton  <timothy_horton@apple.com>
+
+        Crash in SVGTextLayoutAttributesBuilder::fillCharacterDataMap
+        https://bugs.webkit.org/show_bug.cgi?id=78949
+        <rdar://problem/10889440>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Invalidate the text positioning cache when the children of an SVGAElement change,
+        so that we regenerate the list the next time it's needed instead of using stale values.
+
+        Test: svg/text/text-positioning-remove-child-crash.svg
+
+        * rendering/svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::childrenChanged):
+
+2012-03-09  Ashod Nakashian  <ashodnakashian@yahoo.com>
+
+        Bash scripts should support LF endings only
+        https://bugs.webkit.org/show_bug.cgi?id=79509
+
+        Reviewed by David Kilzer.
+
+        * WebCore.gyp/mac/adjust_visibility.sh: Added property svn:eol-style.
+        * WebCore.vcproj/build-generated-files.sh: Added property svn:executable.
+        * WebCore.vcproj/migrate-scripts.sh: Added property svn:executable.
+        * gyp/copy-forwarding-and-icu-headers.sh: Added property svn:eol-style.
+        * gyp/copy-inspector-resources.sh: Added property svn:eol-style.
+        * gyp/generate-derived-sources.sh: Added property svn:eol-style.
+        * gyp/generate-webcore-export-file-generator.sh: Added property svn:eol-style.
+        * gyp/run-if-exists.sh: Added property svn:eol-style.
+        * gyp/streamline-inspector-source.sh: Added property svn:eol-style.
+        * gyp/update-info-plist.sh: Added property svn:eol-style.
+
+2012-03-09  Andreas Kling  <awesomekling@apple.com>
+
+        CSSParser: Use Vector for intermediate property storage.
+        <http://webkit.org/b/80653>
+
+        Reviewed by Antti Koivisto.
+
+        Remove the custom memory management for intermediate CSSProperties in CSSParser
+        and replace it by a Vector<CSSProperty, 256>.
+        This avoids heap allocations and removes a bunch of unnecessary complexity.
+
+        Remove WTF_MAKE_FAST_ALLOCATED from CSSProperty since they are only created on
+        the stack now.
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::~CSSParser):
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseColor):
+        (WebCore::CSSParser::parseDeclaration):
+        (WebCore::CSSParser::addProperty):
+        (WebCore::CSSParser::rollbackLastProperties):
+        (WebCore::CSSParser::clearProperties):
+        (WebCore::CSSParser::parse4Values):
+        (WebCore::CSSParser::parseFlowThread):
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::createFontFaceRule):
+        (WebCore::CSSParser::createPageRule):
+        (WebCore::CSSParser::createMarginAtRule):
+        (WebCore::CSSParser::startDeclarationsForMarginBox):
+        (WebCore::CSSParser::endDeclarationsForMarginBox):
+        (WebCore::CSSParser::deleteFontFaceOnlyValues):
+        (WebCore::CSSParser::createKeyframeRule):
+        * css/CSSParser.h:
+        (WebCore::CSSParser::hasProperties):
+        (CSSParser):
+        * css/CSSProperty.h:
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue):
+        * css/StylePropertySet.cpp:
+        (WebCore::StylePropertySet::StylePropertySet):
+        (WebCore::StylePropertySet::addParsedProperties):
+        * css/StylePropertySet.h:
+        (WebCore::StylePropertySet::create):
+        (StylePropertySet):
+
+2012-03-09  Nate Chapin  <japhet@chromium.org>
+
+        CachedRawResource breaks when trying to load
+        a resource with an empty response body from cache.
+
+        Reviewed by Alexey Proskuryakov.
+
+        Test: http/tests/cache/zero-length-xhr.html
+
+        * loader/cache/CachedRawResource.cpp:
+        (WebCore::CachedRawResource::didAddClient): Don't exit early
+            if m_data is empty, we may still need to notifyFinished().
+
+2012-03-09  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream classes that handle layer tiling
+        https://bugs.webkit.org/show_bug.cgi?id=79875
+
+        Reviewed by Rob Buis.
+
+        Initial upstreaming, no new tests.
+
+        * platform/graphics/blackberry/LayerTile.cpp: Added.
+        (WebCore):
+        (WebCore::LayerTile::LayerTile):
+        (WebCore::LayerTile::~LayerTile):
+        (WebCore::LayerTile::setContents):
+        (WebCore::LayerTile::setContentsToColor):
+        (WebCore::LayerTile::updateContents):
+        (WebCore::LayerTile::discardContents):
+        (WebCore::LayerTile::setVisible):
+        (WebCore::LayerTile::setTexture):
+        * platform/graphics/blackberry/LayerTile.h: Added.
+        (WebCore):
+        (LayerTileData):
+        (WebCore::LayerTileData::LayerTileData):
+        (WebCore::LayerTileData::isVisible):
+        (LayerTile):
+        (WebCore::LayerTile::texture):
+        (WebCore::LayerTile::isVisible):
+        (WebCore::LayerTile::isDirty):
+        (WebCore::LayerTile::hasTexture):
+        (WebCore::LayerTile::setContentsDirty):
+        * platform/graphics/blackberry/LayerTileIndex.h: Added.
+        (WebCore):
+        (TileIndex):
+        (WebCore::TileIndex::TileIndex):
+        (WebCore::TileIndex::~TileIndex):
+        (WebCore::TileIndex::i):
+        (WebCore::TileIndex::j):
+        (WebCore::TileIndex::setIndex):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        (WTF):
+        * platform/graphics/blackberry/LayerTiler.cpp: Added.
+        (WebCore):
+        (WebCore::transformPoint):
+        (WebCore::defaultTileSize):
+        (WebCore::LayerTiler::LayerTiler):
+        (WebCore::LayerTiler::~LayerTiler):
+        (WebCore::LayerTiler::layerWebKitThreadDestroyed):
+        (WebCore::LayerTiler::layerCompositingThreadDestroyed):
+        (WebCore::LayerTiler::setNeedsDisplay):
+        (WebCore::LayerTiler::updateTextureContentsIfNeeded):
+        (WebCore::LayerTiler::shouldPerformRenderJob):
+        (WebCore::LayerTiler::addTextureJob):
+        (WebCore::LayerTiler::clearTextureJobs):
+        (WebCore::LayerTiler::commitPendingTextureUploads):
+        (WebCore::LayerTiler::layerVisibilityChanged):
+        (WebCore::LayerTiler::uploadTexturesIfNeeded):
+        (WebCore::LayerTiler::processTextureJob):
+        (WebCore::LayerTiler::addTileJob):
+        (WebCore::LayerTiler::performTileJob):
+        (WebCore::LayerTiler::drawTextures):
+        (WebCore::LayerTiler::drawMissingTextures):
+        (WebCore::LayerTiler::drawTexturesInternal):
+        (WebCore::LayerTiler::addRenderJob):
+        (WebCore::LayerTiler::removeRenderJob):
+        (WebCore::LayerTiler::deleteTextures):
+        (WebCore::LayerTiler::pruneTextures):
+        (WebCore::LayerTiler::updateTileSize):
+        (WebCore::LayerTiler::disableTiling):
+        (WebCore::LayerTiler::shouldPrefillTile):
+        (WebCore::LayerTiler::indexOfTile):
+        (WebCore::LayerTiler::originOfTile):
+        (WebCore::LayerTiler::rectForTile):
+        (WebCore::LayerTiler::hasDirtyTiles):
+        (WebCore::LayerTiler::bindContentsTexture):
+        * platform/graphics/blackberry/LayerTiler.h: Added.
+        (WebCore):
+        (LayerTiler):
+        (WebCore::LayerTiler::create):
+        (WebCore::LayerTiler::layer):
+        (WebCore::LayerTiler::hasMissingTextures):
+        (WebCore::LayerTiler::TextureJob::TextureJob):
+        (TextureJob):
+        (WebCore::LayerTiler::TextureJob::setContents):
+        (WebCore::LayerTiler::TextureJob::setContentsToColor):
+        (WebCore::LayerTiler::TextureJob::updateContents):
+        (WebCore::LayerTiler::TextureJob::discardContents):
+        (WebCore::LayerTiler::TextureJob::resizeContents):
+        (WebCore::LayerTiler::TextureJob::dirtyContents):
+        (WebCore::LayerTiler::TextureJob::isNull):
+        (WebCore::LayerTiler::tileSize):
+        (WebCore::LayerTiler::removeUpdateContentsJobs):
+
+2012-03-09  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Ensure we use the correct time when notifying animation started
+        https://bugs.webkit.org/show_bug.cgi?id=79537
+
+        Reviewed by James Robinson
+
+        Tested in CCLayerTreeHostTestAddAnimation
+
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::setAnimationEvent):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/cc/CCAnimationEvents.cpp:
+        (WebCore::CCAnimationStartedEvent::create):
+        (WebCore::CCAnimationStartedEvent::CCAnimationStartedEvent):
+        * platform/graphics/chromium/cc/CCAnimationEvents.h:
+        (CCAnimationEvent):
+        (CCAnimationStartedEvent):
+        * platform/graphics/chromium/cc/CCInputHandler.h:
+        (CCInputHandler):
+        * platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp:
+        (WebCore::CCLayerAnimationControllerImpl::animate):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForNextTick):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForStartTime):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability):
+        (WebCore::CCLayerAnimationControllerImpl::resolveConflicts):
+        (WebCore::CCLayerAnimationControllerImpl::tickAnimations):
+        * platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h:
+        (CCLayerAnimationControllerImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::setAnimationEvents):
+        (WebCore::CCLayerTreeHost::setAnimationEventsRecursive):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::animate):
+        (WebCore::CCLayerTreeHostImpl::startPageScaleAnimation):
+        (WebCore::CCLayerTreeHostImpl::animateLayersRecursive):
+        (WebCore::CCLayerTreeHostImpl::animatePageScale):
+        (WebCore::CCLayerTreeHostImpl::animateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImplClient):
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCPageScaleAnimation.cpp:
+        (WebCore::CCPageScaleAnimation::create):
+        (WebCore::CCPageScaleAnimation::CCPageScaleAnimation):
+        (WebCore::CCPageScaleAnimation::zoomTo):
+        (WebCore::CCPageScaleAnimation::zoomWithAnchor):
+        (WebCore::CCPageScaleAnimation::scrollOffsetAtTime):
+        (WebCore::CCPageScaleAnimation::pageScaleAtTime):
+        (WebCore::CCPageScaleAnimation::isAnimationCompleteAtTime):
+        (WebCore::CCPageScaleAnimation::progressRatioForTime):
+        * platform/graphics/chromium/cc/CCPageScaleAnimation.h:
+        (CCPageScaleAnimation):
+        (WebCore::CCPageScaleAnimation::startTime):
+        (WebCore::CCPageScaleAnimation::duration):
+        (WebCore::CCPageScaleAnimation::endTime):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::startPageScaleAnimation):
+        (WebCore::CCSingleThreadProxy::postAnimationEventsToMainThreadOnImplThread):
+        (WebCore::CCSingleThreadProxy::doComposite):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::startPageScaleAnimation):
+        (WebCore::CCThreadProxy::requestStartPageScaleAnimationOnImplThread):
+        (WebCore::CCThreadProxy::postAnimationEventsToMainThreadOnImplThread):
+        (WebCore::CCThreadProxy::scheduledActionDrawAndSwap):
+        (WebCore::CCThreadProxy::setAnimationEvents):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-03-09  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Add SVGRenderingContext and move there the context related code from SVGRenderSupport
+        https://bugs.webkit.org/show_bug.cgi?id=80413
+
+        Reviewed by Nikolas Zimmermann.
+
+        This is the first step of refactoring the rendering context for SVG. The
+        previous context was stateless before, which means the cleanup phase
+        needed to do a lot of checks to revert the initialization part and
+        was unaware of failed inititalization. Future code can also add
+        new local variables to the context.
+
+        This patch add a new SVGRenderingContext class, and moves there the context
+        initialization / cleanup code from SVGRenderSupport. All build systems were
+        updated.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/svg/RenderSVGAllInOne.cpp:
+        * rendering/svg/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        * rendering/svg/RenderSVGForeignObject.cpp:
+        (WebCore::RenderSVGForeignObject::paint):
+        * rendering/svg/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paintReplaced):
+        * rendering/svg/RenderSVGShape.cpp:
+        (WebCore::RenderSVGShape::paint):
+        * rendering/svg/SVGInlineFlowBox.cpp:
+        (WebCore::SVGInlineFlowBox::paint):
+        * rendering/svg/SVGRenderSupport.cpp:
+        * rendering/svg/SVGRenderSupport.h:
+        * rendering/svg/SVGRenderingContext.cpp: Added.
+        (WebCore):
+        (WebCore::isRenderingMaskImage):
+        (WebCore::SVGRenderingContext::~SVGRenderingContext):
+        (WebCore::SVGRenderingContext::prepareToRenderSVGContent):
+        * rendering/svg/SVGRenderingContext.h: Added.
+        (WebCore):
+        (SVGRenderingContext):
+        (WebCore::SVGRenderingContext::SVGRenderingContext):
+        (WebCore::SVGRenderingContext::isRenderingPrepared):
+        * rendering/svg/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::paint):
+
+2012-03-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110191, r110202, and r110279.
+        http://trac.webkit.org/changeset/110191
+        http://trac.webkit.org/changeset/110202
+        http://trac.webkit.org/changeset/110279
+        https://bugs.webkit.org/show_bug.cgi?id=80694
+
+        They broke !ENABLE(INSPECTOR) builds (Requested by Ossy on
+        #webkit).
+
+        * WebCore.exp.in:
+        * testing/Internals.cpp:
+        * testing/Internals.h:
+        (WebCore):
+        (Internals):
+        * testing/Internals.idl:
+
+2012-03-09  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: add SpeechGrammar and SpeechGrammarList
+        https://bugs.webkit.org/show_bug.cgi?id=80417
+
+        Reviewed by Adam Barth.
+
+        Implement SpeechGrammar and SpeechGrammarList.
+        (Spec: http://speech-javascript-api-spec.googlecode.com/git/speechapi.html)
+
+        Test: fast/speech/scripted/speechgrammar-basics.html
+
+        * Modules/speech/DOMWindowSpeech.idl:
+        * Modules/speech/SpeechGrammar.cpp:
+        (WebCore):
+        (WebCore::SpeechGrammar::create):
+        (WebCore::SpeechGrammar::SpeechGrammar):
+        * Modules/speech/SpeechGrammar.h:
+        (WebCore):
+        (SpeechGrammar):
+        (WebCore::SpeechGrammar::src):
+        (WebCore::SpeechGrammar::setSrc):
+        (WebCore::SpeechGrammar::weight):
+        (WebCore::SpeechGrammar::setWeight):
+        * Modules/speech/SpeechGrammar.idl:
+        * Modules/speech/SpeechGrammarList.cpp:
+        (WebCore):
+        (WebCore::SpeechGrammarList::create):
+        (WebCore::SpeechGrammarList::item):
+        (WebCore::SpeechGrammarList::addFromUri):
+        (WebCore::SpeechGrammarList::addFromString):
+        (WebCore::SpeechGrammarList::SpeechGrammarList):
+        * Modules/speech/SpeechGrammarList.h:
+        (WebCore):
+        (SpeechGrammarList):
+        (WebCore::SpeechGrammarList::length):
+        * Modules/speech/SpeechGrammarList.idl:
+        * WebCore.gypi:
+
+2012-03-09  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110269.
+        http://trac.webkit.org/changeset/110269
+        https://bugs.webkit.org/show_bug.cgi?id=80688
+
+        It made inspector/elements/highlight-node.html fail everywhere
+        (Requested by Ossy on #webkit).
+
+        * testing/Internals.idl:
+
+2012-03-07  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] Click in the first line of rule while editing property starts a new property
+        https://bugs.webkit.org/show_bug.cgi?id=80507
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype._checkWillCancelEditing):
+        (WebInspector.StylePropertiesSection.prototype._handleSelectorContainerClick):
+        (WebInspector.StylePropertiesSection.prototype._handleEmptySpaceClick):
+        (WebInspector.StylePropertyTreeElement.prototype.onattach):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2012-03-09  Mark Rowe  <mrowe@apple.com>
+
+        <rdar://problem/11012024> Fix the build by working around <rdar://problem/10710970>.
+
+        * platform/mac/RunLoopMac.mm:
+        (WebCore::RunLoop::stop):
+
+2012-03-09  Marja Hölttä  <marja@google.com>
+
+        FileInputType doesn't support (save|restore)FormControlState
+        https://bugs.webkit.org/show_bug.cgi?id=80145
+
+        Reviewed by Kent Tamura.
+
+        This enables saving and restoring the state of file upload elements in
+        unsubmitted forms.
+
+        Test: fast/forms/file/recover-file-input-in-unposted-form.html
+
+        * html/BaseCheckableInputType.cpp:
+        (WebCore::BaseCheckableInputType::restoreFormControlState): non-const
+        * html/BaseCheckableInputType.h:
+        (BaseCheckableInputType): restoreFormControlState non-const
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::saveFormControlState): save chosen files
+        (WebCore):
+        (WebCore::FileInputType::restoreFormControlState): restore chosen files
+        * html/FileInputType.h:
+        (FileInputType): overwrite (save|restore)FormControlState
+        * html/HiddenInputType.cpp:
+        (WebCore::HiddenInputType::restoreFormControlState): non-const
+        * html/HiddenInputType.h:
+        (HiddenInputType): restoreFormControlState non-const
+        * html/InputType.cpp:
+        (WebCore::InputType::restoreFormControlState): non-const
+        * html/InputType.h:
+        (InputType): restoreFormControlState non-const
+        * html/PasswordInputType.cpp:
+        (WebCore::PasswordInputType::restoreFormControlState): non-const
+        * html/PasswordInputType.h:
+        (PasswordInputType): restoreFormControlState non-const
+
+2012-03-08  Benjamin Poulain  <bpoulain@apple.com>
+
+        Base the access to CSSStyleDeclaration on the CSSPropertyID instead of the PropertyName
+        https://bugs.webkit.org/show_bug.cgi?id=80461
+
+        Reviewed by Geoffrey Garen.
+
+        Previously, the acces to CSS Style properties was done through a NamedGetter. This caused
+        the (slow) mapping between CSSPropertyName and CSSPropertyID to be done twice for every acess:
+        1) canGetItemsForName() prior to the definition of the slot.
+        2) nameGetter() called from the slot with CSSPropertyName to get the actual value.
+
+        This patch changes the access to be based on CSSPropertyID. The slot is defined with the
+        CSSPropertyID as the customIndex, and the value can be accessed directly when the slot is
+        called.
+
+        To handle the differences create by hadPixelOrPosPrefix, two nearly identical callback are defined,
+        one for hadPixelOrPosPrefix, the other for !hadPixelOrPosPrefix.
+
+        The performance gain is about 19% when accessing CSS properties.
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::getPropertyValueFallback):
+        (WebCore::cssPropertyGetterPixelOrPosPrefix):
+        (WebCore):
+        (WebCore::cssPropertyGetterPixelOrPosPrefixCallback):
+        (WebCore::cssPropertyGetter):
+        (WebCore::cssPropertyGetterCallback):
+        (WebCore::JSCSSStyleDeclaration::getOwnPropertySlotDelegate):
+        (WebCore::JSCSSStyleDeclaration::getOwnPropertyDescriptorDelegate):
+        * css/CSSStyleDeclaration.idl:
+
+2012-03-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Fix Qt minimal build
+
+        * testing/Internals.idl:
+
+2012-03-08  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Remove dead CoreGraphics code from chromium compositor implementation
+        https://bugs.webkit.org/show_bug.cgi?id=80470
+
+        Reviewed by Adam Barth.
+
+        We haven't supported CoreGraphics as a raster backend in chromium for a few months and do not plan to do so, so
+        it's time to remove the USE(CG) #ifdefs from our compositor and just rely on USE(SKIA) being set.  This also
+        slightly simplifies how PlatformCanvas works.
+
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h:
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::createTextureUpdaterIfNeeded):
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h:
+        * platform/graphics/chromium/ImageLayerChromium.h:
+        * platform/graphics/chromium/LayerChromium.cpp:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::initialize):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        * platform/graphics/chromium/PlatformCanvas.cpp:
+        (WebCore::PlatformCanvas::createBackingCanvas):
+        (WebCore::PlatformCanvas::AutoLocker::AutoLocker):
+        (WebCore::PlatformCanvas::AutoLocker::~AutoLocker):
+        (WebCore):
+        (WebCore::PlatformCanvas::AutoLocker::pixels):
+        (WebCore::PlatformCanvas::Painter::Painter):
+        * platform/graphics/chromium/PlatformCanvas.h:
+        (WebCore):
+        (AutoLocker):
+        (Painter):
+        (PlatformCanvas):
+        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp:
+        * platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h:
+
+2012-03-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Get rid of itemTypeAttributeChanged
+        https://bugs.webkit.org/show_bug.cgi?id=80666
+
+        Reviewed by Adam Barth.
+
+        This function is unnecessay as we can invalidate m_microDataItemListCaches
+        in invalidateCachesThatDependOnAttributes as done for other node lists.
+
+        * dom/Node.cpp:
+        (WebCore::Node::invalidateNodeListsCacheAfterAttributeChanged):
+        (WebCore::NodeListsNodeData::invalidateCachesThatDependOnAttributes):
+        * dom/Node.h:
+        * dom/NodeRareData.h:
+        (NodeListsNodeData):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseAttribute):
+
+2012-03-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108616.
+        http://trac.webkit.org/changeset/108616
+        https://bugs.webkit.org/show_bug.cgi?id=80676
+
+        breaks animation on Safari welcome page (Requested by smfr on
+        #webkit).
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationController::updateAnimations):
+        * page/animation/AnimationControllerPrivate.h:
+        (AnimationControllerPrivate):
+
+2012-03-08  Benjamin Poulain  <benjamin@webkit.org>
+
+        Fix the build of WebKit with WTFURL following the removal of ForwardingHeaders/wtf
+        https://bugs.webkit.org/show_bug.cgi?id=80652
+
+        Reviewed by Eric Seidel.
+
+        The fowarding headers have been removed, we must now use the full path to the header.
+
+        * platform/KURLWTFURLImpl.h:
+
+2012-03-08  Emil A Eklund  <eae@chromium.org>
+
+        Change calcRadiiFor to IntSize
+        https://bugs.webkit.org/show_bug.cgi?id=80655
+
+        Reviewed by Simon Fraser.
+
+        Borders and RoundedRect are both represented with pixel precision. As
+        such it doesn't make sense for calcRadiiFor to use subpixel units, it
+        just adds unnecessary type conversions.
+
+        No new tests, no new functionality.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::calcRadiiFor):
+
+2012-03-08  Adrienne Walker  <enne@google.com>
+
+        [chromium] Encapsulate mask layer settings in LayerChromium
+        https://bugs.webkit.org/show_bug.cgi?id=80646
+
+        Reviewed by James Robinson.
+
+        If a WebLayer sets a mask layer, the setIsMask flag will not get set
+        properly and the mask layer will not turn off tiling. This was only
+        being set through GraphicsLayerChromium. Move this flag into
+        LayerChromium so that it always gets set.
+
+        Test: LayoutTests/compositing/
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setMaskLayer):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::setMaskLayer):
+
+2012-03-08  Tony Chang  <tony@chromium.org>
+
+        margins on flex-align: baseline are double counted
+        https://bugs.webkit.org/show_bug.cgi?id=80645
+
+        Reviewed by Ojan Vafai.
+
+        Fix a bug where we're counting the margins on baseline aligned
+        children twice. Also add some test cases to make sure we handle
+        wrap-reverse baseline alignment properly.
+
+        Tests: css3/flexbox/multiline-reverse-wrap-baseline-expected.html
+               css3/flexbox/multiline-reverse-wrap-baseline.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren):
+
+2012-03-08  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Pass setVisibility to CCLayerTreeHostImpl regardless of LRC initialization status
+        https://bugs.webkit.org/show_bug.cgi?id=80584
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::setVisible):
+        (WebCore::CCLayerTreeHost::didBecomeInvisibleOnImplThread):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::setVisible):
+        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
+
+2012-03-08  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Ensure that the cc thread animation framework continues to tick when the tab is backgrounded
+        https://bugs.webkit.org/show_bug.cgi?id=77668
+
+        Reviewed by James Robinson.
+
+        Tested in CCLayerTreeHostTestTickAnimationWhileBackgrounded
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (CCLayerTreeHostImplTimeSourceAdapter):
+        (WebCore::CCLayerTreeHostImplTimeSourceAdapter::create):
+        (WebCore::CCLayerTreeHostImplTimeSourceAdapter::~CCLayerTreeHostImplTimeSourceAdapter):
+        (WebCore::CCLayerTreeHostImplTimeSourceAdapter::onTimerTick):
+        (WebCore::CCLayerTreeHostImplTimeSourceAdapter::setActive):
+        (WebCore::CCLayerTreeHostImplTimeSourceAdapter::CCLayerTreeHostImplTimeSourceAdapter):
+        (WebCore):
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::setVisible):
+        (WebCore::CCLayerTreeHostImpl::animateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (WebCore):
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCProxy.cpp:
+        (WebCore::CCProxy::currentThread):
+        (WebCore):
+        (WebCore::CCProxy::isMainThread):
+        (WebCore::CCProxy::isImplThread):
+        (WebCore::CCProxy::setCurrentThreadIsImplThread):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+
+2012-03-08  Nico Weber  <thakis@chromium.org>
+
+        [chromium] Only build NEON files if target_arch=="arm"
+        https://bugs.webkit.org/show_bug.cgi?id=80626
+
+        Currently, webcore_arm_neon will compile a bunch of files
+        whose contents are completely ifdef'd away on non-arm, and
+        then bundle all the generated empty .o files into a useless
+        libwebcore_arm_neon.a. Don't do this.
+
+        Reviewed by Tony Chang.
+
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2012-03-08 Nima Ghanavatian <nghanavatian@rim.com>
+
+        [BlackBerry] Fix warning in PlatformTouchEventBlackBerry.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=80621
+
+        Fixes a warning seen when control reaches the end of a
+        non-void function.  Return TouchCancel in the 'default' case.
+
+        Reviewed by Rob Buis.
+
+        * platform/blackberry/PlatformTouchEventBlackBerry.cpp:
+        (WebCore::touchEventType):
+
+2012-03-08  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Using wrong scissor rect for draw culling
+        https://bugs.webkit.org/show_bug.cgi?id=80624
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::optimizeRenderPasses):
+
+2012-03-08  Andy Estes  <aestes@apple.com>
+
+        REGRESSION (r105396): Dragging an iWork document into icloud.com opens it in the Mac app instead of uploading it to icloud.com
+        https://bugs.webkit.org/show_bug.cgi?id=79443
+
+        Reviewed by Ryosuke Niwa.
+
+        icloud.com registers a drop event handler that sets display:none on the
+        file input element receiving the drop. After dispatching the drop event,
+        DragController hit tests the position under the mouse to see if it is a
+        file input element in need of receiving files. Since the file input
+        element has lost its renderer, it cannot be found by hit testing, so
+        the dropped file is never attached to the file input element, no change
+        event fires, and no upload commences. We want these things to happen
+        even if the element is no longer visible.
+
+        Since we already keep track of the file input element under the mouse
+        via m_fileInputElementUnderMouse, this additional hit test is
+        unnecessary. Use m_fileInputElementUnderMouse in concludeEditDrag()
+        when dropping files.
+
+        Test: fast/events/file-input-hidden-in-ondrop.html
+
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag): Use
+        m_fileInputElementUnderMouse instead of the element returned by hit
+        testing. Assert that m_fileInputElementUnderMouse equals the hit tested
+        element unless m_fileInputElementUnderMouse doesn't have a renderer.
+
+2012-03-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Mac build fix for micro data API.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::removeCachedMicroDataItemList):
+        * html/HTMLElement.idl:
+
+2012-03-07  Jon Lee  <jonlee@apple.com>
+
+        Support [Custom] for static functions
+        https://bugs.webkit.org/show_bug.cgi?id=80573
+
+        Reviewed by Kentaro Hara.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader): If the function is static, add static qualifier to cpp function.
+        (GenerateImplementation): Reorganize the function to split out based on the static
+        attribute, instead of checking for it at every line we output.
+            If the function is static and not custom, the listed code should be the code in
+        the rest of the function that did not have the static check. If it is custom, then
+        we check the number of arguments, and then call the static impl function directly.
+            If the function is not static, all of the "unless ($function->isStatic)" checks
+        are removed since it is not necessary.
+
+        * bindings/scripts/test/TestObj.idl: Added new test case.
+
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore):
+        (WebCore::jsTestObjConstructorFunctionClassMethod2):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (JSTestObj):
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        (-[DOMTestObj classMethod2]):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::ConfigureV8TestObjTemplate):
+        * bindings/scripts/test/V8/V8TestObj.h:
+        (V8TestObj):
+
+2012-03-08  Mark Pilgrim  <pilgrim@chromium.org>
+
+        Collapse ENABLE(BLOB)|ENABLE(FILE_SYSTEM) to just ENABLE(BLOB)
+        https://bugs.webkit.org/show_bug.cgi?id=80592
+
+        Reviewed by Adam Barth.
+
+        In anticipation of moving FILE_SYSTEM-related code to Modules/, we
+        are collapsing combination BLOB/FILE_SYSTEM ifdefs to just
+        BLOB. In other words, it is assumed from now on that you can not
+        have FILE_SYSTEM support without BLOB support.
+        
+        No new tests, all existing tests pass.
+
+        * CMakeLists.txt:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+        (WebCore):
+        (WebCore::ScriptExecutionContext::fileThread):
+        * dom/ScriptExecutionContext.h:
+        (WebCore):
+        (ScriptExecutionContext):
+        * fileapi/AsyncFileStream.cpp:
+        * fileapi/AsyncFileStream.h:
+        * fileapi/FileError.h:
+        * fileapi/FileException.cpp:
+        * fileapi/FileException.h:
+        * fileapi/FileThread.cpp:
+        * fileapi/FileThread.h:
+        * fileapi/OperationNotAllowedException.cpp:
+        * fileapi/OperationNotAllowedException.h:
+        * platform/FileStream.cpp:
+        * platform/FileStream.h:
+        * platform/FileStreamClient.h:
+        * platform/SchemeRegistry.cpp:
+        (WebCore::canDisplayOnlyIfCanRequestSchemes):
+        (WebCore::CORSEnabledSchemes):
+        (WebCore::SchemeRegistry::registerURLSchemeAsNotAllowingJavascriptURLs):
+
+2012-03-08  James Robinson  <jamesr@chromium.org>
+
+        Use an explicit attribute to signal that a context prefers to use a discrete GPU
+        https://bugs.webkit.org/show_bug.cgi?id=80639
+
+        Reviewed by Stephen White.
+
+        On platforms that support both integrated and discrete GPUs and can dynamically switch between the two, we
+        sometimes have a specific preference for a given context. Specifically, contexts used for WebGL and canvas 2d
+        acceleration should use the discrete GPU if available, but compositor contexts can run fine on an integrated
+        GPU. Instead of attempting to infer the intent from examining other context attributes, this adds an explicit
+        attribute to control this behavior.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::create):
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::Attributes::Attributes):
+        (Attributes):
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::get):
+
+2012-03-08  Andy Estes  <aestes@apple.com>
+
+        NULL renderer possible in WebCore::HTMLInputElement::setCanReceiveDroppedFiles()
+        https://bugs.webkit.org/show_bug.cgi?id=80648
+
+        Reviewed by Simon Fraser.
+
+        Test: fast/events/input-element-display-none-in-dragleave-crash.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setCanReceiveDroppedFiles): NULL-check renderer().
+
+2012-03-08  Jer Noble  <jer.noble@apple.com>
+
+        Yet another unreviewed build fix.
+
+        Remove an unneeded and Lion-defined window constant from WebCoreFullScreenWindow.
+
+        * platform/mac/WebCoreFullScreenWindow.mm:
+        (-[WebCoreFullScreenWindow initWithContentRect:styleMask:backing:defer:]):
+
+2012-03-08  Levi Weintraub  <leviw@chromium.org>
+
+        Switch absoluteRects, culledInlineAbsoluteRects, absoluteBoundingBoxRect, and addFocusRingRects back to integers
+        https://bugs.webkit.org/show_bug.cgi?id=80545
+
+        Reviewed by Simon Fraser.
+
+        Converting the above functions, all of which return rects that represent on-screen rects, to IntRects from
+        LayoutRects.
+
+        addFocusRingsRects generates a vector of rects that is handed off directly to the GraphicsContext to be
+        drawn. Snapping the rects before adding them to the vector saves an extra pass through the vector.
+
+        absoluteRects and culledInlineAbsoluteRects are only used by addFocusRingRects, hasNonEmptyBoundingBox (only
+        to check if they're empty), and absoluteBoundingBoxRect, which is exposed from WebCore and thus should be an
+        IntRect anyways.
+
+        No new tests. No change in behavior.
+
+        * dom/Node.cpp:
+        (WebCore::Node::hasNonEmptyBoundingBox):
+        * dom/Range.cpp:
+        (WebCore::Range::boundingBox):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::absoluteRects):
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::culledInlineAbsoluteRects):
+        (WebCore::RenderInline::addFocusRingRects):
+        * rendering/RenderInline.h:
+        (RenderInline):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::addFocusRingRects):
+        * rendering/RenderListBox.h:
+        (RenderListBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::paintFocusRing):
+        (WebCore::RenderObject::absoluteBoundingBoxRect):
+        (WebCore::RenderObject::absoluteFocusRingQuads):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::absoluteRects):
+        (RenderObject):
+        (WebCore::RenderObject::absoluteBoundingBoxRectIgnoringTransforms):
+        (WebCore::RenderObject::addFocusRingRects):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::absoluteRects):
+        (WebCore::RenderText::absoluteRectsForRange):
+        * rendering/RenderText.h:
+        (RenderText):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::addFocusRingRects):
+        * rendering/RenderTextControl.h:
+        (RenderTextControl):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::absoluteRects):
+        * rendering/RenderView.h:
+        (RenderView):
+        * rendering/svg/RenderSVGBlock.cpp:
+        (WebCore::RenderSVGBlock::absoluteRects):
+        * rendering/svg/RenderSVGBlock.h:
+        (RenderSVGBlock):
+        * rendering/svg/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::addFocusRingRects):
+        * rendering/svg/RenderSVGContainer.h:
+        (RenderSVGContainer):
+        * rendering/svg/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::addFocusRingRects):
+        * rendering/svg/RenderSVGImage.h:
+        (RenderSVGImage):
+        * rendering/svg/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::absoluteRects):
+        * rendering/svg/RenderSVGModelObject.h:
+        (RenderSVGModelObject):
+        * rendering/svg/RenderSVGShape.cpp:
+        (WebCore::RenderSVGShape::addFocusRingRects):
+        * rendering/svg/RenderSVGShape.h:
+        (RenderSVGShape):
+
+2012-03-08  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Use EventNames instead of strings
+        https://bugs.webkit.org/show_bug.cgi?id=80649
+
+        Reviewed by Ojan Vafai.
+
+        No new tests. Covered by existing tests.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+
+2012-03-08  Tim Horton  <timothy_horton@apple.com>
+
+        No-op filter changes color output because of colorspace issues
+        https://bugs.webkit.org/show_bug.cgi?id=72411
+        <rdar://problem/10588374>
+
+        Reviewed by Dean Jackson.
+
+        Redefine "linear RGB" color space on Mac to mean linearized sRGB, instead of linear
+        Generic RGB. This makes existing CG color matching equivalent to what other ports do via
+        ImageBuffer::transformColorSpace (which only adjusts gamma, as we will now). Previously,
+        we were also causing actual (non-gamma) color adjustments which were not reversible.
+
+        No new tests, covered by all existing SVG and CSS filter tests.
+
+        * Resources/linearSRGB.icc: Added.
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::linearRGBColorSpaceRef):
+
+2012-03-08  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=80463
+        RenderImage is using the wrong origin when calling addRelevantRepaintedObject
+        -and corresponding-
+        <rdar://problem/10970221>
+
+        Reviewed by Dan Bernstein.
+
+        Use the exact same rect that we paint with instead of the 
+        visualOverflowRect() which does not always have a correct x and y.
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::paintReplaced):
+
+2012-03-08  Jer Noble  <jer.noble@apple.com>
+
+        Full Screen Refactor Part 3: Animate into Full Screen mode using new animation classes.
+        https://bugs.webkit.org/show_bug.cgi?id=78928
+
+        Reviewed by Anders Carlsson.
+
+        Move WKFullScreenWindow from WebKit2 into WebCore to be shared by WebKit2 and WebKit.
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/mac/WebCoreFullScreenWindow.h:
+        * platform/mac/WebCoreFullScreenWindow.mm:
+
+        Add symbols for the following classes and functions to the export list:
+            WebCoreFullScreenWindow
+            WebWindowScaleAnimation
+            WebWindowFadeAnimation
+            ScrollView::contentsToScreen()
+            RenderObject::localToContainerQuad()
+            Document::setAnimatingFullScreen()
+        * WebCore.exp.in:
+
+2012-03-08  Jer Noble  <jer.noble@apple.com>
+
+        Full Screen Refactor Part 1: Remove special-case rendering code for Full Screen animation.
+        https://bugs.webkit.org/show_bug.cgi?id=78925
+
+        Reviewed by John Sullivan.
+
+        No new tests; no net change in functionality so covered by existing tests.
+
+        The following functions had special case code for rendering full-screen elements removed:
+        * dom/Document.cpp:
+        (WebCore::Document::webkitWillEnterFullScreenForElement):
+        (WebCore::Document::webkitDidEnterFullScreenForElement):
+        (WebCore::Document::webkitWillExitFullScreenForElement):
+        (WebCore::Document::webkitDidExitFullScreenForElement):
+        (WebCore::Document::setAnimatingFullScreen):
+        * page/FrameView.cpp:
+        (WebCore):
+        (WebCore::FrameView::updateCompositingLayers):
+        (WebCore::FrameView::syncCompositingStateForThisFrame):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::layerOrAncestorIsTransformed):
+        (WebCore::RenderLayerBacking::updateCompositedBounds):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        * rendering/RenderLayerCompositor.h:
+
+2012-03-08  Matt Lilek  <mrl@apple.com>
+
+        Don't enable VIDEO_TRACK on all OS X platforms
+        https://bugs.webkit.org/show_bug.cgi?id=80635
+
+        Reviewed by Eric Carlson.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2012-03-08  Tony Chang  <tony@chromium.org>
+
+        implement flexbox wrap-reverse
+        https://bugs.webkit.org/show_bug.cgi?id=80552
+
+        Reviewed by Ojan Vafai.
+
+        No new tests, but additional coverage in:
+            css3/flexbox/multiline-align.html
+            css3/flexbox/multiline-pack.html
+            css3/flexbox/multiline.html
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::WrapReverseContext::WrapReverseContext): Helper struct to hold information needed for reversing
+        the order of lines.
+        (RenderFlexibleBox::WrapReverseContext):
+        (WebCore::RenderFlexibleBox::WrapReverseContext::addCrossAxisOffset):
+        (WebCore::RenderFlexibleBox::WrapReverseContext::addNumberOfChildrenOnLine):
+        (WebCore::RenderFlexibleBox::WrapReverseContext::lineCrossAxisDelta): Computes the number of pixels to move a line.
+        (WebCore):
+        (WebCore::RenderFlexibleBox::layoutFlexItems): Call flipForWrapReverse if needed. This happens
+        before flipForRightToLeftColumn because otherwise the crossAxisOffsets will be wrong.
+        (WebCore::flexAlignForChild):
+        (WebCore::RenderFlexibleBox::alignChildren): Flip alignment in wrap-reverse because the cross directions are flipped.
+        (WebCore::RenderFlexibleBox::flipForWrapReverse): Flip each line.
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+
+2012-03-08  Adam Klein  <adamk@chromium.org>
+
+        Remove InDocumentFlag manipulation methods from Node interface
+        https://bugs.webkit.org/show_bug.cgi?id=80612
+
+        Reviewed by Ryosuke Niwa.
+
+        This is a first step towards tightening up Node::inDocument() to match
+        the actual in-document-tree state (see r108152 for the sort of bug
+        resulting from those not matching).
+
+        No new tests, refactoring only.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removedFromDocument): Remove duplicate call to clearInDocument:
+        the call to Node::removedFromDocument three lines above will clear the flag.
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Call ContainerNode constructor with InDocumentFlag always set
+        instead of calling setInDocument.
+        * dom/Node.cpp:
+        (WebCore::Node::insertedIntoDocument): Inline setInDocument (now the only caller).
+        (WebCore::Node::removedFromDocument): Inline clearInDocument (now the only caller).
+        * dom/Node.h: Remove setInDocument & clearInDocument, add new CreateDocument ConstructionType.
+
+2012-03-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Try to fix the Snow Leopard build
+
+        If the build is running under sh, echo -n does not empty the file.
+
+        * DerivedSources.pri:
+
+2012-03-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Prospective build fix for Qt minimal after r110191
+
+        https://bugs.webkit.org/show_bug.cgi?id=80338
+
+        * testing/Internals.cpp:
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+
+2012-03-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Prospective Windows build fix
+
+        Don't assume that windows-builds will always run inside a cmd.exe shell.
+
+        * DerivedSources.pri:
+
+2012-03-08  Vivek Galatage  <vivekgalatage@gmail.com>
+
+        Web Inspector: Creating a selector for class names with trailing spaces results with two dots instead of one
+        https://bugs.webkit.org/show_bug.cgi?id=80529
+
+        Trim the className before replacing the whitespaces with dot "."
+
+        Reviewed by Pavel Feldman.
+
+        No new tests.
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype.appropriateSelectorFor):
+
+2012-03-08  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10981173> Dashboard regions should not be in device space
+
+        Reviewed by John Sullivan.
+
+        Test: TestWebKitAPI/Tests/mac/DeviceScaleFactorInDashboardRegions.mm
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addDashboardRegions): Stop applying the device scale factor to
+        Dashboard regions.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::addDashboardRegions): Ditto.
+
+2012-03-08  Cem Kocagil  <cem.kocagil@gmail.com>
+
+        Web Inspector: Cannot insert right curly bracket on some keyboards
+        https://bugs.webkit.org/show_bug.cgi?id=80474
+
+        Make sure other modifiers are not pressed
+
+        Reviewed by Pavel Feldman
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2012-03-08  Max Vujovic  <mvujovic@adobe.com>
+
+        Add a method to window.internals to enable testing of inspector highlight rects
+        https://bugs.webkit.org/show_bug.cgi?id=80338
+
+        Reviewed by Pavel Feldman.
+
+        Add window.internals.inspectorHighlightRects, a method which makes it possible to test the
+        positions and sizes of inspector highlight rects.
+
+        Test: inspector/elements/highlight-node.html
+
+        * WebCore.exp.in: Export symbols.
+        * testing/Internals.cpp:
+        (WebCore::Internals::inspectorHighlightRects): Call InspectorController::getHighlight and
+        return the highlight's quads as a ClientRectList.
+        (WebCore):
+        * testing/Internals.h:
+        (WebCore):
+        (Internals):
+        * testing/Internals.idl:
+
+            Add inspectorHighlightRects to the window.internals interface.
+
+2012-03-08  Antti Koivisto  <antti@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=80370
+        Enable matched declaration caching for elements with a style attribute
+
+        Reviewed by Andreas Kling
+
+        Make the property set for style attribute immutable as long as there is no CSSOM
+        wrapper for it. If the style attribute changes we create a new property set instead
+        of recycling the old one. This way the property sets can be made cacheable as long
+        as there is no CSSOM wrapper that would allow uncontrolled modifications. Constructing
+        the wrapper disables caching.
+        
+        Made StyledElement::inlineStyle() and StyledElement::ensureInlineStyle() return a const
+        StylePropertySet so making accidental modifications difficult. Also dropped *Decl from
+        the names.
+        
+        Fixed two unrelated bugs that this exposed.
+
+        * css/CSSStyleSelector.cpp:
+        
+            Don't allow caching of document element style if writingModeSetOnDocumentElement() bit is set.
+            Tested by fast/multicol/vertical-rl/break-properties.html.
+        
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/StylePropertySet.h:
+        (StylePropertySet):
+        (WebCore::StylePropertySet::hasCSSOMWrapper):
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        
+            Invalidate the matched properties cache if the document has rem units and the root font changes.
+            Tested by fast/css/rem-dynamic-scaling.html.
+        
+        * dom/ElementAttributeData.cpp:
+        (WebCore):
+        (WebCore::ElementAttributeData::ensureInlineStyle):
+        (WebCore::ElementAttributeData::ensureMutableInlineStyle):
+        (WebCore::ElementAttributeData::updateInlineStyleAvoidingMutation):
+        (WebCore::ElementAttributeData::destroyInlineStyle):
+        * dom/ElementAttributeData.h:
+        (WebCore::ElementAttributeData::inlineStyle):
+        (ElementAttributeData):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::updateStyleAttribute):
+        (WebCore::StyledElement::~StyledElement):
+        (WebCore):
+        (WebCore::StyledElement::style):
+        (WebCore::StyledElement::parseAttribute):
+        (WebCore::StyledElement::setInlineStyleProperty):
+        (WebCore::StyledElement::removeInlineStyleProperty):
+        (WebCore::StyledElement::addSubresourceAttributeURLs):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::inlineStyle):
+        (WebCore::StyledElement::ensureInlineStyle):
+        (StyledElement):
+        (WebCore::StyledElement::destroyInlineStyle):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::hasNoAttributeOrOnlyStyleAttribute):
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock):
+        (WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange):
+        (WebCore::ApplyStyleCommand::removeCSSStyle):
+        (WebCore::ApplyStyleCommand::applyInlineStyleToPushDown):
+        (WebCore::ApplyStyleCommand::addBlockStyle):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+        * editing/EditingStyle.cpp:
+        (WebCore::HTMLElementEquivalent::propertyExistsInStyle):
+        (HTMLTextDecorationEquivalent):
+        (WebCore::HTMLTextDecorationEquivalent::propertyExistsInStyle):
+        (WebCore::EditingStyle::conflictsWithInlineStyleOfElement):
+        (WebCore::EditingStyle::elementIsStyledSpanOrHTMLEquivalent):
+        (WebCore::EditingStyle::mergeInlineStyleOfElement):
+        (WebCore::elementMatchesAndPropertyIsNotInInlineStyleDecl):
+        (WebCore::EditingStyle::mergeStyle):
+        * editing/EditingStyle.h:
+        (EditingStyle):
+        * editing/RemoveCSSPropertyCommand.cpp:
+        (WebCore::RemoveCSSPropertyCommand::doApply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline):
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans):
+        * editing/markup.cpp:
+        (WebCore::StyledMarkupAccumulator::appendElement):
+        (WebCore::styleFromMatchedRulesAndInlineDecl):
+        * html/HTMLElement.cpp:
+        (WebCore::StyledElement::copyNonAttributeProperties):
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::currentColor):
+        * page/PageSerializer.cpp:
+        (WebCore::PageSerializer::serializeFrame):
+        (WebCore::PageSerializer::retrieveResourcesForProperties):
+        * page/PageSerializer.h:
+        (PageSerializer):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::isEmptyOrUnstyledAppleStyleSpan):
+
+2012-03-08  Scott Byer  <scottbyer@chromium.org>
+
+        Have ScrollAnimatorNone use requestAnimationFrame
+        https://bugs.webkit.org/show_bug.cgi?id=78938
+
+        Reviewed by James Robinson.
+
+        No new tests. Passes Chromium webkit_unit_tests.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::serviceScriptedAnimations):
+        * platform/ScrollAnimator.h:
+        (WebCore::ScrollAnimator::serviceScrollAnimations):
+        * platform/ScrollAnimatorNone.cpp:
+        (WebCore::ScrollAnimatorNone::ScrollAnimatorNone):
+        (WebCore::ScrollAnimatorNone::scroll):
+        (WebCore::ScrollAnimatorNone::cancelAnimations):
+        (WebCore):
+        (WebCore::ScrollAnimatorNone::serviceScrollAnimations):
+        (WebCore::ScrollAnimatorNone::animationTimerFired):
+        (WebCore::ScrollAnimatorNone::startNextTimer):
+        (WebCore::ScrollAnimatorNone::animationTimerActive):
+        (WebCore::ScrollAnimatorNone::stopAnimationTimerIfNeeded):
+        * platform/ScrollAnimatorNone.h:
+        (ScrollAnimatorNone):
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::serviceScrollAnimations):
+        (WebCore):
+        * platform/ScrollableArea.h:
+        (WebCore):
+        (ScrollableArea):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hostWindow):
+        (RenderLayer):
+        * rendering/RenderListBox.h:
+        (WebCore::RenderListBox::hostWindow):
+        (RenderListBox):
+
+2012-03-08  Dan Bernstein  <mitz@apple.com>
+
+        REGRESSION (r109964): Assertion failure (!isUndefined()) in Length::getIntValue() when a Dashboard region is specified without offsets
+        https://bugs.webkit.org/show_bug.cgi?id=80614
+
+        Reviewed by Beth Dakin.
+
+        Test: fast/css/dashboard-regions-undefined-length-assertion.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList): Reverted to setting zero lengths,
+        rather than Undefined ones, in the RenderStyle when offsets are not given.
+
+2012-03-08  Mikkel Kruse Johnsen  <mikkel@linet.dk>
+
+        WebKitGtk+ fails to build on win32 against GTK3
+        https://bugs.webkit.org/show_bug.cgi?id=63919
+
+        Reviewed by Gustavo Noronha Silva.
+
+        * plugins/gtk/PluginViewGtk.cpp: Don't use gtk_socket_new with GTK3 on Win32
+        (WebCore::PluginView::platformStart):
+
+2012-03-08  Jason Liu  <jason.liu@torchmobile.com.cn>
+
+        [BlackBerry]New feature: support about:cookie for internal build.
+        https://bugs.webkit.org/show_bug.cgi?id=80367
+
+        Reviewed by Antonio Gomes.
+
+        No new tests.
+
+        * platform/blackberry/CookieManager.cpp:
+        (WebCore::CookieManager::generateHtmlFragmentForCookies):
+        (WebCore):
+        * platform/blackberry/CookieManager.h:
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::handleAbout):
+
+2012-03-08  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Make elements with attributes smaller by eliminating the m_element back pointer in NamedNodeMap
+        https://bugs.webkit.org/show_bug.cgi?id=75069
+
+        Reviewed by Ryosuke Niwa.
+
+        NamedNodeMap is an exposed DOM representation of an element's attribute storage. As part of
+        its implementation it keeps a pointer to its associated Element plus all the attribute
+        storage.
+
+        This commit separate the two things: NamedNodeMap is now a wrapper to Element, containing
+        only the pointer, and the attribute storage is now owned by Element directly. Since usage
+        of NamedNodeMap is not very common, it can be stored in ElementRareData. As a result, most
+        elements with attributes now don't need to allocate memory for that extra pointer in
+        NamedNodeMap.
+
+        One consequence of this implementation is that now we explicitly don't support
+        DocumentType.notations and DocumentType.entities. They weren't supported before, a
+        NamedNodeMap was never created for those attributes -- and some NamedNodeMap functions
+        wouldn't work correctly without an associated Element.
+
+        NamedNodeMap itself was cleaned up, as well as unnecessary references to it removed in the
+        code and comments.
+
+        No new tests and should not change results for existing tests.
+
+        * dom/Attribute.h:
+        (WebCore):
+        * dom/DocumentType.h:
+        (DocumentType): Point out that we don't support does attributes yet.
+        * dom/Element.cpp:
+        (WebCore::Element::~Element): Detaching the NamedNodeMap is no longer necessary because it
+        will be destroyed. We still detach the potential Attrs inside our Attributes by using
+        clearAttributes().
+        (WebCore::Element::attributes): Looks in ElementRareData now. Note we ensure the creation
+        of the attribute storage.
+        (WebCore):
+        (WebCore::Element::getAttribute):
+        (WebCore::Element::setAttributeInternal):
+        (WebCore::Element::parserSetAttributes):
+        (WebCore::Element::hasAttributes):
+        (WebCore::Element::createAttributeData):
+        (WebCore::Element::insertedIntoDocument):
+        (WebCore::Element::removedFromDocument):
+        (WebCore::Element::getURLAttribute):
+        (WebCore::Element::getNonEmptyURLAttribute):
+        (WebCore::Element::hasNamedNodeMap): Helper function for Node::dumpStatistics().
+        * dom/Element.h:
+        (Element):
+        (WebCore::Element::attributeData):
+        (WebCore::Element::ensureAttributeData):
+        (WebCore::Element::fastHasAttribute):
+        (WebCore::Element::fastGetAttribute):
+        (WebCore::Element::hasAttributesWithoutUpdate):
+        (WebCore::Element::idForStyleResolution):
+        (WebCore::Element::attributeCount):
+        (WebCore::Element::attributeItem):
+        (WebCore::Element::getAttributeItem):
+        * dom/ElementAttributeData.h:
+        (WebCore::ElementAttributeData::create):
+        (ElementAttributeData):
+        * dom/ElementRareData.h:
+        (ElementRareData):
+        * dom/NamedNodeMap.cpp: Rewriting now that m_attributeData is not a member, using m_element
+        methods when possible.
+        (WebCore::NamedNodeMap::ref):
+        (WebCore::NamedNodeMap::deref):
+        (WebCore::NamedNodeMap::getNamedItem):
+        (WebCore::NamedNodeMap::getNamedItemNS):
+        (WebCore::NamedNodeMap::removeNamedItem):
+        (WebCore::NamedNodeMap::removeNamedItemNS):
+        (WebCore::NamedNodeMap::setNamedItem):
+        (WebCore::NamedNodeMap::item):
+        (WebCore::NamedNodeMap::length):
+        * dom/NamedNodeMap.h:
+        (WebCore):
+        (WebCore::NamedNodeMap::create):
+        (NamedNodeMap):
+        (WebCore::NamedNodeMap::NamedNodeMap): Instead of asserting m_element in every function, we
+        now assert only in the constructor.
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics): Add a counter for elements with rare data, this allows us
+        compare more clearly the impact of moving NamedNodeMap there.
+        (WebCore::Node::isEqualNode): Remove use of mapsEquivalent(). It was dead code, because
+        both entities and notations were always NULL.
+        (WebCore::Node::compareDocumentPosition):
+        * inspector/DOMPatchSupport.h:
+        (WebCore):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::attributeChanged):
+
+2012-03-08  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream WebGL related files from platform/graphics
+        https://bugs.webkit.org/show_bug.cgi?id=79876
+
+        Reviewed by Rob Buis.
+
+        Initial upstream, no new tests.
+
+        * platform/graphics/blackberry/DrawingBufferBlackBerry.cpp: Added.
+        (WebCore):
+        (DrawingBufferInternal):
+        (WebCore::generateColorTexture):
+        (WebCore::DrawingBuffer::DrawingBuffer):
+        (WebCore::DrawingBuffer::~DrawingBuffer):
+        (WebCore::DrawingBuffer::publishToPlatformLayer):
+        (WebCore::DrawingBuffer::reset):
+        (WebCore::DrawingBuffer::platformLayer):
+        * platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::paintsIntoCanvasBuffer):
+        (WebCore::GraphicsContext3D::makeContextCurrent):
+        (WebCore::GraphicsContext3D::isGLES2Compliant):
+        (WebCore::GraphicsContext3D::isGLES2NPOTStrict):
+        (WebCore::GraphicsContext3D::isErrorGeneratedOnOutOfBoundsAccesses):
+        (WebCore::GraphicsContext3D::platformTexture):
+        (WebCore::GraphicsContext3D::platformLayer):
+        (WebCore::GraphicsContext3D::paintToCanvas):
+        (WebCore::GraphicsContext3D::setContextLostCallback):
+        * platform/graphics/blackberry/WebGLLayerWebKitThread.cpp: Added.
+        (WebCore):
+        (WebCore::WebGLLayerWebKitThread::WebGLLayerWebKitThread):
+        (WebCore::WebGLLayerWebKitThread::~WebGLLayerWebKitThread):
+        (WebCore::WebGLLayerWebKitThread::setNeedsDisplay):
+        (WebCore::WebGLLayerWebKitThread::updateTextureContentsIfNeeded):
+        * platform/graphics/blackberry/WebGLLayerWebKitThread.h: Added.
+        (WebCore):
+        (WebGLLayerWebKitThread):
+        (WebCore::WebGLLayerWebKitThread::create):
+        (WebCore::WebGLLayerWebKitThread::setWebGLContext):
+
+2012-03-08  Yong Li  <yoli@rim.com>
+
+        [BlackBerry] LayerRender should turn off stencil/scissor after drawing layers
+        https://bugs.webkit.org/show_bug.cgi?id=80598
+
+        Reviewed by Rob Buis.
+
+        Turn off stencil/scissor after using them to avoid affecting later GL operation
+        accidentally.
+
+        * platform/graphics/blackberry/LayerRenderer.cpp:
+        (WebCore::LayerRenderer::drawLayers):
+
+2012-03-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Windows build fix.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * DerivedSources.pri: Replace commandline that is too long for Windows with
+        separate lines to be executed in the Makefile for the IDL preprocessing.
+
+2012-03-08  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: The function had to return a hash but it returned just address.
+        https://bugs.webkit.org/show_bug.cgi?id=80591
+
+        Reviewed by Yury Semikhatsky.
+
+        * bindings/v8/RetainedDOMInfo.cpp:
+        (WebCore::RetainedDOMInfo::GetHash):
+
+2012-03-08  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed single line fix. The function had to return a hash but it returned just address.
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::UnspecifiedGroup::GetHash):
+
+2012-03-08  Shinya Kawanaka  <shinyak@chromium.org>
+
+        <shadow> should be rendered correctly.
+        https://bugs.webkit.org/show_bug.cgi?id=78596
+
+        Reviewed by Hajime Morita.
+
+        This patch supports <shadow> element rendering.
+
+        When attaching <shadow> element, if it is in the oldest shadow tree, it runs a part of
+        distribution algorithm. If it is in non-oldest shadow tree, it runs tree a part of
+        tree composition algorithm to assign a older shadow root. In this patch, InsertionPonit
+        try to treat the distributed host children and the assigned shadow children similarly.
+
+        NodeRenderingContext supports rendering <shadow> element. Since the assigned shadow children
+        are treated like distributed host children, that change is to consider non-youngest shadow
+        tree basically also.
+
+        Tests: fast/dom/shadow/shadow-element-rendering-multiple.html
+               fast/dom/shadow/shadow-element-rendering-single.html
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore):
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+          Does not ignore non-youngest shadow tree.
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::ShadowRoot):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        (WebCore::ShadowRoot::assignedTo):
+        (WebCore):
+        (WebCore::ShadowRoot::setAssignedTo):
+        (WebCore::ShadowRoot::isUsedForRendering):
+          Returns true if ShadowRoot is youngest or assigned to some InsertionPoint.
+        (WebCore::toShadowRoot):
+        * dom/ShadowTree.cpp:
+        (WebCore::ShadowTree::insertionPointFor):
+          Returns InsertionPoint to which node is distributed.
+        * dom/ShadowTree.h:
+        (ShadowTree):
+        * html/shadow/HTMLContentElement.h:
+        (WebCore::HTMLContentElement::doesSelectFromHostChildren):
+        (HTMLContentElement):
+        * html/shadow/HTMLShadowElement.cpp:
+        (WebCore::HTMLShadowElement::HTMLShadowElement):
+        (WebCore::HTMLShadowElement::select):
+        (WebCore::HTMLShadowElement::doesSelectFromHostChildren):
+        (WebCore):
+        * html/shadow/HTMLShadowElement.h:
+        (HTMLShadowElement):
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::attach):
+        (WebCore::InsertionPoint::detach):
+        (WebCore::InsertionPoint::assignedFrom):
+        (WebCore):
+        (WebCore::InsertionPoint::assignShadowRoot):
+        (WebCore::InsertionPoint::clearAssignment):
+        * html/shadow/InsertionPoint.h:
+        (InsertionPoint):
+
+2012-03-06  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: SpeechRecognitionAlternative, Result and ResultList
+        https://bugs.webkit.org/show_bug.cgi?id=80424
+
+        Reviewed by Adam Barth.
+
+        Implement the SpeechRecognitionAlternative,
+        SpeechRecognitionResult and SpeechRecognitionResultList.
+        (Spec: http://speech-javascript-api-spec.googlecode.com/git/speechapi.html)
+
+        No new tests because these interfaces don't have constructors.
+        They will be tested as more of the API gets implemented.
+
+        * Modules/speech/SpeechRecognitionAlternative.cpp: Added.
+        (WebCore):
+        (WebCore::SpeechRecognitionAlternative::create):
+        (WebCore::SpeechRecognitionAlternative::SpeechRecognitionAlternative):
+        * Modules/speech/SpeechRecognitionAlternative.h: Added.
+        (WebCore):
+        (SpeechRecognitionAlternative):
+        (WebCore::SpeechRecognitionAlternative::transcript):
+        (WebCore::SpeechRecognitionAlternative::confidence):
+        * Modules/speech/SpeechRecognitionAlternative.idl: Added.
+        * Modules/speech/SpeechRecognitionResult.cpp: Added.
+        (WebCore):
+        (WebCore::SpeechRecognitionResult::create):
+        (WebCore::SpeechRecognitionResult::item):
+        (WebCore::SpeechRecognitionResult::SpeechRecognitionResult):
+        * Modules/speech/SpeechRecognitionResult.h: Added.
+        (WebCore):
+        (SpeechRecognitionResult):
+        (WebCore::SpeechRecognitionResult::length):
+        (WebCore::SpeechRecognitionResult::final):
+        * Modules/speech/SpeechRecognitionResult.idl: Added.
+        * Modules/speech/SpeechRecognitionResultList.cpp: Added.
+        (WebCore):
+        (WebCore::SpeechRecognitionResultList::create):
+        (WebCore::SpeechRecognitionResultList::item):
+        (WebCore::SpeechRecognitionResultList::SpeechRecognitionResultList):
+        * Modules/speech/SpeechRecognitionResultList.h: Added.
+        (WebCore):
+        (SpeechRecognitionResultList):
+        (WebCore::SpeechRecognitionResultList::length):
+        * Modules/speech/SpeechRecognitionResultList.idl: Added.
+        * WebCore.gypi:
+
+2012-03-08  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream GraphicsLayerBlackBerry.{h, cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=79867
+
+        Reviewed by Rob Buis.
+
+        Initial upstream, no new tests.
+
+        * platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::setLayerBorderColor):
+        (WebCore::clearBorderColor):
+        (WebCore::setLayerBackgroundColor):
+        (WebCore::clearLayerBackgroundColor):
+        (WebCore::GraphicsLayer::create):
+        (WebCore::GraphicsLayerBlackBerry::GraphicsLayerBlackBerry):
+        (WebCore::GraphicsLayerBlackBerry::~GraphicsLayerBlackBerry):
+        (WebCore::GraphicsLayerBlackBerry::setName):
+        (WebCore::GraphicsLayerBlackBerry::setChildren):
+        (WebCore::GraphicsLayerBlackBerry::addChild):
+        (WebCore::GraphicsLayerBlackBerry::addChildAtIndex):
+        (WebCore::GraphicsLayerBlackBerry::addChildBelow):
+        (WebCore::GraphicsLayerBlackBerry::addChildAbove):
+        (WebCore::GraphicsLayerBlackBerry::replaceChild):
+        (WebCore::GraphicsLayerBlackBerry::removeFromParent):
+        (WebCore::GraphicsLayerBlackBerry::setPosition):
+        (WebCore::GraphicsLayerBlackBerry::setAnchorPoint):
+        (WebCore::GraphicsLayerBlackBerry::setSize):
+        (WebCore::GraphicsLayerBlackBerry::setTransform):
+        (WebCore::GraphicsLayerBlackBerry::setChildrenTransform):
+        (WebCore::GraphicsLayerBlackBerry::setPreserves3D):
+        (WebCore::GraphicsLayerBlackBerry::setMasksToBounds):
+        (WebCore::GraphicsLayerBlackBerry::setDrawsContent):
+        (WebCore::GraphicsLayerBlackBerry::setContentsVisible):
+        (WebCore::GraphicsLayerBlackBerry::setMaskLayer):
+        (WebCore::GraphicsLayerBlackBerry::setReplicatedByLayer):
+        (WebCore::GraphicsLayerBlackBerry::setFixedPosition):
+        (WebCore::GraphicsLayerBlackBerry::setHasFixedContainer):
+        (WebCore::GraphicsLayerBlackBerry::setHasFixedAncestorInDOMTree):
+        (WebCore::GraphicsLayerBlackBerry::setBackgroundColor):
+        (WebCore::GraphicsLayerBlackBerry::clearBackgroundColor):
+        (WebCore::GraphicsLayerBlackBerry::setContentsOpaque):
+        (WebCore::GraphicsLayerBlackBerry::setBackfaceVisibility):
+        (WebCore::GraphicsLayerBlackBerry::setOpacity):
+        (WebCore::GraphicsLayerBlackBerry::setContentsNeedsDisplay):
+        (WebCore::GraphicsLayerBlackBerry::setNeedsDisplay):
+        (WebCore::GraphicsLayerBlackBerry::setNeedsDisplayInRect):
+        (WebCore::GraphicsLayerBlackBerry::setContentsRect):
+        (WebCore::removeAnimationByIdAndProperty):
+        (WebCore::removeAnimationByName):
+        (WebCore::GraphicsLayerBlackBerry::addAnimation):
+        (WebCore::GraphicsLayerBlackBerry::pauseAnimation):
+        (WebCore::GraphicsLayerBlackBerry::removeAnimation):
+        (WebCore::GraphicsLayerBlackBerry::suspendAnimations):
+        (WebCore::GraphicsLayerBlackBerry::resumeAnimations):
+        (WebCore::GraphicsLayerBlackBerry::setContentsToImage):
+        (WebCore::GraphicsLayerBlackBerry::updateContentsImage):
+        (WebCore::GraphicsLayerBlackBerry::setContentsToCanvas):
+        (WebCore::GraphicsLayerBlackBerry::setContentsToMedia):
+        (WebCore::GraphicsLayerBlackBerry::hostLayerForSublayers):
+        (WebCore::GraphicsLayerBlackBerry::layerForSuperlayer):
+        (WebCore::GraphicsLayerBlackBerry::platformLayer):
+        (WebCore::GraphicsLayerBlackBerry::setDebugBackgroundColor):
+        (WebCore::GraphicsLayerBlackBerry::setDebugBorder):
+        (WebCore::GraphicsLayerBlackBerry::updateSublayerList):
+        (WebCore::GraphicsLayerBlackBerry::updateLayerPosition):
+        (WebCore::GraphicsLayerBlackBerry::updateLayerSize):
+        (WebCore::GraphicsLayerBlackBerry::updateAnchorPoint):
+        (WebCore::GraphicsLayerBlackBerry::updateTransform):
+        (WebCore::GraphicsLayerBlackBerry::updateChildrenTransform):
+        (WebCore::GraphicsLayerBlackBerry::updateMasksToBounds):
+        (WebCore::GraphicsLayerBlackBerry::updateContentsOpaque):
+        (WebCore::GraphicsLayerBlackBerry::updateBackfaceVisibility):
+        (WebCore::GraphicsLayerBlackBerry::updateLayerPreserves3D):
+        (WebCore::GraphicsLayerBlackBerry::updateLayerIsDrawable):
+        (WebCore::GraphicsLayerBlackBerry::updateFixedPosition):
+        (WebCore::GraphicsLayerBlackBerry::updateHasFixedContainer):
+        (WebCore::GraphicsLayerBlackBerry::updateHasFixedAncestorInDOMTree):
+        (WebCore::GraphicsLayerBlackBerry::updateLayerBackgroundColor):
+        (WebCore::GraphicsLayerBlackBerry::updateAnimations):
+        (WebCore::GraphicsLayerBlackBerry::updateContentsVideo):
+        (WebCore::GraphicsLayerBlackBerry::updateContentsRect):
+        (WebCore::GraphicsLayerBlackBerry::setupContentsLayer):
+        (WebCore::GraphicsLayerBlackBerry::updateOpacityOnLayer):
+        (WebCore::GraphicsLayerBlackBerry::contentsVisible):
+        * platform/graphics/blackberry/GraphicsLayerBlackBerry.h: Added.
+        (WebCore):
+        (GraphicsLayerBlackBerry):
+        (WebCore::GraphicsLayerBlackBerry::notifySyncRequired):
+        (WebCore::GraphicsLayerBlackBerry::notifyAnimationStarted):
+        (WebCore::GraphicsLayerBlackBerry::primaryLayer):
+        (WebCore::GraphicsLayerBlackBerry::contentsLayer):
+
+2012-03-07  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Refactoring: Remove Node::isContentElement and Node::isShadowElement.
+        https://bugs.webkit.org/show_bug.cgi?id=80501
+
+        Reviewed by Hajime Morita.
+
+        Removes Node::isContentElement and Node::isShadowElement. These methods are replaced
+        by hasTagName. However the tag name of HTMLContentElement was not consistent,
+        this patch make them consistent.
+
+        No new tests. Should be covered by existing tests.
+
+        * dom/Node.h:
+        * html/HTMLElement.h:
+        (WebCore::HTMLElement::isInsertionPoint):
+        (HTMLElement):
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::SummaryContentElement::SummaryContentElement):
+          It uses HTMLNames::divTag as tagname. It should use HTMLNames::webkitShadowTagName.
+        * html/shadow/HTMLContentElement.h:
+        (HTMLContentElement):
+        * html/shadow/InsertionPoint.h:
+        (InsertionPoint):
+        (WebCore::InsertionPoint::isInsertionPoint):
+        (WebCore::isInsertionPoint):
+        * testing/Internals.cpp:
+        (WebCore::Internals::isValidContentSelect):
+        * testing/Internals.h:
+        (Internals):
+
+2012-03-07  Adam Barth  <abarth@webkit.org>
+
+        ContainerNode::insertedIntoDocument and removedFromDocument use weak iteration patterns
+        https://bugs.webkit.org/show_bug.cgi?id=80569
+
+        Reviewed by Ryosuke Niwa.
+
+        This patch moves ContainerNode::insertedIntoDocument and
+        removedFromDocument to using a better iteration pattern in which we
+        collect all the nodes we're planning to iterate into a vector and then
+        iterate over them.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertedIntoDocument):
+        (WebCore::ContainerNode::removedFromDocument):
+
+2012-03-07  Ami Fischman  <fischman@chromium.org>
+
+        [Chromium] Allow CCLayerTreeHost::context() to be called even with the threaded compositor enabled.
+        https://bugs.webkit.org/show_bug.cgi?id=80565
+
+        Reviewed by James Robinson.
+
+        This gets triggered by the video HW decode+render path when threaded compositor is enabled
+        (https://chromiumcodereview.appspot.com/9639005/)
+
+        No new tests.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::context):
+
+2012-03-07  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc: mixed absolute/percentages work for width, height, margin and padding
+        https://bugs.webkit.org/show_bug.cgi?id=79621
+
+        Reviewed by Andreas Kling.
+
+        ApplyPropertyLength in CSSStyleApplyPropery now handles mixed absolute/percentage
+        length expressions. All property handlers using this template now work with
+        mixed expressions.
+
+        This patch adds a new expression evaluator in CalculationValue.cpp. This is because
+        Length.[cpp|h] (in platform) cannot refer to CSSCalculationValue.[cpp|h] (in css) 
+        due to layering restrictions.
+
+        Lengths can be copied, and so the expressions are stored in a hashmap, and only their
+        ids are copied along with Length. The expressions are RefCounted, and will get 
+        cleaned up when the last referring Length is destructed.
+
+        * WebCore.exp.in:
+        * css/CSSCalculationValue.cpp:
+        (WebCore::CSSCalcPrimitiveValue::toCalcValue):
+        (CSSCalcPrimitiveValue):
+        (WebCore::CSSCalcBinaryOperation::toCalcValue):
+        (CSSCalcBinaryOperation):
+        * css/CSSCalculationValue.h:
+        (WebCore):
+        (CSSCalcExpressionNode):
+        (CSSCalcValue):
+        (WebCore::CSSCalcValue::toCalcValue):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyLength::applyValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/CSSStyleSelector.h:
+        (CSSStyleSelector):
+        * platform/CalculationValue.cpp:
+        (WebCore::CalcExpressionBinaryOperation::evaluate):
+        (WebCore):
+        (WebCore::CalculationValue::create):
+        (WebCore::CalculationValue::evaluate):
+        * platform/CalculationValue.h:
+        (CalcExpressionNode):
+        (WebCore::CalcExpressionNode::~CalcExpressionNode):
+        (WebCore):
+        (CalculationValue):
+        (WebCore::CalculationValue::CalculationValue):
+        (CalcExpressionNumber):
+        (WebCore::CalcExpressionNumber::CalcExpressionNumber):
+        (WebCore::CalcExpressionNumber::evaluate):
+        (CalcExpressionLength):
+        (WebCore::CalcExpressionLength::CalcExpressionLength):
+        (WebCore::CalcExpressionLength::evaluate):
+        (CalcExpressionBinaryOperation):
+        (WebCore::CalcExpressionBinaryOperation::CalcExpressionBinaryOperation):
+        * platform/Length.cpp:
+        (WebCore):
+        (WebCore::Length::~Length):
+        (CalculationValueHandleMap):
+        (WebCore::CalculationValueHandleMap::CalculationValueHandleMap):
+        (WebCore::CalculationValueHandleMap::insert):
+        (WebCore::CalculationValueHandleMap::remove):
+        (WebCore::CalculationValueHandleMap::get):
+        (WebCore::calcHandles):
+        (WebCore::Length::Length):
+        (WebCore::Length::calculationValue):
+        (WebCore::Length::calculatedValue):
+        (WebCore::Length::calculatedMinValue):
+        (WebCore::Length::calculatedFloatValue):
+        (WebCore::Length::incrementCalculatedRef):
+        (WebCore::Length::decrementCalculatedRef):
+        (WebCore::Length::nonNanCalculatedValue):
+        * platform/Length.h:
+        (Length):
+        (WebCore::Length::Length):
+        (WebCore::Length::operator=):
+        (WebCore::Length::operator*=):
+        (WebCore::Length::value):
+        (WebCore::Length::setValue):
+        (WebCore::Length::calcValue):
+        (WebCore::Length::calcMinValue):
+        (WebCore::Length::calcFloatValue):
+        (WebCore::Length::isZero):
+        (WebCore::Length::isPositive):
+        (WebCore::Length::isNegative):
+        (WebCore::Length::isPercent):
+        (WebCore::Length::isSpecified):
+        (WebCore::Length::isCalculated):
+        (WebCore::Length::initFromLength):
+        (WebCore::Length::calculationHandle):
+
+2012-03-07  Kent Tamura  <tkent@chromium.org>
+
+        Do not refer to resutlsButtonElement and cancelButtonElement to compute paddings of search popups
+        https://bugs.webkit.org/show_bug.cgi?id=80564
+
+        Reviewed by Hajime Morita.
+
+        We'd like to reduce dependency of resultsButtonElement and
+        cancelButtonElement from RenderTextControlSingleLine.
+
+        No behavior change.
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::clientPaddingLeft):
+        Use the left position of innerBlockElement, instead of the width of resultsButtonElement.
+        They are equivalent.
+        (WebCore::RenderTextControlSingleLine::clientPaddingRight):
+        Use <the container width - right position of innerBlockElement>,
+        instead of the width of the cancelButtonElement. They are
+        equivalent.
+
+2012-03-07  Mike Lawther  <mikelawther@chromium.org>
+
+        use DEFINE_STATIC_LOCAL on Lengths to avoid exit time destructors
+        https://bugs.webkit.org/show_bug.cgi?id=80561
+
+        Reviewed by Eric Seidel.
+
+        This is in preparation for http://wkb.ug/79621 where a destructor is added to Length.
+
+        No new tests as this is not a behaviour change.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyPageSize::getPageSizeFromName):
+
+2012-03-07  Adam Barth  <abarth@webkit.org>
+
+        ContainerNode::willRemove uses a weak iteration pattern
+        https://bugs.webkit.org/show_bug.cgi?id=80530
+
+        Reviewed by Ryosuke Niwa.
+
+        This patch moves ContainerNode::willRemove to using a better iteration
+        pattern in which we collect all the nodes we're planning to iterate
+        into a vector and then iterate over them.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::willRemove):
+
+2012-03-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8][Performance] Optimize V8 bindings for HTMLElement.classList,
+        Element.dataset and Node.attributes
+        https://bugs.webkit.org/show_bug.cgi?id=80376
+
+        Reviewed by Adam Barth.
+
+        This patch improves the performance of HTMLElement.classList, Element.dataset
+        and Node.attributes by 6.4 times, 7.1 times and 10.9 times, respectively.
+
+        Previously, a 'hiddenReferenceName' string was allocated on v8::Handle and
+        created every time the DOM attribute is accessed, in spite of the fact that
+        the 'hiddenReferenceName' string is static.
+
+        This patch moves the 'hiddenReferenceName' string to v8::Persistent and makes it static.
+        Also, this patch removes 'if (!elementValue.IsEmpty() && elementValue->IsObject())',
+        since if 'element' exists, it is guaranteed that 'elementValue' is not empty
+        and is an Object.
+
+        Performance tests: https://bugs.webkit.org/attachment.cgi?id=130283
+
+        AppleWebKit/JavaScriptCore:
+        div.classList : 382ms
+        div.classList.foo = 123 : 335ms
+        div.dataset : 403ms
+        div.dataset.foo = 123 : 5250ms
+        div.attributes : 183ms
+
+        Chromium/V8 (without this patch):
+        div.classList : 9140ms
+        div.classList.foo = 123 : 9086ms
+        div.dataset : 9930ms
+        div.dataset.foo = 123 : 49698ms
+        div.attributes : 13489ms
+
+        Chromium/V8 (with this patch):
+        div.classList : 1435ms
+        div.classList.foo = 123 : 1470ms
+        div.dataset : 1400ms
+        div.dataset.foo = 123 : 30396ms
+        div.attributes : 1242ms
+
+        No tests. No change in behavior.
+
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp: Modified as described above.
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Ditto.
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp: Ditto.
+        (WebCore::toV8):
+
+        * bindings/v8/V8HiddenPropertyName.cpp: Defined a hidden property name string statically
+        to optimize the macro.
+        (WebCore):
+        (WebCore::V8HiddenPropertyName::hiddenReferenceName):
+        * bindings/v8/V8HiddenPropertyName.h: Modified to switch two prefixes "WebCore::HiddenProperty::"
+        and "WebCore::HiddenReference::", depending on whether a given name represents a hidden property
+        or a hidden reference.
+        (WebCore):
+        (V8HiddenPropertyName):
+
+2012-03-07  Kent Tamura  <tkent@chromium.org>
+
+        Add RenderBoxModelObject::marginWidth() and marginHeight()
+        https://bugs.webkit.org/show_bug.cgi?id=80556
+
+        Reviewed by Kentaro Hara.
+
+        They make some code shorter.
+
+        No behavior change.
+
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::marginHeight): Added.
+        (WebCore::RenderBoxModelObject::marginWidth): Added.
+        * inspector/DOMNodeHighlighter.cpp: Use marginHeight() and/or marginWidth().
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::FloatWithRect::FloatWithRect): ditto.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::checkFloatsInCleanLine): ditto.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::repaintLayerRectsForImage): ditto.
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::layoutHorizontalBox): ditto.
+        (WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox): ditto.
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::crossAxisMarginExtentForChild): ditto.
+        (WebCore::RenderFlexibleBox::computeNextFlexLine): ditto.
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::culledInlineAbsoluteRects): ditto.
+        (WebCore::RenderInline::culledInlineAbsoluteQuads): ditto.
+        (WebCore::RenderInline::culledInlineBoundingBox): ditto.
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::trackPieceRectWithMargins): ditto.
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::computeLogicalHeight): ditto.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::computeControlHeight): ditto.
+
+2012-03-07  Jessie Berlin  <jberlin@apple.com>
+
+        Clean Windows build fails after r110033
+        https://bugs.webkit.org/show_bug.cgi?id=80553
+
+        Rubber-stamped by Jon Honeycutt and Eric Seidel.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        Update the expected location of the copied JSC WTF string implementation files.
+
+2012-03-07  Michael Nordman  <michaeln@google.com>
+
+        [Chromium] Don't be so CRASH() happy in the bindings layer.
+        https://bugs.webkit.org/show_bug.cgi?id=75111
+        - change the v8 bindings generated code to check for the 'worker is terminating'
+          condition prior to committing a suicidal CRASH()
+        - fixup custom v8 bindings accordingly
+        - simplify bindings/generic/ActiveDOMCallback, there is no need for it to support
+          destruction on a different thread
+
+        Reviewed by David Levin.
+
+        No new tests, existing tests apply.
+
+        * bindings/generic/ActiveDOMCallback.cpp: Simplified in general.
+        (WebCore):
+        (WebCore::ActiveDOMCallback::ActiveDOMCallback):
+        (WebCore::ActiveDOMCallback::~ActiveDOMCallback):
+        (WebCore::ActiveDOMCallback::canInvokeCallback):
+        (WebCore::ActiveDOMCallback::isScriptControllerTerminating): New method to avoid CRASH()ing in exceptional conditions in v8 bindings.
+        * bindings/generic/ActiveDOMCallback.h: Derive from ContextDestructionObserver.
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::scheduleExecutionTermination): Use a mutex to provide a memory barrier.
+        (WebCore::WorkerScriptController::isExecutionTerminating): New supporting method to avoid CRASH()ing in exceptional conditions.
+        * bindings/js/WorkerScriptController.h:
+        (WorkerScriptController):
+        * bindings/scripts/CodeGeneratorV8.pm: Generates v8 bindding code that uses isScriptControllerTerminating to avoid CRASH()ing.
+        (GenerateCallbackImplementation):
+        * bindings/scripts/test/V8/V8TestCallback.cpp: Fixup expected outputs of the modified CodeGeneratorV8.pm script.
+        (WebCore::V8TestCallback::callbackWithClass1Param):
+        (WebCore::V8TestCallback::callbackWithClass2Param):
+        (WebCore::V8TestCallback::callbackWithStringList):
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::WorkerScriptController): Initialize a new data member.
+        (WebCore::WorkerScriptController::scheduleExecutionTermination): Use a mutex to provide a memory barrier.
+        (WebCore::WorkerScriptController::isExecutionTerminating): New supporting method to avoid CRASH()ing in exceptional conditions.
+        * bindings/v8/WorkerScriptController.h: Add a pair of new data members, bool + mutex.
+        (WorkerScriptController):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8SQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8MutationCallbackCustom.cpp:
+        (WebCore::V8MutationCallback::handleEvent):
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::ScriptExecutionContext): Initilaize data members.
+        (WebCore::ScriptExecutionContext::stopActiveDOMObjects): Set m_activeDOMObjectsAreStopped.
+        * dom/ScriptExecutionContext.h: Add m_activeDOMObjectsAreStopped data member.
+        (WebCore::ScriptExecutionContext::activeDOMObjectsAreStopped): Simple getter.
+        (ScriptExecutionContext):
+
+2012-03-07  Kent Tamura  <tkent@chromium.org>
+
+        Remove meaningless code in RenderTextControlSingleLine::preferredContentWidth()
+        https://bugs.webkit.org/show_bug.cgi?id=80493
+
+        Reviewed by Hajime Morita.
+
+        preferredContentWidth() added border+padding widths of the search result
+        button, search cancel button, and speech input button. It makes no sense
+        to make the intrinsic width wider by only their border+padding width,
+        not their content width.
+
+        The default borders and paddings of these buttons are 0 in all
+        platforms, and adding border or padding to these elements by page
+        authors made unreasonable behavior. So we had better remove this
+        code.
+
+        Tests: fast/forms/search/intrinsic-search-width-with-decoration-border-padding.html
+               fast/speech/intrinsic-input-width-with-speech-border-padding.html
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+         Remove the meaningless code.
+        * rendering/RenderTextControlSingleLine.h:
+        (RenderTextControlSingleLine): Remove speechButtonElement(). It's unnecessary.
+
+2012-03-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r110126.
+        http://trac.webkit.org/changeset/110126
+        https://bugs.webkit.org/show_bug.cgi?id=80558
+
+        compile failed on AppleMac (Requested by ukai on #webkit).
+
+        * WebCore.exp.in:
+        * css/CSSCalculationValue.cpp:
+        * css/CSSCalculationValue.h:
+        (WebCore):
+        (CSSCalcExpressionNode):
+        (CSSCalcValue):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyLength::applyValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/CSSStyleSelector.h:
+        * platform/CalculationValue.cpp:
+        * platform/CalculationValue.h:
+        * platform/Length.cpp:
+        (WebCore::newLengthArray):
+        * platform/Length.h:
+        (WebCore::Length::operator*=):
+        (WebCore::Length::value):
+        (WebCore::Length::setValue):
+        (Length):
+        (WebCore::Length::calcValue):
+        (WebCore::Length::calcMinValue):
+        (WebCore::Length::calcFloatValue):
+        (WebCore::Length::isZero):
+        (WebCore::Length::isPositive):
+        (WebCore::Length::isNegative):
+        (WebCore::Length::isPercent):
+        (WebCore::Length::isSpecified):
+
+2012-03-05  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Make Node::dumpStatistics() work again
+        https://bugs.webkit.org/show_bug.cgi?id=80327
+
+        Reviewed by Ryosuke Niwa.
+
+        Update the code in dumpStatistics() to the latest attribute storage changes. Also
+        move the DUMP_NODE_STATISTICS define here from the Node.cpp, since its also used
+        by Document.h.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics): Use more self-describing variable names.
+        * dom/Node.h:
+
+2012-03-07  Mike Lawther  <mikelawther@chromium.org>
+
+        CSS3 calc: mixed absolute/percentages work for width, height, margin and padding
+        https://bugs.webkit.org/show_bug.cgi?id=79621
+
+        Reviewed by Andreas Kling.
+
+        ApplyPropertyLength in CSSStyleApplyPropery now handles mixed absolute/percentage
+        length expressions. All property handlers using this template now work with
+        mixed expressions.
+
+        This patch adds a new expression evaluator in CalculationValue.cpp. This is because
+        Length.[cpp|h] (in platform) cannot refer to CSSCalculationValue.[cpp|h] (in css) 
+        due to layering restrictions.
+
+        Lengths can be copied, and so the expressions are stored in a hashmap, and only their
+        ids are copied along with Length. The expressions are RefCounted, and will get 
+        cleaned up when the last referring Length is destructed.
+
+        * WebCore.exp.in:
+        * css/CSSCalculationValue.cpp:
+        (WebCore::CSSCalcPrimitiveValue::toCalcValue):
+        (CSSCalcPrimitiveValue):
+        (WebCore::CSSCalcBinaryOperation::toCalcValue):
+        (CSSCalcBinaryOperation):
+        * css/CSSCalculationValue.h:
+        (WebCore):
+        (CSSCalcExpressionNode):
+        (CSSCalcValue):
+        (WebCore::CSSCalcValue::toCalcValue):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyLength::applyValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/CSSStyleSelector.h:
+        (CSSStyleSelector):
+        * platform/CalculationValue.cpp:
+        (WebCore::CalcExpressionBinaryOperation::evaluate):
+        (WebCore):
+        (WebCore::CalculationValue::create):
+        (WebCore::CalculationValue::evaluate):
+        * platform/CalculationValue.h:
+        (CalcExpressionNode):
+        (WebCore::CalcExpressionNode::~CalcExpressionNode):
+        (WebCore):
+        (CalculationValue):
+        (WebCore::CalculationValue::CalculationValue):
+        (CalcExpressionNumber):
+        (WebCore::CalcExpressionNumber::CalcExpressionNumber):
+        (WebCore::CalcExpressionNumber::evaluate):
+        (CalcExpressionLength):
+        (WebCore::CalcExpressionLength::CalcExpressionLength):
+        (WebCore::CalcExpressionLength::evaluate):
+        (CalcExpressionBinaryOperation):
+        (WebCore::CalcExpressionBinaryOperation::CalcExpressionBinaryOperation):
+        * platform/Length.cpp:
+        (WebCore):
+        (WebCore::Length::~Length):
+        (CalculationValueHandleMap):
+        (WebCore::CalculationValueHandleMap::CalculationValueHandleMap):
+        (WebCore::CalculationValueHandleMap::insert):
+        (WebCore::CalculationValueHandleMap::remove):
+        (WebCore::CalculationValueHandleMap::get):
+        (WebCore::calcHandles):
+        (WebCore::Length::Length):
+        (WebCore::Length::calculationValue):
+        (WebCore::Length::calculatedValue):
+        (WebCore::Length::calculatedMinValue):
+        (WebCore::Length::calculatedFloatValue):
+        (WebCore::Length::incrementCalculatedRef):
+        (WebCore::Length::decrementCalculatedRef):
+        (WebCore::Length::nonNanCalculatedValue):
+        * platform/Length.h:
+        (Length):
+        (WebCore::Length::Length):
+        (WebCore::Length::operator=):
+        (WebCore::Length::operator*=):
+        (WebCore::Length::value):
+        (WebCore::Length::setValue):
+        (WebCore::Length::calcValue):
+        (WebCore::Length::calcMinValue):
+        (WebCore::Length::calcFloatValue):
+        (WebCore::Length::isZero):
+        (WebCore::Length::isPositive):
+        (WebCore::Length::isNegative):
+        (WebCore::Length::isPercent):
+        (WebCore::Length::isSpecified):
+        (WebCore::Length::isCalculated):
+        (WebCore::Length::initFromLength):
+        (WebCore::Length::calculationHandle):
+
+2012-03-07  Emil A Eklund  <eae@chromium.org>
+
+        Change remaining scroll methods to integers
+        https://bugs.webkit.org/show_bug.cgi?id=80539
+
+        Reviewed by Eric Seidel.
+
+        No new tests, no new functionality.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively):
+        (WebCore::RenderLayer::scrollToOffset):
+        (WebCore::RenderLayer::scrollRectToVisible):
+        (WebCore::RenderLayer::scrollToXOffset):
+        (WebCore::RenderLayer::scrollToYOffset):
+        Change scrollTo methods to take integer x and y values as the actual
+        scrolling is done in increments of full pixels.
+        
+        (WebCore::cornerStart):
+        (WebCore::RenderLayer::scrollWidth):
+        (WebCore::RenderLayer::scrollHeight):
+        Change scrollWidth/Height to return pixel snapped values and remove
+        pixelSnapped versions of same as all callers either used snapped the
+        values or used the pixelSnapped versions of these methods.
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::scrollWidth):
+        Change scrollWidth to return snapped client width.
+        
+        * rendering/RenderListBox.h:
+        Change scrollSize, scrollPosition and setScrollOffset methods to use
+        integers in accordance with the interface defined by ScrollableArea.
+        
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+
+2012-03-07  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Implement getAttributeNode() in terms of ElementAttributeData instead of NamedNodeMap
+        https://bugs.webkit.org/show_bug.cgi?id=80541
+
+        Reviewed by Ryosuke Niwa.
+
+        DOM methods exposed in Element and NamedNodeMap are now implemented in terms of
+        ElementAttributeData. The difference between them is that Element methods can early
+        return if there's no attribute storage.
+
+        * dom/Element.cpp:
+        (WebCore::Element::getAttributeNode):
+        Removed the manual lowercasing letting our existing mechanism in
+        ElementAttributeData::getAttributeItemIndex() take care of it. I considered that
+        this could be an optimization, but testing a few Dromaeo tests (dom-attr,
+        jslib-attr-jquery, jslib-attr-prototype) the difference isn't significant. It
+        shouldn't affect correctness either.
+
+        (WebCore::Element::getAttributeNodeNS):
+        * dom/ElementAttributeData.cpp:
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        (WebCore::ElementAttributeData::getAttributeNode):
+        (WebCore):
+        * dom/NamedNodeMap.cpp:
+        (WebCore::NamedNodeMap::getNamedItem):
+        (WebCore::NamedNodeMap::getNamedItemNS):
+        * dom/NamedNodeMap.h:
+        (NamedNodeMap):
+
+2012-03-07  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Support printing WebGL content in threaded compositor
+        https://bugs.webkit.org/show_bug.cgi?id=80464
+
+        Reviewed by Kenneth Russell.
+
+        Do the readback on the WebGL context instead of the compositor's context since we cannot use the latter from the
+        main thread. Since we're on the WebGL context, we have to be careful to restore any state we change.
+
+        Tested printing manually with threaded compositing enabled.
+
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::paintRenderedResultsToCanvas):
+        * platform/graphics/chromium/WebGLLayerChromium.h:
+        (WebGLLayerChromium):
+
+2012-03-07  Adam Barth  <abarth@webkit.org>
+
+        Remove #define private public from WebCache.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=80520
+
+        Reviewed by Eric Seidel.
+
+        Add some accessors for state used by WebCache.cpp.
+
+        * loader/cache/MemoryCache.h:
+        (WebCore::MemoryCache::minDeadCapacity):
+        (WebCore::MemoryCache::maxDeadCapacity):
+        (WebCore::MemoryCache::capacity):
+        (WebCore::MemoryCache::liveSize):
+        (WebCore::MemoryCache::deadSize):
+        (MemoryCache):
+
+2012-03-07  Kentaro Hara  <haraken@chromium.org>
+
+        [V8][Performance] Optimize Element.firstElementChild, Element.lastElementChild,
+        Element.previousElementSibling, Element.nextElementSibling, Node.parentElement
+        https://bugs.webkit.org/show_bug.cgi?id=80506
+
+        Reviewed by Adam Barth.
+
+        This patch improves the performance of Element.firstElementChild by 5.8 times,
+        Element.lastElementChild by 6.2 times, Element.previousElementSibling by 7.1 times,
+        Element.nextElementSibling by 7.1 times, and Node.parentElement by 6.7 times.
+
+        Previously, while toV8(Node*) caches a wrapper object on a node object
+        (i.e. node->wrapper(), node->setWrapper()), toV8(Element*) does not
+        cache a wrapper object.
+
+        This patch removes toV8(Element*), so that DOM attribute getters that return
+        Element* use toV8(Node*). This change makes these DOM attribute getters
+        cache the wrapper object on a node object. This optimization is already
+        implemented in JavaScriptCore.
+
+        Performance tests: https://bugs.webkit.org/attachment.cgi?id=130594
+
+        The test results in my local Mac environment are as follows:
+
+        AppleWebKit/JavaScriptCore:
+        div.firstElementChild : 1162ms
+        div.lastElementChild : 1016ms
+        div.previousElementSibling : 918ms
+        div.nextElementSibling : 900ms
+        div.parentElement : 901ms
+
+        Chromium/V8 (without this patch):
+        div.firstElementChild : 9515ms
+        div.lastElementChild : 9449ms
+        div.previousElementSibling : 9254ms
+        div.nextElementSibling : 9315ms
+        div.parentElement : 9380ms
+
+        Chromium/V8 (with this patch):
+        div.firstElementChild : 1628ms
+        div.lastElementChild : 1527ms
+        div.previousElementSibling : 1310ms
+        div.nextElementSibling : 1310ms
+        div.parentElement : 1410ms
+
+        No tests. No change in behavior.
+
+        * dom/Element.idl: Removed toV8(Element*)
+        * bindings/v8/custom/V8NodeCustom.cpp: Ditto.
+        (WebCore::toV8Slow):
+        * bindings/scripts/CodeGeneratorV8.pm: Ditto.
+        (GenerateHeader):
+
+        * bindings/v8/custom/V8ElementCustom.cpp: Removed.
+        * Target.pri: Removed V8ElementCustom.cpp.
+        * UseV8.cmake: Ditto.
+        * WebCore.gypi: Ditto.
+
+2012-03-07  Joshua Bell  <jsbell@chromium.org>
+
+        [Chromium] IndexedDB: V8LocalContext creation in IDBKey extraction/injection is slow
+        https://bugs.webkit.org/show_bug.cgi?id=80358
+
+        Cache a re-usable context (per isolate) for cases like IDB's key/SSV extraction/injection,
+        where no user script is run. This yields a 3x-4x performance improvement in basic IDB
+        operations.
+
+        Reviewed by Tony Chang.
+
+        No new tests - no behavior changes.
+
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::createIDBKeyFromSerializedValueAndKeyPath):
+        (WebCore::injectIDBKeyIntoSerializedValue):
+        * bindings/v8/V8Binding.h:
+        (WebCore::V8BindingPerIsolateData::auxiliaryContext):
+        (V8BindingPerIsolateData):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::V8AuxiliaryContext::V8AuxiliaryContext):
+        (WebCore::V8AuxiliaryContext::~V8AuxiliaryContext):
+        (WebCore::V8AuxiliaryContext::auxiliaryContext):
+        * bindings/v8/V8Utilities.h:
+        (V8AuxiliaryContext):
+
+2012-03-07  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Remove unused wasRecreate variable
+        https://bugs.webkit.org/show_bug.cgi?id=80533
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::initializeLayerRenderer):
+
+2012-03-07  Ryan Sleevi  <rsleevi@chromium.org>
+
+        [chromium] Update GYP files to reflect file deletes/renames
+        https://bugs.webkit.org/show_bug.cgi?id=80525
+
+        Reviewed by Ryosuke Niwa.
+
+        No change in functionality, so no tests.
+
+        * WebCore.gypi:
+        Updated AppleMac private headers due to r109877
+        Updated platform/qt references due to r109542
+        Updated platform/mac references due to r109147
+        Updated platform/mac references due to r108956
+
+2012-03-07  Eric Carlson  <eric.carlson@apple.com>
+
+        Html5 video element Useragent string is Quicktime
+        https://bugs.webkit.org/show_bug.cgi?id=46241
+
+        Reviewed by Daniel Bates.
+
+        Test: http/tests/media/video-useragent.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerUserAgent): Return the UA string for the current source.
+        * html/HTMLMediaElement.h:
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::userAgent):  New, return the client's mediaPlayerUserAgent.
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerUserAgent):
+
+        * platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm:
+        (WebCore::MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL): Tell AVFoundation to set
+            the UA header.
+
+2012-03-07  Scott Byer  <scottbyer@chromium.org>
+
+        Get ScrollAnimatorNone to handle the stop and reverse cases.
+        https://bugs.webkit.org/show_bug.cgi?id=80455
+
+        Reviewed by James Robinson.
+
+        Chromium webkit_unit_tests ScrollAnimatorNoneTest.ScrollStopInMiddle and
+        ScrollAnimatorNoneTest.ReverseInMiddle.
+
+        * platform/ScrollAnimatorNone.cpp:
+        (WebCore::ScrollAnimatorNone::PerAxisData::updateDataFromParameters):
+
+2012-03-07  Yong Li  <yoli@rim.com>
+
+        RenderImage ignores its percent width/height when setContainerSizeForRenderer
+        https://bugs.webkit.org/show_bug.cgi?id=80431
+
+        Reviewed by George Staikos.
+
+        Not only respect fixed width/height explicitly specified in img element, but also
+        respect percent width/height when determining container size for images.
+
+        No new tests because there is no functional change but only internal buffer sizes.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::computeReplacedLogicalWidth):
+
+2012-03-06  Benjamin Poulain  <bpoulain@apple.com>
+
+        [Mac] Update the configuration files for iOS
+        https://bugs.webkit.org/show_bug.cgi?id=80435
+
+        Reviewed by David Kilzer.
+
+        * Configurations/WebCore.xcconfig:
+
+2012-03-07  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Cull occluded tiles during paint
+        https://bugs.webkit.org/show_bug.cgi?id=76838
+
+        Reviewed by Adrienne Walker.
+
+        Using CCOcclusionTracker instead of the old custom paint occlusion
+        tracking. Stops painting tiles when the tile is not visible.
+
+        CCOcclusionTracker only uses Layer::opaque() for determining
+        occlusion so far. The Layer::addSelfToOccludedRegion is being
+        replaced by a superior method in CCOcclusionTracker that will
+        work for both threads, so removing that support here.
+
+        Unit test: TiledLayerChromiumTest.cpp
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::paintContentsIfDirty):
+        (WebCore::ContentLayerChromium::idlePaintContentsIfDirty):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        (ContentLayerChromium):
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerChromium::paintContentsIfDirty):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::idlePaintContentsIfDirty):
+        (LayerChromium):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore):
+        (WebCore::contentToLayerTransform):
+        (WebCore::TiledLayerChromium::prepareToUpdateTiles):
+        (WebCore::TiledLayerChromium::prepareToUpdate):
+        (WebCore::TiledLayerChromium::prepareToUpdateIdle):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (TiledLayerChromium):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::paintContentsIfDirty):
+        (WebCore::CCLayerTreeHost::paintLayerContents):
+
+2012-03-07  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Implement removeAttributeNode() in terms of ElementAttributeData instead of NamedNodeMap
+        https://bugs.webkit.org/show_bug.cgi?id=80522
+
+        Reviewed by Andreas Kling.
+
+        DOM methods exposed in Element and NamedNodeMap are now implemented in terms of
+        ElementAttributeData. A helper function takeAttribute() was added to increase
+        code sharing. Also removed some unneeded methods.
+
+        * dom/Element.cpp:
+        (WebCore::Element::removeAttribute): Use ElementAttributeData function directly.
+        (WebCore::Element::removeAttributeNode): Get the index manually and use new
+        takeAttribute() directly.
+        * dom/Element.h:
+        (Element): Remove unused removeAttribute(unsigned index).
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::takeAttribute): Like removeAttribute() but
+        returns a reference to old Attr.
+        (WebCore):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        * dom/NamedNodeMap.cpp:
+        (WebCore::NamedNodeMap::removeNamedItem): Avoid looking up the property twice by
+        getting the index directly from the name, instead of going through the qualified name.
+        * dom/NamedNodeMap.h: Remove now unused internal methods for removing attributes.
+
+2012-03-07  Alexey Proskuryakov  <ap@apple.com>
+
+        Merge AsyncFileStream with FileStreamProxy
+        https://bugs.webkit.org/show_bug.cgi?id=80325
+
+        Build fix.
+
+        * WebCore.xcodeproj/project.pbxproj: Removed files that got mysteriously added to the project
+        with a merge.
+
+2012-03-07  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Unreviewed ASSERT failure fix.
+        https://bugs.webkit.org/show_bug.cgi?id=75568
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        Fix a bad merge of the patch, we should call updateCachedSizeForOverflowClip if we lose
+        our layer.
+
+2012-03-07  ChangSeok Oh  <shivamidow@gmail.com>
+
+        [EFL] Revise PlatformKeyboardEventEfl and EflKeyboardUtilities
+        https://bugs.webkit.org/show_bug.cgi?id=80511
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Added 'const' keyword in front of argument of keyIdentifiersForEvasKeyName/windowsKeyCodeForEvasKeyName.
+        Since they should not be changed while processing each function.
+        And initialized missing member variables of PlatformKeyboardEventEfl.
+
+        No new tests, since no new feature.
+
+        * platform/efl/EflKeyboardUtilities.cpp:
+        (WebCore::keyIdentifierForEvasKeyName): Added const keyword
+        (WebCore::windowsKeyCodeForEvasKeyName): Added const keyword
+        * platform/efl/EflKeyboardUtilities.h:
+        (WebCore):
+        * platform/efl/PlatformKeyboardEventEfl.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+
+2012-03-07  Hironori Bono  <hbono@chromium.org>
+
+        [Chromium] Mirror the resizer image of an RTL element when WTF_USE_RTL_SCROLLBAR is 1
+        https://bugs.webkit.org/show_bug.cgi?id=9223
+
+        Reviewed by Tony Chang.
+
+        This change mirrors a resizer image of an RTL element horizontall as Firefox
+        does. This change also mirrors its dragging behavior, i.e. draging the resizer
+        of an RTL element to the left side increases its width. (This feature is enabled
+        only when WTF_USE_RTL_SCROLLBAR is 1.)
+
+        Test: platform/chromium/scrollbars/drag-rtl-resizer.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::resize): Mirrored the x coordinate of mouse positions
+        when mirroring a resizer.
+        (WebCore::RenderLayer::offsetFromResizeCorner): Returned the offset from the
+        bottom-left corner when rendering a resizer there.
+        (WebCore::RenderLayer::drawPlatformResizerImage): Mirrored the resizer bitmap
+        horizontally when rendering a resizer to the bottom-left corner.
+
+2012-03-07  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Lazily allocate overflow: hidden layers if we have overflowing content
+        https://bugs.webkit.org/show_bug.cgi?id=75568
+
+        Reviewed by David Hyatt.
+
+        Change covered by the existing tests and the tons of rebaselines.
+
+        This change makes us lazily allocate our RenderLayer for overflow: hidden layers only.
+
+        Apart from saving some memory, it will also speed up the rendering as we don't need to
+        go through the layer's machinery when painting and hit testing.
+
+        On http://dglazkov.github.com/performance-tests/biggrid.html benchmark, this puts the
+        overflow: hidden case in par with the overflow: visible case when scrolling that is a
+        very-smooth scrolling vs a jerky one currently (mostly due to the painting speedup).
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
+        Changed this method to update our size cache if needed.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::isPointInOverflowControl):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::willBeDestroyed):
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::layout):
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+        (WebCore::RenderBox::scrollLeft):
+        (WebCore::RenderBox::scrollTop):
+        (WebCore::RenderBox::setScrollLeft):
+        (WebCore::RenderBox::setScrollTop):
+        (WebCore::RenderBox::includeVerticalScrollbarSize):
+        (WebCore::RenderBox::includeHorizontalScrollbarSize):
+        (WebCore::RenderBox::scrolledContentOffset):
+        (WebCore::RenderBox::pushContentsClip):
+        (WebCore::RenderBox::popContentsClip):
+        (WebCore::RenderBox::addLayoutOverflow):
+        Added layer() check to the previous call sites.
+
+        (WebCore::cachedSizeForOverflowClipMap):
+        (WebCore::RenderBox::cachedSizeForOverflowClip):
+        (WebCore::RenderBox::updateCachedSizeForOverflowClip):
+        (WebCore::RenderBox::clearCachedSizeForOverflowClip):
+        This logic stores the size information for later repainting.
+        It is in practice replicating what RenderLayer is doing.
+        I had to disable an ASSERT here as it would trigger in NRWT but
+        not under DRT. I haven't found by code inspection what was wrong.
+
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::hasOverflowClipWithLayer):
+        Helper function.
+
+        (WebCore::RenderBox::requiresLayerForOverflowClip):
+        This determines if we can survive without a RenderLayer. For the moment,
+        it is very conservative.
+
+        (WebCore::RenderBox::requiresLayer):
+        Updated to call requiresLayerForOverflowClip.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::ensureLayer):
+        Added this function to create and add a new layer.
+
+        (WebCore::RenderBoxModelObject::willBeDestroyed):
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        Patched those method to handle updating / removing
+        cached size entries.
+
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::requiresLayer):
+        Pushed the overflowClip check down to RenderBox as only RenderBoxes can have
+        overflow clips.
+
+        * rendering/RenderTableRow.h:
+        (WebCore::RenderTableRow::requiresLayer):
+        Added a comment about why we need a layout for table rows.
+
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layout):
+        Updated those call sites to use RenderBlock::updateScrollInfoAfterLayout
+        or RenderBox::updateCachedSizeForOverflowClip. The current logic is really
+        not tight proof and would need to be rethought to not avoid cases.
+
+2012-03-07  Konrad Piascik  <kpiascik@rim.com>
+
+        [BlackBerry] Fix warnings in CookieMap
+        https://bugs.webkit.org/show_bug.cgi?id=80512
+
+        Reviewed by Rob Buis.
+
+        No new tests. No behavioural changes.
+
+        * platform/blackberry/CookieMap.cpp:
+        (WebCore::CookieMap::addOrReplaceCookie):
+        (WebCore::CookieMap::removeCookie):
+        (WebCore::CookieMap::getAllCookies):
+        (WebCore::CookieMap::updateOldestCookie):
+
+2012-03-07  Levi Weintraub  <leviw@chromium.org>
+
+        Update usage of LayoutUnits in InlineBox and InlineFlowBox
+        https://bugs.webkit.org/show_bug.cgi?id=80051
+
+        Reviewed by Eric Seidel.
+
+        Updating LayoutUnit vs Integer usage in InlineBox and InlineFlowBox. While the
+        line box tree remains floating point, margins are now subpixel, and rects from
+        the render tree use LayoutUnits. For more information, see the LayoutUnit wiki
+        page: https://trac.webkit.org/wiki/LayoutUnit
+
+        No new tests. No change in behavior.
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::flipForWritingMode): Changing over to LayoutUnits.
+        * rendering/InlineBox.h:
+        (InlineBox):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::getFlowSpacingLogicalWidth): Returning a LayoutUnit
+        instead of an integer, as it uses margin which is a LayoutUnit.
+        (WebCore::InlineFlowBox::placeBoxesInInlineDirection): Using a LayoutUnit for
+        margin.
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection): Build fixes for when
+        LayoutUnits are subpixel.
+        (WebCore::InlineFlowBox::paintFillLayer): Ditto.
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::marginBorderPaddingLogicalLeft): Returning a LayoutUnit
+        instead of an integer since margin is a LayoutUnit.
+        (WebCore::InlineFlowBox::marginBorderPaddingLogicalRight): Ditto.
+        (InlineFlowBox):
+        (WebCore::InlineFlowBox::logicalLeftLayoutOverflow): Adding a static_cast that's
+        redundant now, but required when we switch to subpixel LayoutUnits.
+        (WebCore::InlineFlowBox::logicalRightLayoutOverflow): Ditto.
+        (WebCore::InlineFlowBox::logicalLeftVisualOverflow): Ditto.
+        (WebCore::InlineFlowBox::logicalRightVisualOverflow): Ditto.
+
+2012-03-07  Qi Zhang  <qi.2.zhang@nokia.com>
+
+        [Qt] Unskip http/tests/websocket/tests/hixie76/long-invalid-header.html
+        https://bugs.webkit.org/show_bug.cgi?id=80516
+
+        Reviewed by Csaba Osztrogonác.
+
+        Missed some files related to websocket, take them in.
+
+        * Target.pri:
+
+2012-03-05  Alexey Proskuryakov  <ap@apple.com>
+
+        Merge AsyncFileStream with FileStreamProxy
+        https://bugs.webkit.org/show_bug.cgi?id=80325
+
+        Reviewed by Filip Pizlo.
+
+        AsyncFileStream sounds like a platform concept, but the implementation is web specific.
+        Better to just keep it in one place.
+
+        This is a step toward decoupling blob scheme support from ResourceHandle, which is supposed
+        to be an interface to platform networking APIs only, and definitely shouldn't know about
+        Web concepts.
+
+        No change in functionality, so no tests.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Updated for moved and removed files. Namely, platform/AsyncFileStream is dead, and
+        fileapi/FileStreamProxy is now fileapi/AsyncFileStream.
+
+        * fileapi/AsyncFileStream.cpp: Copied from Source/WebCore/fileapi/FileStreamProxy.cpp.
+        (WebCore::AsyncFileStream::AsyncFileStream):
+        (WebCore::AsyncFileStream::create):
+        (WebCore::AsyncFileStream::~AsyncFileStream):
+        (WebCore::AsyncFileStream::fileThread):
+        (WebCore::didStart):
+        (WebCore::AsyncFileStream::startOnFileThread):
+        (WebCore::AsyncFileStream::stop):
+        (WebCore::derefProxyOnContext):
+        (WebCore::AsyncFileStream::stopOnFileThread):
+        (WebCore::didGetSize):
+        (WebCore::AsyncFileStream::getSize):
+        (WebCore::AsyncFileStream::getSizeOnFileThread):
+        (WebCore::didOpen):
+        (WebCore::AsyncFileStream::openForRead):
+        (WebCore::AsyncFileStream::openForReadOnFileThread):
+        (WebCore::AsyncFileStream::openForWrite):
+        (WebCore::AsyncFileStream::openForWriteOnFileThread):
+        (WebCore::AsyncFileStream::close):
+        (WebCore::AsyncFileStream::closeOnFileThread):
+        (WebCore::didRead):
+        (WebCore::AsyncFileStream::read):
+        (WebCore::AsyncFileStream::readOnFileThread):
+        (WebCore::didWrite):
+        (WebCore::AsyncFileStream::write):
+        (WebCore::AsyncFileStream::writeOnFileThread):
+        (WebCore::didTruncate):
+        (WebCore::AsyncFileStream::truncate):
+        (WebCore::AsyncFileStream::truncateOnFileThread):
+        * fileapi/AsyncFileStream.h: Copied from Source/WebCore/fileapi/FileStreamProxy.h.
+        (WebCore):
+        (AsyncFileStream):
+        (WebCore::AsyncFileStream::client):
+        (WebCore::AsyncFileStream::setClient):
+        * fileapi/FileStreamProxy.cpp: Removed.
+        * fileapi/FileStreamProxy.h: Removed.
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::createAsyncFileStream):
+        * platform/AsyncFileStream.h: Removed.
+        Fewer files!
+
+        * platform/network/BlobRegistry.h: Removed createResourceHandle(). It's logically a method
+        on in-process BlobRegistryImpl only, and we no longer need to call this from platform code.
+
+        * platform/network/BlobRegistryImpl.cpp:
+        (WebCore::createResourceHandle):
+        (WebCore::registerBlobResourceHandleConstructor):
+        (WebCore::BlobRegistryImpl::registerBlobURL):
+        * platform/network/BlobRegistryImpl.h:
+        Except for chromium, "blob" is a scheme that's handled internally. Added hooks for that.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::builtinResourceHandleConstructorMap):
+        (WebCore::ResourceHandle::registerBuiltinConstructor):
+        (WebCore::ResourceHandle::create):
+        * platform/network/ResourceHandle.h:
+        Added a way for other code to register handlers for URL schemes. Non-Chromium platforms
+        use this for blob: now.
+
+2012-03-07  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10923294> REGRESSION (r100847): Entries are clipped out in Day One
+        https://bugs.webkit.org/show_bug.cgi?id=80494
+
+        Reviewed by Sam Weinig.
+
+        Test: fast/dom/HTMLDocument/width-and-height.html
+
+        * html/HTMLDocument.idl: Reverted r100847 by re-enabling the width and height properties
+        in the JavaScript bindings.
+
+2012-03-07  Philippe Normand  <pnormand@igalia.com>
+
+        [GTK] media/audio-garbage-collect.html is flaky
+        https://bugs.webkit.org/show_bug.cgi?id=72698
+
+        Reviewed by Xan Lopez.
+
+        Call ::hasPendingActivity() instead of ::paused() when checking if
+        the audio element is still active. This is similar to what the
+        image element (another ActiveDOMObject implementation) does just
+        above. This contributes to fixing the audio-garbage-collect.html
+        test.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::isReachableFromDOM):
+
+2012-03-07  Adele Peterson  <adele@apple.com>
+
+        REGRESSION(r96566): Cursor is I-beam upon dragging an attachment in mail
+        https://bugs.webkit.org/show_bug.cgi?id=80458
+        <rdar://problem/10873195>
+
+        Reviewed by Dan Bernstein.
+
+        No tests because we currently don't have any test machinery for cursors.
+
+        Make sure the shortcut to always use an iBeam cursor during selection isn't used during dragging.
+        Before r96566, we handled plugin cursors as a special case before calling into selectCursor, so we never hit this code path.
+
+        * page/EventHandler.cpp: (WebCore::EventHandler::selectCursor):
+
+2012-03-07  ChangSeok Oh  <shivamidow@gmail.com>
+
+        [EFL] Key press event is not processed properly.
+        https://bugs.webkit.org/show_bug.cgi?id=80491
+
+        Reviewed by Gustavo Noronha Silva.
+
+        This issue is related with mutation observer feature.
+        If enter key is pressed, then a keyboard event should be processed
+        and reach to the mutation observer, but it doesn't.
+        Some special keys like Enter, Backspace and Tab key should be processed
+        and change to a single character code, but EFL port hasn't handled like that.
+
+        At least we can verify this with following two tests as I know. but they require another
+        functionality for bug79601. I'm going to submit the patch for it after this one.
+
+        Test: fast/mutation/end-of-task-delivery.html
+              fast/mutation/inline-event-listener.html
+
+        * platform/efl/EflKeyboardUtilities.cpp:
+        (WebCore::singleCharacterString):
+        (WebCore):
+        * platform/efl/EflKeyboardUtilities.h:
+        (WebCore):
+        * platform/efl/PlatformKeyboardEventEfl.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+
+2012-03-07  Gavin Peters  <gavinp@chromium.org>
+
+        Add Histograms for reporting on PageCache reject reasons
+        https://bugs.webkit.org/show_bug.cgi?id=80187
+
+        Enhance the PageCache debug mode so that it uses Histograms to
+        report on causes of failure.  Turn on the debug printing path
+        even in non-debug Chromium builds, so these histograms will
+        update.
+
+        Reviewed by Brady Eidson.
+
+        No new tests, does not change behaviour.
+
+        * history/PageCache.cpp:
+        (WebCore):
+        (WebCore::logCanCacheFrameDecision):
+        (WebCore::logCanCachePageDecision):
+        (WebCore::PageCache::canCache):
+
+2012-03-07  Elliot Poger  <epoger@google.com>
+
+        [Chromium] Remove use_skia option from GYP
+        https://bugs.webkit.org/show_bug.cgi?id=75811
+
+        Reviewed by Tony Chang.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-03-07  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Introduce LabelableElement to share "labels" attribute implementation
+        https://bugs.webkit.org/show_bug.cgi?id=80392
+
+        Reviewed by Kent Tamura.
+
+        This patch introduces new class LabelableElement as base class of
+        HTMLFormControlElement for sharing implementation of "labels" 
+        attribute among form-associate elements, "meter" element, and 
+        "progress" element.
+
+        This patch allows us to change base class of HTMLMeterElement and
+        HTMLProgressElement dervied from HTMLFormControlElement to 
+        HTMLElement for remove them from HTMLFormElement::m_associatedFormElements
+        where we don't need to put "meter" and "progress" elements(bug 80381.)
+
+        This patch also changes implementation of isLabelable using virtual
+        method rather than sequence of hasTagName for execution speed and
+        better readability.
+
+        No new tests are required. No behavior changes.
+
+        * CMakeLists.txt: Add LabelableElement.cpp and .h
+        * GNUmakefile.list.am:  Add LabelableElement.cpp and .h
+        * Target.pri: Add LabelableElement.cpp and .h
+        * WebCore.gypi: Add LabelableElement.cpp and .h
+        * WebCore.vcproj/WebCore.vcproj: Add LabelableElement.cpp and .h
+        * WebCore.xcodeproj/project.pbxproj: Add LabelableElement.cpp and .h
+        * html/HTMLButtonElement.h: Implement isLabelable.
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::HTMLFormControlElement): Change direct base class.
+        * html/HTMLFormControlElement.h:
+        (HTMLFormControlElement): Change direct base class.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::isLabelable): Removed to use virtual method instead of hasTagName.
+        (WebCore):
+        * html/HTMLInputElement.h: Declaration of isLabelable.
+        * html/HTMLKeygenElement.h: Implement isLabelable.
+        * html/HTMLMeterElement.h: Implement isLabelable.
+        * html/HTMLProgressElement.h: Implement isLabelable.
+        * html/HTMLSelectElement.h: Implement isLabelable.
+        * html/HTMLTextAreaElement.h: Implement isLabelable.
+        * html/LabelableElement.cpp: Added.
+        (WebCore):
+        (WebCore::LabelableElement::LabelableElement):
+        (WebCore::LabelableElement::~LabelableElement):
+        (WebCore::LabelableElement::labels): Moved from HTMLFormControlElement.
+        * html/LabelableElement.h: Added.
+        (WebCore):
+        (LabelableElement):
+
+2012-03-07  Arun Patole  <bmf834@motorola.com>
+
+        HTMLTrackElement.idl doesn't have default attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=80116
+
+        Reviewed by Kentaro Hara.
+
+        Renamed isDefault to 'default' so that in JS, it will be track.default instead of track.isDefault.
+        * html/HTMLTrackElement.idl:
+
+2012-03-07  Zoltan Horvath  <zoltan@webkit.org>
+
+        [Qt] Add qmake config tests for JPEG and PNG library
+        https://bugs.webkit.org/show_bug.cgi?id=80398
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add JPEG and PNG library tests to config.tests and
+        add error() abort to WebCore.pri if tests don't work.
+
+        * WebCore.pri:
+
+2012-03-06  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: extract source mapping logic from DebuggerPresentationModel to ScriptMappingImpl.
+        https://bugs.webkit.org/show_bug.cgi?id=80412
+
+        Reviewed by Vsevolod Vlasov.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/ScriptMapping.js:
+        (WebInspector.ScriptMappingImpl):
+        (WebInspector.ScriptMappingImpl.prototype.rawLocationToUILocation):
+        (WebInspector.ScriptMappingImpl.prototype.createLiveLocation):
+        (WebInspector.ScriptMappingImpl.prototype.uiSourceCodeList):
+        (WebInspector.ScriptMappingImpl.prototype._handleUISourceCodeListChanged):
+        (WebInspector.ScriptMappingImpl.prototype._uiSourceCodeListChanged):
+        (WebInspector.ScriptMappingImpl.prototype._bindScriptToRawSourceCode):
+        (WebInspector.ScriptMappingImpl.prototype.setFormatSource):
+        (WebInspector.ScriptMappingImpl.prototype.forceUpdateSourceMapping):
+        (WebInspector.ScriptMappingImpl.prototype.reset):
+
+2012-03-07  Mark Rowe  <mrowe@apple.com>
+
+        Fix DerivedSources.make to not assume that WTF and WebCore build in to the same build directory.
+
+        We can't assume that wtf/Platform.h can be found inside BUILT_PRODUCTS_DIR as
+        that won't be the case if WTF and WebCore are building in to different build
+        directories. We should instead look for wtf/Platform.h in the header search path.
+        
+        Unreviewed due to being a build fix.
+
+        * DerivedSources.make: Set up the header search path, and invoke the compiler in
+        such a manner that it looks for wtf/Platform.h in that search path.
+
+2012-03-07  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream Texture and TextureCache
+        https://bugs.webkit.org/show_bug.cgi?id=80121
+
+        Reviewed by Rob Buis.
+
+        Initial upstream, no new tests.
+
+        * platform/graphics/blackberry/Texture.cpp: Added.
+        (WebCore):
+        (WebCore::copyImageData):
+        (WebCore::Texture::Texture):
+        (WebCore::Texture::~Texture):
+        (WebCore::Texture::updateContents):
+        (WebCore::Texture::setContentsToColor):
+        (WebCore::Texture::protect):
+        * platform/graphics/blackberry/Texture.h: Added.
+        (WebCore):
+        (Texture):
+        (WebCore::Texture::create):
+        (WebCore::Texture::textureId):
+        (WebCore::Texture::isDirty):
+        (WebCore::Texture::hasTexture):
+        (WebCore::Texture::isColor):
+        (WebCore::Texture::isOpaque):
+        (WebCore::Texture::isProtected):
+        (WebCore::Texture::protect):
+        (WebCore::Texture::unprotect):
+        (WebCore::Texture::size):
+        (WebCore::Texture::width):
+        (WebCore::Texture::height):
+        (WebCore::Texture::bytesPerPixel):
+        (WebCore::Texture::setTextureId):
+        * platform/graphics/blackberry/TextureCacheCompositingThread.cpp: Added.
+        (WebCore):
+        (TextureProtector):
+        (WebCore::TextureProtector::TextureProtector):
+        (WebCore::TextureProtector::~TextureProtector):
+        (WebCore::TextureCacheCompositingThread::TextureCacheCompositingThread):
+        (WebCore::TextureCacheCompositingThread::allocateTextureId):
+        (WebCore::TextureCacheCompositingThread::freeTextureId):
+        (WebCore::TextureCacheCompositingThread::collectGarbage):
+        (WebCore::TextureCacheCompositingThread::textureResized):
+        (WebCore::TextureCacheCompositingThread::textureDestroyed):
+        (WebCore::TextureCacheCompositingThread::install):
+        (WebCore::TextureCacheCompositingThread::evict):
+        (WebCore::TextureCacheCompositingThread::textureAccessed):
+        (WebCore::textureCacheCompositingThread):
+        (WebCore::TextureCacheCompositingThread::prune):
+        (WebCore::TextureCacheCompositingThread::clear):
+        (WebCore::TextureCacheCompositingThread::setMemoryUsage):
+        (WebCore::TextureCacheCompositingThread::textureForTiledContents):
+        (WebCore::TextureCacheCompositingThread::textureForColor):
+        (WebCore::TextureCacheCompositingThread::updateContents):
+        (WebCore::TextureCacheCompositingThread::key):
+        * platform/graphics/blackberry/TextureCacheCompositingThread.h: Added.
+        (WebCore):
+        (TextureCacheCompositingThread):
+        (WebCore::TextureCacheCompositingThread::createTexture):
+        (WebCore::TextureCacheCompositingThread::memoryUsage):
+        (WebCore::TextureCacheCompositingThread::memoryLimit):
+        (WebCore::TextureCacheCompositingThread::setMemoryLimit):
+        (WebCore::TextureCacheCompositingThread::prune):
+        (WebCore::TextureCacheCompositingThread::ZombieTexture::ZombieTexture):
+        (ZombieTexture):
+        (WebCore::TextureCacheCompositingThread::incMemoryUsage):
+        (WebCore::TextureCacheCompositingThread::decMemoryUsage):
+        (WebCore::TextureCacheCompositingThread::ColorHash::hash):
+        (WebCore::TextureCacheCompositingThread::ColorHash::equal):
+        (ColorHash):
+        (ColorHashTraits):
+        (WebCore::TextureCacheCompositingThread::ColorHashTraits::constructDeletedValue):
+        (WebCore::TextureCacheCompositingThread::ColorHashTraits::isDeletedValue):
+
+2012-03-07  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Should raise SYNTAX_ERR when message contains unpaired surrogates
+        https://bugs.webkit.org/show_bug.cgi?id=80103
+
+        Reviewed by Kent Tamura.
+
+        Add UTF8 validation checks for WebSocket message and close reason.
+
+        Tests: http/tests/websocket/tests/hybi/unpaired-surrogates-in-close-reason.html
+               http/tests/websocket/tests/hybi/unpaired-surrogates-in-message.html
+
+        * Modules/websockets/WebSocket.cpp:
+        (WebCore::WebSocket::send): Raise SYNTAX_ERR if the message is invalid.
+        (WebCore::WebSocket::close):Raise SYNTAX_ERR if the reason is invalid.
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::send): Check whether message is a valid UTF8 string.
+
+2012-03-07  Byungwoo Lee  <bw80.lee@samsung.com>
+
+        [EFL] Build warning: Fix warn_unused_result warnings.
+        https://bugs.webkit.org/show_bug.cgi?id=79194
+
+        Reviewed by Filip Pizlo.
+
+        Fixed build warning which is getting generated when not using return
+        value of a fuction, especially declared with warn_unused_result
+        attribute.
+
+        * platform/efl/SharedBufferEfl.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+
+2012-03-07  Kent Tamura  <tkent@chromium.org>
+
+        Cleanup of RenderTextControl::adjustControlHeightBasedOnLineHeight()
+        https://bugs.webkit.org/show_bug.cgi?id=80480
+
+        Reviewed by Hajime Morita.
+
+        The callsite of adjustControlHeightBasedOnLineHeight() stored
+        padding+border+margin height of the inner text in height(), and
+        adjustControlHeightBasedOnLineHeight() implementations refered it. It
+        was unreasonable and hard to understand.
+
+        The purpose of adjustControlHeightBasedOnLineHeight() is to compute
+        - the maximum height of line-heights of the inner text and decorations
+        - the maximum height of padding+border+margin heights of the inner text and decorations,
+        and to sum them up. This patch rewrites the code to make it understood easily.
+
+        adjustControlHeightBasedOnLineHeight() is renamed to
+        computeControlheight(), it takes additional parameter of
+        padding+boder+margin height, and returns the sum of them.
+
+        No behavior change.
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::computeLogicalHeight):
+        * rendering/RenderTextControl.h:
+        (RenderTextControl):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::computeControlHeight):
+        * rendering/RenderTextControlMultiLine.h:
+        (RenderTextControlMultiLine):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::computeControlHeight):
+        * rendering/RenderTextControlSingleLine.h:
+        (RenderTextControlSingleLine):
+
+2012-03-06  Eric Seidel  <eric@webkit.org>
+
+        Make WTF public headers use fully-qualified include paths and remove ForwardingHeaders/wtf
+        https://bugs.webkit.org/show_bug.cgi?id=80363
+
+        Reviewed by Mark Rowe.
+
+        ForwardingHeaders/wtf is no longer needed (or functional) now that
+        JavaScriptCore no longer includes the WTF headers as private headers.
+
+        * DerivedSources.make:
+        * ForwardingHeaders/wtf/ASCIICType.h: Removed.
+        * ForwardingHeaders/wtf/AVLTree.h: Removed.
+        * ForwardingHeaders/wtf/Alignment.h: Removed.
+        * ForwardingHeaders/wtf/AlwaysInline.h: Removed.
+        * ForwardingHeaders/wtf/ArrayBuffer.h: Removed.
+        * ForwardingHeaders/wtf/ArrayBufferView.h: Removed.
+        * ForwardingHeaders/wtf/Assertions.h: Removed.
+        * ForwardingHeaders/wtf/Atomics.h: Removed.
+        * ForwardingHeaders/wtf/Bitmap.h: Removed.
+        * ForwardingHeaders/wtf/BloomFilter.h: Removed.
+        * ForwardingHeaders/wtf/BumpPointerAllocator.h: Removed.
+        * ForwardingHeaders/wtf/ByteArray.h: Removed.
+        * ForwardingHeaders/wtf/CheckedArithmetic.h: Removed.
+        * ForwardingHeaders/wtf/CheckedBoolean.h: Removed.
+        * ForwardingHeaders/wtf/Compiler.h: Removed.
+        * ForwardingHeaders/wtf/Complex.h: Removed.
+        * ForwardingHeaders/wtf/CryptographicallyRandomNumber.h: Removed.
+        * ForwardingHeaders/wtf/CurrentTime.h: Removed.
+        * ForwardingHeaders/wtf/DataLog.h: Removed.
+        * ForwardingHeaders/wtf/DateInstanceCache.h: Removed.
+        * ForwardingHeaders/wtf/DateMath.h: Removed.
+        * ForwardingHeaders/wtf/DecimalNumber.h: Removed.
+        * ForwardingHeaders/wtf/Decoder.h: Removed.
+        * ForwardingHeaders/wtf/Deque.h: Removed.
+        * ForwardingHeaders/wtf/DisallowCType.h: Removed.
+        * ForwardingHeaders/wtf/DoublyLinkedList.h: Removed.
+        * ForwardingHeaders/wtf/DynamicAnnotations.h: Removed.
+        * ForwardingHeaders/wtf/Encoder.h: Removed.
+        * ForwardingHeaders/wtf/ExportMacros.h: Removed.
+        * ForwardingHeaders/wtf/FastAllocBase.h: Removed.
+        * ForwardingHeaders/wtf/FastMalloc.h: Removed.
+        * ForwardingHeaders/wtf/FixedArray.h: Removed.
+        * ForwardingHeaders/wtf/Float32Array.h: Removed.
+        * ForwardingHeaders/wtf/Float64Array.h: Removed.
+        * ForwardingHeaders/wtf/Forward.h: Removed.
+        * ForwardingHeaders/wtf/Functional.h: Removed.
+        * ForwardingHeaders/wtf/GetPtr.h: Removed.
+        * ForwardingHeaders/wtf/HashCountedSet.h: Removed.
+        * ForwardingHeaders/wtf/HashFunctions.h: Removed.
+        * ForwardingHeaders/wtf/HashMap.h: Removed.
+        * ForwardingHeaders/wtf/HashSet.h: Removed.
+        * ForwardingHeaders/wtf/HashTable.h: Removed.
+        * ForwardingHeaders/wtf/HashTraits.h: Removed.
+        * ForwardingHeaders/wtf/HexNumber.h: Removed.
+        * ForwardingHeaders/wtf/Int16Array.h: Removed.
+        * ForwardingHeaders/wtf/Int32Array.h: Removed.
+        * ForwardingHeaders/wtf/Int8Array.h: Removed.
+        * ForwardingHeaders/wtf/ListHashSet.h: Removed.
+        * ForwardingHeaders/wtf/ListRefPtr.h: Removed.
+        * ForwardingHeaders/wtf/Locker.h: Removed.
+        * ForwardingHeaders/wtf/MD5.h: Removed.
+        * ForwardingHeaders/wtf/MainThread.h: Removed.
+        * ForwardingHeaders/wtf/MathExtras.h: Removed.
+        * ForwardingHeaders/wtf/MessageQueue.h: Removed.
+        * ForwardingHeaders/wtf/MetaAllocator.h: Removed.
+        * ForwardingHeaders/wtf/MetaAllocatorHandle.h: Removed.
+        * ForwardingHeaders/wtf/NonCopyingSort.h: Removed.
+        * ForwardingHeaders/wtf/Noncopyable.h: Removed.
+        * ForwardingHeaders/wtf/NotFound.h: Removed.
+        * ForwardingHeaders/wtf/OSAllocator.h: Removed.
+        * ForwardingHeaders/wtf/OwnArrayPtr.h: Removed.
+        * ForwardingHeaders/wtf/OwnPtr.h: Removed.
+        * ForwardingHeaders/wtf/OwnPtrCommon.h: Removed.
+        * ForwardingHeaders/wtf/PageAllocation.h: Removed.
+        * ForwardingHeaders/wtf/PageAllocationAligned.h: Removed.
+        * ForwardingHeaders/wtf/PageBlock.h: Removed.
+        * ForwardingHeaders/wtf/PageReservation.h: Removed.
+        * ForwardingHeaders/wtf/ParallelJobs.h: Removed.
+        * ForwardingHeaders/wtf/PassOwnArrayPtr.h: Removed.
+        * ForwardingHeaders/wtf/PassOwnPtr.h: Removed.
+        * ForwardingHeaders/wtf/PassRefPtr.h: Removed.
+        * ForwardingHeaders/wtf/Platform.h: Removed.
+        * ForwardingHeaders/wtf/PossiblyNull.h: Removed.
+        * ForwardingHeaders/wtf/RandomNumber.h: Removed.
+        * ForwardingHeaders/wtf/RedBlackTree.h: Removed.
+        * ForwardingHeaders/wtf/RefCounted.h: Removed.
+        * ForwardingHeaders/wtf/RefCountedLeakCounter.h: Removed.
+        * ForwardingHeaders/wtf/RefPtr.h: Removed.
+        * ForwardingHeaders/wtf/RetainPtr.h: Removed.
+        * ForwardingHeaders/wtf/SHA1.h: Removed.
+        * ForwardingHeaders/wtf/SegmentedVector.h: Removed.
+        * ForwardingHeaders/wtf/SimpleStats.h: Removed.
+        * ForwardingHeaders/wtf/Spectrum.h: Removed.
+        * ForwardingHeaders/wtf/StackBounds.h: Removed.
+        * ForwardingHeaders/wtf/StaticConstructors.h: Removed.
+        * ForwardingHeaders/wtf/StdLibExtras.h: Removed.
+        * ForwardingHeaders/wtf/StringExtras.h: Removed.
+        * ForwardingHeaders/wtf/StringHasher.h: Removed.
+        * ForwardingHeaders/wtf/TemporaryChange.h: Removed.
+        * ForwardingHeaders/wtf/ThreadRestrictionVerifier.h: Removed.
+        * ForwardingHeaders/wtf/ThreadSafeRefCounted.h: Removed.
+        * ForwardingHeaders/wtf/ThreadSpecific.h: Removed.
+        * ForwardingHeaders/wtf/Threading.h: Removed.
+        * ForwardingHeaders/wtf/ThreadingPrimitives.h: Removed.
+        * ForwardingHeaders/wtf/TypeTraits.h: Removed.
+        * ForwardingHeaders/wtf/Uint16Array.h: Removed.
+        * ForwardingHeaders/wtf/Uint32Array.h: Removed.
+        * ForwardingHeaders/wtf/Uint8Array.h: Removed.
+        * ForwardingHeaders/wtf/Uint8ClampedArray.h: Removed.
+        * ForwardingHeaders/wtf/UnusedParam.h: Removed.
+        * ForwardingHeaders/wtf/VMTags.h: Removed.
+        * ForwardingHeaders/wtf/ValueCheck.h: Removed.
+        * ForwardingHeaders/wtf/Vector.h: Removed.
+        * ForwardingHeaders/wtf/VectorTraits.h: Removed.
+        * ForwardingHeaders/wtf/WTFThreadData.h: Removed.
+        * ForwardingHeaders/wtf/dtoa.h: Removed.
+        * ForwardingHeaders/wtf/dtoa/double-conversion.h: Removed.
+        * ForwardingHeaders/wtf/text/ASCIIFastPath.h: Removed.
+        * ForwardingHeaders/wtf/text/AtomicString.h: Removed.
+        * ForwardingHeaders/wtf/text/AtomicStringHash.h: Removed.
+        * ForwardingHeaders/wtf/text/AtomicStringImpl.h: Removed.
+        * ForwardingHeaders/wtf/text/CString.h: Removed.
+        * ForwardingHeaders/wtf/text/StringBuffer.h: Removed.
+        * ForwardingHeaders/wtf/text/StringBuilder.h: Removed.
+        * ForwardingHeaders/wtf/text/StringConcatenate.h: Removed.
+        * ForwardingHeaders/wtf/text/StringHash.h: Removed.
+        * ForwardingHeaders/wtf/text/StringImpl.h: Removed.
+        * ForwardingHeaders/wtf/text/TextPosition.h: Removed.
+        * ForwardingHeaders/wtf/text/WTFString.h: Removed.
+        * ForwardingHeaders/wtf/unicode/CharacterNames.h: Removed.
+        * ForwardingHeaders/wtf/unicode/Collator.h: Removed.
+        * ForwardingHeaders/wtf/unicode/UTF8.h: Removed.
+        * ForwardingHeaders/wtf/unicode/Unicode.h: Removed.
+        * ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h: Removed.
+        * ForwardingHeaders/wtf/unicode/wince/UnicodeWince.h: Removed.
+        * ForwardingHeaders/wtf/url/ParsedURL.h: Removed.
+
+2012-03-07  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] The "legend" element should not be a form-associated element.
+        https://bugs.webkit.org/show_bug.cgi?id=80239
+
+        Reviewed by Kent Tamura.
+
+        This patch changes base class of HTMLLegendElement to HTMLElement from
+        HTMLFormControlElement for saving memory space and iteration time of
+        extra "legend" elements in HTMLFormElement::m_formAssociatedElements
+        and matching the HTML5 specification for ease of maintenance.
+
+        Changes of TextIterator is lead by usage of isFormControlElement. This
+        changes will be replaced with more meaningful predicate as part of
+        https://bugs.webkit.org/show_bug.cgi?id=80381
+
+        No new tests are required. No behavior changes.
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::advance): Check HTMLLegendElement in addition to isFormControlElement. This change is for text dump in LayoutTests implemented by document.innerText attribute.
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::HTMLLegendElement): Remove form parameter.
+        (WebCore::HTMLLegendElement::create): Remove form parameter.
+        (WebCore::HTMLLegendElement::associatedControl): Stop checking legend element, because HTMLLegendElement is no longer HTMLFormControlElement.
+        (WebCore::HTMLLegendElement::supportFocus): Removed. It called HTMLElement::supportFocus.
+        (WebCore::HTMLLegendElement::formControlType): Remove implementation of virtual method declared in HTMLFormControlElement.
+        * html/HTMLLegendElement.h:
+        (HTMLLegendElement): Change base class to HTMLElement.
+        * html/HTMLTagNames.in: Remove "constructorNeedsFormElement" for not passing "form" parameter in HTMLElementFactory.
+
+2012-03-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Make the removal of transitive library dependencies work with CMake < 2.8.7.
+        https://bugs.webkit.org/show_bug.cgi?id=80469
+
+        Reviewed by Antonio Gomes.
+
+        No new tests, this is a buildsystem change.
+
+        * CMakeLists.txt: Manually set the LINK_INTERFACE_LIBRARIES target
+        property on the library being created.
+
+2012-03-06  Lianghui Chen  <liachen@rim.com>
+
+        [BlackBerry] Set correct ResourceRequest target type.
+        https://bugs.webkit.org/show_bug.cgi?id=80430
+
+        Reviewed by Rob Buis.
+
+        For loads started by AppCache, they are based on the manifest file,
+        it is not definitely sure what target it is for, so we just guess
+        based on its mimetype or file extension.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::createResourceHandle):
+        * loader/cache/CachedResource.cpp:
+        (WebCore):
+        (WebCore::CachedResource::load):
+        * platform/network/blackberry/ResourceRequest.h:
+        (ResourceRequest):
+        * platform/network/blackberry/ResourceRequestBlackBerry.cpp:
+        (WebCore):
+        (WebCore::mimeTypeRequestTypeMap):
+        (WebCore::ResourceRequest::targetTypeFromMimeType):
+        * workers/DefaultSharedWorkerRepository.cpp:
+        (WebCore::SharedWorkerScriptLoader::load):
+        * workers/Worker.cpp:
+        (WebCore::Worker::create):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::createResourceRequest):
+        * workers/WorkerScriptLoader.h:
+        (WorkerScriptLoader):
+
+2012-03-06  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Add clipping to scissor rect to CCOcclusionTracker
+        https://bugs.webkit.org/show_bug.cgi?id=79927
+
+        Reviewed by Adrienne Walker.
+
+        Adds logic to CCOcclusionTracker to occlude anything outside of the
+        current screen and target surface scissor rects. When tracking
+        damage for partial swaps, the scissor rects are bounded by the
+        tracked damage rects.
+
+        Unit tests: CCOcclusionTrackerTest.cpp
+
+        * platform/graphics/chromium/cc/CCOcclusionTracker.cpp:
+        (WebCore::::CCOcclusionTrackerBase):
+        (WebCore):
+        (WebCore::::markOccludedBehindLayer):
+        (WebCore::testContentRectOccluded):
+        (WebCore::::occluded):
+        (WebCore::computeUnoccludedContentRect):
+        (WebCore::::unoccludedContentRect):
+        (WebCore::::layerScissorRect):
+        * platform/graphics/chromium/cc/CCOcclusionTracker.h:
+        (WebCore):
+        (CCOcclusionTrackerDamageClientBase):
+        (CCOcclusionTrackerBase):
+
+2012-03-06  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rolling out r110011.
+        http://trac.webkit.org/changeset/110011
+        https://bugs.webkit.org/show_bug.cgi?id=80376
+
+        layout tests crash
+
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore):
+        (WebCore::V8HiddenPropertyName::hiddenReferenceName):
+        * bindings/v8/V8HiddenPropertyName.h:
+        (WebCore):
+        (V8HiddenPropertyName):
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::toV8):
+
+2012-03-06  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rolling out r110016.
+        http://trac.webkit.org/changeset/110016
+
+        layout tests crash
+
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::toV8):
+
+2012-03-06  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, fixed test crashes.
+
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::toV8):
+
+2012-03-06  Hajime Morrita  <morrita@chromium.org>
+
+        https://bugs.webkit.org/show_bug.cgi?id=79935
+        REGRESSION: <content> element is not HTMLUnknownElement when Shadow DOM API is disabled
+
+        Reviewed by Adam Barth.
+
+        This change introduced "runtimeConditional" keyword to make_name.pl sources,
+        which allows HTMLElementFactory and HTMLElementWrapperFactory to check RuntimeEnabledFeatures
+        and treat any tag name as HTMLUnknownElement if its definition has runtimeConditional and
+        the flag given is turned off.
+
+        Test: fast/dom/shadow/content-shadow-unknown.html
+
+        * WebCore.exp.in:
+        * dom/make_names.pl:
+        (defaultTagPropertyHash):
+        (printConstructorInterior):
+        (printFactoryCppFile):
+        (printWrapperFunctions):
+        (printWrapperFactoryCppFile):
+        * html/HTMLTagNames.in:
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::contentTagName):
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::InternalSettings):
+        (WebCore::InternalSettings::restoreTo):
+        (WebCore::InternalSettings::setShadowDOMEnabled):
+        (WebCore):
+        * testing/InternalSettings.h:
+        (InternalSettings):
+        * testing/InternalSettings.idl:
+
+2012-03-06  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Introduce ThreadableWebSocketChannel::SendResult
+        https://bugs.webkit.org/show_bug.cgi?id=80356
+
+        Reviewed by Kent Tamura.
+
+        Introduced ThreadableWebSocketChannel::SendResult type so that
+        WebSocketChannel can pass the validation result.
+
+        No new test. No changes in behavior.
+
+        * Modules/websockets/ThreadableWebSocketChannel.h: Added SendResult.
+        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper):
+        (WebCore::ThreadableWebSocketChannelClientWrapper::sendRequestResult): Use ThreadableWebSocketChannel::SendResult instead of bool.
+        (WebCore::ThreadableWebSocketChannelClientWrapper::setSendRequestResult): Ditto.
+        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (ThreadableWebSocketChannelClientWrapper):
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::send): Use ThreadableWebSocketChannel::SendResult instead of bool. Pass Cstring to enqueTextFrame instead of String.
+        (WebCore::WebSocketChannel::enqueueTextFrame): Ditto.
+        (WebCore::WebSocketChannel::processOutgoingFrameQueue): Ditto.
+        * Modules/websockets/WebSocketChannel.h:
+        (WebSocketChannel):
+        (QueuedFrame): Changed the type of stringData from String to CString.
+        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::send): Use ThreadableWebSocketChannel::SendResult instead of bool.
+        (WebCore::workerContextDidSend): Ditto.
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::send): Ditto.
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send): Ditto.
+        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
+        (WorkerThreadableWebSocketChannel): ditto.
+        (Bridge): Ditto.
+
+2012-03-06  Kentaro Hara  <haraken@chromium.org>
+
+        [V8][Performance] Optimize V8 bindings for HTMLElement.classList,
+        Element.dataset and Node.attributes
+        https://bugs.webkit.org/show_bug.cgi?id=80376
+
+        Reviewed by Adam Barth.
+
+        This patch improves the performance of HTMLElement.classList, Element.dataset
+        and Node.attributes by 6.4 times, 7.1 times and 10.9 times, respectively.
+
+        Previously, a 'hiddenReferenceName' string was allocated on v8::Handle and
+        created every time the DOM attribute is accessed, in spite of the fact that
+        the 'hiddenReferenceName' string is static.
+
+        This patch moves the 'hiddenReferenceName' string to v8::Persistent and makes it static.
+        Also, this patch removes 'if (!elementValue.IsEmpty() && elementValue->IsObject())',
+        since if 'element' exists, it is guaranteed that 'elementValue' is not empty
+        and is an Object.
+
+        Performance tests: https://bugs.webkit.org/attachment.cgi?id=130283
+
+        AppleWebKit/JavaScriptCore:
+        div.classList : 382ms
+        div.classList.foo = 123 : 335ms
+        div.dataset : 403ms
+        div.dataset.foo = 123 : 5250ms
+        div.attributes : 183ms
+
+        Chromium/V8 (without this patch):
+        div.classList : 9140ms
+        div.classList.foo = 123 : 9086ms
+        div.dataset : 9930ms
+        div.dataset.foo = 123 : 49698ms
+        div.attributes : 13489ms
+
+        Chromium/V8 (with this patch):
+        div.classList : 1435ms
+        div.classList.foo = 123 : 1470ms
+        div.dataset : 1400ms
+        div.dataset.foo = 123 : 30396ms
+        div.attributes : 1242ms
+
+        No tests. No change in behavior.
+
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp: Modified as described above.
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Ditto.
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp: Ditto.
+        (WebCore::toV8):
+
+        * bindings/v8/V8HiddenPropertyName.cpp: Defined a hidden property name string statically
+        to optimize the macro.
+        (WebCore):
+        (WebCore::V8HiddenPropertyName::hiddenReferenceName):
+        * bindings/v8/V8HiddenPropertyName.h: Modified to switch two prefixes "WebCore::HiddenProperty::"
+        and "WebCore::HiddenReference::", depending on whether a given name represents a hidden property
+        or a hidden reference.
+        (WebCore):
+        (V8HiddenPropertyName):
+
+2012-03-06  Nat Duca  <nduca@chromium.org>
+
+        [chromium] CCThreadProxy context lost support
+        https://bugs.webkit.org/show_bug.cgi?id=80100
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCScheduler.cpp:
+        (WebCore::CCScheduler::didLoseContext):
+        (WebCore):
+        (WebCore::CCScheduler::didRecreateContext):
+        (WebCore::CCScheduler::processScheduledActions):
+        * platform/graphics/chromium/cc/CCScheduler.h:
+        (CCSchedulerClient):
+        (CCScheduler):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp:
+        (WebCore::CCSchedulerStateMachine::CCSchedulerStateMachine):
+        (WebCore::CCSchedulerStateMachine::nextAction):
+        (WebCore::CCSchedulerStateMachine::updateState):
+        (WebCore::CCSchedulerStateMachine::vsyncCallbackNeeded):
+        (WebCore::CCSchedulerStateMachine::didLoseContext):
+        (WebCore):
+        (WebCore::CCSchedulerStateMachine::didRecreateContext):
+        * platform/graphics/chromium/cc/CCSchedulerStateMachine.h:
+        (CCSchedulerStateMachine):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::recreateContext):
+        (WebCore::CCThreadProxy::loseContext):
+        (WebCore::CCThreadProxy::scheduledActionBeginContextRecreation):
+        (WebCore):
+        (WebCore::CCThreadProxy::scheduledActionDrawAndSwap):
+        (WebCore::CCThreadProxy::setAnimationEvents):
+        (WebCore::CCThreadProxy::beginContextRecreation):
+        (WebCore::CCThreadProxy::recreateContextOnImplThread):
+        (WebCore::CCThreadProxy::loseContextOnImplThread):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-03-06  Tony Chang  <tony@chromium.org>
+
+        refactor method names in RenderFlexibleBox to make them more consistent
+        https://bugs.webkit.org/show_bug.cgi?id=80446
+
+        Reviewed by Ojan Vafai.
+
+        No new tests, just renaming internal methods.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::flowAwareBorderAfter): New, used by layoutAndPlaceChildren
+        (WebCore::RenderFlexibleBox::flowAwarePaddingAfter): New, used by layoutAndPlaceChildren
+        (WebCore::RenderFlexibleBox::marginBoxAscentForChild): Add ForChild for consistency.
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren): We were adding the before padding+border twice (it's in the offset and
+        crossAxisBorderAndPaddingExtent() and subtracting it once.  Instead, just add the after padding+border.
+        (WebCore::RenderFlexibleBox::alignChildren):
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox): Reorder methods to match the .cpp file.
+
+2012-03-06  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rolling out r109969.
+        http://trac.webkit.org/changeset/109969
+        https://bugs.webkit.org/show_bug.cgi?id=80376
+
+        layout tests crash
+
+        * bindings/v8/V8HiddenPropertyName.cpp:
+        (WebCore):
+        (WebCore::V8HiddenPropertyName::hiddenReferenceName):
+        * bindings/v8/V8HiddenPropertyName.h:
+        (WebCore):
+        (V8HiddenPropertyName):
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::toV8):
+
+2012-03-06  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rolling out r109999.
+        http://trac.webkit.org/changeset/109999
+
+        layout tests crash
+
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp:
+        (WebCore::toV8):
+
+2012-03-06  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, fix crashes.
+
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp:
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp:
+        (WebCore::toV8):
+
+2012-03-06  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Fix threaded compositing issues in WebGLLayerChromium (except for printing)
+        https://bugs.webkit.org/show_bug.cgi?id=80459
+
+        Reviewed by Kenneth Russell.
+
+        This fixes a few wrong-thread issues in WebGLLayerChromium for threaded compositing.  The key requirements that
+        threaded compositing imposes on LayerChromium subclasses are that the compositor's context can only be used from
+        the compositor thread, meaning inside of updateCompositorResources() and pushPropertiesTo(), and that
+        non-compositor contexts can only be used from the main thread. This means specifically that we can't use the
+        DrawingBuffer's context in either of these two functions.
+
+        Summary of changes:
+        *) Move the publishToPlatformLayer() call and related logic inside of paintContentsIfDirty(), which is called
+        on the main thread.
+        *) Move lost context tracking outside of drawsContent(), since that function is called from both threads, to a
+        separate bool that is updated after each WebGL composite and setDrawingBuffer call.
+
+        Printing still doesn't work in threaded mode with this patch, I'll address that separately. Printing and lost
+        context recovery still work as they did in the single-threaded path.
+
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::WebGLLayerChromium):
+        (WebCore::WebGLLayerChromium::drawsContent):
+        (WebCore::WebGLLayerChromium::paintContentsIfDirty):
+        (WebCore::WebGLLayerChromium::updateCompositorResources):
+        (WebCore::WebGLLayerChromium::setDrawingBuffer):
+        * platform/graphics/chromium/WebGLLayerChromium.h:
+        (WebGLLayerChromium):
+
+2012-03-06  Anders Carlsson  <andersca@apple.com>
+
+        Cracks between tiles when zoomed in
+        https://bugs.webkit.org/show_bug.cgi?id=80460
+        <rdar://problem/10996688>
+
+        Use enclosingIntRect instead of enclosedIntRect when converting from FloatRect to IntRect.
+
+        * platform/graphics/mac/WebLayer.mm:
+        (drawLayerContents):
+
+2012-03-06  Anders Carlsson  <andersca@apple.com>
+
+        Tile cache layers should always be clipped to the view's bounds
+        https://bugs.webkit.org/show_bug.cgi?id=80456
+        <rdar://problem/10996174>
+
+        Reviewed by Simon Fraser.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::shouldClipCompositedBounds):
+        Factor this code out into a separate function for better clarity. Always return true if we have a tile cache layer.
+
+        (WebCore::RenderLayerBacking::updateCompositedBounds):
+        Call shouldClipCompositedBounds directly.
+
+2012-03-06  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Null-check m_layerRenderer in CCLayerTreeHostImpl::finishAllRendering()
+        https://bugs.webkit.org/show_bug.cgi?id=80445
+
+        Reviewed by Adrienne Walker.
+
+        Null-check CCLayerTreeHostImpl::m_layerRenderer since it won't be set if context initialiation failed for any
+        reason.
+
+        Covered by new unit test in CCLayerTreeHostImplTest.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::finishAllRendering):
+
+2012-03-06  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Can't select a line of RTL text on Facebook
+        https://bugs.webkit.org/show_bug.cgi?id=59435
+
+        Reviewed by Eric Seidel.
+
+        Deploy prevLeafChildIgnoringLineBreak and nextLeafChildIgnoringLineBreak
+        in RenderedPosition::leftBoundaryOfBidiRun and RenderedPosition::rightBoundaryOfBidiRun.
+
+        Without this patch, WebKit extends selection from right to left when the user selects
+        <span dir="rtl">ABC<br></span> from left to right by a mouse drag.
+
+        Test: editing/selection/select-bidi-run.html
+
+        * editing/RenderedPosition.cpp:
+        (WebCore::RenderedPosition::leftBoundaryOfBidiRun):
+        (WebCore::RenderedPosition::rightBoundaryOfBidiRun):
+
+2012-03-06  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        undefined reference to JSC::IdentifierTable::~IdentifierTable() on EFL port
+        https://bugs.webkit.org/show_bug.cgi?id=80282
+
+        Reviewed by Antonio Gomes.
+
+        No new tests, this is a buildsystem change.
+
+        Remove transitive library dependencies; they are especially
+        dangerous when one ends up linking against WTF, JSC and then WTF
+        again, since some symbols will not be defined.
+
+        Passing --no-copy-dt-needed-entries and --as-needed to the linker
+        (which some recent Linux distros do by default) makes the issue
+        even more evident.
+
+        * CMakeLists.txt: Explicitly link to WTF as WebCore uses symbols
+        from it.
+        * PlatformEfl.cmake: Explicitly link against libjpeg and libpng.
+
+2012-03-06  James Robinson  <jamesr@chromium.org>
+
+        [chromium] REGRESSION(109469): WebGL printing busted
+        https://bugs.webkit.org/show_bug.cgi?id=80450
+
+        Reviewed by Kenneth Russell.
+
+        Avoid marking layers as needing display in setContentsTo...() since this breaks WebGL's damage tracking and is
+        unnecessary.
+
+        Tested WebGL printing manually.
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setContentsToCanvas):
+        (WebCore::GraphicsLayerChromium::setContentsToMedia):
+
+2012-03-06  Adrienne Walker  <enne@google.com>
+
+        Overlap map for compositing should ignore empty layers
+        https://bugs.webkit.org/show_bug.cgi?id=63499
+
+        Reviewed by Simon Fraser.
+
+        Test: compositing/layer-creation/overlap-empty-layer.html
+
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::addToOverlapMap):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+
+2012-03-06  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        [chromium] Increase the accelerated canvas min size to 256 * 256
+        https://bugs.webkit.org/show_bug.cgi?id=80451
+
+        Reviewed by Stephen White.
+
+        Test: Manually
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2012-03-06  Kentaro Hara  <haraken@chromium.org>
+
+        [V8][Performance] Optimize V8 bindings for HTMLElement.classList,
+        Element.dataset and Node.attributes
+        https://bugs.webkit.org/show_bug.cgi?id=80376
+
+        Reviewed by Adam Barth.
+
+        This patch improves the performance of HTMLElement.classList, Element.dataset
+        and Node.attributes by 6.4 times, 7.1 times and 10.9 times, respectively.
+
+        Previously, a 'hiddenReferenceName' string was allocated on v8::Handle and
+        created every time the DOM attribute is accessed, in spite of the fact that
+        the 'hiddenReferenceName' string is static.
+
+        This patch moves the 'hiddenReferenceName' string to v8::Persistent and makes it static.
+        Also, this patch removes 'if (!elementValue.IsEmpty() && elementValue->IsObject())',
+        since if 'element' exists, it is guaranteed that 'elementValue' is not empty
+        and is an Object.
+
+        Performance tests: https://bugs.webkit.org/attachment.cgi?id=130283
+
+        AppleWebKit/JavaScriptCore:
+        div.classList : 382ms
+        div.classList.foo = 123 : 335ms
+        div.dataset : 403ms
+        div.dataset.foo = 123 : 5250ms
+        div.attributes : 183ms
+
+        Chromium/V8 (without this patch):
+        div.classList : 9140ms
+        div.classList.foo = 123 : 9086ms
+        div.dataset : 9930ms
+        div.dataset.foo = 123 : 49698ms
+        div.attributes : 13489ms
+
+        Chromium/V8 (with this patch):
+        div.classList : 1435ms
+        div.classList.foo = 123 : 1470ms
+        div.dataset : 1400ms
+        div.dataset.foo = 123 : 30396ms
+        div.attributes : 1242ms
+
+        No tests. No change in behavior.
+
+        * bindings/v8/custom/V8DOMStringMapCustom.cpp: Modified as described above.
+        (WebCore::toV8):
+        * bindings/v8/custom/V8DOMTokenListCustom.cpp: Ditto.
+        (WebCore::toV8):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp: Ditto.
+        (WebCore::toV8):
+
+        * bindings/v8/V8HiddenPropertyName.cpp: Defined a hidden property name string statically
+        to optimize the macro.
+        (WebCore):
+        (WebCore::V8HiddenPropertyName::hiddenReferenceName):
+        * bindings/v8/V8HiddenPropertyName.h: Modified to switch two prefixes "WebCore::HiddenProperty::"
+        and "WebCore::HiddenReference::", depending on whether a given name represents a hidden property
+        or a hidden reference.
+        (WebCore):
+        (V8HiddenPropertyName):
+
+2012-03-06  Alexis Menard  <alexis.menard@openbossa.org>
+
+        getComputedStyle returns incorrect values for the width and height of pseudo-elements
+        https://bugs.webkit.org/show_bug.cgi?id=37835
+
+        Reviewed by Tony Chang.
+
+        In case we are querying the computed style of an element with a pseudo-element we can't use
+        the renderer of the element as this one is not the one used to render the pseudo-element. We need
+        to use the one created to render the pseudo-element.
+
+        No new tests : Extend the existing getComputedStyle-with-pseudo-element.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2012-03-06  Shawn Singh  <shawnsingh@chromium.org>
+
+        [chromium] Make compositeAndReadback and damage tracking play nicely together
+        https://bugs.webkit.org/show_bug.cgi?id=80199
+
+        Reviewed by James Robinson.
+
+        Requires system-level testing (pixels on front-buffer should be
+        observed for correct behavior) that cannot be done by layout tests
+        or unit tests, have to rely on manual testing.
+
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::compositeAndReadback):
+
+2012-03-06  Luke Macpherson   <macpherson@chromium.org>
+
+        Make CSSStyleSelector::convertToLength() behave more like CSSPrimitiveValue::convertToLength().
+        https://bugs.webkit.org/show_bug.cgi?id=80375
+
+        Reviewed by Eric Seidel.
+
+        No new tests / cleanup only.
+
+        This patch removes the bool* ok parameter from CSSStyleSelector's convertToLength,
+        and instead uses the recently added Length(Undefined) value to indicate failure.
+        This paves the way for a future patch that will call primitiveValue->convertToLength directly.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-06  Raymes Khoury  <raymes@chromium.org>
+
+        Add state variable and ASSERTs to DocumentWriter to help track down
+        https://bugs.webkit.org/show_bug.cgi?id=80427 and prevent illegal usage
+        of DocumentWriter. This also makes endIfNotLoadingMainResource() private
+        as there is no external usage.
+
+        Reviewed by Adam Barth.
+
+        This only adds ASSERT/CRASH and does not change existing behaviour.
+
+        * loader/DocumentWriter.cpp:
+        (WebCore::DocumentWriter::DocumentWriter):
+        (WebCore::DocumentWriter::begin):
+        (WebCore::DocumentWriter::addData):
+        (WebCore::DocumentWriter::endIfNotLoadingMainResource):
+        (WebCore::DocumentWriter::setDocumentWasLoadedAsPartOfNavigation):
+        * loader/DocumentWriter.h:
+        (DocumentWriter):
+
+2012-03-06  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSSRegions][CSSOM]Restrict parsing of named flow name
+        https://bugs.webkit.org/show_bug.cgi?id=80359
+
+        Reviewed by Andreas Kling.
+
+        The function that does the parsing for flow thread name should restrict the
+        number of parsed properties to 1, otherwise it would allow parsing of
+        "-webkit-flow-into: flow; color: red;" constructions.
+
+        Modified fast/regions/webkit-named-flow-invalid-name.html to include the above case.
+
+        * css/CSSParser.cpp:
+        (WebCore::validFlowName):
+        (WebCore::CSSParser::parseFlowThread):
+
+2012-03-06  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed build fix for minimal build after r109939.
+
+        Guard access to page->inspectorController with ENABLE(INSPECTOR).
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::performPostLayoutTasks):
+
+2012-03-05  Dean Jackson  <dino@apple.com>
+
+        Enable compositing when a CSS filter is animating
+        https://bugs.webkit.org/show_bug.cgi?id=79048
+
+        Reviewed by Simon Fraser.
+
+        Now that some systems (e.g. OS X) have both hardware accelerated
+        CSS filters, and the ability to animate them via the hardware
+        compositor, all CSS filters should be composited when animating.
+
+        Tests: css3/filters/composited-during-animation-layertree.html
+               css3/filters/composited-during-animation.html
+               css3/filters/composited-during-transition-layertree.html
+
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore):
+        (WebCore::supportsAcceleratedFilterAnimations):
+            new method that returns true if the platform supports
+            hardware animations of filters.
+        (WebCore::GraphicsLayerCA::addAnimation):
+        (WebCore::GraphicsLayerCA::createAnimationFromKeyframes):
+            only create layer-animations if the platform supports it.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
+            create a compositing layer if animating a filter on a
+            supported platform.
+
+2012-03-06  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r109825.
+        http://trac.webkit.org/changeset/109825
+        https://bugs.webkit.org/show_bug.cgi?id=79413
+
+        Broke webkit_unit_tests on Chromium Win
+
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp:
+        (WebCore::IDBLevelDBBackingStore::open):
+        * platform/leveldb/LevelDBDatabase.cpp:
+        (WebCore):
+        * platform/leveldb/LevelDBDatabase.h:
+        (LevelDBDatabase):
+
+2012-03-06  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=80351
+        InlineTextBox is using the wrong origin when calling 
+        addRelevantRepaintedObject
+        -and corresponding-
+        <rdar://problem/10970221>
+
+        Reviewed by Sam Weinig.
+
+        boxOrigin represents the actual location of the text. The adjustedPaintOffset 
+        (which I was using previously) will only correspond to the first line in a 
+        block of lines.
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+
+2012-03-06  Filip Spacek  <fspacek@rim.com>
+
+        [BlackBerry] Disable border radius clips (r95239) for BlackBerry
+        https://bugs.webkit.org/show_bug.cgi?id=80416
+
+        Reviewed by Antonio Gomes
+
+        The BlackBerry port suffers from the same performance
+        degradation when border radius clip is enabled as Chromium.
+
+        * rendering/RenderLayer.cpp:
+
+2012-03-06  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r109832.
+        http://trac.webkit.org/changeset/109832
+        https://bugs.webkit.org/show_bug.cgi?id=80356
+
+        Broke WebSocket tests on Chrome Mac and Linux
+
+        * Modules/websockets/ThreadableWebSocketChannel.h:
+        (ThreadableWebSocketChannel):
+        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper):
+        (WebCore::ThreadableWebSocketChannelClientWrapper::sendRequestResult):
+        (WebCore::ThreadableWebSocketChannelClientWrapper::setSendRequestResult):
+        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (ThreadableWebSocketChannelClientWrapper):
+        * Modules/websockets/WebSocket.cpp:
+        (WebCore::WebSocket::send):
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::send):
+        (WebCore::WebSocketChannel::enqueueTextFrame):
+        (WebCore::WebSocketChannel::processOutgoingFrameQueue):
+        * Modules/websockets/WebSocketChannel.h:
+        (WebSocketChannel):
+        (QueuedFrame):
+        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::send):
+        (WebCore::workerContextDidSend):
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::send):
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send):
+        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
+        (WorkerThreadableWebSocketChannel):
+        (Bridge):
+
+2012-03-06  Stephen White  <senorblanco@chromium.org>
+
+        Unreviewed, rolling out r109840.
+        http://trac.webkit.org/changeset/109840
+        https://bugs.webkit.org/show_bug.cgi?id=80103
+
+        Broke WebSocket tests on Chrome Mac and Linux
+
+        * Modules/websockets/WebSocket.cpp:
+        (WebCore::WebSocket::send):
+        (WebCore::WebSocket::close):
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::send):
+
+2012-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        <http://webkit.org/b/78575> Web Inspector: Disable dock button when not allowed to dock
+
+        There are times when an undocked inspector frontend is not allowed to
+        attach to the main window. We can disable the dock button in those cases.
+
+        Reviewed by Pavel Feldman.
+
+        No new tests. This functionality is port specific right now.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::performPostLayoutTasks):
+        When the main frame is resized we let the inspector client know,
+        so that it can react to it as needed.
+
+        * WebCore.exp.in:
+        * inspector/InspectorClient.h:
+        (WebCore::InspectorClient::didResizeMainFrame):
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::inspectorClient):
+        Call up to the port though to the InspectorClient.
+
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::frontendLoaded):
+        (WebCore::InspectorFrontendClientLocal::setDockingUnavailable):
+        * inspector/InspectorFrontendClientLocal.h:
+        On ports where the inspector frontend client is local, provide a 
+        setDockingUnavailable InspectorFrontendAPI to update the docking state.
+        Automatically update availability when the frontend completes loading.
+
+        * inspector/front-end/InspectorFrontendAPI.js:
+        (InspectorFrontendAPI.setDockingUnavailable):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createGlobalStatusBarItems):
+        (WebInspector.setAttachedWindow):
+        (WebInspector.setDockingUnavailable):
+        (WebInspector.updateDockToggleButton):
+        Update the dock button's enabled/disabled state when its created,
+        when the attached state changes, when get a frontend API notification
+        that we cannot attach.
+
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        Remove unused canAttachWindow method.
+
+2012-03-06  Hans Wennborg  <hans@chromium.org>
+
+        Speech JavaScript API: add SpeechRecognitionError
+        https://bugs.webkit.org/show_bug.cgi?id=80410
+
+        Reviewed by Adam Barth.
+
+        Add SpeechRecognitionError.
+
+        Test: fast/speech/scripted/speechrecognitionerror-basics.html
+
+        * Modules/speech/DOMWindowSpeech.idl: Added.
+        * Modules/speech/SpeechRecognitionError.cpp: Added.
+        (WebCore):
+        (WebCore::SpeechRecognitionError::create):
+        (WebCore::SpeechRecognitionError::SpeechRecognitionError):
+        * Modules/speech/SpeechRecognitionError.h: Added.
+        (WebCore):
+        (SpeechRecognitionError):
+        (WebCore::SpeechRecognitionError::code):
+        (WebCore::SpeechRecognitionError::message):
+        * Modules/speech/SpeechRecognitionError.idl: Added.
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+
+2012-03-06  David Corvoysier  <david.corvoysier@orange.com>
+
+        Unreleased gst_object_reference to audio sink in MediaPlayerPrivateGStreamer
+        https://bugs.webkit.org/show_bug.cgi?id=79795
+
+        Bug fix: Used a GRefPtr to hold the reference to the audio sink instead of a GstElement*.
+        Code cleanup: Used the same pattern for webkit web source and removed explicit gst_unref in destructor.
+
+        Reviewed by Philippe Normand.
+
+        No new tests. No change in behavior.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (MediaPlayerPrivateGStreamer):
+
+2012-03-06  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Build fix for !ENABLE(WORKERS) after r109556 and r109833.
+
+        * CMakeLists.txt:
+
+2012-03-06  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        [Qt][WK2] Crash in Frame.cpp when loading index.hu
+        https://bugs.webkit.org/show_bug.cgi?id=80165
+
+        Guard against possible null document, which can happen
+        when unsetting a document in a frame.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setDocument):
+
+2012-03-06  Lucas Forschler  <lforschler@apple.com>
+
+        WebCore build exceeds address space on 32-bit Windows builds.
+        https://bugs.webkit.org/show_bug.cgi?id=80346
+
+        Reviewed by Jessie Berlin.
+
+        Patch by Lucas Forschler, landed by Jessie Berlin.
+
+        Add AllInOne.cpp files for a few projects.
+        This will only affect Production and Release builds.
+        Let VS rebuild the project file.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * css/MediaAllInOne.cpp: Added.
+        * loader/appcache/ApplicationCacheAllInOne.cpp: Added.
+        * mathml/MathMLAllInOne.cpp: Added.
+        * platform/text/TextAllInOne.cpp: Added.
+
+2012-03-06  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: add support for inspection of huge (1M elements) arrays.
+        https://bugs.webkit.org/show_bug.cgi?id=80421
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype.completionsForExpression.evaluated):
+        * inspector/front-end/ElementsPanel.js:
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.update.callback):
+        (WebInspector.ObjectPropertiesSection.prototype.update):
+        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ArrayGroupingTreeElement):
+        (WebInspector.ArrayGroupingTreeElement._populateArray):
+        (WebInspector.ArrayGroupingTreeElement._populateRanges):
+        (WebInspector.ArrayGroupingTreeElement._populateRanges.callback):
+        (WebInspector.ArrayGroupingTreeElement._populateAsFragment):
+        (WebInspector.ArrayGroupingTreeElement._populateAsFragment.processArrayFragment):
+        (WebInspector.ArrayGroupingTreeElement._populateAsFragment.processProperties):
+        (WebInspector.ArrayGroupingTreeElement._populateNonIndexProperties.buildObjectFragment):
+        (WebInspector.ArrayGroupingTreeElement._populateNonIndexProperties.processObjectFragment):
+        (WebInspector.ArrayGroupingTreeElement._populateNonIndexProperties.processProperties):
+        (WebInspector.ArrayGroupingTreeElement._populateNonIndexProperties):
+        (WebInspector.ArrayGroupingTreeElement.prototype.onpopulate):
+        (WebInspector.ArrayGroupingTreeElement.prototype.onattach):
+        * inspector/front-end/PropertiesSidebarPane.js:
+        (WebInspector.PropertiesSidebarPane.prototype.update.nodeResolved):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject.prototype.callFunction):
+        (WebInspector.RemoteObject.prototype.callFunctionJSON):
+
+2012-03-06  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Open link in resources panel only works the second time
+        https://bugs.webkit.org/show_bug.cgi?id=80407
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.openResource):
+
+2012-03-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: InspectorCounters mechanism should be thread-safe
+        https://bugs.webkit.org/show_bug.cgi?id=80166
+
+        Make InspectorCounters instance thread local so that it can be safely accessed
+        in workers.
+
+        Reviewed by Pavel Feldman.
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::~V8AbstractEventListener):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        * dom/Document.h:
+        (WebCore::Node::Node):
+        * dom/Node.cpp:
+        (WebCore::Node::~Node):
+        * inspector/InspectorCounters.cpp:
+        (WebCore::InspectorCounters::InspectorCounters):
+        (WebCore::InspectorCounters::counterValue):
+        (WebCore):
+        (WebCore::InspectorCounters::current):
+        * inspector/InspectorCounters.h:
+        (WebCore::InspectorCounters::incrementCounter):
+        (WebCore::InspectorCounters::decrementCounter):
+        (InspectorCounters):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::setHeapSizeStatistic):
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::ThreadGlobalData):
+        (WebCore::ThreadGlobalData::destroy):
+        * platform/ThreadGlobalData.h:
+        (WebCore):
+        (ThreadGlobalData):
+        (WebCore::ThreadGlobalData::inspectorCounters):
+
+2012-03-06  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream typedef of NativeImageSourcePtr and NativeImagePtr
+        https://bugs.webkit.org/show_bug.cgi?id=80388
+
+        Reviewed by Antonio Gomes.
+
+        These are the BlackBerry typdefs of NativeImageSourcePtr and NativeImagePtr.
+
+        * platform/graphics/ImageSource.h:
+        (WebCore):
+
+2012-03-06  Hans Muller  <hmuller@adobe.com>
+
+        SVG transform-origin presentation attribute
+        https://bugs.webkit.org/show_bug.cgi?id=79678
+
+        Reviewed by Nikolas Zimmermann.
+
+        Added the SVG transform-origin presentation attribute.  Currently WebCore::mapAttributeToCSSProperty()
+        just maps it to -webkit-transform-origin.  When the transform-origin CSS property is supported, this
+        part of the change can be removed.
+
+        Test: svg/transforms/transform-origin-presentation-attribute.xhtml
+
+        * svg/SVGStyledElement.cpp:
+        (WebCore::mapAttributeToCSSProperty):
+        (WebCore::SVGStyledElement::cssPropertyIdForSVGAttributeName):
+        * svg/svgattrs.in:
+
+2012-01-26  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] disable GStreamerGWorld when building against 0.11
+        https://bugs.webkit.org/show_bug.cgi?id=77088
+
+        Reviewed by Martin Robinson.
+
+        Don't build GStreamerGWorld and PlatformVideoWindow under
+        GStreamer 0.11. It's supposed to be removed soon anyway.
+
+        * platform/graphics/gstreamer/GStreamerGWorld.cpp:
+        * platform/graphics/gstreamer/GStreamerGWorld.h:
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::totalBytes):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h:
+        (MediaPlayerPrivateGStreamer):
+        * platform/graphics/gstreamer/PlatformVideoWindow.h:
+        * platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp:
+        * platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp:
+        * platform/graphics/gstreamer/PlatformVideoWindowMac.mm:
+        * platform/graphics/gstreamer/PlatformVideoWindowQt.cpp:
+
+2012-03-06  Alexander Færøy  <alexander.faeroy@nokia.com>
+
+        Rename m_tileCreationTimer in the tiled backing store
+        https://bugs.webkit.org/show_bug.cgi?id=80414
+
+        Patch by Kenneth Rohde Christiansen and Alexander Færøy.
+
+        Reviewed by Tor Arne Vestbø.
+
+        The m_tileCreationTimer member is currently being used to represent a
+        timer that is fired when the backing store has been updated which is
+        confusing with its current name.  This patch fixes this by renaming
+        the m_tileCreationTimer to m_backingStoreUpdateTimer.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::TiledBackingStore):
+        (WebCore::TiledBackingStore::setTileSize):
+        (WebCore::TiledBackingStore::coverWithTilesIfNeeded):
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::startBackingStoreUpdateTimer):
+        (WebCore::TiledBackingStore::backingStoreUpdateTimerFired):
+        (WebCore::TiledBackingStore::setContentsFrozen):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-03-06  Alexander Færøy  <alexander.faeroy@nokia.com>
+
+        Remove TileTimer typedef from the tiled backing store
+        https://bugs.webkit.org/show_bug.cgi?id=80408
+
+        Patch by Kenneth Rohde Christiansen and Alexander Færøy.
+
+        Reviewed by Tor Arne Vestbø.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::tileBufferUpdateTimerFired):
+        (WebCore::TiledBackingStore::tileCreationTimerFired):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-03-06  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream LayerRenderer.{h, cpp}
+        https://bugs.webkit.org/show_bug.cgi?id=79874
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream, no new tests.
+
+        * platform/graphics/blackberry/LayerRenderer.cpp: Added.
+        (WebCore):
+        (WebCore::checkGLError):
+        (WebCore::loadShader):
+        (WebCore::loadShaderProgram):
+        (WebCore::orthoMatrix):
+        (WebCore::rawPtrVectorFromRefPtrVector):
+        (WebCore::LayerRenderer::create):
+        (WebCore::LayerRenderer::LayerRenderer):
+        (WebCore::LayerRenderer::~LayerRenderer):
+        (WebCore::LayerRenderer::releaseLayerResources):
+        (WebCore::compareLayerZ):
+        (WebCore::LayerRenderer::drawLayers):
+        (WebCore::LayerRenderer::useSurface):
+        (WebCore::LayerRenderer::drawLayersOnSurfaces):
+        (WebCore::LayerRenderer::setRootLayer):
+        (WebCore::LayerRenderer::addLayer):
+        (WebCore::LayerRenderer::removeLayer):
+        (WebCore::LayerRenderer::addLayerToReleaseTextureResourcesList):
+        (WebCore::LayerRenderer::toOpenGLWindowCoordinates):
+        (WebCore::LayerRenderer::toWebKitWindowCoordinates):
+        (WebCore::LayerRenderer::toWebKitDocumentCoordinates):
+        (WebCore::LayerRenderer::drawDebugBorder):
+        (WebCore::LayerRenderer::drawHolePunchRect):
+        (WebCore::LayerRenderer::updateLayersRecursive):
+        (WebCore::hasRotationalComponent):
+        (WebCore::LayerRenderer::layerAlreadyOnSurface):
+        (WebCore::collect3DPreservingLayers):
+        (WebCore::LayerRenderer::compositeLayersRecursive):
+        (WebCore::LayerRenderer::updateScissorIfNeeded):
+        (WebCore::LayerRenderer::makeContextCurrent):
+        (WebCore::LayerRenderer::bindCommonAttribLocation):
+        (WebCore::LayerRenderer::initializeSharedGLObjects):
+        (WebCore::LayerRenderingResults::holePunchRect):
+        (WebCore::LayerRenderingResults::addHolePunchRect):
+        (WebCore::LayerRenderingResults::addDirtyRect):
+        (WebCore::LayerRenderingResults::isEmpty):
+        * platform/graphics/blackberry/LayerRenderer.h: Added.
+        (WebCore):
+        (LayerRenderingResults):
+        (WebCore::LayerRenderingResults::LayerRenderingResults):
+        (WebCore::LayerRenderingResults::holePunchRectSize):
+        (WebCore::LayerRenderingResults::dirtyRect):
+        (LayerRenderer):
+        (WebCore::LayerRenderer::rootLayer):
+        (WebCore::LayerRenderer::hardwareCompositing):
+        (WebCore::LayerRenderer::setClearSurfaceOnDrawLayers):
+        (WebCore::LayerRenderer::clearSurfaceOnDrawLayers):
+        (WebCore::LayerRenderer::context):
+        (WebCore::LayerRenderer::lastRenderingResults):
+        (WebCore::LayerRenderer::setNeedsCommit):
+
+2012-03-06  Roland Steiner  <rolandsteiner@chromium.org>
+
+        r109563 caused perf regression
+        https://bugs.webkit.org/show_bug.cgi?id=80404
+
+        Add test for Element or ShadowRoot.
+
+        Reviewed by Antti Koivisto.
+
+        No new tests. (fix)
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::pushParentElement):
+
+2012-03-06  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: prepare for extracting ScriptMapping implementation from DebuggerPresentationModel.
+        https://bugs.webkit.org/show_bug.cgi?id=80396
+
+        Limit RawSourceCode usages to a subset of methods. This subset will be moved to ScriptMapping implementation in a separate change.
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype.createPlacard):
+        (WebInspector.DebuggerPresentationModel.prototype.createLiveLocation):
+        (WebInspector.DebuggerPresentationModel.prototype._parsedScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._failedToParseScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.setScriptSource.didEditScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.setScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype._forceUpdateSourceMapping):
+        (WebInspector.DebuggerPresentationModel.prototype._addConsoleMessageToScript):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerPaused):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.PresentationCallFrame):
+        (WebInspector.PresentationCallFrame.prototype.uiLocation):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard):
+        (WebInspector.DebuggerPresentationModelResourceBinding.prototype.canSetContent):
+        (WebInspector.DebuggerPresentationModelResourceBinding.prototype.setContent):
+        (WebInspector.DebuggerPresentationModelResourceBinding.prototype._uiSourceCodeForResource):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.linkifyRawLocation):
+
+2012-03-06  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [Regression] Execution line is not revealed when debugger is stopped if scripts panel was not yet shown.
+        https://bugs.webkit.org/show_bug.cgi?id=80306
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/debugger/reveal-execution-line.html
+
+        * inspector/front-end/ConsoleView.js:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerPaused):
+        * inspector/front-end/JavaScriptSourceFrame.js:
+        (WebInspector.JavaScriptSourceFrame.prototype.afterTextChanged):
+        (WebInspector.JavaScriptSourceFrame.prototype.setExecutionLine):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._executionLineChanged):
+        (WebInspector.ScriptsPanel.prototype._revealExecutionLine):
+        (WebInspector.ScriptsPanel.prototype._callFrameSelected):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.willHide):
+        (WebInspector.SourceFrame.prototype.highlightLine):
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype._clearLineToReveal):
+        (WebInspector.SourceFrame.prototype.setContent):
+
+2012-03-06  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: remove reference to RawSourceCode from UISourceCode.
+        https://bugs.webkit.org/show_bug.cgi?id=80395
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._handleUISourceCodeListChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._uiSourceCodeListChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype.setScriptSource.didEditScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.setScriptSource):
+        (WebInspector.DebuggerPresentationModel.prototype.continueToLine):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerReset):
+        * inspector/front-end/RawSourceCode.js:
+        (WebInspector.RawSourceCode.prototype._createUISourceCode):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode):
+
+2012-03-06  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: move timeline panel overview mode toggle buttons to overview sidebar tree
+        https://bugs.webkit.org/show_bug.cgi?id=80304
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/Images/statusbarButtonGlyphs.png:
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype._showTimelines):
+        (WebInspector.TimelineOverviewPane.prototype._showMemoryGraph):
+        (WebInspector.TimelineOverviewPane.prototype._setVerticalOverview):
+        (WebInspector.TimelineOverviewPane.prototype._onOverviewModeChanged):
+        (WebInspector.TimelineOverviewPane.prototype.update):
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        (WebInspector.TimelineOverviewPane.prototype._onWindowChanged):
+        (WebInspector.TimelineVerticalOverview):
+        (WebInspector.TimelineOverviewModeSelector):
+        (WebInspector.TimelineOverviewModeSelector.prototype.addButton):
+        (WebInspector.TimelineOverviewModeSelector.prototype.get value):
+        (WebInspector.TimelineOverviewModeSelector.prototype._createButton):
+        (WebInspector.TimelineOverviewModeSelector.prototype._select):
+        (WebInspector.TimelineOverviewModeSelector.prototype._onClick):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype.get statusBarItems):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._updateEventDividers):
+        (WebInspector.TimelinePanel.prototype._glueParentButtonClicked):
+        (WebInspector.TimelinePanel.prototype.revealRecordAt):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/timelinePanel.css:
+        (.timeline-vertical-overview #timeline-overview-grid):
+        (.timeline-vertical-overview .timeline-overview-window):
+        (.timeline-vertical-overview .timeline-overview-dividers-background):
+        (.timeline-vertical-overview #timeline-overview-memory):
+        (.timeline-vertical-overview-status-bar-item.toggled-on .glyph):
+        (.timeline-vertical-overview-bars):
+        (.timeline-vertical-overview-bars .padding):
+        (.timeline-vertical-overview-bars .timeline-bar-vertical):
+        (.timeline.timeline-vertical-overview .resources-divider):
+        (.sidebar-tree-item .timeline-vertical-overview-status-bar-item):
+        (.timeline-overview-mode-selector):
+        (.timeline-overview-mode-selector .glyph):
+        (.timeline-overview-mode-selector button):
+        (.timeline-overview-mode-selector button.toggled):
+        (.timeline-overview-mode-selector button:active):
+        (.sidebar-tree-item:not(.selected) .timeline-overview-mode-selector button):
+        (.sidebar-tree-item:not(.selected) .timeline-overview-mode-selector button.toggled):
+        (.timeline-overview-mode-selector button:first-of-type):
+        (.timeline-overview-mode-selector button:last-of-type):
+        (.timeline-mode-vertical-bars .glyph):
+        (.timeline-mode-horizontal-bars .glyph):
+
+2012-03-05  Alexander Færøy  <alexander.faeroy@nokia.com>
+
+        Make it explicit when we are allowing updates to the actual backing store or the tile buffers
+        https://bugs.webkit.org/show_bug.cgi?id=80288
+
+        Patch by Kenneth Rohde Christiansen and Alexander Færøy.
+
+        Reviewed by Noam Rosenthal.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::isBackingStoreUpdatesSuspended):
+        (WebCore):
+        (WebCore::TiledBackingStore::isTileBufferUpdatesSuspended):
+        (WebCore::TiledBackingStore::startTileBufferUpdateTimer):
+        (WebCore::TiledBackingStore::startTileCreationTimer):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-03-06  Mark Rowe  <mrowe@apple.com>
+
+        Build fix after r109877.
+
+        * WebCore.xcodeproj/project.pbxproj: Ensure that headers are copied in to WebCore.framework so that
+        WebKit can still find them.
+
+2012-03-06  Andreas Kling  <awesomekling@apple.com>
+
+        Remove incorrect WTF::Vector traits for CSSProperty.
+        <http://webkit.org/b/53285>
+        <rdar://problem/10161286>
+
+        Reviewed by Antti Koivisto.
+
+        We shouldn't allow copying Vector<CSSProperty> contents around with memcpy()
+        as CSSProperty has a RefPtr member and this would muck up the refcount.
+        This was added to facilitate fast comparison of property vectors, and we no
+        longer use that, so there shouldn't be any performance concerns here.
+
+        * css/CSSProperty.h:
+
+2012-03-06  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix the Qt minimal build.
+
+        * Target.pri:
+
+2012-03-06  Roland Steiner  <rolandsteiner@chromium.org>
+
+        :scope should behave as :root outside scoped style sheet
+        https://bugs.webkit.org/show_bug.cgi?id=80389
+
+        Fall through to :root implementation if no scope is used.
+
+        Reviewed by Antti Koivisto.
+
+        Test: fast/css/style-scoped/scope-pseudo.html
+
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOneSelector):
+
+2012-03-05  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [Regression] Message bubbles are not removed from scripts panel source frames after console was cleared.
+        https://bugs.webkit.org/show_bug.cgi?id=80275
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._consoleMessagesCleared):
+        * inspector/front-end/utilities.js:
+
+2012-03-06  Adam Barth  <abarth@webkit.org>
+
+        Move SQLDatabase code into Modules/webdatabase
+        https://bugs.webkit.org/show_bug.cgi?id=80393
+
+        Reviewed by Kentaro Hara.
+
+        There are still a couple (minor) SQLDatabase references from WebCore
+        proper, but we've gotten this code to the point where it makes sense to
+        move it into the Modules directory.  (This patch just moves code---no
+        behavior change.)
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * Modules/webdatabase: Added.
+        * Modules/webdatabase/AbstractDatabase.cpp: Copied from Source/WebCore/storage/AbstractDatabase.cpp.
+        * Modules/webdatabase/AbstractDatabase.h: Copied from Source/WebCore/storage/AbstractDatabase.h.
+        * Modules/webdatabase/ChangeVersionWrapper.cpp: Copied from Source/WebCore/storage/ChangeVersionWrapper.cpp.
+        * Modules/webdatabase/ChangeVersionWrapper.h: Copied from Source/WebCore/storage/ChangeVersionWrapper.h.
+        * Modules/webdatabase/DOMWindowSQLDatabase.cpp: Copied from Source/WebCore/storage/DOMWindowSQLDatabase.cpp.
+        * Modules/webdatabase/DOMWindowSQLDatabase.h: Copied from Source/WebCore/storage/DOMWindowSQLDatabase.h.
+        * Modules/webdatabase/DOMWindowSQLDatabase.idl: Copied from Source/WebCore/storage/DOMWindowSQLDatabase.idl.
+        * Modules/webdatabase/Database.cpp: Copied from Source/WebCore/storage/Database.cpp.
+        * Modules/webdatabase/Database.h: Copied from Source/WebCore/storage/Database.h.
+        * Modules/webdatabase/Database.idl: Copied from Source/WebCore/storage/Database.idl.
+        * Modules/webdatabase/DatabaseAuthorizer.cpp: Copied from Source/WebCore/storage/DatabaseAuthorizer.cpp.
+        * Modules/webdatabase/DatabaseAuthorizer.h: Copied from Source/WebCore/storage/DatabaseAuthorizer.h.
+        * Modules/webdatabase/DatabaseCallback.h: Copied from Source/WebCore/storage/DatabaseCallback.h.
+        * Modules/webdatabase/DatabaseCallback.idl: Copied from Source/WebCore/storage/DatabaseCallback.idl.
+        * Modules/webdatabase/DatabaseContext.cpp: Copied from Source/WebCore/storage/DatabaseContext.cpp.
+        * Modules/webdatabase/DatabaseContext.h: Copied from Source/WebCore/storage/DatabaseContext.h.
+        * Modules/webdatabase/DatabaseDetails.h: Copied from Source/WebCore/storage/DatabaseDetails.h.
+        * Modules/webdatabase/DatabaseSync.cpp: Copied from Source/WebCore/storage/DatabaseSync.cpp.
+        * Modules/webdatabase/DatabaseSync.h: Copied from Source/WebCore/storage/DatabaseSync.h.
+        * Modules/webdatabase/DatabaseSync.idl: Copied from Source/WebCore/storage/DatabaseSync.idl.
+        * Modules/webdatabase/DatabaseTask.cpp: Copied from Source/WebCore/storage/DatabaseTask.cpp.
+        * Modules/webdatabase/DatabaseTask.h: Copied from Source/WebCore/storage/DatabaseTask.h.
+        * Modules/webdatabase/DatabaseThread.cpp: Copied from Source/WebCore/storage/DatabaseThread.cpp.
+        * Modules/webdatabase/DatabaseThread.h: Copied from Source/WebCore/storage/DatabaseThread.h.
+        * Modules/webdatabase/DatabaseTracker.cpp: Copied from Source/WebCore/storage/DatabaseTracker.cpp.
+        * Modules/webdatabase/DatabaseTracker.h: Copied from Source/WebCore/storage/DatabaseTracker.h.
+        * Modules/webdatabase/DatabaseTrackerClient.h: Copied from Source/WebCore/storage/DatabaseTrackerClient.h.
+        * Modules/webdatabase/OriginQuotaManager.cpp: Copied from Source/WebCore/storage/OriginQuotaManager.cpp.
+        * Modules/webdatabase/OriginQuotaManager.h: Copied from Source/WebCore/storage/OriginQuotaManager.h.
+        * Modules/webdatabase/OriginUsageRecord.cpp: Copied from Source/WebCore/storage/OriginUsageRecord.cpp.
+        * Modules/webdatabase/OriginUsageRecord.h: Copied from Source/WebCore/storage/OriginUsageRecord.h.
+        * Modules/webdatabase/SQLCallbackWrapper.h: Copied from Source/WebCore/storage/SQLCallbackWrapper.h.
+        * Modules/webdatabase/SQLError.h: Copied from Source/WebCore/storage/SQLError.h.
+        * Modules/webdatabase/SQLError.idl: Copied from Source/WebCore/storage/SQLError.idl.
+        * Modules/webdatabase/SQLException.cpp: Copied from Source/WebCore/storage/SQLException.cpp.
+        * Modules/webdatabase/SQLException.h: Copied from Source/WebCore/storage/SQLException.h.
+        * Modules/webdatabase/SQLException.idl: Copied from Source/WebCore/storage/SQLException.idl.
+        * Modules/webdatabase/SQLResultSet.cpp: Copied from Source/WebCore/storage/SQLResultSet.cpp.
+        * Modules/webdatabase/SQLResultSet.h: Copied from Source/WebCore/storage/SQLResultSet.h.
+        * Modules/webdatabase/SQLResultSet.idl: Copied from Source/WebCore/storage/SQLResultSet.idl.
+        * Modules/webdatabase/SQLResultSetRowList.cpp: Copied from Source/WebCore/storage/SQLResultSetRowList.cpp.
+        * Modules/webdatabase/SQLResultSetRowList.h: Copied from Source/WebCore/storage/SQLResultSetRowList.h.
+        * Modules/webdatabase/SQLResultSetRowList.idl: Copied from Source/WebCore/storage/SQLResultSetRowList.idl.
+        * Modules/webdatabase/SQLStatement.cpp: Copied from Source/WebCore/storage/SQLStatement.cpp.
+        * Modules/webdatabase/SQLStatement.h: Copied from Source/WebCore/storage/SQLStatement.h.
+        * Modules/webdatabase/SQLStatementCallback.h: Copied from Source/WebCore/storage/SQLStatementCallback.h.
+        * Modules/webdatabase/SQLStatementCallback.idl: Copied from Source/WebCore/storage/SQLStatementCallback.idl.
+        * Modules/webdatabase/SQLStatementErrorCallback.h: Copied from Source/WebCore/storage/SQLStatementErrorCallback.h.
+        * Modules/webdatabase/SQLStatementErrorCallback.idl: Copied from Source/WebCore/storage/SQLStatementErrorCallback.idl.
+        * Modules/webdatabase/SQLStatementSync.cpp: Copied from Source/WebCore/storage/SQLStatementSync.cpp.
+        * Modules/webdatabase/SQLStatementSync.h: Copied from Source/WebCore/storage/SQLStatementSync.h.
+        * Modules/webdatabase/SQLTransaction.cpp: Copied from Source/WebCore/storage/SQLTransaction.cpp.
+        * Modules/webdatabase/SQLTransaction.h: Copied from Source/WebCore/storage/SQLTransaction.h.
+        * Modules/webdatabase/SQLTransaction.idl: Copied from Source/WebCore/storage/SQLTransaction.idl.
+        * Modules/webdatabase/SQLTransactionCallback.h: Copied from Source/WebCore/storage/SQLTransactionCallback.h.
+        * Modules/webdatabase/SQLTransactionCallback.idl: Copied from Source/WebCore/storage/SQLTransactionCallback.idl.
+        * Modules/webdatabase/SQLTransactionClient.cpp: Copied from Source/WebCore/storage/SQLTransactionClient.cpp.
+        * Modules/webdatabase/SQLTransactionClient.h: Copied from Source/WebCore/storage/SQLTransactionClient.h.
+        * Modules/webdatabase/SQLTransactionCoordinator.cpp: Copied from Source/WebCore/storage/SQLTransactionCoordinator.cpp.
+        * Modules/webdatabase/SQLTransactionCoordinator.h: Copied from Source/WebCore/storage/SQLTransactionCoordinator.h.
+        * Modules/webdatabase/SQLTransactionErrorCallback.h: Copied from Source/WebCore/storage/SQLTransactionErrorCallback.h.
+        * Modules/webdatabase/SQLTransactionErrorCallback.idl: Copied from Source/WebCore/storage/SQLTransactionErrorCallback.idl.
+        * Modules/webdatabase/SQLTransactionSync.cpp: Copied from Source/WebCore/storage/SQLTransactionSync.cpp.
+        * Modules/webdatabase/SQLTransactionSync.h: Copied from Source/WebCore/storage/SQLTransactionSync.h.
+        * Modules/webdatabase/SQLTransactionSync.idl: Copied from Source/WebCore/storage/SQLTransactionSync.idl.
+        * Modules/webdatabase/SQLTransactionSyncCallback.h: Copied from Source/WebCore/storage/SQLTransactionSyncCallback.h.
+        * Modules/webdatabase/SQLTransactionSyncCallback.idl: Copied from Source/WebCore/storage/SQLTransactionSyncCallback.idl.
+        * Modules/webdatabase/WorkerContextSQLDatabase.cpp: Copied from Source/WebCore/storage/WorkerContextSQLDatabase.cpp.
+        * Modules/webdatabase/WorkerContextSQLDatabase.h: Copied from Source/WebCore/storage/WorkerContextSQLDatabase.h.
+        * Modules/webdatabase/WorkerContextSQLDatabase.idl: Copied from Source/WebCore/storage/WorkerContextSQLDatabase.idl.
+        * Modules/webdatabase/chromium: Added.
+        * Modules/webdatabase/chromium/DatabaseObserver.h: Copied from Source/WebCore/storage/chromium/DatabaseObserver.h.
+        * Modules/webdatabase/chromium/DatabaseTrackerChromium.cpp: Copied from Source/WebCore/storage/chromium/DatabaseTrackerChromium.cpp.
+        * Modules/webdatabase/chromium/QuotaTracker.cpp: Copied from Source/WebCore/storage/chromium/QuotaTracker.cpp.
+        * Modules/webdatabase/chromium/QuotaTracker.h: Copied from Source/WebCore/storage/chromium/QuotaTracker.h.
+        * Modules/webdatabase/chromium/SQLTransactionClientChromium.cpp: Copied from Source/WebCore/storage/chromium/SQLTransactionClientChromium.cpp.
+        * Target.pri:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/AbstractDatabase.cpp: Removed.
+        * storage/AbstractDatabase.h: Removed.
+        * storage/ChangeVersionWrapper.cpp: Removed.
+        * storage/ChangeVersionWrapper.h: Removed.
+        * storage/DOMWindowSQLDatabase.cpp: Removed.
+        * storage/DOMWindowSQLDatabase.h: Removed.
+        * storage/DOMWindowSQLDatabase.idl: Removed.
+        * storage/Database.cpp: Removed.
+        * storage/Database.h: Removed.
+        * storage/Database.idl: Removed.
+        * storage/DatabaseAuthorizer.cpp: Removed.
+        * storage/DatabaseAuthorizer.h: Removed.
+        * storage/DatabaseCallback.h: Removed.
+        * storage/DatabaseCallback.idl: Removed.
+        * storage/DatabaseContext.cpp: Removed.
+        * storage/DatabaseContext.h: Removed.
+        * storage/DatabaseDetails.h: Removed.
+        * storage/DatabaseSync.cpp: Removed.
+        * storage/DatabaseSync.h: Removed.
+        * storage/DatabaseSync.idl: Removed.
+        * storage/DatabaseTask.cpp: Removed.
+        * storage/DatabaseTask.h: Removed.
+        * storage/DatabaseThread.cpp: Removed.
+        * storage/DatabaseThread.h: Removed.
+        * storage/DatabaseTracker.cpp: Removed.
+        * storage/DatabaseTracker.h: Removed.
+        * storage/DatabaseTrackerClient.h: Removed.
+        * storage/OriginQuotaManager.cpp: Removed.
+        * storage/OriginQuotaManager.h: Removed.
+        * storage/OriginUsageRecord.cpp: Removed.
+        * storage/OriginUsageRecord.h: Removed.
+        * storage/SQLCallbackWrapper.h: Removed.
+        * storage/SQLError.h: Removed.
+        * storage/SQLError.idl: Removed.
+        * storage/SQLException.cpp: Removed.
+        * storage/SQLException.h: Removed.
+        * storage/SQLException.idl: Removed.
+        * storage/SQLResultSet.cpp: Removed.
+        * storage/SQLResultSet.h: Removed.
+        * storage/SQLResultSet.idl: Removed.
+        * storage/SQLResultSetRowList.cpp: Removed.
+        * storage/SQLResultSetRowList.h: Removed.
+        * storage/SQLResultSetRowList.idl: Removed.
+        * storage/SQLStatement.cpp: Removed.
+        * storage/SQLStatement.h: Removed.
+        * storage/SQLStatementCallback.h: Removed.
+        * storage/SQLStatementCallback.idl: Removed.
+        * storage/SQLStatementErrorCallback.h: Removed.
+        * storage/SQLStatementErrorCallback.idl: Removed.
+        * storage/SQLStatementSync.cpp: Removed.
+        * storage/SQLStatementSync.h: Removed.
+        * storage/SQLTransaction.cpp: Removed.
+        * storage/SQLTransaction.h: Removed.
+        * storage/SQLTransaction.idl: Removed.
+        * storage/SQLTransactionCallback.h: Removed.
+        * storage/SQLTransactionCallback.idl: Removed.
+        * storage/SQLTransactionClient.cpp: Removed.
+        * storage/SQLTransactionClient.h: Removed.
+        * storage/SQLTransactionCoordinator.cpp: Removed.
+        * storage/SQLTransactionCoordinator.h: Removed.
+        * storage/SQLTransactionErrorCallback.h: Removed.
+        * storage/SQLTransactionErrorCallback.idl: Removed.
+        * storage/SQLTransactionSync.cpp: Removed.
+        * storage/SQLTransactionSync.h: Removed.
+        * storage/SQLTransactionSync.idl: Removed.
+        * storage/SQLTransactionSyncCallback.h: Removed.
+        * storage/SQLTransactionSyncCallback.idl: Removed.
+        * storage/WorkerContextSQLDatabase.cpp: Removed.
+        * storage/WorkerContextSQLDatabase.h: Removed.
+        * storage/WorkerContextSQLDatabase.idl: Removed.
+        * storage/chromium/DatabaseObserver.h: Removed.
+        * storage/chromium/DatabaseTrackerChromium.cpp: Removed.
+        * storage/chromium/QuotaTracker.cpp: Removed.
+        * storage/chromium/QuotaTracker.h: Removed.
+        * storage/chromium/SQLTransactionClientChromium.cpp: Removed.
+
+2012-03-05  Kent Tamura  <tkent@chromium.org>
+
+        Do not reformat strings in <input type=number> on platforms using LocalizedNumberICU.
+        https://bugs.webkit.org/show_bug.cgi?id=78326
+
+        Reviewed by Hajime Morita.
+
+        We had bugs such as stripping leading zeros, dropping lower digits
+        of large numbers because we parse a user-input string to a double
+        value, and generate a string from the double value.
+
+        In order to avoid such reformatting, we converts number strings by
+        replacing standard digits to corresponding localized digits.
+
+        * WebCore.gypi: Added LocalizedNumberICU.h
+        * platform/text/LocalizedNumberICU.cpp:
+        (WebCore::ICULocale::ICULocale): Added.
+        (WebCore::ICULocale::create): A testing factory function.
+        (WebCore::ICULocale::createForCurrentLocale): A practical factory function.
+        (WebCore::ICULocale::setDecimalSymbol): Initialize a symbol table.
+        (WebCore::ICULocale::initializeDecimalFormat): Initialize ICU DecimalFormat.
+        (WebCore::ICULocale::convertToLocalizedNumber):
+         Replace characters to corresponding localized characters.
+        (WebCore::matches): A helper function for convertFromLocalizedNumber.
+        (WebCore::endsWith): ditto.
+        (WebCore::ICULocale::determineStartPosition): ditto.
+        (WebCore::ICULocale::matchedDecimalSymbolIndex): ditto.
+        (WebCore::ICULocale::convertFromLocalizedNumber):
+         Replace characters to corresponding standard characters.
+        (WebCore::currentLocale): Added.
+        (WebCore::convertToLocalizedNumber): Uses ICULocale::convertToLocalizedNumber.
+        (WebCore::convertFromLocalizedNumber): Uses ICULocale::convertFromLocalizedNumber.
+        * platform/text/LocalizedNumberICU.h: Added.
+        (ICULocale): Added. This is exposed to WebKit/chromium/tests/LocalizedNumberICUTest.cpp.
+
+2012-03-06  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix the GTK minimal build
+        https://bugs.webkit.org/show_bug.cgi?id=80390
+
+        Reviewed by Csaba Osztrogonác.
+
+        Add some missing ifdefs.
+
+        * Modules/geolocation/NavigatorGeolocation.cpp:
+        * Modules/geolocation/NavigatorGeolocation.h:
+
+2012-03-05  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: stop using RawSourceCode in BreakpointManager.
+        https://bugs.webkit.org/show_bug.cgi?id=80286
+
+        Reviewed by Vsevolod Vlasov.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.uiSourceCodeAdded):
+        (WebInspector.BreakpointManager.prototype.setBreakpoint):
+        (WebInspector.BreakpointManager.prototype._materializeBreakpoint):
+        (WebInspector.BreakpointManager.prototype._breakpointDebuggerLocationChanged):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        * inspector/front-end/ScriptMapping.js: Added.
+        (WebInspector.ScriptMapping):
+        (WebInspector.ScriptMapping.prototype.rawLocationToUILocation):
+        (WebInspector.ScriptMapping.prototype.uiLocationToRawLocation):
+        (WebInspector.ScriptMapping.prototype.createLiveLocation):
+        (WebInspector.ScriptMapping.prototype.uiSourceCodeList):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2012-03-05  Philippe Normand  <pnormand@igalia.com>
+
+        WebAudio JSC-related fixes
+        https://bugs.webkit.org/show_bug.cgi?id=80299
+
+        Reviewed by Adam Barth.
+
+        * bindings/js/JSAudioContextCustom.cpp:
+        (WebCore::JSAudioContextConstructor::constructJSAudioContext):
+        Wrap the audio context in a DOM wrapper.
+        * webaudio/AudioContext.idl: No need to protect EventTarget by V8
+        guards, I think.
+        * webaudio/JavaScriptAudioNode.idl: Ditto.
+
+2012-03-05  Kishore Bolisetty  <kbolisetty@innominds.com>
+
+        Element not fully repainted after application and removal of transform
+        https://bugs.webkit.org/show_bug.cgi?id=61338
+
+        Reviewed by Simon Fraser.
+        RenderLayer is created and removed when a transform is applied and removed to element.
+        To render the element properly after removal of transform on it, preferred widths and dimensions of
+        the element and its containing block needs to be recalculated.
+
+        Test: fast/repaint/transform-rotate-and-remove.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore):
+        (WebCore::RenderBoxModelObject::styleWillChange):
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        * rendering/RenderBoxModelObject.h:
+        (RenderBoxModelObject):
+
+2012-03-05  Gavin Barraclough  <barraclough@apple.com>
+
+        putByIndex should throw in strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=80335
+
+        Reviewed by Filip Pizlo.
+
+        Make the MethodTable PutByIndex trap take a boolean 'shouldThrow' parameter.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::putProperty):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        (GenerateImplementation):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_SetProperty):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::setSlot):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::putByIndex):
+        * bridge/runtime_array.h:
+        (RuntimeArray):
+
+2012-03-05  Shinya Kawanaka  <shinyak@chromium.org>
+
+        InsertionPoint::attach should be consistent with Element.
+        https://bugs.webkit.org/show_bug.cgi?id=80373
+
+        Reviewed by Hajime Morita.
+
+        This patch is preparation for coming <shadow> patches.
+
+        InsertionPoint used to attach fallback elements before attaching distributed elements.
+        To be consistent with Element::attach behavior, attaching distributed elements first is
+        natural, because Element attaches a shadow tree first.
+
+        Also, this patch extracts a few methods form InsretionPoint::attach() and detach()
+        to keep code clean. They will become messy without this refactoring when adding
+        <shadow> patch.
+
+        No new tests. Should be covered by existing tests.
+
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::attach):
+        (WebCore::InsertionPoint::detach):
+        (WebCore::InsertionPoint::distributeHostChildren):
+        (WebCore):
+        (WebCore::InsertionPoint::clearDistribution):
+        (WebCore::InsertionPoint::attachDistributedNode):
+        * html/shadow/InsertionPoint.h:
+        (InsertionPoint):
+
+2012-03-05  Adam Barth  <abarth@webkit.org>
+
+        Attempt to fix a number of GTK tests.
+
+        * GNUmakefile.list.am:
+
+2012-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        Unreviewed rollout of r109858 for restructuring.
+
+2012-03-05  Joseph Pecoraro  <pecoraro@apple.com>
+
+        <http://webkit.org/b/78575> Web Inspector: Hide dock button when not allowed to dock
+
+        There are times when an undocked inspector frontend is not allowed to
+        attach to the main window. We can remove the dock button in those cases.
+
+        Reviewed by Timothy Hatcher.
+
+        No new tests. This functionality is port specific right now.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::performPostLayoutTasks):
+        When the main frame is resized we let the inspector frontend client
+        update its docked availablility.
+
+        * WebCore.exp.in:
+        * inspector/InspectorInstrumentation.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didResizeMainFrameImpl):
+        (WebCore::InspectorInstrumentation::didResizeMainFrame):
+        * inspector/InspectorClient.h:
+        (WebCore::InspectorClient::updateDockingAvailability):
+        * inspector/InspectorController.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::resume):
+        (WebCore::InspectorController::updateDockingAvailability):
+        When the main frame is resized call up to the InspectorClient to let
+        it update docking availability of the inspector frontend.
+
+        * inspector/InspectorFrontendClient.h:
+        * inspector/InspectorFrontendClientLocal.h:
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::frontendLoaded):
+        (WebCore::InspectorFrontendClientLocal::setDockingUnavailable):
+        On ports where the inspector frontend client is local, provide a 
+        setDockingUnavailable InspectorFrontendAPI to update the docking state.
+        Automatically update availablity when the frontend completes loading.
+
+        * inspector/front-end/InspectorFrontendAPI.js:
+        (InspectorFrontendAPI.setDockingUnavailable):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createGlobalStatusBarItems):
+        (WebInspector.setAttachedWindow):
+        (WebInspector.setDockingUnavailable):
+        (WebInspector.updateDockToggleButtonVisibility):
+        Update the dock button's visibility when its created, when the attached
+        state changes, when get a frontend API notification that we cannot attach.
+
+2012-03-05  Adrienne Walker  <enne@google.com>
+
+        Compositing overlap testing can throw layers into compositing when they should not be.
+        https://bugs.webkit.org/show_bug.cgi?id=50192
+
+        Reviewed by Simon Fraser.
+
+        The previous overlap map behavior was that a non-composited query
+        layer would become composited due to overlap if and only if the query
+        layer's absolute bounds overlapped the absolute bounds of some other
+        layer which:
+            - draws before the query layer
+            - is or has a compositing ancestor
+
+        This behavior, while correct, was too permissive in throwing layers
+        into compositing, causing many layers to get their own backing when
+        they could have just gone into their compositing ancestor's backing.
+
+        The correct logic is that non-composited query layer needs to be
+        composited due to overlap if and only if the query layer's absolute
+        bounds overlap the absolute bounds of some other layer which:
+            - draws before the query layer
+            - has a different compositing ancestor than the query layer
+            - is or has a compositing ancestor that is a descendent of the
+              query layer's compositing ancestor
+
+        This patch changes the semantics of the overlap map to enable this
+        behavior.
+
+        Rather than having one global overlap map, there is now a stack of
+        overlap maps. New (empty) overlap maps are pushed onto the stack
+        whenever a layer becomes a compositing ancestor and popped after all
+        of the compositing requirements for that layer's children have been
+        computed.
+
+        The compositing ancestor and all of its non-composited children of a
+        compositing ancestor do not get considered for overlap until their
+        composited ancestor has been popped off the stack. If a compositing
+        ancestor has a compositing subtree, then any descendents of that
+        compositing ancestor that draw after that subtree will consider
+        everything in the compositing subtree for overlap.
+
+        Test: compositing/layer-creation/stacking-context-overlap.html
+
+        * platform/graphics/Region.cpp:
+        (WebCore::Region::intersects):
+        (WebCore):
+        * platform/graphics/Region.h:
+        (Region):
+        * rendering/RenderLayerCompositor.cpp:
+        (RenderLayerCompositor::OverlapMap):
+        (WebCore::RenderLayerCompositor::OverlapMap::OverlapMap):
+        (WebCore::RenderLayerCompositor::OverlapMap::add):
+        (WebCore::RenderLayerCompositor::OverlapMap::contains):
+        (WebCore::RenderLayerCompositor::OverlapMap::overlapsLayers):
+        (WebCore::RenderLayerCompositor::OverlapMap::isEmpty):
+        (WebCore::RenderLayerCompositor::OverlapMap::popCompositingContainer):
+        (WebCore::RenderLayerCompositor::OverlapMap::pushCompositingContainer):
+        (WebCore::RenderLayerCompositor::addToOverlapMapRecursive):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        * rendering/RenderLayerCompositor.h:
+        (RenderLayerCompositor):
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Address review comments from https://bugs.webkit.org/show_bug.cgi?id=80368
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::setNeedsDisplayInRect):
+
+2012-03-05  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] HTMLFieldSetForms.idl doesn't have type attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=80109
+
+        Reviewed by Hajime Morita.
+
+        Test: fast/forms/fieldset/fieldset-type.html
+
+        * html/HTMLFieldSetElement.idl: Add attribute "type"
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::setScale):
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        pinch-to-zoom and double-tap flicker when using the new scrolling model
+        https://bugs.webkit.org/show_bug.cgi?id=80368
+        <rdar://problem/10866221>
+
+        Reviewed by Sam Weinig.
+
+        In order to work better with zooming, make the tile cache undo the scale transformation
+        and handle the scaling manually. This avoids creating huge tile backing stores when zoomed in.
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::TileCache):
+        Initialize m_scale to 1.
+
+        (WebCore::TileCache::setNeedsDisplayInRect):
+        Scale the given rect appropriately.
+
+        (WebCore::TileCache::drawLayer):
+        Apply a scale context transform.
+
+        (WebCore::TileCache::setScale):
+        No longer set the contents scale. Instead, update the scale and revalidate the tiles.
+
+        (WebCore::TileCache::revalidateTiles):
+        Return early if the bounds are empty. This avoids showing a single tile if that happens due to a race condition.
+
+        (WebCore::TileCache::getTileIndexRangeForRect):
+        Apply the scale to the bounds.
+
+        (WebCore::TileCache::createTileLayer):
+        Don't set the contents scale.
+
+        * platform/graphics/ca/mac/WebTileCacheLayer.mm:
+        (-[WebTileCacheLayer setContentsScale:]):
+        Call TileCache::setScale.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateCompositedBounds):
+        Make sure to give the tile cache layer sane composited bounds, even if the page has absolutely positioned
+        elements that are outside of the page.
+
+2012-03-05  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        GraphicsContext3D.h should include RefCounted.h explicitly
+        https://bugs.webkit.org/show_bug.cgi?id=80251
+
+        Reviewed by Rob Buis.
+
+        GraphicsContext3D.h was using RefCounted but including RefCounted.h indirectly
+        through GraphicsLayer.h through Animation.h. However Animation.h is included
+        by GraphicsLayer.h only when ACCELERATED_COMPOSITING is on. For some configurations
+        that don't use ACCELERATED_COMPOSITING but use GraphicsContext3D, like the
+        BlackBerry x86 configuration, the indirect inclusion will fail.
+
+        This patch is adding explicit inclusion of RefCounted.h to avoid that kind of
+        problem.
+
+        * platform/graphics/GraphicsContext3D.h:
+
+2012-03-05  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Should raise SYNTAX_ERR when message contains unpaired surrogates
+        https://bugs.webkit.org/show_bug.cgi?id=80103
+
+        Reviewed by Kent Tamura.
+
+        Add UTF8 validation checks for WebSocket message and close reason.
+
+        Tests: http/tests/websocket/tests/hybi/unpaired-surrogates-in-close-reason.html
+               http/tests/websocket/tests/hybi/unpaired-surrogates-in-message.html
+
+        * Modules/websockets/WebSocket.cpp:
+        (WebCore::WebSocket::send): Raise SYNTAX_ERR if the message is invalid.
+        (WebCore::WebSocket::close):Raise SYNTAX_ERR if the reason is invalid.
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::send): Check whether message is a valid UTF8 string.
+
+2012-03-05  Kenneth Russell  <kbr@google.com>
+
+        [chromium] Notify CCLayerImpl tree of context loss and restoration
+        https://bugs.webkit.org/show_bug.cgi?id=80339
+
+        Reviewed by James Robinson.
+
+        Tested by manually killing GPU process while playing Flash video.
+        Video continues to play after compositor restores its context.
+
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::didLoseAndRecreateGraphicsContext):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::sendContextLostAndRestoredNotification):
+        (WebCore):
+        (WebCore::CCLayerTreeHostImpl::sendContextLostAndRestoredNotificationRecursive):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.cpp:
+        (WebCore::CCPluginLayerImpl::didLoseAndRecreateGraphicsContext):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.h:
+        (CCPluginLayerImpl):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::recreateContext):
+
+2012-03-05  Changhun Kang  <temoochin@company100.net>
+
+        Change the argument orders to match OpenGL's in GraphicsContext3D functions
+        https://bugs.webkit.org/show_bug.cgi?id=80120
+
+        Reviewed by Kenneth Russell.
+
+        No new tests because this patch just change the order of arguments.
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::uniform1fv):
+        (WebCore::WebGLRenderingContext::uniform1iv):
+        (WebCore::WebGLRenderingContext::uniform2fv):
+        (WebCore::WebGLRenderingContext::uniform2iv):
+        (WebCore::WebGLRenderingContext::uniform3fv):
+        (WebCore::WebGLRenderingContext::uniform3iv):
+        (WebCore::WebGLRenderingContext::uniform4fv):
+        (WebCore::WebGLRenderingContext::uniform4iv):
+        (WebCore::WebGLRenderingContext::uniformMatrix2fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix3fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix4fv):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawDebugBorderQuad):
+        (WebCore::LayerRendererChromium::drawTileQuad):
+        (WebCore::LayerRendererChromium::drawYUV):
+        (WebCore::LayerRendererChromium::drawStreamTexture):
+        (WebCore::LayerRendererChromium::drawTexturedQuad):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::drawSurface):
+        * platform/graphics/efl/GraphicsContext3DEfl.cpp:
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        * platform/graphics/filters/FECustomFilter.cpp:
+        (WebCore::FECustomFilter::bindProgramAndBuffers):
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+
+2012-03-05  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] HTMLFieldSetForms.idl doesn't have name attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=80108
+
+        Reviewed by Hajime Morita.
+
+        Test: fast/forms/fieldset/fieldset-name.html
+
+        * html/HTMLFieldSetElement.idl: Add "name" attribute.
+
+2012-03-05  Levi Weintraub  <leviw@chromium.org>
+
+        Update usage of LayoutUnits in RenderBox
+        https://bugs.webkit.org/show_bug.cgi?id=80039
+
+        Reviewed by Julien Chaffraix.
+
+        Updating the usage of integers versus LayoutUnits in RenderBox to mirror the
+        subpixellayout branch. This reverts absoluteRects, intrinsicSize, and focusRingRects
+        methods to use integers, and flipForWritingMode functions to LayoutUnits.
+
+        No new tests. No change in behavior.
+
+        * platform/graphics/FractionalLayoutRect.h:
+        (WebCore::FractionalLayoutRect::pixelSnappedX): Convenience methods that only calculate
+        the needed values. This requires less computation than pixelSnappedIntRect(r).x().
+        (WebCore::FractionalLayoutRect::pixelSnappedY): Ditto.
+        (WebCore::FractionalLayoutRect::pixelSnappedWidth): Ditto.
+        (WebCore::FractionalLayoutRect::pixelSnappedHeight): Ditto.
+        (WebCore::FractionalLayoutRect::pixelSnappedMaxX): Ditto.
+        (WebCore::FractionalLayoutRect::pixelSnappedMaxY): Ditto.
+        (FractionalLayoutRect):
+        * platform/graphics/IntRect.h:
+        (IntRect):
+        (WebCore::IntRect::pixelSnappedX): Stub methods to allow us to use IntRects like we do
+        FractionalLayoutRects.
+        (WebCore::IntRect::pixelSnappedY): Ditto.
+        (WebCore::IntRect::pixelSnappedMaxX): Ditto.
+        (WebCore::IntRect::pixelSnappedMaxY): Ditto.
+        (WebCore::IntRect::pixelSnappedWidth): Ditto.
+        (WebCore::IntRect::pixelSnappedHeight): Ditto.
+        * rendering/LayoutTypes.h:
+        (WebCore::pixelSnappedIntRect): Convenience method for building a pixelSnappedIntRect from
+        a LayoutPoint and LayoutSize without constructing an intermediate LayoutRect.
+        (WebCore):
+        (WebCore::snapSizeToPixel): Stub method for snapping a LayoutUnit representing a size to
+        its pixel value using its location.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::pixelSnappedClientWidth): Changing to actually call snapSizeToPixel.
+        (WebCore::RenderBox::pixelSnappedClientHeight): Ditto.
+        (WebCore::RenderBox::absoluteRects): Switching to return IntRects that represent the actual
+        rendered location on screen.
+        (WebCore::RenderBox::addFocusRingRects): Ditto.
+        (WebCore::RenderBox::paintFillLayer): One-liner switching an IntSize() to LayoutSize() to
+        avoid unnecessary conversion.
+        (WebCore::RenderBox::shrinkLogicalWidthToAvoidFloats): Preparing for the conversion by
+        replacing 0 with zeroLayoutUnit.
+        (WebCore::RenderBox::positionLineBox): Preparing for conversion by replacing lroundf
+        with roundedLayoutUnit.
+        (WebCore::RenderBox::flipForWritingMode): Switching to use LayoutUnits.
+        * rendering/RenderBox.h:
+        (RenderBox):
+        (WebCore::RenderBox::pixelSnappedBorderBoxRect): Convenience method.
+        (WebCore::RenderBox::borderBoundingBox): Converting to a pixelSnappedIntRect.
+        (WebCore::RenderBox::intrinsicSize): Intrinsic sizes should always be integers.
+
+2012-03-05  Adam Barth  <abarth@webkit.org>
+
+        WorkerContext shouldn't need to know about SQLDatabase
+        https://bugs.webkit.org/show_bug.cgi?id=80352
+
+        Reviewed by Eric Seidel.
+
+        This patch removes the SQLDatabase functions from WorkerContext in
+        preparation for moving the SQLDatabase code into a module.  These
+        functions don't interact with the rest of WorkerContext.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/DOMWindowSQLDatabase.cpp:
+        * storage/WorkerContextSQLDatabase.cpp: Added.
+        (WebCore):
+        (WebCore::WorkerContextSQLDatabase::openDatabase):
+        (WebCore::WorkerContextSQLDatabase::openDatabaseSync):
+        * storage/WorkerContextSQLDatabase.h: Added.
+        (WebCore):
+        (WorkerContextSQLDatabase):
+        (WebCore::WorkerContextSQLDatabase::WorkerContextSQLDatabase):
+        (WebCore::WorkerContextSQLDatabase::~WorkerContextSQLDatabase):
+        * storage/WorkerContextSQLDatabase.idl: Added.
+        * workers/WorkerContext.cpp:
+        (WebCore):
+        * workers/WorkerContext.h:
+        (WebCore):
+        (WorkerContext):
+        * workers/WorkerContext.idl:
+
+2012-03-05  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [WebSocket] Introduce ThreadableWebSocketChannel::SendResult
+        https://bugs.webkit.org/show_bug.cgi?id=80356
+
+        Reviewed by Kent Tamura.
+
+        Introduced ThreadableWebSocketChannel::SendResult type so that
+        WebSocketChannel can pass the validation result.
+
+        No new test. No changes in behavior.
+
+        * Modules/websockets/ThreadableWebSocketChannel.h: Added SendResult.
+        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp:
+        (WebCore::ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper):
+        (WebCore::ThreadableWebSocketChannelClientWrapper::sendRequestResult): Use ThreadableWebSocketChannel::SendResult instead of bool.
+        (WebCore::ThreadableWebSocketChannelClientWrapper::setSendRequestResult): Ditto.
+        * Modules/websockets/ThreadableWebSocketChannelClientWrapper.h:
+        (ThreadableWebSocketChannelClientWrapper):
+        * Modules/websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::send): Use ThreadableWebSocketChannel::SendResult instead of bool. Pass Cstring to enqueTextFrame instead of String.
+        (WebCore::WebSocketChannel::enqueueTextFrame): Ditto.
+        (WebCore::WebSocketChannel::processOutgoingFrameQueue): Ditto.
+        * Modules/websockets/WebSocketChannel.h:
+        (WebSocketChannel):
+        (QueuedFrame): Changed the type of stringData from String to CString.
+        * Modules/websockets/WorkerThreadableWebSocketChannel.cpp:
+        (WebCore::WorkerThreadableWebSocketChannel::send): Use ThreadableWebSocketChannel::SendResult instead of bool.
+        (WebCore::workerContextDidSend): Ditto.
+        (WebCore::WorkerThreadableWebSocketChannel::Peer::send): Ditto.
+        (WebCore::WorkerThreadableWebSocketChannel::Bridge::send): Ditto.
+        * Modules/websockets/WorkerThreadableWebSocketChannel.h:
+        (WorkerThreadableWebSocketChannel): ditto.
+        (Bridge): Ditto.
+
+2012-03-05  Kentaro Hara  <haraken@chromium.org>
+
+        [JSC] Cache the CSSPropertyID in JSCSSStyleDeclaration
+        https://bugs.webkit.org/show_bug.cgi?id=80250
+
+        Reviewed by Benjamin Poulain.
+
+        V8CSSStyleDeclaration caches the calculated CSSPropertyID.
+        Similarly, we can implement the cache in JSCSSStyleDeclaration.
+
+        In my local Mac environment, this optimization improves the performance
+        of CSS property getters by 35%, and the performance of CSS property setters
+        by 8%.
+
+        CSS property getter: for (var i = 0; i < 1000000; i++) span.style.fontWeight;
+        CSS property setter: for (var i = 0; i < 1000000; i++) span.style.fontWeight = "bold";
+
+        Tests: fast/dom/CSSStyleDeclaration/* (No change in test results)
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (CSSPropertyInfo):
+        (WebCore):
+        (WebCore::cssPropertyIDForJSCSSPropertyName):
+        (WebCore::JSCSSStyleDeclaration::nameGetter):
+        (WebCore::JSCSSStyleDeclaration::putDelegate):
+
+2012-03-05  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Handle LevelDB database corruption
+        https://bugs.webkit.org/show_bug.cgi?id=79413
+
+        Add LevelDBDatabase::destroy() method so that clients can retry if open() fails.
+
+        Reviewed by Tony Chang.
+
+        Test: webkit_unit_tests --gtest_filter='LevelDBDatabaseTest.CorruptionTest'
+
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp: Implement open/destroy/open strategy.
+        (WebCore::IDBLevelDBBackingStore::open):
+        * platform/leveldb/LevelDBDatabase.cpp:
+        (WebCore::LevelDBDatabase::destroy):
+        (WebCore):
+        * platform/leveldb/LevelDBDatabase.h:
+        (LevelDBDatabase):
+
+2012-03-05  Stephen Chenney  <schenney@chromium.org>
+
+        [Chromium] SVG Composite of Offset crashes
+        https://bugs.webkit.org/show_bug.cgi?id=77245
+
+        Reviewed by Stephen White.
+
+        The feComposite arithmetic mode filter could readily be made to
+        generate invalid pre-multiplied pixel values which would then go on to
+        pollute other filters and cause invalid final output pixels. This
+        patch checks for filters that require valid inputs, and checks that a
+        result is valid, and corrects the result if necessary. This matches
+        the behavior of FF and Opera while preventing crashes or other
+        undesirable behavior.
+
+        Test: svg/filters/feComposite-arithmetic-invalid-rgba.svg
+
+        * platform/graphics/filters/FEComposite.h: Override the default validity checks and image cleanup methods.
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::correctFilterResultIfNeeded): Force valid pixels if this is an arithmetic filter
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::apply): Check for validity status and correct
+        (WebCore::FilterEffect::forceValidPremultipliedPixels): Make an image valid
+        (WebCore):
+        * platform/graphics/filters/FilterEffect.h: New virtual methods for image validity.
+        (FilterEffect):
+        (WebCore::FilterEffect::requiresValidPreMulultipliedPixels):
+        (WebCore::FilterEffect::forceValidPremultipliedPixels):
+        (WebCore::FilterEffect::correctFilterResultIfNeeded):
+        * rendering/svg/RenderSVGResourceFilter.cpp:
+        (WebCore::RenderSVGResourceFilter::postApplyResource): Check that the final filter result is valid
+
+2012-03-05  Alexis Menard  <alexis.menard@openbossa.org>
+
+        getComputedStyle gives incorrect information for 'height' property
+        https://bugs.webkit.org/show_bug.cgi?id=33593
+
+        Reviewed by David Hyatt.
+
+        Make sure that the contentBoxRect doesn't take into account the
+        intrinsic padding when querying it. As stated by http://www.w3.org/TR/css3-box/#the-lsquo0
+        the height is the content area which doesn't include the intrinsic padding, the border, and
+        the padding.
+
+        Test: fast/css/getComputedStyle/getComputedStyle-height.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeNode):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::contentBoxRect):
+        (WebCore::RenderBox::contentWidth):
+        (WebCore::RenderBox::contentHeight):
+        (WebCore::RenderBox::contentLogicalWidth):
+        (WebCore::RenderBox::contentLogicalHeight):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paddingTop):
+        (WebCore::RenderBoxModelObject::paddingBottom):
+        (WebCore::RenderBoxModelObject::paddingLeft):
+        (WebCore::RenderBoxModelObject::paddingRight):
+        (WebCore::RenderBoxModelObject::paddingBefore):
+        (WebCore::RenderBoxModelObject::paddingAfter):
+        (WebCore::RenderBoxModelObject::paddingStart):
+        (WebCore::RenderBoxModelObject::paddingEnd):
+        * rendering/RenderBoxModelObject.h:
+        (RenderBoxModelObject):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paddingTop):
+        (WebCore::RenderTableCell::paddingBottom):
+        (WebCore::RenderTableCell::paddingLeft):
+        (WebCore::RenderTableCell::paddingRight):
+        (WebCore::RenderTableCell::paddingBefore):
+        (WebCore::RenderTableCell::paddingAfter):
+        (WebCore::RenderTableCell::cellBaselinePosition):
+        * rendering/RenderTableCell.h:
+        (RenderTableCell):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::firstLineBoxBaseline):
+
+2012-03-05  MORITA Hajime  <morrita@google.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=80257
+        Lifecycle of InternalSettings should be simplified.
+
+        Reviewed by Ryosuke Niwa.
+
+        - Moved settings update code to separate restoreTo() method.
+        - Eliminated flags which indidate the changed field.
+          Now these modifiable parameters are backed up at the initialization.
+
+        No new tests. Refactoring.
+
+        * testing/InternalSettings.cpp:
+        (WebCore::InternalSettings::create):
+        (WebCore::InternalSettings::InternalSettings):
+        (WebCore):
+        (WebCore::InternalSettings::restoreTo):
+        * testing/InternalSettings.h:
+        (InternalSettings):
+        * testing/Internals.cpp:
+        (WebCore::Internals::reset):
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Be more aggressive about repainting page overlays
+        https://bugs.webkit.org/show_bug.cgi?id=80336
+        <rdar://problem/10965943>
+
+        Reviewed by Simon Fraser.
+
+        Add a way to find out if a given GraphicsLayer is going to be repainted.
+
+        * WebCore.exp.in:
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::needsDisplay):
+        (GraphicsLayer):
+        * platform/graphics/ca/GraphicsLayerCA.h:
+
+2012-03-05  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream LayerRendererSurface.{cpp, h}
+        https://bugs.webkit.org/show_bug.cgi?id=80122
+
+        Reviewed by Rob Buis.
+
+        Initial upstream, no new tests.
+
+        * PlatformBlackBerry.cmake:
+        * platform/graphics/blackberry/LayerRendererSurface.cpp: Added.
+        (WebCore):
+        (WebCore::LayerRendererSurface::LayerRendererSurface):
+        (WebCore::LayerRendererSurface::~LayerRendererSurface):
+        (WebCore::LayerRendererSurface::setContentRect):
+        (WebCore::LayerRendererSurface::drawRect):
+        (WebCore::LayerRendererSurface::ensureTexture):
+        (WebCore::LayerRendererSurface::releaseTexture):
+        * platform/graphics/blackberry/LayerRendererSurface.h: Added.
+        (WebCore):
+        (LayerRendererSurface):
+        (WebCore::LayerRendererSurface::size):
+        (WebCore::LayerRendererSurface::contentRect):
+        (WebCore::LayerRendererSurface::clipRect):
+        (WebCore::LayerRendererSurface::setClipRect):
+        (WebCore::LayerRendererSurface::setDrawTransform):
+        (WebCore::LayerRendererSurface::drawTransform):
+        (WebCore::LayerRendererSurface::setReplicaDrawTransform):
+        (WebCore::LayerRendererSurface::replicaDrawTransform):
+        (WebCore::LayerRendererSurface::texture):
+        (WebCore::LayerRendererSurface::drawOpacity):
+        (WebCore::LayerRendererSurface::setDrawOpacity):
+
+2012-03-05  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSSRegions][CSSOM]Prevent creation of NamedFlow object for invalid flow name
+        https://bugs.webkit.org/show_bug.cgi?id=79685
+
+        Reviewed by David Hyatt.
+
+        Asking for a named flow with an invalid flow name should return a null object.
+
+        Test: fast/regions/webkit-named-flow-invalid-name.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFlowThread):
+        (WebCore):
+        * css/CSSParser.h:
+        * dom/Document.cpp:
+        (WebCore::validFlowName):
+        (WebCore):
+        (WebCore::Document::webkitGetFlowByName):
+
+2012-03-05  Ryosuke Niwa  <rniwa@webkit.org>
+
+        unicode-bidi should support isolate override and override isolate
+        https://bugs.webkit.org/show_bug.cgi?id=73164
+
+        Reviewed by Eric Seidel.
+
+        Updated CSS parser and CSS style selector to support the union of bidi-override and isolate in
+        unicode-bidi property. Added OverrideIsolate to EUnicodeBidi instead of turning Override and Isolate
+        into bit flags to avoid increasing the number of bits required to store the unicodeBidi flag.
+
+        Also fixed a bug in RenderBlock::constructTextRun to actually check whether an isolated run's direction
+        is overridden or not when constructing one.
+
+        Tests: fast/css/unicode-bidi-computed-value.html
+               fast/text/bidi-override-isolate.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::renderUnicodeBidiFlagsToCSSValue): Added; Create a CSSValueList when unicode-bidi has both
+        isolate and bidi-override specified.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):  Calls renderUnicodeBidiFlagsToCSSValue.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Support parsing combinations of -webkit-isolate and bidi-override;
+        Create a CSSValueList in such cases.
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore):
+        * css/CSSStyleApplyProperty.cpp:
+        (ApplyPropertyUnicodeBidi):
+        (WebCore::ApplyPropertyUnicodeBidi::applyValue): Support combinations of -webkit-isolate and
+        bidi-override. Set the unicodeBidi flag to OverrideIsolate in such cases.
+        (WebCore::ApplyPropertyUnicodeBidi::createHandler):
+        (WebCore):
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * platform/text/UnicodeBidi.h: Added OverrideIsolate. We don't use bit flags to avoid increasing the
+        number of bits required to store flags especially because isolate and bidi-override are only values
+        that can be combined.
+        (WebCore::isIsolated):
+        (WebCore):
+        (WebCore::isOverride):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::constructTextRun):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::statusWithDirection): Takes isOverride; we used to assume it's always false.
+        (WebCore::constructBidiRuns): Instantiate isolatedResolver with a proper value of isOverride.
+        (WebCore::RenderBlock::layoutRunsAndFloatsInRange):
+        (WebCore::RenderBlock::determineStartPosition):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemStyle):
+        (WebCore::RenderMenuList::menuStyle):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::menuStyle):
+        * rendering/svg/SVGTextMetrics.cpp:
+        (WebCore::SVGTextMetrics::constructTextRun):
+
+2012-03-05  Emil A Eklund  <eae@chromium.org>
+
+        Replace uses of x(), y() and width(), height() pairs with locationOffset and size()
+        https://bugs.webkit.org/show_bug.cgi?id=80196
+
+        Reviewed by Julien Chaffraix.
+
+        Replace IntSize(x(), y()) with locationOffset()
+        Replace IntSize(width(), height()) with size()
+        Replace IntRect(0, 0, width(), height()) with IntRect(IntPoint(), size())
+        Replace IntRect::move(x(), y()) with IntRect::move(locationOffset())
+
+        No new tests.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+        (WebCore::HTMLCanvasElement::baseTransform):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::simplifiedLayout):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::borderBoxRect):
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::localSelectionRect):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::localSelectionRect):
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::updateScrollbarParts):
+        (WebCore::RenderScrollbar::buttonRect):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::setCellLogicalWidths):
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::viewRect):
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Always update the scroll layer position on the main thread when we have an overlay
+        https://bugs.webkit.org/show_bug.cgi?id=80324
+
+        Reviewed by Sam Weinig.
+
+        Add a way to ensure that scroll layer position updates happen on the main thread.
+
+        * WebCore.exp.in:
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::ScrollingCoordinator):
+        (WebCore::ScrollingCoordinator::updateShouldUpdateScrollLayerPositionOnMainThread):
+        (WebCore):
+        (WebCore::ScrollingCoordinator::setForceMainThreadScrollLayerPositionUpdates):
+        * page/scrolling/ScrollingCoordinator.h:
+        (ScrollingCoordinator):
+
+2012-03-05  Tony Chang  <tony@chromium.org>
+
+        Implement flex-wrap: wrap
+        https://bugs.webkit.org/show_bug.cgi?id=79930
+
+        Reviewed by David Hyatt.
+
+        Tests: css3/flexbox/multiline-align.html
+               css3/flexbox/multiline.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::sizesToIntrinsicLogicalWidth): Don't apply column+stretch optimization to multiline.
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::FlexOrderIterator::FlexOrderIterator):
+        (WebCore::RenderFlexibleBox::FlexOrderIterator::currentChild): Expose the current child so we can pause
+        in the middle of iteration and resume later.
+        (RenderFlexibleBox::FlexOrderIterator):
+        (WebCore::RenderFlexibleBox::isMultiline):
+        (WebCore):
+        (WebCore::RenderFlexibleBox::layoutFlexItems): Loop per line.
+        (WebCore::RenderFlexibleBox::availableAlignmentSpaceForChild): Use the line space, not the whole container space.
+        (WebCore::RenderFlexibleBox::computeFlexOrder): Return true for each line.
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren): Use the line offset. Also compute the line height as we go.
+        (WebCore::RenderFlexibleBox::layoutColumnReverse): Use the line offset.
+        (WebCore::RenderFlexibleBox::alignChildren): Align based on the line height. For multiline + column, we have to relayout
+        since the width may change (same as the row case above). We'll have to do something smarter when we implement flex-line-pack.
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+
+2012-03-05  Ben Vanik  <benvanik@google.com>
+
+        Implement WebGL extension EXT_texture_filter_anisotropic
+        https://bugs.webkit.org/show_bug.cgi?id=79541
+
+        This exports the EXT_texture_filter_anisotropic extension with the WEBKIT_ prefix as defined at
+        https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/extensions/proposals/EXT_texture_filter_anisotropic/index.html
+
+        Reviewed by Kenneth Russell.
+
+        Tested with the Khronos conformance test for the extension, available at https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/tests/conformance/extensions/ext-texture-filter-anisotropic.html
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWebGLRenderingContextCustom.cpp:
+        (WebCore::toJS):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp:
+        (WebCore::toV8Object):
+        * html/canvas/EXTTextureFilterAnisotropic.cpp: Copied from Source/WebCore/html/canvas/WebGLExtension.h.
+        (WebCore):
+        (WebCore::EXTTextureFilterAnisotropic::EXTTextureFilterAnisotropic):
+        (WebCore::EXTTextureFilterAnisotropic::~EXTTextureFilterAnisotropic):
+        (WebCore::EXTTextureFilterAnisotropic::getName):
+        (WebCore::EXTTextureFilterAnisotropic::create):
+        * html/canvas/EXTTextureFilterAnisotropic.h: Copied from Source/WebCore/html/canvas/WebGLExtension.h.
+        (WebCore):
+        (EXTTextureFilterAnisotropic):
+        * html/canvas/EXTTextureFilterAnisotropic.idl: Copied from Source/WebCore/html/canvas/WebGLExtension.h.
+        * html/canvas/WebGLExtension.h:
+        * html/canvas/WebGLObject.cpp:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContext::getExtension):
+        (WebCore::WebGLRenderingContext::getParameter):
+        (WebCore::WebGLRenderingContext::getSupportedExtensions):
+        (WebCore::WebGLRenderingContext::getTexParameter):
+        (WebCore::WebGLRenderingContext::texParameter):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore):
+        (WebGLRenderingContext):
+        * platform/graphics/Extensions3D.h:
+        (Extensions3D):
+        * platform/graphics/opengl/Extensions3DOpenGL.cpp:
+        (WebCore::Extensions3DOpenGL::supports):
+
+2012-03-05  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r109760.
+        http://trac.webkit.org/changeset/109760
+        https://bugs.webkit.org/show_bug.cgi?id=80320
+
+        Caused many GTK+ tests to crash (Requested by mrobinson on
+        #webkit).
+
+        * platform/network/ResourceHandleClient.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+        (WebCore):
+        (WebCore::WebCoreSynchronousLoader::~WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::didReceiveResponse):
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::WebCoreSynchronousLoader::run):
+        (WebCore::closeCallback):
+        (WebCore::readCallback):
+        (WebCore::ResourceHandle::defaultSession):
+
+2012-03-05  Adam Klein  <adamk@chromium.org>
+
+        Never dispatch mutation events in shadow DOM
+        https://bugs.webkit.org/show_bug.cgi?id=79278
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: fast/dom/shadow/suppress-mutation-events-in-shadow.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren): Move allowEventDispatch() call later,
+        now that childrenChanged won't trigger mutation events in shadow dom.
+        (WebCore::dispatchChildInsertionEvents): Bail out if in shadow tree.
+        (WebCore::dispatchChildRemovalEvents): ditto.
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchSubtreeModifiedEvent): ditto.
+
+2012-03-05  Alexey Proskuryakov  <ap@apple.com>
+
+        BlobResourceHandle should keep a reference to itself when calling client code.
+        https://bugs.webkit.org/show_bug.cgi?id=80318
+
+        Reviewed by Brady Eidson.
+
+        * platform/network/BlobResourceHandle.cpp:
+        (WebCore::BlobResourceHandle::doStart):
+        (WebCore::BlobResourceHandle::getSizeForNext):
+        (WebCore::BlobResourceHandle::readSync):
+        (WebCore::BlobResourceHandle::readDataAsync):
+        (WebCore::BlobResourceHandle::consumeData):
+        (WebCore::BlobResourceHandle::failed):
+        Added RefPtrs in functions that can result in calling client code, and use "this" object afterwards.
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Let RenderLayerCompositor set the tile cache visible rect
+        https://bugs.webkit.org/show_bug.cgi?id=80317
+
+        Reviewed by Simon Fraser.
+
+        We can't compute the visible rect from CALayers, because that breaks when we're updating
+        the scroll layer position on the main thread (since by the time visibleRectChanged() is called,
+        the CALayers won't yet have been updated).
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::visibleRectChanged):
+        * platform/graphics/ca/GraphicsLayerCA.cpp:
+        (WebCore::GraphicsLayerCA::visibleRectChanged):
+        * platform/graphics/ca/GraphicsLayerCA.h:
+        (GraphicsLayerCA):
+        * platform/graphics/ca/PlatformCALayer.h:
+        (PlatformCALayer):
+        * platform/graphics/ca/mac/PlatformCALayerMac.mm:
+        (PlatformCALayer::visibleRectChanged):
+        * platform/graphics/ca/mac/TileCache.h:
+        (TileCache):
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::visibleRectChanged):
+        (WebCore::TileCache::revalidateTiles):
+        * platform/graphics/ca/mac/WebTileCacheLayer.h:
+        (WebCore):
+        * platform/graphics/ca/mac/WebTileCacheLayer.mm:
+        (-[WebTileCacheLayer visibleRectChanged:]):
+        * platform/graphics/ca/win/PlatformCALayerWin.cpp:
+        (PlatformCALayer::visibleRectChanged):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::frameViewDidScroll):
+
+2012-03-05  Kangil Han  <kangil.han@samsung.com>
+
+        [CMake][DRT] Add WebCoreTestSupport.
+        https://bugs.webkit.org/show_bug.cgi?id=79896
+
+        Reviewed by Daniel Bates.
+
+        Add WebCoreTestSupport library for DRT in CMake.
+        We will use internals object by linking this library on DRT.
+
+        * CMakeLists.txt:
+        * UseJSC.cmake:
+        * UseV8.cmake:
+
+2012-03-05  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r109656.
+        http://trac.webkit.org/changeset/109656
+        https://bugs.webkit.org/show_bug.cgi?id=80316
+
+        This seems to have regressed Parser/html5-full-render by about
+        10% (Requested by anttik on #webkit).
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::getPositionOffsetValue):
+        (WebCore::getBorderRadiusCornerValues):
+        (WebCore::getBorderRadiusCornerValue):
+        (WebCore::getBorderRadiusShorthandValue):
+        (WebCore::lineHeightFromStyle):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validUnit):
+        (WebCore::CSSParser::createPrimitiveNumericValue):
+        (WebCore::unitFromString):
+        (WebCore::CSSParser::parseValidPrimitive):
+        (WebCore::CSSParser::detectNumberToken):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::isValidCSSUnitTypeForDoubleConversion):
+        (WebCore::unitCategory):
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::canonicalUnitTypeForCategory):
+        (WebCore::CSSPrimitiveValue::customCssText):
+        * css/CSSPrimitiveValue.h:
+        (CSSPrimitiveValue):
+        * css/CSSPrimitiveValue.idl:
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyLength::applyValue):
+        (WebCore::ApplyPropertyBorderRadius::applyValue):
+        (WebCore::ApplyPropertyFontSize::applyValue):
+        (WebCore::ApplyPropertyLineHeight::applyValue):
+        (WebCore::ApplyPropertyVerticalAlign::applyValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * dom/Document.cpp:
+        (WebCore::Document::pageSizeAndMarginsInPixels):
+        (WebCore):
+        * dom/Document.h:
+        (Document):
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::getRegion):
+        * platform/Length.h:
+        (WebCore::Length::calcValue):
+        (WebCore::Length::calcMinValue):
+        (WebCore::Length::calcFloatValue):
+        (WebCore::Length::blend):
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::lineHeight):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::lineHeight):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::reflectionOffset):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::clipRect):
+        (WebCore::RenderBox::computeLogicalWidthInRegion):
+        (WebCore::RenderBox::computeLogicalWidthInRegionUsing):
+        (WebCore::RenderBox::computeInlineDirectionMargins):
+        (WebCore::RenderBox::computeLogicalHeightUsing):
+        (WebCore::RenderBox::computePercentageLogicalHeight):
+        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
+        (WebCore::RenderBox::computeBlockDirectionMargins):
+        (WebCore::RenderBox::computePositionedLogicalWidthUsing):
+        (WebCore::RenderBox::computePositionedLogicalHeightUsing):
+        (WebCore::RenderBox::computePositionedLogicalWidthReplaced):
+        (WebCore::RenderBox::computePositionedLogicalHeightReplaced):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::relativePositionOffsetX):
+        (WebCore::RenderBoxModelObject::relativePositionOffsetY):
+        (WebCore::RenderBoxModelObject::paddingTop):
+        (WebCore::RenderBoxModelObject::paddingBottom):
+        (WebCore::RenderBoxModelObject::paddingLeft):
+        (WebCore::RenderBoxModelObject::paddingRight):
+        (WebCore::RenderBoxModelObject::paddingBefore):
+        (WebCore::RenderBoxModelObject::paddingAfter):
+        (WebCore::RenderBoxModelObject::paddingStart):
+        (WebCore::RenderBoxModelObject::paddingEnd):
+        (WebCore::RenderBoxModelObject::getBackgroundRoundedRect):
+        (WebCore::RenderBoxModelObject::calculateFillTileSize):
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        (WebCore::computeBorderImageSide):
+        (WebCore::RenderBoxModelObject::paintNinePieceImage):
+        (WebCore::RenderBoxModelObject::paintBorder):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::preferredMainAxisContentExtentForChild):
+        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes):
+        (WebCore::RenderFlexibleBox::runFreeSpaceAllocationAlgorithm):
+        * rendering/RenderInline.cpp:
+        (WebCore::computeMargin):
+        (WebCore::RenderInline::lineHeight):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::updateOptionsWidth):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        * rendering/RenderObject.h:
+        (RenderObject):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::calcScrollbarThicknessUsing):
+        (WebCore::RenderScrollbarPart::computeScrollbarWidth):
+        (WebCore::RenderScrollbarPart::computeScrollbarHeight):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::computeLogicalWidth):
+        (WebCore::RenderTable::convertStyleLogicalWidthToComputedWidth):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::logicalHeightForRowSizing):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
+        * rendering/RenderText.h:
+        (WebCore::RenderText::marginLeft):
+        (WebCore::RenderText::marginRight):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButtonGradients):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::verticalPositionForBox):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::calcRadiiFor):
+        (WebCore::RenderStyle::getRoundedBorderFor):
+        * rendering/style/RenderStyle.h:
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::resolveLengthAttributeForSVG):
+        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth):
+        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight):
+
+2012-03-05  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Add missing method to PasteboardBlackBerry.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=80326
+
+        Reviewed by Antonio Gomes.
+
+        Add missing method.
+
+        * platform/blackberry/PasteboardBlackBerry.cpp:
+        (WebCore::Pasteboard::writeClipboard):
+        (WebCore):
+
+2012-03-05  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] UTF chars printed back from cookie through php shows as ???
+        https://bugs.webkit.org/show_bug.cgi?id=80307
+
+        Reviewed by Antonio Gomes.
+
+        PR: 130055
+
+        we need to check the cookies encoding first and encode the cookie header data
+        to pass to the request.
+
+        * platform/network/blackberry/NetworkManager.cpp:
+        (WebCore::NetworkManager::startJob):
+
+2012-03-05  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Remove old cleanupResources() code
+        https://bugs.webkit.org/show_bug.cgi?id=80290
+
+        Reviewed by Adrienne Walker.
+
+        cleanupResources() is only called by destructors, and adds no
+        value, any more, beyond the destructors themselves, but complicates
+        the code path.
+
+        Covered by existing tests.
+
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (CCLayerImpl):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.cpp:
+        (WebCore::CCPluginLayerImpl::~CCPluginLayerImpl):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.h:
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::~CCRenderSurface):
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        (CCRenderSurface):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.cpp:
+        (WebCore::CCVideoLayerImpl::~CCVideoLayerImpl):
+
+2012-03-05  Sami Kyostila  <skyostil@chromium.org>
+
+        Partially loaded JPEGs should have alpha channel
+        https://bugs.webkit.org/show_bug.cgi?id=78239
+
+        Reviewed by Kenneth Russell.
+
+        While a JPEG image is loading, the area outside the decoded region
+        should be fully transparent. Since currently all JPEG frames are marked
+        as opaque, a renderer respecting this flag will draw the partially
+        loaded image with garbage outside the valid image region.
+
+        Hence, a partially loaded JPEG image should be marked as having an alpha
+        channel while decoding is in progress. For performance reasons we mark
+        the image opaque after decoding has finished.
+
+        Graphics corruption caused by this bug was recently observed on
+        Chromium (http://code.google.com/p/chromium/issues/detail?id=113171). A
+        recent Skia change (r3036) changed SkBitmap::extractSubset() to produce
+        a bitmap with the same opaqueness flag as the parent. This meant that
+        the renderer was now seeing an opaque image from the JPEG decoder, and
+        drawing it appropriately resulted in garbage outside the decoded region.
+
+        Test: http/tests/incremental/partial-jpeg.html
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        (WebCore::JPEGImageDecoder::jpegComplete):
+
+2012-03-05  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Initialize CCOverdrawCounts struct to zero
+        https://bugs.webkit.org/show_bug.cgi?id=80204
+
+        Reviewed by Adrienne Walker.
+
+        CCOverdrawCounts is stack allocated but not explicitly initialized, so the values are garbage. This adds a c'tor
+        to zero out the fields, which is the desired behavior.  Bug was initially caught by valgrind, see
+        http://crbug.com/116475
+
+        * platform/graphics/chromium/cc/CCRenderPass.h:
+        (WebCore::CCOverdrawCounts::CCOverdrawCounts):
+
+2012-03-05  Min Qin  <qinmin@google.com>
+
+        Add media control css for chromium on android
+        https://bugs.webkit.org/show_bug.cgi?id=79550
+
+        Reviewed by Adam Barth.
+
+        This should not change the any test results as it does not affect the any current bots. New test expectations will be added if we have a android bot on webkit.
+
+        * WebCore.gyp/WebCore.gyp:
+        * css/mediaControlsChromiumAndroid.css: Added.
+        (body:-webkit-full-page-media):
+        (audio):
+        (audio:-webkit-full-page-media, video:-webkit-full-page-media):
+        (audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel):
+        (video:-webkit-full-page-media::-webkit-media-controls-panel):
+        (audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button):
+        (audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button):
+        (audio::-webkit-media-controls-timeline-container):
+        (video::-webkit-media-controls-timeline-container):
+        (audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display):
+        (audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline):
+        (video::-webkit-media-controls-fullscreen-button):
+        (audio::-webkit-media-controls-fullscreen-button):
+        (audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container):
+        (audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaFullscreenButton):
+        (WebCore):
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):
+        * rendering/RenderThemeChromiumAndroid.cpp:
+        (WebCore::RenderThemeChromiumAndroid::extraMediaControlsStyleSheet):
+        (WebCore):
+        (WebCore::RenderThemeChromiumAndroid::paintMediaFullscreenButton):
+        * rendering/RenderThemeChromiumAndroid.h:
+
+2012-03-05  Anders Carlsson  <andersca@apple.com>
+
+        Fix crash in ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition
+        https://bugs.webkit.org/show_bug.cgi?id=80303
+        <rdar://problem/10953682>
+
+        Reviewed by Beth Dakin.
+
+        Add the same null checks that already exist in updateMainFrameScrollPosition.
+
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition):
+
+2012-03-05  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: CSS inactive property check should account for vendor prefixes
+        https://bugs.webkit.org/show_bug.cgi?id=80225
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/styles/vendor-prefixes.html
+
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyle::populateObjectWithStyleProperties):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.alteredHexNumber):
+        (WebInspector.StylesSidebarPane.canonicalPropertyName):
+        (WebInspector.StylesSidebarPane.prototype._markUsedProperties):
+        (WebInspector.StylePropertiesSection.prototype.isPropertyOverloaded):
+
+2012-03-05  Adam Barth  <abarth@webkit.org>
+
+        Geolocation should use a ScriptExecutionContext as its context object
+        https://bugs.webkit.org/show_bug.cgi?id=80248
+
+        Reviewed by Kentaro Hara.
+
+        This patch updates Geolocation to use some more modern WebCore
+        mechanisms.  Previously, Geolocation used a Frame as a context object,
+        which required a bunch of manual integration with the PageCache as well
+        as custom signaling for Geolocation::reset().  After this patch,
+        Geolocation subclasses ActiveDOMObject, which does all this work
+        automatically.
+
+        * Modules/geolocation/Geolocation.cpp:
+        (WebCore::Geolocation::create):
+        (WebCore):
+        (WebCore::Geolocation::Geolocation):
+        (WebCore::Geolocation::~Geolocation):
+        (WebCore::Geolocation::document):
+        (WebCore::Geolocation::frame):
+        (WebCore::Geolocation::page):
+        (WebCore::Geolocation::stop):
+        (WebCore::Geolocation::getCurrentPosition):
+        (WebCore::Geolocation::watchPosition):
+        (WebCore::Geolocation::requestPermission):
+        (WebCore::Geolocation::clearWatch):
+        (WebCore::Geolocation::setIsAllowed):
+        * Modules/geolocation/Geolocation.h:
+        (WebCore):
+        (Geolocation):
+        * Modules/geolocation/NavigatorGeolocation.cpp:
+        (WebCore):
+        (WebCore::NavigatorGeolocation::geolocation):
+        * Modules/geolocation/NavigatorGeolocation.h:
+        (NavigatorGeolocation):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (Document):
+        * history/PageCache.cpp:
+        (WebCore::logCanCacheFrameDecision):
+        (WebCore::PageCache::canCachePageContainingThisFrame):
+
+2012-03-05  Martin Robinson  <mrobinson@igalia.com>
+
+        [soup] Crash while loading http://www.jusco.cn
+        https://bugs.webkit.org/show_bug.cgi?id=68238
+
+        Reviewed by Philippe Normand.
+
+        Test: http/tests/xmlhttprequest/xmlhttprequest-sync-no-timers.html
+
+        When running synchronous XMLHttpRequests, push a new inner thread default
+        context, so that other sources from timers and network activity do not run.
+        This will make synchronous requests truly synchronous with the rest of
+        WebCore.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCoreSynchronousLoader): Clean up the method definitions a bit by writing them inline.
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader): Push a new thread default
+        context to prevent other sources from running.
+        (WebCore::WebCoreSynchronousLoader::~WebCoreSynchronousLoader): Pop the inner thread default context.
+        (WebCore::closeCallback): If the client is synchronous call didFinishLoading now.
+        (WebCore::readCallback): Only call didFinishLoading if the client isn't synchronous.
+        (WebCore::ResourceHandle::defaultSession): Activate use-thread-context so that the soup session
+        respects the inner thread context.
+        (ResourceHandleClient):
+        (WebCore::ResourceHandleClient::isSynchronousClient): Added this virtual method.
+
+2012-03-05  Alexander Færøy  <alexander.faeroy@nokia.com>
+
+        Remove pointer to timer and use the timers directly in the tiled backing store
+        https://bugs.webkit.org/show_bug.cgi?id=80283
+
+        Patch by Kenneth Rohde Christiansen and Alexander Færøy.
+
+        Reviewed by Simon Hausmann.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::TiledBackingStore):
+        (WebCore::TiledBackingStore::~TiledBackingStore):
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::startTileBufferUpdateTimer):
+        (WebCore::TiledBackingStore::startTileCreationTimer):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-03-05  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] Tabbing an empty new property in the middle of style moves the editor to the next section
+        https://bugs.webkit.org/show_bug.cgi?id=80264
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.element.userInput.previousContent.context.moveDirection.alreadyNew):
+        (WebInspector.StylePropertyTreeElement.prototype):
+
+2012-03-05  Rob Buis  <rbuis@rim.com>
+
+        [BlackBerry] Update LocalizedStringsBlackBerry.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=80278
+
+        Reviewed by Antonio Gomes.
+
+        Update LocalizedStringsBlackBerry.cpp to current HEAD.
+
+        * platform/blackberry/LocalizedStringsBlackBerry.cpp:
+        (WebCore::inputElementAltText): fall back to "Submit".
+        (WebCore::imageTitle): choose the format "filename(widthxheight)" like Chrome does.
+        (WebCore::fileButtonNoFilesSelectedLabel): fall back to "No File Chosen" translation like Chrome does.
+        (WebCore):
+
+2012-03-05  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: [chromium] introduce HeapSnapshot performance test.
+        https://bugs.webkit.org/show_bug.cgi?id=80280
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/HeapSnapshotProxy.js:
+        (WebInspector.HeapSnapshotLoaderProxy.prototype.finishLoading.updateStaticData):
+        (WebInspector.HeapSnapshotLoaderProxy.prototype.finishLoading):
+        (WebInspector.HeapSnapshotLoaderProxy.prototype._callLoadCallbacks):
+
+2012-03-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: cannot be launched when localStorage is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=80252
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/Settings.js:
+
+2012-03-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: check for the number of parsed css properties.
+        https://bugs.webkit.org/show_bug.cgi?id=80268
+
+        Reviewed by Vsevolod Vlasov.
+
+        Test: inspector/styles/set-property-boundaries.html
+
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::didRemoveDOMNode):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyle::setPropertyText):
+
+2012-03-05  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Tabbed pane should redraw tab elements when tab is closed.
+        https://bugs.webkit.org/show_bug.cgi?id=80273
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TabbedPane.js:
+        (WebInspector.TabbedPane.prototype.closeTab):
+
+2012-03-05  Alexander Færøy  <alexander.faeroy@nokia.com>
+
+        Improve comments in the tiled backing store
+        https://bugs.webkit.org/show_bug.cgi?id=80279
+
+        Patch by Kenneth Rohde Christiansen and Alexander Færøy.
+
+        Reviewed by Simon Hausmann.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::createTiles):
+
+2012-03-05  Alexander Færøy  <alexander.faeroy@nokia.com>
+
+        TiledBackingStore.{h,cpp} contains unclear variable names
+        https://bugs.webkit.org/show_bug.cgi?id=80276
+
+        Patch by Kenneth Rohde Christiansen and Alexander Færøy.
+
+        Reviewed by Simon Hausmann.
+
+        This patch renames some of the variables in TiledBackingStore.cpp to
+        enhance the clearity and for consistence.
+
+        The visibleContentsRect is renamed to visibleRect as it is not in
+        contents coordinates.
+
+        The panningTrajectoryVector and m_visibleRectTrajectoryVector are
+        renamed to just *[m_]trajectoryVector, as that is descriptive enough.
+
+        The previous prefix has also been removed, as it is being used as the
+        current one in the code. This avoids confusion.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::coverWithTilesIfNeeded):
+        (WebCore::TiledBackingStore::visibleRect):
+        (WebCore::TiledBackingStore::visibleAreaIsCovered):
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::computeCoverAndKeepRect):
+        (WebCore::TiledBackingStore::removeAllNonVisibleTiles):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-03-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Fix build with Qt 5 and OpenGL ES 2.0
+
+        Reviewed by Noam Rosenthal.
+
+        * platform/graphics/texmap/TextureMapper.h: Since we don't do QT += opengl with Qt 5 anymore
+        here in WebCore, we cannot check for QT_OPENGL_LIB. But since this is Qt5, we know that the
+        GLES setting comes qconfig.h and we can rely on it.
+
+2012-03-05  Alexander Færøy  <alexander.faeroy@nokia.com>
+
+        Whitespace clean-up of TiledBackingStore.cpp.
+
+        Rubber-stamped by Kenneth Rohde Christiansen.
+
+        Already covered by existing tests.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore):
+        (WebCore::TiledBackingStore::updateTileBuffers):
+        (WebCore::TiledBackingStore::paint):
+
+2012-03-05  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.list.am: Add missing header file.
+
+2012-03-05  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Incorrect appropriateSelectorFor() suggestion for when a DOMNode has more than 2 CSS classes
+        https://bugs.webkit.org/show_bug.cgi?id=80258
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode.prototype.appropriateSelectorFor):
+
+2012-03-02  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] [CRASH] Handle rule addition and inline style editing failure due to Content-Security-Policy in the page
+        https://bugs.webkit.org/show_bug.cgi?id=80024
+
+        Reviewed by Pavel Feldman.
+
+        Test: inspector/styles/add-new-rule-inline-style-csp.html
+
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::InspectorCSSAgent::viaInspectorStyleSheet):
+        * inspector/InspectorCSSAgent.h:
+        (InlineStyleOverrideScope):
+        (WebCore::InspectorCSSAgent::InlineStyleOverrideScope::InlineStyleOverrideScope):
+        (WebCore::InspectorCSSAgent::InlineStyleOverrideScope::~InlineStyleOverrideScope):
+        (InspectorCSSAgent):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheetForInlineStyle::setStyleText):
+        * page/ContentSecurityPolicy.cpp:
+        (WebCore::ContentSecurityPolicy::ContentSecurityPolicy):
+        (WebCore::ContentSecurityPolicy::allowInlineStyle):
+        (WebCore::ContentSecurityPolicy::setOverrideAllowInlineStyle):
+        (WebCore):
+        * page/ContentSecurityPolicy.h:
+        (ContentSecurityPolicy):
+
+2012-03-05  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] The "optgroup" element should not be a form-associated element
+        https://bugs.webkit.org/show_bug.cgi?id=80234
+
+        Reviewed by Kent Tamura.
+
+        This patch changes base class of HTMLOptGroup to HTMLElement from
+        HTMLFormControlElement to avoid the "optgroup" element in form-associate
+        elements collection.
+
+        This patch doesn't affect HTMLOptionElement::disabled's static_cast. However,
+        it doesn't good at coding style. This patch also fix it.
+
+
+        No new tests. No behavior changes.
+
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::HTMLOptGroupElement): Remove "form" parameter.
+        (WebCore::HTMLOptGroupElement::create): Remove "form" parameter.
+        (WebCore::HTMLOptGroupElement::childrenChanged): Replace base method call.
+        (WebCore::HTMLOptGroupElement::parseAttribute): Replace base method call.
+        (WebCore::HTMLOptGroupElement::attach): Replace base method call.
+        (WebCore::HTMLOptGroupElement::detach): Replace base method call.
+        * html/HTMLOptGroupElement.h:
+        (HTMLOptGroupElement): Change base class to HTMLElement.
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::disabled): Replace static_cast<HTMLFormControlElement*> to static_cast<HTMLElement*> with checking isHTMLElement.
+        * html/HTMLTagNames.in: Remove "constructorNeedsFormElement" for not passing "form" parameter in HTMLElementFactory.
+
+2012-03-05  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: fix extensions-resource.html test.
+        https://bugs.webkit.org/show_bug.cgi?id=80183
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype._updateAnchor):
+
+2012-03-02  Andrey Kosyakov  <caseq@chromium.org>
+
+        Add instrumentation for frame start/end on timeline.
+
+        Web Inspector: add timeline instrumentation for frame events
+        https://bugs.webkit.org/show_bug.cgi?id=80127
+
+        Reviewed by Pavel Feldman.
+
+        - display frame boundaries when vertical overview mode is on
+        - aggregate by frame in vertical overview mode
+        - switched event filtering criteria from index to time in vertical overview mode
+
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didBeginFrameImpl):
+        (WebCore):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::didBeginFrame):
+        (WebCore):
+        * inspector/InspectorTimelineAgent.cpp:
+        (TimelineRecordType):
+        (WebCore::InspectorTimelineAgent::didBeginFrame):
+        (WebCore):
+        * inspector/InspectorTimelineAgent.h:
+        (InspectorTimelineAgent):
+        * inspector/front-end/TimelineModel.js:
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype._showMemoryGraph):
+        (WebInspector.TimelineOverviewPane.prototype.setStartAtZero):
+        (WebInspector.TimelineOverviewPane.prototype.updateEventDividers):
+        (WebInspector.TimelineOverviewPane.prototype.sidebarResized):
+        (WebInspector.TimelineOverviewPane.prototype.reset):
+        (WebInspector.TimelineOverviewPane.prototype.accept):
+        (WebInspector.TimelineOverviewPane.prototype.windowStartTime):
+        (WebInspector.TimelineOverviewPane.prototype.windowEndTime):
+        (WebInspector.TimelineOverviewPane.prototype._onWindowChanged):
+        (WebInspector.TimelineStartAtZeroOverview):
+        (WebInspector.TimelineStartAtZeroOverview.prototype.reset):
+        (WebInspector.TimelineStartAtZeroOverview.prototype.update):
+        (WebInspector.TimelineStartAtZeroOverview.prototype._aggregateFrames):
+        (WebInspector.TimelineStartAtZeroOverview.prototype._aggregateFrameStatistics):
+        (WebInspector.TimelineStartAtZeroOverview.prototype._aggregateRecords):
+        (WebInspector.TimelineStartAtZeroOverview.prototype._buildBar):
+        (WebInspector.TimelineStartAtZeroOverview.prototype.getWindowTimes):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._updateEventDividers):
+        (WebInspector.TimelinePanel.prototype._createEventDivider):
+        (WebInspector.TimelinePanel.prototype._toggleStartAtZeroButtonClicked):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline.addTimestampRecords):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelineCategoryFilter.prototype.accept):
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.prototype.get _recordStyles):
+        * inspector/front-end/inspectorCommon.css:
+        * inspector/front-end/timelinePanel.css:
+        (#timeline-container):
+        (.timeline .resources-event-divider):
+        (.timeline.timeline-start-at-zero .resources-divider):
+        (.timeline .resources-event-divider.timeline-frame-divider):
+
+2012-03-05  MORITA Hajime  <morrita@google.com>
+
+        Unreviewed build fix for !ENABLE(SHADOW_DOM).
+
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::contentTagName):
+
+2012-03-04  MORITA Hajime  <morrita@google.com>
+
+        Internally used HTMLContentElement subclasses should have correct wrapper.
+        https://bugs.webkit.org/show_bug.cgi?id=80237
+
+        Reviewed by Kent Tamura.
+
+        DetailsContentElement and DetailsSummaryElement used to use
+        <div> as their tag name. But this means they are wrapped by
+        wrapper objects for HTMLDivElement, which is wrong. This happened
+        to work though because HTMLDivElement has no extra state or API.
+
+        This change introduces "noConstructor" keyword for make_name.pl
+        sources.  This keyword allows a tag name to specify its own
+        wrapper without making the tag name visible from the parser, or
+        HTMLElementFactory in precise.
+
+        Following this addition, this change also adds a new tag name
+        "webkitShadowContent" for DetailsContentElement and DetailsSummaryElement,
+        which has no constructor, and whose wrapper type is HTMLElement.
+
+        This change isn't visible from the page author and only matters for testing.
+
+        Test: fast/dom/shadow/content-element-user-agent-shadow.html
+
+        * dom/make_names.pl:
+        (defaultTagPropertyHash):
+        (buildConstructorMap):
+        (printConstructors):
+        (printFunctionInits):
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::DetailsContentElement::DetailsContentElement):
+        (WebCore::DetailsSummaryElement::DetailsSummaryElement):
+        * html/HTMLTagNames.in:
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::contentTagName):
+
+2012-03-05  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Refactoring: Move HTMLContentElement::attach to InsertionPoint::attach.
+        https://bugs.webkit.org/show_bug.cgi?id=80243
+
+        Reviewed by Hajime Morita.
+
+        Since the current code in HTMLContentElement::attach() will be used for coming <shadow>
+        elements, it is natural that InsertionPoint::attach() has such code.
+
+        No new tests, no change in behavior.
+
+        * html/shadow/HTMLContentElement.cpp:
+        * html/shadow/HTMLContentElement.h:
+        (HTMLContentElement):
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::attach):
+        (WebCore):
+        (WebCore::InsertionPoint::detach):
+        * html/shadow/InsertionPoint.h:
+        (InsertionPoint):
+
+2012-03-05  Adam Barth  <abarth@webkit.org>
+
+        allowDatabaseAccess and databaseExceededQuota should be part of DatabaseContext not ScriptExecutionContext
+        https://bugs.webkit.org/show_bug.cgi?id=80178
+
+        Reviewed by Eric Seidel.
+
+        These functions are only used by SQLDatabase, which means we can move
+        them to DatabaseContext, removing one more tendril of the SQLDatabase
+        code.
+
+        * dom/Document.cpp:
+        (WebCore):
+        * dom/Document.h:
+        (Document):
+        * dom/ScriptExecutionContext.h:
+        (ScriptExecutionContext):
+        * storage/DatabaseContext.cpp:
+        (WebCore::DatabaseContext::DatabaseContext):
+        (WebCore::DatabaseContext::from):
+        (WebCore::DatabaseContext::allowDatabaseAccess):
+        (WebCore):
+        (WebCore::DatabaseContext::databaseExceededQuota):
+        * storage/DatabaseContext.h:
+        (DatabaseContext):
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::canEstablishDatabase):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::executeSQL):
+        * storage/SQLTransactionClient.cpp:
+        (WebCore::SQLTransactionClient::didExceedQuota):
+        * storage/SQLTransactionSync.cpp:
+        (WebCore::SQLTransactionSync::executeSQL):
+        * workers/WorkerContext.cpp:
+        (WebCore):
+        * workers/WorkerContext.h:
+        (WorkerContext):
+
+2012-03-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r107551.
+        http://trac.webkit.org/changeset/107551
+        https://bugs.webkit.org/show_bug.cgi?id=80245
+
+        caused incorrect style sharing (Requested by kling on
+        #webkit).
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-04  Luke Macpherson   <macpherson@chromium.org>
+
+        Remove unused macro HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE.
+        https://bugs.webkit.org/show_bug.cgi?id=80236
+
+        Reviewed by Eric Seidel.
+
+        No new tests / unused code deletion only.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore):
+
+2012-03-04  Filip Pizlo  <fpizlo@apple.com>
+
+        JIT heuristics should be hyperbolic
+        https://bugs.webkit.org/show_bug.cgi?id=80055
+        <rdar://problem/10922260>
+
+        Reviewed by Oliver Hunt.
+
+        No new tests, since there's no new functionality.
+
+        * ForwardingHeaders/wtf/SimpleStats.h: Added.
+
+2012-03-04  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Methods like firstRendererOf of NodeRenderingContext should be extracted.
+        https://bugs.webkit.org/show_bug.cgi?id=79902
+
+        Reviewed by Hajime Morita.
+
+        firstRendererOfInsertionPoint should return the first renderer of its child, however
+        it returns next renderer of parent. The same thing happens lastRendererOfInsertionPoint.
+
+        Test: content-element-move.html has another test case.
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore):
+        (WebCore::nextRendererOfInsertionPoint):
+        (WebCore::previousRendererOfInsertionPoint):
+        (WebCore::firstRendererOfInsertionPoint):
+        (WebCore::lastRendererOfInsertionPoint):
+        (WebCore::firstRendererOf):
+        (WebCore::lastRendererOf):
+        (WebCore::NodeRenderingContext::nextRenderer):
+        (WebCore::NodeRenderingContext::previousRenderer):
+
+2012-03-04  MORITA Hajime <morrita@google.com>
+
+        Unreviewed build fix for ENABLE(MATHML).
+
+        * mathml/MathMLElement.h:
+        (WebCore):
+
+2012-03-04  MORITA Hajime  <morrita@google.com>
+
+        WebKit needs toHTMLUnknownElement() and isUnknown() for sanity check.
+        https://bugs.webkit.org/show_bug.cgi?id=80229
+
+        Reviewed by Kent Tamura.
+
+        The code generator has naked static_cast<> which could be unsafe.
+        We can turn it into toHTMLUnknownElement() and the like.
+
+        No new tests. Just added a sanity check.
+
+        * dom/make_names.pl:
+        (printWrapperFactoryCppFile):
+        * html/HTMLElement.h:
+        (HTMLElement):
+        (WebCore::HTMLElement::isHTMLUnknownElement):
+        * html/HTMLUnknownElement.h:
+        (HTMLUnknownElement):
+        (WebCore::toHTMLUnknownElement):
+        (WebCore):
+        * mathml/MathMLElement.h:
+        (toMathMLElement):
+        * svg/SVGElement.h:
+        (WebCore::toSVGElement):
+        (WebCore):
+
+2012-03-04  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertyWebkitColumnBreakAfter, CSSPropertyWebkitColumnBreakBefore and CSSPropertyWebkitColumnBreakInside in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=80226
+
+        Reviewed by Eric Seidel.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-04  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>
+
+        [BlackBerry] Credential backing store implementation
+        https://bugs.webkit.org/show_bug.cgi?id=79650
+
+        Reviewed by Antonio Gomes.
+
+        Opened Credential database in CedentialBackingStore::instance().
+        Added never_remember table and associated sql statment
+        members to store the never remember sites.
+        Removed CredentialStorage initialize codes because that
+        won't give users a chance to re-enter the new credential
+        information for an already stored site.
+        Changed login update and has statement to support
+        autofill feature of multiple credential forms in the
+        same page; Also added url as a parameter of hasLogin() function.
+        Added calling reset() after each statement calls step(),
+        to make it work correctly next time.
+        Also fixed a macro typo in HANDLE_SQL_EXEC_FAILURE.
+
+        No new tests.
+
+        * platform/network/blackberry/CredentialBackingStore.cpp:
+        (WebCore::CredentialBackingStore::instance):
+        (WebCore::CredentialBackingStore::CredentialBackingStore):
+        (WebCore::CredentialBackingStore::open):
+        (WebCore::CredentialBackingStore::close):
+        (WebCore::CredentialBackingStore::addLogin):
+        (WebCore::CredentialBackingStore::updateLogin):
+        (WebCore::CredentialBackingStore::hasLogin):
+        (WebCore::CredentialBackingStore::getLogin):
+        (WebCore):
+        (WebCore::CredentialBackingStore::removeLogin):
+        (WebCore::CredentialBackingStore::addNeverRemember):
+        (WebCore::CredentialBackingStore::hasNeverRemember):
+        (WebCore::CredentialBackingStore::getNeverRemember):
+        (WebCore::CredentialBackingStore::removeNeverRemember):
+        (WebCore::CredentialBackingStore::clearLogins):
+        (WebCore::CredentialBackingStore::clearNeverRemember):
+        * platform/network/blackberry/CredentialBackingStore.h:
+        (CredentialBackingStore):
+
+2012-03-04  Hyowon Kim  <hw1008.kim@samsung.com>
+
+        [EFL] Evas_GL initialization and destruction in GraphicsContext3DPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=80211
+
+        Reviewed by Noam Rosenthal.
+
+        This patch adds initialization and destruction codes using Evas_GL APIs to GC3DPrivate.
+
+        No new tests. No behavior change.
+
+        * platform/graphics/efl/GraphicsContext3DPrivate.cpp:
+        (WebCore::GraphicsContext3DPrivate::create):
+        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::~GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::initialize):
+        (WebCore::GraphicsContext3DPrivate::createSurface):
+        (WebCore::GraphicsContext3DPrivate::makeContextCurrent):
+        * platform/graphics/efl/GraphicsContext3DPrivate.h:
+        (GraphicsContext3DPrivate):
+
+2012-03-04  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [CMake] Libraries are installed to /usr/lib and not /usr/lib64 on x86_64
+        https://bugs.webkit.org/show_bug.cgi?id=71507
+
+        Reviewed by Antonio Gomes.
+
+        No new tests, buildsystem change.
+
+        * CMakeLists.txt: Use ${LIB_INSTALL_DIR} instead of hardcoding "lib".
+
+2012-03-04  Hyowon Kim  <hw1008.kim@samsung.com>
+
+        [EFL] Implementation of missing functions in GraphicsContext3DPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=79759
+
+        Reviewed by Noam Rosenthal.
+
+        The initial patch (Bug 62961) only contains implementations for simple functions
+        which call GL functions through Evas_GL_API.
+        This patch implements a little complicated functions such as getActiveAttrib(),
+        getShaderSource() and so on.
+
+        No new tests. No behavior change.
+
+        * platform/graphics/efl/GraphicsContext3DPrivate.cpp:
+        (WebCore::GraphicsContext3DPrivate::getActiveAttrib):
+        (WebCore::GraphicsContext3DPrivate::getActiveUniform):
+        (WebCore::GraphicsContext3DPrivate::getError):
+        (WebCore::GraphicsContext3DPrivate::getIntegerv):
+        (WebCore::GraphicsContext3DPrivate::getProgramInfoLog):
+        (WebCore::GraphicsContext3DPrivate::getShaderInfoLog):
+        (WebCore::GraphicsContext3DPrivate::getShaderSource):
+
+2012-03-04  Kentaro Hara  <haraken@chromium.org>
+
+        Revert SVG-related APIs from DOMWindowSVG.idl back to DOMWindow.idl
+        https://bugs.webkit.org/show_bug.cgi?id=80139
+
+        Reviewed by Adam Barth.
+
+        Based on the discussion on webkit-dev@
+        (http://markmail.org/message/kagvswmah67zmrry#query:+page:1+mid:h34vzbiu5suub3ld+state:results),
+        this patch reverts SVG-related APIs from DOMWindowSVG.idl back to DOMWindow.idl.
+
+        No tests. No change in behavior.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/DOMWindow.idl:
+        * svg/DOMWindowSVG.idl: Removed.
+
+2012-03-04  Kentaro Hara  <haraken@chromium.org>
+
+        Revert WebGL-related APIs from DOMWindowWebGL.idl back to DOMWindow.idl
+        https://bugs.webkit.org/show_bug.cgi?id=80144
+
+        Reviewed by Adam Barth.
+
+        Based on the discussion on webkit-dev@
+        (http://markmail.org/message/kagvswmah67zmrry#query:+page:1+mid:h34vzbiu5suub3ld+state:results),
+        this patch reverts WebGL-related APIs from DOMWindowWebGL.idl back to DOMWindow.idl.
+
+        No tests. No change in behavior.
+
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/canvas/DOMWindowWebGL.idl: Removed.
+        * page/DOMWindow.idl:
+
+2012-03-04  MORITA Hajime  <morrita@google.com>
+
+        Unreviewed build fix.
+
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::canHaveGeneratedChildren):
+
+2012-03-01  MORITA Hajime  <morrita@google.com>
+
+        REGRESSION(r108758): Assertion failure in WebCore::RenderMenuList::addChild
+        https://bugs.webkit.org/show_bug.cgi?id=80096
+
+        Reviewed by Dimitri Glazkov.
+
+        After r108758 RenderBlock allowed <select> to have generated
+        contents. But it shouldn't. This change stops allowing it again by
+        replacing some canHaveChildren() invocations with
+        less permissive canHaveGeneratedChildren().
+
+        This change also pulls back original canHaveChildren() logic to
+        RenderButton to allow <button> to have generated contents.
+
+        Then RenderDeprecatedFlexibleBox::buttonText() is morphed to
+        more intention revealing canHaveGeneratedChildren().
+
+        Test: fast/forms/select-generated-content.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore):
+        (WebCore::canHaveGeneratedChildren):
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::findFirstLetterBlock):
+        (WebCore::RenderBlock::updateFirstLetter):
+        * rendering/RenderButton.cpp:
+        * rendering/RenderButton.h:
+        (RenderButton):
+        * rendering/RenderDeprecatedFlexibleBox.h:
+        (WebCore::RenderDeprecatedFlexibleBox::canHaveGeneratedChildren):
+        * rendering/RenderMenuList.h:
+
+2012-03-04  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream two helper files from platform/graphics/blackberry
+        https://bugs.webkit.org/show_bug.cgi?id=80125
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream, no new tests.
+
+        * platform/graphics/blackberry/InstrumentedPlatformCanvas.h: Added.
+        (WebCore):
+        (InstrumentedPlatformCanvas):
+        (WebCore::InstrumentedPlatformCanvas::InstrumentedPlatformCanvas):
+        (WebCore::InstrumentedPlatformCanvas::~InstrumentedPlatformCanvas):
+        (WebCore::InstrumentedPlatformCanvas::isSolidColor):
+        (WebCore::InstrumentedPlatformCanvas::solidColor):
+        (WebCore::InstrumentedPlatformCanvas::save):
+        (WebCore::InstrumentedPlatformCanvas::saveLayer):
+        (WebCore::InstrumentedPlatformCanvas::restore):
+        (WebCore::InstrumentedPlatformCanvas::translate):
+        (WebCore::InstrumentedPlatformCanvas::scale):
+        (WebCore::InstrumentedPlatformCanvas::rotate):
+        (WebCore::InstrumentedPlatformCanvas::skew):
+        (WebCore::InstrumentedPlatformCanvas::concat):
+        (WebCore::InstrumentedPlatformCanvas::setMatrix):
+        (WebCore::InstrumentedPlatformCanvas::clipRect):
+        (WebCore::InstrumentedPlatformCanvas::clipPath):
+        (WebCore::InstrumentedPlatformCanvas::clipRegion):
+        (WebCore::InstrumentedPlatformCanvas::clear):
+        (WebCore::InstrumentedPlatformCanvas::drawPaint):
+        (WebCore::InstrumentedPlatformCanvas::drawPoints):
+        (WebCore::InstrumentedPlatformCanvas::drawRect):
+        (WebCore::InstrumentedPlatformCanvas::drawPath):
+        (WebCore::InstrumentedPlatformCanvas::drawBitmap):
+        (WebCore::InstrumentedPlatformCanvas::drawBitmapRect):
+        (WebCore::InstrumentedPlatformCanvas::drawBitmapMatrix):
+        (WebCore::InstrumentedPlatformCanvas::drawSprite):
+        (WebCore::InstrumentedPlatformCanvas::drawText):
+        (WebCore::InstrumentedPlatformCanvas::drawPosText):
+        (WebCore::InstrumentedPlatformCanvas::drawPosTextH):
+        (WebCore::InstrumentedPlatformCanvas::drawTextOnPath):
+        (WebCore::InstrumentedPlatformCanvas::drawPicture):
+        (WebCore::InstrumentedPlatformCanvas::drawVertices):
+        (WebCore::InstrumentedPlatformCanvas::drawData):
+        * platform/graphics/blackberry/LayerMessage.h: Added.
+        (WebCore):
+        (WebCore::isCompositingThread):
+        (WebCore::compositingThread):
+        (WebCore::isWebKitThread):
+        (WebCore::webKitThread):
+        (WebCore::dispatchCompositingMessage):
+        (WebCore::dispatchSyncCompositingMessage):
+        (WebCore::dispatchWebKitMessage):
+
+2012-03-04  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Introduce SMIL overrideStyle, to make SVG stop mutating CSS styles directly
+        https://bugs.webkit.org/show_bug.cgi?id=79790
+
+        Reviewed by Dirk Schulze.
+
+        Restore SMIL animation behavior back to pre-r109342.
+        1) Always animate presentation attributes as CSS properties, regardless of the
+        attributeTypes value. Matches Opera/FF, and makes the attribute optional again
+        as specified in both SMIL & SVG.
+
+        Extend existing svg/animations/attributesTypes.html to verify this.
+
+        2) Switch setInstancesUpdatesBlocked calls to the right locations again, to
+        avoid chromium assertions (and/or extra work being done). Fixing that reveals another
+        problem: in the instance updating code path, we always called setTargetAttributeAnimatedCSSValue
+        even for XML animations.
+
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::shouldApplyAnimation): Restore old logic.
+        (WebCore::SVGAnimationElement::setTargetAttributeAnimatedValue): Fix typo, move setInstancesUpdatesBlocked calls.
+
+2012-03-04  Jonathan Dong  <jonathan.dong@torchmobile.com.cn>
+
+        [BlackBerry] upstream MediaPlayerPrivateBlackBerry.[cpp|h]
+        https://bugs.webkit.org/show_bug.cgi?id=79729
+
+        Reviewed by Rob Buis and Antonio Gomes.
+
+        Implementation of MediaPlayerPrivate for BlackBerry porting.
+        Initial upstream, No new tests.
+
+        * PlatformBlackBerry.cmake:
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::MediaPlayerPrivate::create):
+        (WebCore::MediaPlayerPrivate::registerMediaEngine):
+        (WebCore::MediaPlayerPrivate::getSupportedTypes):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::notifyAppActivatedEvent):
+        (WebCore::MediaPlayerPrivate::setCertificatePath):
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::~MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::cancelLoad):
+        (WebCore::MediaPlayerPrivate::prepareToPlay):
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::pause):
+        (WebCore::MediaPlayerPrivate::supportsFullscreen):
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::hasVideo):
+        (WebCore::MediaPlayerPrivate::hasAudio):
+        (WebCore::MediaPlayerPrivate::setVisible):
+        (WebCore::MediaPlayerPrivate::duration):
+        (WebCore::MediaPlayerPrivate::currentTime):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::userDrivenSeekTimerFired):
+        (WebCore::MediaPlayerPrivate::seeking):
+        (WebCore::MediaPlayerPrivate::setRate):
+        (WebCore::MediaPlayerPrivate::paused):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::networkState):
+        (WebCore::MediaPlayerPrivate::readyState):
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable):
+        (WebCore::MediaPlayerPrivate::buffered):
+        (WebCore::MediaPlayerPrivate::bytesLoaded):
+        (WebCore::MediaPlayerPrivate::setSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::MediaPlayerPrivate::hasAvailableVideoFrame):
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+        (WebCore::MediaPlayerPrivate::movieLoadType):
+        (WebCore::MediaPlayerPrivate::userAgent):
+        (WebCore::MediaPlayerPrivate::resizeSourceDimensions):
+        (WebCore::MediaPlayerPrivate::setFullscreenWebPageClient):
+        (WebCore::MediaPlayerPrivate::getWindow):
+        (WebCore::MediaPlayerPrivate::getPeerWindow):
+        (WebCore::MediaPlayerPrivate::getWindowPosition):
+        (WebCore::MediaPlayerPrivate::mmrContextName):
+        (WebCore::MediaPlayerPrivate::percentLoaded):
+        (WebCore::MediaPlayerPrivate::sourceWidth):
+        (WebCore::MediaPlayerPrivate::sourceHeight):
+        (WebCore::MediaPlayerPrivate::setAllowPPSVolumeUpdates):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::onStateChanged):
+        (WebCore::MediaPlayerPrivate::onMediaStatusChanged):
+        (WebCore::MediaPlayerPrivate::onError):
+        (WebCore::MediaPlayerPrivate::onDurationChanged):
+        (WebCore::MediaPlayerPrivate::onTimeChanged):
+        (WebCore::MediaPlayerPrivate::onPauseStateChanged):
+        (WebCore::MediaPlayerPrivate::onRateChanged):
+        (WebCore::MediaPlayerPrivate::onVolumeChanged):
+        (WebCore::MediaPlayerPrivate::onRepaint):
+        (WebCore::MediaPlayerPrivate::onSizeChanged):
+        (WebCore::MediaPlayerPrivate::onPlayNotified):
+        (WebCore::MediaPlayerPrivate::onPauseNotified):
+        (WebCore::MediaPlayerPrivate::onBuffering):
+        (WebCore::MediaPlayerPrivate::showErrorDialog):
+        (WebCore::MediaPlayerPrivate::frameView):
+        (WebCore::MediaPlayerPrivate::platformWindow):
+        (WebCore::MediaPlayerPrivate::isFullscreen):
+        (WebCore::MediaPlayerPrivate::platformMedia):
+        (WebCore::MediaPlayerPrivate::platformLayer):
+        (WebCore::loadBufferingImageData):
+        (WebCore::MediaPlayerPrivate::bufferingTimerFired):
+        (WebCore::MediaPlayerPrivate::setBuffering):
+        (WebCore::allocateTextureId):
+        (WebCore::MediaPlayerPrivate::drawBufferingAnimation):
+        * platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h: Added.
+        (WebKit):
+        (WebCore):
+        (MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged):
+
+2012-03-03  Benjamin Poulain  <benjamin@webkit.org>
+
+        Remove the unused function WebCore::protocolIsInHTTPFamily()
+        https://bugs.webkit.org/show_bug.cgi?id=80218
+
+        Reviewed by Anders Carlsson.
+
+        * WebCore.order:
+        * platform/KURL.cpp:
+        * platform/KURL.h:
+        (WebCore):
+
+2012-03-03  Benjamin Poulain  <benjamin@webkit.org>
+
+        Implement the basis of KURLWTFURL
+        https://bugs.webkit.org/show_bug.cgi?id=79600
+
+        Reviewed by Adam Barth.
+
+        Add a simple, non-optimized, implementation for the main methods of KURL based
+        on ParsedURL.
+
+        * platform/KURLWTFURL.cpp:
+        (WebCore):
+        (WebCore::detach):
+        (WebCore::KURL::KURL):
+        (WebCore::KURL::copy):
+        (WebCore::KURL::isEmpty):
+        (WebCore::KURL::isValid):
+        (WebCore::KURL::string):
+        (WebCore::KURL::protocol):
+        (WebCore::KURL::host):
+        (WebCore::KURL::hasPort):
+        (WebCore::KURL::port):
+        (WebCore::KURL::user):
+        (WebCore::KURL::pass):
+        (WebCore::KURL::hasPath):
+        (WebCore::KURL::path):
+        (WebCore::KURL::lastPathComponent):
+        (WebCore::KURL::query):
+        (WebCore::KURL::hasFragmentIdentifier):
+        (WebCore::KURL::fragmentIdentifier):
+        (WebCore::KURL::baseAsString):
+        (WebCore::KURL::fileSystemPath):
+        (WebCore::KURL::protocolIs):
+        (WebCore::KURL::protocolIsInHTTPFamily):
+        (WebCore::KURL::setProtocol):
+        (WebCore::KURL::setHost):
+        (WebCore::KURL::removePort):
+        (WebCore::KURL::setPort):
+        (WebCore::KURL::setHostAndPort):
+        (WebCore::KURL::setUser):
+        (WebCore::KURL::setPass):
+        (WebCore::KURL::setPath):
+        (WebCore::KURL::setQuery):
+        (WebCore::KURL::setFragmentIdentifier):
+        (WebCore::KURL::removeFragmentIdentifier):
+        (WebCore::protocolHostAndPortAreEqual):
+        * platform/KURLWTFURLImpl.h:
+        (KURLWTFURLImpl):
+        (WebCore::KURLWTFURLImpl::copy):
+        (WebCore):
+
+2012-03-03  Benjamin Poulain  <benjamin@webkit.org>
+
+        Remove the redundant method KURL::protocolInHTTPFamily()
+        https://bugs.webkit.org/show_bug.cgi?id=80216
+
+        Reviewed by Anders Carlsson.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+        (WebCore::FrameLoader::addExtraFieldsToRequest):
+        * loader/ResourceLoadScheduler.cpp:
+        (WebCore::ResourceLoadScheduler::hostForURL):
+        (WebCore::ResourceLoadScheduler::scheduleLoad):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::requestIsHTTPOrHTTPSGet):
+        * loader/cache/CachedResource.cpp:
+        (WebCore::CachedResource::freshnessLifetime):
+        * loader/cache/MemoryCache.cpp:
+        (WebCore::MemoryCache::removeFragmentIdentifierIfNeeded):
+        * loader/icon/IconController.cpp:
+        (WebCore::IconController::defaultURL):
+        * platform/KURL.h:
+        (KURL):
+        * platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp:
+        * platform/network/CredentialStorage.cpp:
+        (WebCore::CredentialStorage::set):
+        (WebCore::findDefaultProtectionSpaceForURL):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::setCachePolicy):
+        (WebCore::ResourceRequestBase::setTimeoutInterval):
+        (WebCore::ResourceRequestBase::setHTTPMethod):
+        (WebCore::ResourceRequestBase::setHTTPHeaderField):
+        (WebCore::ResourceRequestBase::clearHTTPAuthorization):
+        (WebCore::ResourceRequestBase::clearHTTPReferrer):
+        (WebCore::ResourceRequestBase::clearHTTPOrigin):
+        (WebCore::ResourceRequestBase::setResponseContentDispositionEncodingFallbackArray):
+        (WebCore::ResourceRequestBase::setHTTPBody):
+        (WebCore::ResourceRequestBase::setAllowCookies):
+        (WebCore::ResourceRequestBase::setPriority):
+        (WebCore::ResourceRequestBase::addHTTPHeaderField):
+        * platform/network/blackberry/NetworkManager.cpp:
+        (WebCore::NetworkManager::startJob):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::createCFURLConnection):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::createNSURLConnection):
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
+
+2012-03-03  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        [BlackBerry] Upstream LayerWebKitThread and its derived classes
+        https://bugs.webkit.org/show_bug.cgi?id=79871
+
+        Reviewed by Antonio Gomes.
+
+        Initial upstream, no new tests.
+
+        * platform/graphics/blackberry/CanvasLayerWebKitThread.cpp: Added.
+        (WebCore):
+        (WebCore::CanvasLayerWebKitThread::CanvasLayerWebKitThread):
+        (WebCore::CanvasLayerWebKitThread::~CanvasLayerWebKitThread):
+        (WebCore::CanvasLayerWebKitThread::setCanvas):
+        (WebCore::CanvasLayerWebKitThread::setNeedsDisplay):
+        (WebCore::CanvasLayerWebKitThread::updateTextureContentsIfNeeded):
+        * platform/graphics/blackberry/CanvasLayerWebKitThread.h: Added.
+        (WebCore):
+        (CanvasLayerWebKitThread):
+        (WebCore::CanvasLayerWebKitThread::create):
+        * platform/graphics/blackberry/LayerData.h: Added.
+        (WebCore):
+        (LayerData):
+        (WebCore::LayerData::LayerData):
+        (WebCore::LayerData::~LayerData):
+        (WebCore::LayerData::anchorPoint):
+        (WebCore::LayerData::anchorPointZ):
+        (WebCore::LayerData::backgroundColor):
+        (WebCore::LayerData::borderColor):
+        (WebCore::LayerData::borderWidth):
+        (WebCore::LayerData::bounds):
+        (WebCore::LayerData::doubleSided):
+        (WebCore::LayerData::frame):
+        (WebCore::LayerData::masksToBounds):
+        (WebCore::LayerData::opacity):
+        (WebCore::LayerData::opaque):
+        (WebCore::LayerData::position):
+        (WebCore::LayerData::sublayerTransform):
+        (WebCore::LayerData::transform):
+        (WebCore::LayerData::preserves3D):
+        (WebCore::LayerData::getTextureID):
+        (WebCore::LayerData::setTextureID):
+        (WebCore::LayerData::needsTexture):
+        (WebCore::LayerData::layerProgramShader):
+        (WebCore::LayerData::isFixedPosition):
+        (WebCore::LayerData::hasFixedContainer):
+        (WebCore::LayerData::hasFixedAncestorInDOMTree):
+        (WebCore::LayerData::pluginView):
+        (WebCore::LayerData::holePunchRect):
+        (WebCore::LayerData::hasHolePunchRect):
+        (WebCore::LayerData::mediaPlayer):
+        (WebCore::LayerData::canvas):
+        (WebCore::LayerData::replicate):
+        (WebCore::LayerData::layerType):
+        (WebCore::LayerData::includeVisibility):
+        * platform/graphics/blackberry/LayerWebKitThread.cpp: Added.
+        (WebCore):
+        (WebCore::LayerWebKitThread::create):
+        (WebCore::LayerWebKitThread::LayerWebKitThread):
+        (WebCore::LayerWebKitThread::~LayerWebKitThread):
+        (WebCore::LayerWebKitThread::paintContents):
+        (WebCore::LayerWebKitThread::contentsVisible):
+        (WebCore::LayerWebKitThread::createFrontBufferLock):
+        (WebCore::LayerWebKitThread::updateTextureContentsIfNeeded):
+        (WebCore::LayerWebKitThread::setContents):
+        (WebCore::LayerWebKitThread::setDrawable):
+        (WebCore::LayerWebKitThread::setNeedsCommit):
+        (WebCore::LayerWebKitThread::notifyAnimationStarted):
+        (WebCore::LayerWebKitThread::commitOnWebKitThread):
+        (WebCore::LayerWebKitThread::startAnimations):
+        (WebCore::LayerWebKitThread::updateTextureContents):
+        (WebCore::LayerWebKitThread::commitOnCompositingThread):
+        (WebCore::LayerWebKitThread::addSublayer):
+        (WebCore::LayerWebKitThread::insertSublayer):
+        (WebCore::LayerWebKitThread::removeFromSuperlayer):
+        (WebCore::LayerWebKitThread::removeSublayer):
+        (WebCore::LayerWebKitThread::replaceSublayer):
+        (WebCore::LayerWebKitThread::indexOfSublayer):
+        (WebCore::LayerWebKitThread::setBounds):
+        (WebCore::LayerWebKitThread::setFrame):
+        (WebCore::LayerWebKitThread::rootLayer):
+        (WebCore::LayerWebKitThread::removeAllSublayers):
+        (WebCore::LayerWebKitThread::setSublayers):
+        (WebCore::LayerWebKitThread::setNeedsDisplayInRect):
+        (WebCore::LayerWebKitThread::setNeedsDisplay):
+        (WebCore::LayerWebKitThread::updateLayerHierarchy):
+        (WebCore::LayerWebKitThread::setIsMask):
+        * platform/graphics/blackberry/LayerWebKitThread.h: Added.
+        (WebCore):
+        (LayerWebKitThread):
+        (WebCore::LayerWebKitThread::setAnchorPoint):
+        (WebCore::LayerWebKitThread::setAnchorPointZ):
+        (WebCore::LayerWebKitThread::setBackgroundColor):
+        (WebCore::LayerWebKitThread::setBorderColor):
+        (WebCore::LayerWebKitThread::setBorderWidth):
+        (WebCore::LayerWebKitThread::setDoubleSided):
+        (WebCore::LayerWebKitThread::setMasksToBounds):
+        (WebCore::LayerWebKitThread::setMaskLayer):
+        (WebCore::LayerWebKitThread::maskLayer):
+        (WebCore::LayerWebKitThread::setReplicaLayer):
+        (WebCore::LayerWebKitThread::replicaLayer):
+        (WebCore::LayerWebKitThread::setNeedsDisplayOnBoundsChange):
+        (WebCore::LayerWebKitThread::setOpacity):
+        (WebCore::LayerWebKitThread::setOpaque):
+        (WebCore::LayerWebKitThread::setPosition):
+        (WebCore::LayerWebKitThread::getSublayers):
+        (WebCore::LayerWebKitThread::setSublayerTransform):
+        (WebCore::LayerWebKitThread::superlayer):
+        (WebCore::LayerWebKitThread::setTransform):
+        (WebCore::LayerWebKitThread::setPreserves3D):
+        (WebCore::LayerWebKitThread::setFixedPosition):
+        (WebCore::LayerWebKitThread::setHasFixedContainer):
+        (WebCore::LayerWebKitThread::setHasFixedAncestorInDOMTree):
+        (WebCore::LayerWebKitThread::contents):
+        (WebCore::LayerWebKitThread::setOwner):
+        (WebCore::LayerWebKitThread::drawsContent):
+        (WebCore::LayerWebKitThread::layerCompositingThread):
+        (WebCore::LayerWebKitThread::setAbsoluteOffset):
+        (WebCore::LayerWebKitThread::contentsScale):
+        (WebCore::LayerWebKitThread::setRunningAnimations):
+        (WebCore::LayerWebKitThread::setSuspendedAnimations):
+        (WebCore::LayerWebKitThread::setNeedsTexture):
+        (WebCore::LayerWebKitThread::setLayerProgramShader):
+        (WebCore::LayerWebKitThread::isDrawable):
+        (WebCore::LayerWebKitThread::boundsChanged):
+        (WebCore::LayerWebKitThread::setSuperlayer):
+        (WebCore::LayerWebKitThread::numSublayers):
+        * platform/graphics/blackberry/PluginLayerWebKitThread.cpp: Added.
+        (WebCore):
+        (WebCore::PluginLayerWebKitThread::PluginLayerWebKitThread):
+        (WebCore::PluginLayerWebKitThread::~PluginLayerWebKitThread):
+        (WebCore::PluginLayerWebKitThread::setPluginView):
+        (WebCore::PluginLayerWebKitThread::setHolePunchRect):
+        (WebCore::PluginLayerWebKitThread::setNeedsDisplay):
+        (WebCore::PluginLayerWebKitThread::updateTextureContentsIfNeeded):
+        * platform/graphics/blackberry/PluginLayerWebKitThread.h: Added.
+        (WebCore):
+        (PluginLayerWebKitThread):
+        (WebCore::PluginLayerWebKitThread::create):
+        * platform/graphics/blackberry/VideoLayerWebKitThread.cpp: Added.
+        (WebCore):
+        (WebCore::VideoLayerWebKitThread::VideoLayerWebKitThread):
+        (WebCore::VideoLayerWebKitThread::~VideoLayerWebKitThread):
+        (WebCore::VideoLayerWebKitThread::setMediaPlayer):
+        (WebCore::VideoLayerWebKitThread::setHolePunchRect):
+        (WebCore::VideoLayerWebKitThread::setNeedsDisplay):
+        (WebCore::VideoLayerWebKitThread::boundsChanged):
+        (WebCore::VideoLayerWebKitThread::updateTextureContentsIfNeeded):
+        * platform/graphics/blackberry/VideoLayerWebKitThread.h: Added.
+        (WebCore):
+        (VideoLayerWebKitThread):
+        (WebCore::VideoLayerWebKitThread::create):
+
+2012-03-03  Hans Wennborg  <hans@chromium.org>
+
+        Implement Speech JavaScript API
+        https://bugs.webkit.org/show_bug.cgi?id=80019
+
+        Reviewed by Adam Barth.
+
+        Add ENABLE_SCRIPTED_SPEECH and runtime flag.
+
+        No functionality yet, so no new tests.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * Target.pri:
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore):
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (RuntimeEnabledFeatures):
+        (WebCore::RuntimeEnabledFeatures::setScriptedSpeechEnabled):
+        (WebCore::RuntimeEnabledFeatures::scriptedSpeechEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitSpeechRecognitionEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitSpeechRecognitionErrorEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitSpeechGrammarEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitSpeechGrammarListEnabled):
+
+2012-03-03  Raymond Toy  <rtoy@google.com>
+
+        DelayNode has a fixed one second max delay time
+        https://bugs.webkit.org/show_bug.cgi?id=78758
+
+        Change DelayNode to accept an optional parameter to specify the
+        maximum delay allowed. If not specified, the default is 1 sec.
+        
+        Reviewed by Chris Rogers.
+
+        Test: webaudio/delaynode-maxdelay.html
+              webaudio/delaynode-maxdelay-expected.txt
+
+        * webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::createDelayNode): Allow maxDelayTime
+        parameter to specify max delay.
+        * webaudio/AudioContext.h: Allow maxDelayTime
+        parameter to specify max delay but default to 1.
+        (AudioContext):
+        * webaudio/AudioContext.idl: createDelayNode takes optional max
+        delay time parameter.
+        * webaudio/DelayDSPKernel.cpp:
+        (WebCore::DelayDSPKernel::DelayDSPKernel): Remove unused
+        DefaultMaxDelayTime. Set m_maxDelayTime from processor
+        maxDelayTime. 
+        * webaudio/DelayNode.cpp:
+        (WebCore::DelayNode::DelayNode): Add maxDelayTime parameter. 
+        * webaudio/DelayNode.h:
+        (WebCore::DelayNode::create): Add maxDelayTime parameter. 
+        (DelayNode): Add maxDelayTime parameter. 
+        * webaudio/DelayProcessor.cpp:
+        (WebCore::DelayProcessor::DelayProcessor): Add maxDelayTime
+        parameter.  
+        * webaudio/DelayProcessor.h:
+        (DelayProcessor): Add maxDelayTime parameter. 
+        (WebCore::DelayProcessor::maxDelayTime): New slot to hold
+        maxDelayTime. 
+
+2012-03-03  Raymond Toy  <rtoy@google.com>
+
+        Simplified discreteTimeConstantForSampleRate
+        https://bugs.webkit.org/show_bug.cgi?id=78051
+
+        Remove hardcoded constant and simplify computation of discrete
+        time constant.
+        
+        Reviewed by Chris Rogers.
+
+        No new tests needed.  Covered by existing AudioParam tests.
+
+        * platform/audio/AudioUtilities.cpp:
+        (WebCore::AudioUtilities::discreteTimeConstantForSampleRate):
+        Simplify formula.
+        * platform/audio/AudioUtilities.h:
+        (AudioUtilities): Update function signature.
+        * platform/audio/DynamicsCompressorKernel.cpp:
+        (WebCore::DynamicsCompressorKernel::DynamicsCompressorKernel):
+        cast to float to avoid warnings.
+        * webaudio/AudioParamTimeline.cpp:
+        (WebCore::AudioParamTimeline::valuesForTimeRangeImpl): cast to
+        float to avoid warnings.
+
+2012-03-03  Anders Carlsson  <andersca@apple.com>
+
+        Fix build with newer versions of clang.
+
+        * bindings/objc/DOM.mm:
+        (-[DOMNode description]):
+        Remove an unused parameter.
+
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::getClass):
+        Use object_getClass instead of accessing isa directly.
+
+        * platform/LocalizedStrings.cpp:
+        (WebCore::formatLocalizedString):
+        Disable the -Wformat-nonliteral warning around the call to CFStringCreateWithFormatAndArguments.
+
+        * platform/graphics/mac/WebLayer.mm:
+        (-[CALayer _descriptionWithPrefix:]):
+        Use %p for the CALayer pointer, and use %lu for the number of sublayers.
+
+        * platform/mac/HTMLConverter.mm:
+        (-[WebHTMLConverter _addAttachmentForElement:URL:needsParagraph:usePlaceholder:]):
+        Cast the NSAttachmentCharacte enum to unichar.
+
+2012-03-03  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r109343.
+        http://trac.webkit.org/changeset/109343
+        https://bugs.webkit.org/show_bug.cgi?id=80212
+
+        Int32array can't handle values for native nodes because they
+        have int64 ids (Requested by loislo1 on #webkit).
+
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.HeapSnapshotLoader.prototype._parseNodes):
+        (WebInspector.HeapSnapshotLoader.prototype.pushJSONChunk):
+        (WebInspector.HeapSnapshot):
+        (WebInspector.HeapSnapshot.prototype._init):
+
+2012-03-03  Andreas Kling  <awesomekling@apple.com>
+
+        Free up a bit in RenderObject.
+        http://webkit.org/b/80208
+
+        Reviewed by Anders Carlsson.
+
+        Move m_hasMarkupTruncation to RenderBlock, stealing one bit from m_lineHeight.
+        This flag is only used by RenderBlock.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::RenderBlock):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::setHasMarkupTruncation):
+        (WebCore::RenderBlock::hasMarkupTruncation):
+        (RenderBlock):
+        * rendering/RenderObject.h:
+        (RenderObject):
+        (WebCore::RenderObject::RenderObjectBitfields::RenderObjectBitfields):
+        (RenderObjectBitfields):
+
+2012-03-03  Joe Thomas  <joethomas@motorola.com>
+
+        Implement vw/vh/vmin (viewport sizes) from CSS 3 Values and Units
+        https://bugs.webkit.org/show_bug.cgi?id=27160
+
+        The specification related to this implementation is located at http://dev.w3.org/csswg/css3-values/#viewport-relative-lengths.
+        vw/vh/vmin are implemented as primitive length units. Added the parsing logic for these new units and creation of primitive values.
+
+        Added new Length types such as ViewportRelativeWidth, ViewportRelativeHeight and ViewportRelativeMin for viewport-relative lengths
+        and included the support for fetching the value of these relative length units based on the current viewport size.
+
+        Reviewed by Antti Koivisto.
+
+        Tests: css3/viewport-relative-lengths/css3-viewport-relative-lengths-getStyle.html
+               css3/viewport-relative-lengths/css3-viewport-relative-lengths-vh-absolute.html
+               css3/viewport-relative-lengths/css3-viewport-relative-lengths-vh.html
+               css3/viewport-relative-lengths/css3-viewport-relative-lengths-vmin-absolute.html
+               css3/viewport-relative-lengths/css3-viewport-relative-lengths-vmin.html
+               css3/viewport-relative-lengths/css3-viewport-relative-lengths-vw-absolute.html
+               css3/viewport-relative-lengths/css3-viewport-relative-lengths-vw.html
+
+        * css/CSSComputedStyleDeclaration.cpp: Modified to support viewport relative Length types.
+        (WebCore::getPositionOffsetValue): Ditto.
+        (WebCore::getBorderRadiusCornerValues): Ditto.
+        (WebCore::getBorderRadiusCornerValue): Ditto.
+        (WebCore::getBorderRadiusShorthandValue): Ditto.
+        (WebCore::lineHeightFromStyle): Ditto.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Ditto.
+        * css/CSSGrammar.y: Added vw/vh/vmin support.
+        * css/CSSParser.cpp: Parsing of relative units and creation of CSSPrimitiveValue.
+        (WebCore::CSSParser::validUnit): Added vw/vh/vmin to the valid units.
+        (WebCore::CSSParser::createPrimitiveNumericValue): Added vw/vh/vmin as valid primitive units.
+        (WebCore::unitFromString):
+        (WebCore::CSSParser::parseValidPrimitive): Creation of CSSPrimitiveValue for vw/vh/vmin.
+        (WebCore::CSSParser::detectNumberToken): Parsing the vw/vh/vmin tokens.
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::isValidCSSUnitTypeForDoubleConversion): Added support for vw/vh/vmin.
+        (WebCore::unitCategory): Ditto.
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::canonicalUnitTypeForCategory): Added support for vw/vh/vmin.
+        (WebCore::CSSPrimitiveValue::customCssText): Ditto.
+        (WebCore::CSSPrimitiveValue::viewportRelativeLength): Function to create the Length structure for the viewport-relative unit types.
+        (WebCore):
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::isViewportRelativeLength): Checks whether the primitive value is ViewportRelative Lengths.
+        (CSSPrimitiveValue):
+        * css/CSSPrimitiveValue.idl: Added support for vw/vh/vmin.
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::ApplyPropertyLength::applyValue): Applying relative viewport length units to the specific CSS property.
+        (WebCore::ApplyPropertyBorderRadius::applyValue): Ditto.
+        (WebCore::ApplyPropertyFontSize::applyValue): Ditto.
+        (WebCore::ApplyPropertyLineHeight::applyValue): Ditto.
+        (WebCore::ApplyPropertyVerticalAlign::applyValue): Ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::convertToLength): Added support for viewport relative units.
+        (WebCore::createGridTrackBreadth): Ditto.
+        (WebCore::CSSStyleSelector::mapFillSize): Ditto.
+        (WebCore::CSSStyleSelector::mapFillXPosition): Ditto.
+        (WebCore::CSSStyleSelector::mapFillYPosition): Ditto.
+        * dom/Document.cpp:
+        (WebCore::Document::pageSizeAndMarginsInPixels): Modified to support viewport relative Length types.
+        (WebCore::Document::viewportSize): New function to fetch the current viewport size.
+        (WebCore):
+        * dom/Document.h: Ditto.
+        (Document):
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::getRegion): Modified to support viewport relative Length types.
+        * platform/Length.h: New LengthTypes such as ViewportRelativeWidth, ViewportRelativeHeight and ViewportRelativeMin added.
+        (WebCore::Length::calcValue): Modified to support viewport relative Length types.
+        (WebCore::Length::calcMinValue): Ditto.
+        (WebCore::Length::calcFloatValue): Ditto.
+        (Length):
+        (WebCore::Length::isViewportRelative): To check the Length is of type ViewportRelative.
+        (WebCore::Length::viewportRelativeLength): To get the relative value.
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::lineHeight): Modified to support viewport relative Length types.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::lineHeight): Ditto.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::reflectionOffset): Ditto.
+        (WebCore::RenderBox::paintBoxDecorations): Ditto.
+        (WebCore::RenderBox::clipRect): Ditto.
+        (WebCore::RenderBox::computeLogicalWidthInRegion): Ditto.
+        (WebCore::RenderBox::computeLogicalWidthInRegionUsing): Ditto.
+        (WebCore::RenderBox::computeInlineDirectionMargins): Ditto.
+        (WebCore::RenderBox::computeLogicalHeightUsing): Ditto.
+        (WebCore::RenderBox::computePercentageLogicalHeight): Ditto.
+        (WebCore::RenderBox::computeReplacedLogicalHeightUsing): Ditto.
+        (WebCore::RenderBox::computeBlockDirectionMargins): Ditto.
+        (WebCore::RenderBox::computePositionedLogicalWidthUsing): Ditto.
+        (WebCore::RenderBox::computePositionedLogicalHeightUsing): Ditto.
+        (WebCore::RenderBox::computePositionedLogicalWidthReplaced): Ditto.
+        (WebCore::RenderBox::computePositionedLogicalHeightReplaced): Ditto.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::relativePositionOffsetX): Ditto.
+        (WebCore::RenderBoxModelObject::relativePositionOffsetY): Ditto.
+        (WebCore::RenderBoxModelObject::paddingTop): Ditto.
+        (WebCore::RenderBoxModelObject::paddingBottom): Ditto.
+        (WebCore::RenderBoxModelObject::paddingLeft): Ditto.
+        (WebCore::RenderBoxModelObject::paddingRight): Ditto.
+        (WebCore::RenderBoxModelObject::paddingBefore): Ditto.
+        (WebCore::RenderBoxModelObject::paddingAfter): Ditto.
+        (WebCore::RenderBoxModelObject::paddingStart): Ditto.
+        (WebCore::RenderBoxModelObject::paddingEnd): Ditto.
+        (WebCore::RenderBoxModelObject::getBackgroundRoundedRect): Ditto.
+        (WebCore::RenderBoxModelObject::calculateFillTileSize): Ditto.
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry): Ditto.
+        (WebCore::computeBorderImageSide): Ditto.
+        (WebCore::RenderBoxModelObject::paintNinePieceImage): Ditto.
+        (WebCore::RenderBoxModelObject::paintBorder): Ditto.
+        (WebCore::RenderBoxModelObject::paintBoxShadow): Ditto.
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::preferredMainAxisContentExtentForChild): Ditto.
+        (WebCore::RenderFlexibleBox::computeMainAxisPreferredSizes): Ditto.
+        (WebCore::RenderFlexibleBox::runFreeSpaceAllocationAlgorithm): Ditto.
+        * rendering/RenderInline.cpp:
+        (WebCore::computeMargin): Ditto.
+        (WebCore::RenderInline::lineHeight): Ditto.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::updateOptionsWidth): Ditto.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded): Ditto.
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::viewportSize): New function to fetch the current viewport size.
+        (RenderObject):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint): Modified to support viewport relative Length types.
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::calcScrollbarThicknessUsing): Ditto.
+        (WebCore::RenderScrollbarPart::computeScrollbarWidth): Ditto.
+        (WebCore::RenderScrollbarPart::computeScrollbarHeight): Ditto.
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::computeLogicalWidth): Ditto.
+        (WebCore::RenderTable::convertStyleLogicalWidthToComputedWidth): Ditto.
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::logicalHeightForRowSizing): Ditto.
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowLogicalHeight): Ditto.
+        * rendering/RenderText.h:
+        (WebCore::RenderText::marginLeft): Ditto.
+        (WebCore::RenderText::marginRight): Ditto.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMenuListButtonGradients): Ditto.
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint): Ditto.
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::verticalPositionForBox): Ditto.
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::calcRadiiFor): Ditto.
+        (WebCore::RenderStyle::getRoundedBorderFor): Ditto.
+        * rendering/style/RenderStyle.h: Ditto.
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::resolveLengthAttributeForSVG): Ditto.
+        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth): Ditto.
+        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight): Ditto.
+
+2012-03-02  Pablo Flouret  <pablof@motorola.com>
+
+        Editor's default paragraph separator is not reset when a frame's document is changed
+        https://bugs.webkit.org/show_bug.cgi?id=80065
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: editing/execCommand/reset-values-after-navigation.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::clear):
+
+2012-03-02  Alexey Proskuryakov  <ap@apple.com>
+
+        Have a copy of plug-in sandboxing API header in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=80185
+        <rdar://problem/8242128>
+
+        Reviewed by Anders Carlsson.
+
+        * plugins/npapi-sandbox.h: Added.
+
+        * WebCore.xcodeproj/project.pbxproj: Added as unused file.
+
+2012-03-02  Emil A Eklund  <eae@chromium.org>
+
+        Revert borders to integers for subpixel layout
+        https://bugs.webkit.org/show_bug.cgi?id=80175
+
+        Reviewed by Eric Seidel.
+
+        Change border representation and calculation back to integers to ensure
+        that borders given the same width are rendered with the same actual width.
+
+        This will also avoid unnecessary type conversions when we switch over
+        to subpixel precision.
+
+        No new tests.
+
+        * rendering/LayoutTypes.h:
+        (WebCore::pixelSnappedIntRect):
+        (WebCore):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::borderTop):
+        (WebCore::RenderBoxModelObject::borderBottom):
+        (WebCore::RenderBoxModelObject::borderLeft):
+        (WebCore::RenderBoxModelObject::borderRight):
+        (WebCore::RenderBoxModelObject::borderBefore):
+        (WebCore::RenderBoxModelObject::borderAfter):
+        (WebCore::RenderBoxModelObject::borderStart):
+        (WebCore::RenderBoxModelObject::borderEnd):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::convertStyleLogicalWidthToComputedWidth):
+        (WebCore::RenderTable::calcBorderStart):
+        (WebCore::RenderTable::calcBorderEnd):
+        (WebCore::RenderTable::borderBefore):
+        (WebCore::RenderTable::borderAfter):
+        (WebCore::RenderTable::outerBorderBefore):
+        (WebCore::RenderTable::outerBorderAfter):
+        (WebCore::RenderTable::outerBorderStart):
+        (WebCore::RenderTable::outerBorderEnd):
+        * rendering/RenderTable.h:
+        (WebCore::RenderTable::borderStart):
+        (WebCore::RenderTable::borderEnd):
+        (RenderTable):
+        (WebCore::RenderTable::borderLeft):
+        (WebCore::RenderTable::borderRight):
+        (WebCore::RenderTable::borderTop):
+        (WebCore::RenderTable::borderBottom):
+        (WebCore::RenderTable::outerBorderLeft):
+        (WebCore::RenderTable::outerBorderRight):
+        (WebCore::RenderTable::outerBorderTop):
+        (WebCore::RenderTable::outerBorderBottom):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        (WebCore::RenderTableCell::borderLeft):
+        (WebCore::RenderTableCell::borderRight):
+        (WebCore::RenderTableCell::borderTop):
+        (WebCore::RenderTableCell::borderBottom):
+        (WebCore::RenderTableCell::borderStart):
+        (WebCore::RenderTableCell::borderEnd):
+        (WebCore::RenderTableCell::borderBefore):
+        (WebCore::RenderTableCell::borderAfter):
+        (WebCore::RenderTableCell::borderHalfLeft):
+        (WebCore::RenderTableCell::borderHalfRight):
+        (WebCore::RenderTableCell::borderHalfTop):
+        (WebCore::RenderTableCell::borderHalfBottom):
+        (WebCore::RenderTableCell::borderHalfStart):
+        (WebCore::RenderTableCell::borderHalfEnd):
+        (WebCore::RenderTableCell::borderHalfBefore):
+        (WebCore::RenderTableCell::borderHalfAfter):
+        (WebCore::RenderTableCell::paintCollapsedBorders):
+        * rendering/RenderTableCell.h:
+        (RenderTableCell):
+
+2012-03-01  Eric Seidel  <eric@webkit.org>
+
+        Chrome 18 fails html5test.com XHR Blob response test
+        https://bugs.webkit.org/show_bug.cgi?id=76760
+
+        Reviewed by Adam Barth.
+
+        Most of the code was already there, this just fixes the FIXME
+        which was causing this feature not to work.  Chromium already
+        had this #ifdef enabled, but other ports (at least Mac) do not.
+
+        Test: fast/files/xhr-response-blob.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::didFinishLoading):
+
+2012-03-02  Kentaro Hara  <haraken@chromium.org>
+
+        Revert Worker-related APIs from DOMWindowWorker.idl back to DOMWindow.idl
+        https://bugs.webkit.org/show_bug.cgi?id=80151
+
+        Reviewed by Adam Barth.
+
+        Based on the discussion on webkit-dev@
+        (http://markmail.org/message/kagvswmah67zmrry#query:+page:1+mid:h34vzbiu5suub3ld+state:results),
+        this patch reverts Worker-related APIs from DOMWindowWorker.idl back to DOMWindow.idl.
+
+        No tests. No change in behavior.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * page/DOMWindow.idl:
+        * workers/DOMWindowWorker.idl: Removed.
+
+2012-03-02  Kentaro Hara  <haraken@chromium.org>
+
+        Revert HTML-related APIs from DOMWindowHTML.idl back to DOMWindow.idl
+        https://bugs.webkit.org/show_bug.cgi?id=80140
+
+        Reviewed by Adam Barth.
+
+        Based on the discussion on webkit-dev@
+        (http://markmail.org/message/kagvswmah67zmrry#query:+page:1+mid:h34vzbiu5suub3ld+state:results),
+        we should revert HTML-related APIs from DOMWindowHTML.idl back to DOMWindow.idl.
+
+        No tests. No change in behavior.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/DOMWindowHTML.idl: Removed.
+        * page/DOMWindow.idl:
+
+2012-03-02  Kentaro Hara  <haraken@chromium.org>
+
+        Revert XML-related APIs from DOMWindowXML.idl back to DOMWindow.idl
+        https://bugs.webkit.org/show_bug.cgi?id=80148
+
+        Reviewed by Adam Barth.
+
+        Based on the discussion on webkit-dev@
+        (http://markmail.org/message/kagvswmah67zmrry#query:+page:1+mid:h34vzbiu5suub3ld+state:results),
+        this patch reverts XML-related APIs from DOMWindowXML.idl back to DOMWindow.idl.
+
+        No tests. No change in behavior.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/DOMWindow.idl:
+        * xml/DOMWindowXML.idl: Removed.
+
+2012-03-02  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Implement NamedNodeMap::setNamedItem() in terms of Element::setAttributeNode() instead of the other way round
+        https://bugs.webkit.org/show_bug.cgi?id=80188
+
+        Reviewed by Ryosuke Niwa.
+
+        Using setNamedItem() in setAttributeNode() implementation made us do unnecessary
+        checks like whether the element existed or whether the given node was an
+        attribute. So now setAttributeNode() do less work.
+
+        No new tests were added, functionality should be unchanged.
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttributeNode):
+        (WebCore::Element::setAttributeNodeNS):
+        * dom/Element.h:
+        (Element):
+        (WebCore::Element::attributes): We got rid of ensureUpdatedAttributes(), next in
+        line will be updatedAttributes().
+        * dom/NamedNodeMap.cpp:
+        (WebCore::NamedNodeMap::setNamedItem):
+
+2012-03-02  SravanKumar Sandela  <ssandela@innominds.com>
+
+        Layout issue with fieldset legend element
+        https://bugs.webkit.org/show_bug.cgi?id=78684
+
+        Reviewed by Dirk Pranke.
+
+        The clipping logic for legend element was incorrect and now it has been corrected by taking correct offset in to consideration. 
+
+        Test: fast/forms/fieldset-legend-padding-unclipped-fieldset-border.html
+
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations):
+
+2012-03-02  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Bindings for node always check if they are a Document.
+        https://bugs.webkit.org/show_bug.cgi?id=79947
+
+        Reviewed by Adam Barth.
+
+        This changes the generated bindings code to only generate the Document code for the Document wrappers.
+
+        No new tests. Covered by existing tests.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateToV8Converters):
+        * bindings/scripts/test/V8/V8Float64Array.cpp:
+        (WebCore::V8Float64Array::wrapSlow):
+        * bindings/scripts/test/V8/V8TestActiveDOMObject.cpp:
+        (WebCore::V8TestActiveDOMObject::wrapSlow):
+        * bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp:
+        (WebCore::V8TestCustomNamedGetter::wrapSlow):
+        * bindings/scripts/test/V8/V8TestEventConstructor.cpp:
+        (WebCore::V8TestEventConstructor::wrapSlow):
+        * bindings/scripts/test/V8/V8TestEventTarget.cpp:
+        (WebCore::V8TestEventTarget::wrapSlow):
+        * bindings/scripts/test/V8/V8TestInterface.cpp:
+        (WebCore::V8TestInterface::wrapSlow):
+        * bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp:
+        (WebCore::V8TestMediaQueryListListener::wrapSlow):
+        * bindings/scripts/test/V8/V8TestNamedConstructor.cpp:
+        (WebCore::V8TestNamedConstructor::wrapSlow):
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::V8TestObj::wrapSlow):
+        * bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
+        (WebCore::V8TestSerializedScriptValueInterface::wrapSlow):
+
+2012-03-02  Igor Oliveira  <igor.o@sisa.samsung.com>
+
+        animation-timing-function falls back to ease when overriding animation-name
+        https://bugs.webkit.org/show_bug.cgi?id=71623
+
+        In this patch the animation name needs to be the first value declared, if
+        a different value is found, we do not check for the animation name again.  
+
+        Reviewed by Dean Jackson.
+
+        Test: animations/animation-shorthand-overriding.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAnimationShorthand):
+
+2012-03-02  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] [AC] Connect WebGL to the TextureMapperGL code
+        https://bugs.webkit.org/show_bug.cgi?id=78968
+
+        Reviewed by Gustavo Noronha Silva.
+
+        No new tests. This is covered by existing accelerated compositing and
+        WebGL tests.
+
+        Rely on the shared version of GL acquisition from GLContext. This reduces
+        a lot of code and now allows us to connect WebGL into the accelerated compositing
+        rendering path.
+
+        * GNUmakefile.list.am: GLContext should be included for all X11 builds now.
+        There are no longer GTK+ specific versions of GraphicsContext3D.
+        * platform/graphics/GraphicsContext3D.h: Add a default argument for
+        resolveMultisamplingIfNecessary. This will resolve the entire texture.
+        * platform/graphics/cairo/GraphicsContext3DCairo.cpp: GraphicsContext3D is
+        now responsible for creating GraphicsContext3DPrivate in the constructor.
+        (WebCore::GraphicsContext3D::platformLayer): Now return m_private.
+        * platform/graphics/cairo/GraphicsContext3DPrivate.cpp: Added.
+        * platform/graphics/cairo/GraphicsContext3DPrivate.h: Renamed from Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.h.
+        * platform/graphics/glx/GraphicsContext3DPrivate.cpp: Removed.
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::resolveMultisamplingIfNecessary): Properly
+        handle the default argument.
+        * platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp:
+        (WebCore::GraphicsContext3D::prepareTexture): Use the new default argument now.
+        (WebCore::GraphicsContext3D::readRenderingResults): Ditto.
+
+2012-02-18  Martin Robinson  <mrobinson@igalia.com>
+
+        [GTK] [AC] Generalize WindowContextGL
+        https://bugs.webkit.org/show_bug.cgi?id=78969
+
+        Reviewed by Gustavo Noronha Silva.
+
+        No new tests. This should not change functionality.
+
+        * GNUmakefile.list.am: Added new files to source list.
+        * platform/graphics/cairo/GLContext.h: Added. An abstraction for all GL contexts.
+        * platform/graphics/glx/GLContextGLX.cpp: Added. This file is composed of very little
+        new code, as the logic for instantiating offscreen GL contexts is copied from
+        GraphicsContext3DPrivate. The code duplication will be removed in a followup patch.
+        (WebCore::GLContext::platformContext):
+        * platform/graphics/gtk/GLContextGtk.cpp: Added. This includes some helper factories
+        for creating and caching GL contexts for GTK+ widgets.
+
+2012-03-02  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Remove TRACE_EVENT from CCQuadCuller::cullOccludedQuads.
+        https://bugs.webkit.org/show_bug.cgi?id=80174
+
+        Reviewed by James Robinson.
+
+        Covered by existing chromium unit tests.
+
+        Firing TRACE_EVENT once per draw quad is overwhelming.
+
+        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
+        (WebCore::CCQuadCuller::cullOccludedQuads):
+
+2012-03-02  Erik Arvidsson  <arv@chromium.org>
+
+        [V8] Make inline event attributes use evt for SVG and event otherwise
+        https://bugs.webkit.org/show_bug.cgi?id=80167
+
+        Reviewed by Ojan Vafai.
+
+        Test: fast/dom/inline-event-attributes-event-param-name.html
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+
+2012-03-02  Gavin Peters  <gavinp@chromium.org>
+
+        Sync PageCache debugging with PageCache behaviour
+        https://bugs.webkit.org/show_bug.cgi?id=79943
+
+        Sync up the debug printing code in PageCache with the actual logic,
+        and clean up the debug printing at the same time.
+
+        Reviewed by Brady Eidson.
+
+        No new tests, as this is a refactor of debug only code.
+
+        * history/PageCache.cpp:
+        (WebCore):
+        (WebCore::logCanCacheFrameDecision):
+        (WebCore::logCanCachePageDecision):
+
+2012-03-02  Maciej Stachowiak  <mjs@apple.com>
+
+        REGRESSION(r97353): Crash when accessing location or history properties inside a navigated window
+        https://bugs.webkit.org/show_bug.cgi?id=80133
+        <rdar://problem/10432233>
+        
+        Reviewed by Antti Koivisto.
+
+        Test: fast/dom/Window/navigated-window-properties.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore): Remove custom getters for window.location and window.history; they
+        were unnecessary and did the wrong thing when DOMWindow returned null values 
+        for these.
+        * page/DOMWindow.idl: ditto
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::reportException): Remove assert about null values and update comment,
+        since this is now an expected state for navigated inner windows.
+
+2012-03-02  Ryosuke Niwa  <rniwa@webkit.org>
+
+        REGRESSION(r74971): Can't select a line of RTL text on Facebook
+        https://bugs.webkit.org/show_bug.cgi?id=59435
+
+        Reviewed by Eric Seidel.
+
+        The bug was caused by inline text boxes created by BRs being placed at the end of the line
+        according to the block's direction regardless of its unicode bidi-level. e.g. if we have
+        <div dir="rtl"><span dir="ltr">hello<br>world</span></div>
+        the inline box generated by the br has the bidi-level of 2 like the rest of text in the span.
+        This inline text box gives an illusion of having text on the left of "hello" to hit testing
+        and editing code and causes all sorts of problems.
+
+        Fixed the bug by replacing calls to nextLeafChild and prevLeafChild by newly introduced
+        nextLeafChildIgnoringLineBreak and prevLeafChildIgnoringLineBreak. These two functions will
+        return 0 when they hit the end of a line or inline text box that's a line break. In effect,
+        hit testing and editing code can ignore inline boxes generated by br's.
+
+        In the long term, we should move these two functions into RenderedPosition along with the rest
+        of code that converts a Position and an inline box, offset pair.
+
+        Test: editing/selection/select-line-break-with-opposite-directionality.html
+
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset):
+        * editing/RenderedPosition.cpp:
+        (WebCore::RenderedPosition::prevLeafChild):
+        (WebCore::RenderedPosition::nextLeafChild):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::nextLeafChildIgnoringLineBreak):
+        (WebCore::InlineBox::prevLeafChildIgnoringLineBreak):
+        * rendering/InlineBox.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionForPointWithInlineChildren):
+        * rendering/RenderText.cpp:
+        (WebCore::lineDirectionPointFitsInBox): If we're on the left of a RTL line, we should stay at
+        upstream position since we're at the end of a line.
+        (WebCore::createVisiblePositionAfterAdjustingOffsetForBiDi): Merge the two special cases into
+        the general loop as the comment suggests. Skip an inline text box for a line break at the left
+        edge when there are more line boxes on the line.
+        (WebCore::RenderText::positionForPoint):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::closestLeafChildForLogicalLeftPosition): Ignore line boxes created for
+        line boxes when there are other boxes on the line.
+
+2012-03-02  Adam Treat  <atreat@rim.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=80161
+        PR: 141157
+
+        BlackBerryPlatformScreen.h API has been updated.  Reflect those
+        changes in our usage.
+
+        Reviewed by Antonio Gomes.
+        Internally reviewed by Jakob Petsovits
+
+        * platform/blackberry/PlatformScreenBlackBerry.cpp:
+        (WebCore::screenAvailableRect):
+        (WebCore::screenRect):
+
+2012-03-02  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Move the 'overflow' event dispatching logic out of RenderLayer
+        https://bugs.webkit.org/show_bug.cgi?id=80090
+
+        Unreviewed build fix.
+
+        * rendering/RenderBlock.cpp:
+        (OverflowEventDispatcher): Removed the unused function.
+
+2012-03-02  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Move the 'overflow' event dispatching logic out of RenderLayer
+        https://bugs.webkit.org/show_bug.cgi?id=80090
+
+        Reviewed by Simon Fraser.
+
+        Test: fast/events/overflow-events-writing-mode.html
+
+        This moves the 'overflow' event dispatch from RenderLayer to an helper class
+        OverflowEventDispatcher. For now, the class lives in RenderBlock as it matches
+        the existing code but it may be moved later to its own class as FrameView could
+        benefit from it too or if we need to support 'overflow' events on RenderBoxes.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore):
+        (OverflowEventDispatcher):
+        (WebCore::OverflowEventDispatcher::OverflowEventDispatcher):
+        (WebCore::OverflowEventDispatcher::~OverflowEventDispatcher):
+        (WebCore::OverflowEventDispatcher::computeOverflowStatus):
+        RAII dispatcher class that stores the information before layout and compare
+        them after to dispatch the right information.
+
+        (WebCore::RenderBlock::layout): Added an instance of OverflowEventDispatcher.
+
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::hasHorizontalLayoutOverflow):
+        (WebCore::RenderBox::hasVerticalLayoutOverflow):
+        Helper method to know if we have an horizontal / vertical layout overflow.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+        * rendering/RenderLayer.h:
+        Removed the scroll tracking logic as we don't need it anymore. This removes
+        3 booleans from RenderLayer.
+
+2012-03-02  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Create a method in Element to compare attributes with other Element
+        https://bugs.webkit.org/show_bug.cgi?id=80169
+
+        Reviewed by Ryosuke Niwa.
+
+        Avoid manually peeking at attribute storage to get this information. This
+        simplify the callsites. The actual implementation of comparison was moved to
+        ElementAttributeData. The mapsEquivalent() function still exists for the sake
+        of DocumentType nodes.
+
+        * dom/Element.cpp:
+        (WebCore::Element::hasEquivalentAttributes):
+        (WebCore):
+        * dom/Element.h:
+        (Element):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::ElementAttributeData::isEquivalent):
+        (WebCore):
+        * dom/ElementAttributeData.h:
+        (ElementAttributeData):
+        * dom/NamedNodeMap.cpp:
+        (WebCore::NamedNodeMap::mapsEquivalent):
+        * dom/Node.cpp:
+        (WebCore::Node::isEqualNode):
+        * editing/htmlediting.cpp:
+        (WebCore::areIdenticalElements): Use Element::hasTagName() instead of matching
+        directly to make code a bit clearer.
+
+2012-03-02  Zan Dobersek  <zandobersek@gmail.com>
+
+        [GTK] Smooth scrolling support
+        https://bugs.webkit.org/show_bug.cgi?id=16123
+
+        Reviewed by Martin Robinson.
+
+        No new tests - no new functionality.
+
+        Add the ScrollAnimatorNone class to compilation and enable
+        the smooth scrolling feature by default at compilation time.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+
+2012-03-02  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] media/media-can-play-flac-audio.html fails
+        https://bugs.webkit.org/show_bug.cgi?id=80124
+
+        Reviewed by Martin Robinson.
+
+        Handle audio/x-flac in the mimeTypeCache() function so that we
+        advertize both audio/flac and audio/x-flac.
+
+        No new tests, this is covered already by media/media-can-play-flac-audio.html.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+
+2012-03-02  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: fix fronted compilation.
+        https://bugs.webkit.org/show_bug.cgi?id=80154
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/DebuggerModel.js:
+        (WebInspector.DebuggerModel.prototype.scriptForSourceID):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.linkifyLocation):
+        * inspector/front-end/ScriptsSearchScope.js:
+        (WebInspector.ScriptsSearchResultsPane.prototype.createAnchor):
+
+2012-03-02  Kaustubh Atrawalkar  <kaustubh@motorola.com>
+
+        Rename DOMURL to URL in the bindings
+        https://bugs.webkit.org/show_bug.cgi?id=78214
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. Interface name change.
+
+        * html/DOMURL.idl: Added InterfaceName attribute to DOMURL.
+
+2012-03-02  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Add :scope pseudo-class
+        https://bugs.webkit.org/show_bug.cgi?id=79077
+
+        Add :scope pseudo class name & pseudoId
+        Add selector check for the new pseudo-class
+
+        Reviewed by Antti Koivisto.
+
+        Test: fast/css/style-scoped/scope-pseudo.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::pseudoId):
+        (WebCore::nameToPseudoTypeMap):
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        * css/SelectorChecker.cpp:
+        (WebCore::SelectorChecker::checkOneSelector):
+
+2012-03-01  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Make parser code not depend on NamedNodeMap
+        https://bugs.webkit.org/show_bug.cgi?id=79963
+
+        Reviewed by Adam Barth.
+
+        Instead of creating Element-less NamedNodeMaps, the parsing code now creates
+        AttributeVectors, that are used to fill Element via the parserSetAttributes()
+        method. This allows us to remove even more methods from the NamedNodeMap.
+
+        The AttributeVector class contains convenience methods that take the attribute's
+        QualifiedName as parameter. This class is also used inside ElementAttributeData.
+
+        * dom/Attr.h:
+        (Attr):
+        * dom/Element.cpp:
+        (WebCore::Element::getAttribute):
+        (WebCore::Element::parserSetAttributes): Now we have to create the attribute
+        storage, and fill it (by Vector::swap()) with the passed attributes. Also use an
+        early return to reduce indentation.
+        (WebCore::Element::insertedIntoDocument):
+        (WebCore::Element::removedFromDocument):
+        (WebCore::Element::getURLAttribute):
+        (WebCore::Element::getNonEmptyURLAttribute):
+        * dom/Element.h:
+        (Element):
+        (WebCore::Element::fastHasAttribute):
+        (WebCore::Element::fastGetAttribute):
+        (WebCore::Element::hasAttributesWithoutUpdate):
+        (WebCore::Element::attributeItem):
+        (WebCore::Element::getAttributeItem):
+        * dom/ElementAttributeData.cpp:
+        (WebCore::AttributeVector::removeAttribute):
+        (WebCore):
+        * dom/ElementAttributeData.h:
+        (AttributeVector):
+        (WebCore::AttributeVector::create):
+        (WebCore::AttributeVector::attributeItem):
+        (WebCore::AttributeVector::AttributeVector):
+        (WebCore):
+        (WebCore::AttributeVector::getAttributeItem):
+        (WebCore::AttributeVector::getAttributeItemIndex):
+        (WebCore::AttributeVector::insertAttribute): Boolean parameter isn't necessary
+        since all the callers used 'false', indicating that duplicates were not allowed.
+        (WebCore::ElementAttributeData::attributeItem):
+        (WebCore::ElementAttributeData::getAttributeItem):
+        (WebCore::ElementAttributeData::getAttributeItemIndex):
+        (ElementAttributeData):
+        * dom/NamedNodeMap.cpp:
+        (WebCore::NamedNodeMap::getNamedItem):
+        (WebCore::NamedNodeMap::setNamedItem):
+        (WebCore::NamedNodeMap::removeNamedItem):
+        (WebCore::NamedNodeMap::mapsEquivalent):
+        * dom/NamedNodeMap.h:
+        * html/parser/HTMLConstructionSite.cpp:
+        (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML):
+        (WebCore::HTMLConstructionSite::mergeAttributesFromTokenIntoElement):
+        (WebCore::HTMLConstructionSite::insertScriptElement):
+        (WebCore::HTMLConstructionSite::createElement):
+        (WebCore::HTMLConstructionSite::createHTMLElement):
+        (WebCore):
+        * html/parser/HTMLToken.h:
+        (WebCore::AtomicHTMLToken::AtomicHTMLToken):
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processFakeStartTag):
+        (WebCore::HTMLTreeBuilder::attributesForIsindexInput):
+        (WebCore):
+        * html/parser/HTMLTreeBuilder.h:
+        * html/parser/TextDocumentParser.cpp:
+        (WebCore::TextDocumentParser::insertFakePreElement):
+        * xml/parser/MarkupTokenBase.h:
+        (WebCore::AtomicMarkupTokenBase::AtomicMarkupTokenBase):
+        (WebCore::AtomicMarkupTokenBase::attributes):
+        (WebCore::AtomicMarkupTokenBase::takeAttributes):
+        (AtomicMarkupTokenBase):
+        (WebCore::::initializeAttributes):
+        * xml/parser/XMLToken.h:
+        (WebCore::AtomicXMLToken::AtomicXMLToken):
+        * xml/parser/XMLTreeBuilder.cpp:
+        (WebCore::XMLTreeBuilder::processNamespaces):
+        (WebCore::XMLTreeBuilder::processAttributes):
+
+2012-03-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: assertion failure in JSMainThreadExecState::instrumentedCall
+        https://bugs.webkit.org/show_bug.cgi?id=80152
+
+        Extracted common code of JS call instrumentation into instrumentFunctionCall method
+        and call it directly where the instrumentation is needed instead of calling
+        JSMainThreadExecState::instrumentedCall which works on the main thread only.
+
+        Reviewed by Pavel Feldman.
+
+        * bindings/js/JSCallbackData.cpp:
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSMainThreadExecState.h:
+        (WebCore::JSMainThreadExecState::instrumentFunctionCall):
+
+2012-03-02  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Make order of attribute/method in HTMLTextAreaElement.idl as same as specification
+        https://bugs.webkit.org/show_bug.cgi?id=80101
+
+        Reviewed by Kent Tamura.
+
+        No new tests. No behavior changes.
+
+        * html/HTMLTextAreaElement.idl: Reorder attribute/method position.
+
+2012-03-02  Patrick Gansterer  <paroga@webkit.org>
+
+        Build fix after r109538.
+
+        * CMakeLists.txt:
+        * Modules/websockets/WebSocketDeflater.cpp:
+
+2012-03-02  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Scoped stylesheets don't appear to work in Shadow DOM
+        https://bugs.webkit.org/show_bug.cgi?id=79549
+
+        Make the scope stack in CSSStyleSelector use ContainerNode* instead of Element*.
+        Adapt using sites accordingly.
+        Push the ShadowRoot to the scope stack in the same way that elements are pushed.
+        Fix an issue with removedFromDocument() on destruction.
+
+        Reviewed by Antti Koivisto.
+
+        Test: fast/css/style-scoped/style-scoped-in-shadow.html
+
+        * css/CSSStyleSelector.cpp:
+        (RuleSet):
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        (WebCore::CSSStyleSelector::determineScope):
+        (WebCore::CSSStyleSelector::ruleSetForScope):
+        (WebCore::CSSStyleSelector::appendAuthorStylesheets):
+        (WebCore::CSSStyleSelector::setupScopeStack):
+        (WebCore::CSSStyleSelector::pushScope):
+        (WebCore):
+        (WebCore::CSSStyleSelector::popScope):
+        (WebCore::CSSStyleSelector::pushParentElement):
+        (WebCore::CSSStyleSelector::popParentElement):
+        (WebCore::CSSStyleSelector::pushParentShadowRoot):
+        (WebCore::CSSStyleSelector::popParentShadowRoot):
+        (WebCore::CSSStyleSelector::matchScopedAuthorRules):
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/CSSStyleSelector.h:
+        (CSSStyleSelector):
+        (WebCore::CSSStyleSelector::pushScope):
+        (WebCore::CSSStyleSelector::popScope):
+        (WebCore::CSSStyleSelector::MatchOptions::MatchOptions):
+        (MatchOptions):
+        (WebCore::CSSStyleSelector::scopeStackIsConsistent):
+        (WebCore::CSSStyleSelector::ScopeStackFrame::ScopeStackFrame):
+        (ScopeStackFrame):
+        * css/SelectorChecker.h:
+        (SelectorCheckingContext):
+        * dom/Element.cpp:
+        (WebCore::StyleSelectorParentPusher::push):
+        (WebCore::StyleSelectorParentPusher::~StyleSelectorParentPusher):
+        (WebCore::Element::beginParsingChildren):
+        (WebCore::Element::finishParsingChildren):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::attach):
+        (WebCore):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        * dom/ShadowTree.cpp:
+        (WebCore::ShadowTree::recalcShadowTreeStyle):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::removedFromDocument):
+
+2012-03-02  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Make order of attribute/method in HTMLSelectElement.idl as same as specification
+        https://bugs.webkit.org/show_bug.cgi?id=80097
+
+        Reviewed by Kent Tamura.
+
+        No new tests. No behavior changes.
+
+        * html/HTMLSelectElement.idl: Reorder attribute/method position.
+
+2012-03-02  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: limit RawSourceCode usages to DebuggerPresentationModel.
+        https://bugs.webkit.org/show_bug.cgi?id=80146
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.uiLocationToRawLocation):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.linkifyLocation):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.linkifyRawLocation):
+        * inspector/front-end/ObjectPopoverHelper.js:
+        (WebInspector.ObjectPopoverHelper.prototype._showObjectPopover.showObjectPopover.):
+        (WebInspector.ObjectPopoverHelper.prototype._showObjectPopover):
+        * inspector/front-end/ScriptsSearchScope.js:
+        (WebInspector.ScriptsSearchResultsPane.prototype.createAnchor):
+
+2012-03-02  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: update execution line using LiveLocation.
+        https://bugs.webkit.org/show_bug.cgi?id=80143
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype._uiSourceCodeListChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerResumed):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame.updateExecutionLine):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+
+2012-03-02  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Build fix for LocalizedStringsBlackBerry.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=80099
+
+        Unreviewed build fix.
+
+        * platform/blackberry/LocalizedStringsBlackBerry.cpp:
+
+2012-03-02  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Fix build on AppleWebKit after 109548.
+
+        * WebCore.exp.in:
+
+2012-03-02  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Make order of attribute/method in HTMLOptionElement.idl as same as specification
+        https://bugs.webkit.org/show_bug.cgi?id=80095
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. No behavior changes.
+
+        * html/HTMLOptionElement.idl: Reorder attribute/method position.
+
+2012-03-02  Adam Barth  <abarth@webkit.org>
+
+        WorkerContext shouldn't know about IndexedDB
+        https://bugs.webkit.org/show_bug.cgi?id=80094
+
+        Reviewed by Kentaro Hara.
+
+        There are still a couple IndexedDB stragglers we should clean up in
+        WebCore proper.  This patch moves some IndexedDB logic from
+        WorkerContext into the indexeddb module.
+
+        In the process of writing this patch, I noticed that some IndexedDB
+        files were missing from various build systems, so I added them.  I
+        suspect that means IndexedDB is only enabled by default on Chromium.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Modules/indexeddb/WorkerContextIndexedDatabase.cpp: Added.
+        (WebCore):
+        (WebCore::WorkerContextIndexedDatabase::WorkerContextIndexedDatabase):
+        (WebCore::WorkerContextIndexedDatabase::~WorkerContextIndexedDatabase):
+        (WebCore::WorkerContextIndexedDatabase::from):
+        (WebCore::WorkerContextIndexedDatabase::webkitIndexedDB):
+        * Modules/indexeddb/WorkerContextIndexedDatabase.h: Added.
+        (WebCore):
+        (WorkerContextIndexedDatabase):
+        * Modules/indexeddb/WorkerContextIndexedDatabase.idl: Added.
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * workers/WorkerContext.cpp:
+        (WebCore):
+        * workers/WorkerContext.h:
+        (WebCore):
+        (WorkerContext):
+        * workers/WorkerContext.idl:
+
+2012-03-02  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Compile WebCore without QtWidgets
+        https://bugs.webkit.org/show_bug.cgi?id=80141
+
+        Reviewed by Tor Arne Vestbø.
+
+        * Target.pri: Don't add widgets to QT.
+        * WebCore.pri: Use QT += opengl only with Qt 4, because it has an implicit QtWidgets
+        dependency. With Qt 5 all necessary OpenGL API is part of QtGui (with a QOpenGL* prefix).
+
+2012-03-02  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Make order of attribute/method in HTMLFormElement.idl as same as specification
+        https://bugs.webkit.org/show_bug.cgi?id=80093
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. No behavior changes
+
+        * html/HTMLFormElement.idl: Reorder attribute/method position.
+
+2012-03-02  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Make order of attribute/method in HTMLButtonElement.idl as same as specification
+        https://bugs.webkit.org/show_bug.cgi?id=80091
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. No behavior changes.
+
+        * html/HTMLButtonElement.idl: Reorder attribute/method position.
+
+2012-03-02  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Suspend/Resume API for pausing timers and animations.
+        https://bugs.webkit.org/show_bug.cgi?id=76063
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * dom/ActiveDOMObject.h:
+            New ReasonForSuspension: PageWillBePaused.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::suspend): Handle new ReasonForSuspension.
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::setDocument):
+        (WebCore::Frame::suspendActiveDOMObjectsAndAnimations):
+        (WebCore::Frame::resumeActiveDOMObjectsAndAnimations):
+        * page/Frame.h:
+        (WebCore::Frame::activeDOMObjectsAndAnimationsSuspended):
+            Frame now maintains a state of suspending animation and ActiveDOMObjects,
+            which is inherited to all child-frames.
+        * page/Page.cpp:
+        (WebCore::Page::suspendActiveDOMObjectsAndAnimations):
+        (WebCore::Page::resumeActiveDOMObjectsAndAnimations):
+        * page/Page.h:
+            Functions for suspending and resuming active DOM objects and animations in all frames.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::willRenderImage):
+            WillRenderImage now checks for suspension. This causes animated images to pause
+            together with all other types of animations.
+
+2012-03-02  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Make order of attribute/method in HTMLFieldSetElement.idl as same as specification
+        https://bugs.webkit.org/show_bug.cgi?id=80092
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. No behavior changes.
+
+        * html/HTMLFieldSetElement.idl: Reorder attribute/method position.
+
+2012-03-02  Antti Koivisto  <antti@apple.com>
+
+        possible regression: r104060 maybe causing crashes
+        https://bugs.webkit.org/show_bug.cgi?id=75676
+
+        Rubber-stamped by Simon Hausmann.
+
+        Remove the speculative fix (the problem was elsewhere, http://trac.webkit.org/changeset/104845).
+
+        Also remove the debugging code added for this bug.
+    
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::clearStyleSelector):
+        (WebCore::Document::updateActiveStylesheets):
+        * dom/Document.h:
+        (Document):
+
+2012-03-01  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Implement suggestions in Watch Expressions
+        https://bugs.webkit.org/show_bug.cgi?id=79912
+
+        Drive-by: make subproperties in ObjectPropertySections editable
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView):
+        (WebInspector.ConsoleView.prototype.completionsForTextPrompt):
+        * inspector/front-end/DatabaseQueryView.js:
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.ondblclick):
+        (WebInspector.ObjectPropertyTreeElement.prototype.renderPromptAsBlock):
+        (WebInspector.ObjectPropertyTreeElement.prototype.elementAndValueToEdit):
+        (WebInspector.ObjectPropertyTreeElement.prototype.startEditing.blurListener):
+        (WebInspector.ObjectPropertyTreeElement.prototype.startEditing):
+        (WebInspector.ObjectPropertyTreeElement.prototype.editingEnded):
+        (WebInspector.ObjectPropertyTreeElement.prototype.editingCancelled):
+        (WebInspector.ObjectPropertyTreeElement.prototype.editingCommitted):
+        (WebInspector.ObjectPropertyTreeElement.prototype._promptKeyDown):
+        (WebInspector.ObjectPropertyPrompt):
+        * inspector/front-end/StylesSidebarPane.js:
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.complete):
+        * inspector/front-end/WatchExpressionsSidebarPane.js:
+        (WebInspector.WatchExpressionTreeElement.prototype.renderPromptAsBlock):
+        (WebInspector.WatchExpressionTreeElement.prototype.elementAndValueToEdit):
+        (WebInspector.WatchExpressionTreeElement.prototype.editingCancelled):
+        * inspector/front-end/inspector.css:
+        (.watch-expressions > li.editing-sub-part .text-prompt):
+
+2012-03-02  Antti Koivisto  <antti@apple.com>
+
+        REGRESSION (r104060): Page contents not painted if inserting a new stylesheet and temporary body node
+        https://bugs.webkit.org/show_bug.cgi?id=76590
+
+        Reviewed by Maciej Stachowiak.
+
+        Test: fast/css/pending-stylesheet-repaint.html
+        
+        If there has been a style recalc with a pending stylesheet, the forced repaint will need to be triggered even
+        if the stylesheet doesn't affect the rendering. Otherwise we may end up never painting at all.
+
+        * dom/Document.cpp:
+        (WebCore::Document::styleSelectorChanged):
+
+2012-03-02  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Move QStyle theming code out of WebCore into WebKit1
+        https://bugs.webkit.org/show_bug.cgi?id=80128
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Moved QStyle dependant code into WebKit1, where it's okay to depend on
+        QtWidgets/QStyle. Added factory hooks into RenderThemeQt to allow changing
+        the default "mobile" style to QStyle on start-up.
+
+        * Target.pri:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore):
+        (WebCore::RenderThemeQt::setCustomTheme):
+        (WebCore::RenderThemeQt::customScrollbarTheme):
+        (WebCore::createTheme):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeQt::extraDefaultStyleSheet):
+        * platform/qt/RenderThemeQt.h:
+        (WebCore):
+        (RenderThemeQt):
+        * platform/qt/RenderThemeQtMobile.cpp:
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarTheme::nativeTheme):
+
+2012-03-02  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertyWebkitColumnRuleStyle in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=80085
+
+        Reviewed by Eric Seidel.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: enable Timeline panel for workers
+        https://bugs.webkit.org/show_bug.cgi?id=80130
+
+        Enabled Timeline panel for worker inspector. Refactored
+        JS function calls instrumentation to work for both
+        worker contexts and documents.
+
+        Reviewed by Pavel Feldman.
+
+        * bindings/js/JSCallbackData.cpp:
+        (WebCore::JSCallbackData::invokeCallback):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSMainThreadExecState.h:
+        (WebCore):
+        (WebCore::JSMainThreadExecState::instrumentedCall):
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptExecutionContextFromScriptState):
+        (WebCore):
+        * bindings/js/ScriptState.h:
+        (WebCore):
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::ScriptState::scriptExecutionContext):
+        (WebCore):
+        (WebCore::scriptExecutionContextFromScriptState):
+        * bindings/v8/ScriptState.h:
+        (WebCore):
+        (ScriptState):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::instrumentedCallFunction):
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::callListenerFunction):
+        * inspector/InjectedScript.cpp:
+        (WebCore::InjectedScript::callFunctionWithEvalEnabled):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore):
+        (WebCore::InspectorInstrumentation::instrumentingAgentsForNonDocumentContext):
+        * inspector/InspectorInstrumentation.h:
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::willCallFunction):
+        (WebCore):
+        (WebCore::InspectorInstrumentation::instrumentingAgentsForContext):
+        * inspector/WorkerInspectorController.cpp:
+        (WebCore::WorkerInspectorController::WorkerInspectorController):
+        (WebCore::WorkerInspectorController::connectFrontend):
+        (WebCore::WorkerInspectorController::disconnectFrontend):
+        (WebCore::WorkerInspectorController::restoreInspectorStateFromCookie):
+        * inspector/WorkerInspectorController.h:
+        (WebCore):
+        (WorkerInspectorController):
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2012-03-02  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Adding WebSocket per-frame DEFLATE extension
+        https://bugs.webkit.org/show_bug.cgi?id=77522
+
+        Add WebSocketDeflateFramer class which handles deflate-frame extension.
+        This class encapsulates WebSocketDeflater and WebSocketInflater classes,
+        which depend on zlib, so that WebSocketChannel is not necessary to aware
+        zlib dependency.
+
+        Reviewed by Kent Tamura.
+
+        Tests: http/tests/websocket/tests/hybi/compressed-control-frame.html
+               http/tests/websocket/tests/hybi/deflate-frame-comp-bit-onoff.html
+               http/tests/websocket/tests/hybi/deflate-frame-invalid-parameter.html
+               http/tests/websocket/tests/hybi/deflate-frame-parameter.html
+
+        * CMakeLists.txt: Added WebSocketDeflateFramer.(cpp|h)
+        * GNUmakefile.list.am: Ditto.
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.gyp/WebCore.gyp: Added zlib dependency.
+        * WebCore.vcproj/WebCore.vcproj: Added WebSocketDeflateFramer.(cpp|h)
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::didConnect): Set m_extensions.
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::connect): Add deflate-frame extension processor to WebSocketHanshake if deflate can use.
+        (WebCore::WebSocketChannel::fail): Call m_deflateFramer.didFail().
+        (WebCore::WebSocketChannel::processFrame): Decompress frames if needed.
+        (WebCore::WebSocketChannel::sendFrame): Compress frames if possible.
+        * websockets/WebSocketChannel.h:
+        * websockets/WebSocketDeflateFramer.cpp: Added.
+        (WebCore):
+        (WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::create):
+        (WebCore::WebSocketExtensionDeflateFrame::~WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::WebSocketExtensionDeflateFrame):
+        (WebCore::WebSocketExtensionDeflateFrame::handshakeString):
+        (WebCore::WebSocketExtensionDeflateFrame::processResponse):
+        (WebCore::DeflateResultHolder::DeflateResultHolder):
+        (WebCore::DeflateResultHolder::~DeflateResultHolder):
+        (WebCore::DeflateResultHolder::fail):
+        (WebCore::InflateResultHolder::InflateResultHolder):
+        (WebCore::InflateResultHolder::~InflateResultHolder):
+        (WebCore::InflateResultHolder::fail):
+        (WebCore::WebSocketDeflateFramer::WebSocketDeflateFramer):
+        (WebCore::WebSocketDeflateFramer::createExtensionProcessor):
+        (WebCore::WebSocketDeflateFramer::canDeflate):
+        (WebCore::WebSocketDeflateFramer::enableDeflate):
+        (WebCore::WebSocketDeflateFramer::deflate):
+        (WebCore::WebSocketDeflateFramer::resetDeflateContext):
+        (WebCore::WebSocketDeflateFramer::inflate):
+        (WebCore::WebSocketDeflateFramer::resetInflateContext):
+        (WebCore::WebSocketDeflateFramer::didFail):
+        * websockets/WebSocketDeflateFramer.h: Added.
+        (WebCore):
+        (DeflateResultHolder):
+        (WebCore::DeflateResultHolder::succeeded):
+        (WebCore::DeflateResultHolder::failureReason):
+        (InflateResultHolder):
+        (WebCore::InflateResultHolder::succeeded):
+        (WebCore::InflateResultHolder::failureReason):
+        (WebSocketDeflateFramer):
+        (WebCore::WebSocketDeflateFramer::enabled):
+
+2012-03-01  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [InspectorIndexedDB] Show meaningful description for object store items values.
+        https://bugs.webkit.org/show_bug.cgi?id=79691
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/IndexedDBModel.js:
+        (WebInspector.IndexedDBModel.idbKeyFromKey):
+        * inspector/front-end/IndexedDBViews.js:
+        (WebInspector.IDBDataView.prototype._updateData.callback):
+        (WebInspector.IDBDataView.prototype._updateData):
+        (WebInspector.IDBDataGridNode.prototype.createCell):
+        (WebInspector.IDBDataGridNode.prototype._formatValue):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.LocalJSONObject.prototype.get subtype):
+        * inspector/front-end/indexedDBViews.css:
+        (.indexed-db-data-view .data-grid .data-container td):
+        (.indexed-db-data-view .data-grid .data-container td.primaryKey-column):
+        (.indexed-db-data-view .data-grid .data-container td.primaryKey-column div.primitive-value):
+        (.indexed-db-data-view .data-grid .data-container td .section .header .title):
+
+2012-03-02  Wei James  <james.wei@intel.com>
+
+        [Chromium] Layout Test webaudio/audiobuffersource-channels.html is failing
+        https://bugs.webkit.org/show_bug.cgi?id=79765
+
+        Reviewed by Chris Rogers.
+
+        * webaudio/AudioBuffer.cpp:
+        (WebCore::AudioBuffer::create):
+        * webaudio/AudioBufferSourceNode.cpp:
+        (WebCore::AudioBufferSourceNode::setBuffer):
+        * webaudio/AudioContext.h:
+        (WebCore):
+        (AudioContext):
+        (WebCore::AudioContext::maxNumberOfChannels):
+        * webaudio/AudioNodeOutput.cpp:
+        (WebCore::AudioNodeOutput::AudioNodeOutput):
+        (WebCore::AudioNodeOutput::setNumberOfChannels):
+
+2012-03-02  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertyWebkitRegionBreakAfter, CSSPropertyWebkitRegionBreakBefore and CSSPropertyWebkitRegionBreakInside in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=80066
+
+        Reviewed by Eric Seidel.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-02  Pablo Flouret  <pablof@motorola.com>
+
+        Implement DefaultParagraphSeparator execCommand, to let authors choose the default block element
+        https://bugs.webkit.org/show_bug.cgi?id=59961
+
+        Reviewed by Ryosuke Niwa.
+
+        http://dvcs.w3.org/hg/editing/raw-file/tip/editing.html#the-defaultparagraphseparator-command
+
+        Test: editing/execCommand/default-paragraph-separator.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::Editor):
+        * editing/Editor.h:
+        (WebCore::Editor::defaultParagraphSeparator):
+        (WebCore::Editor::setDefaultParagraphSeparator):
+        (Editor):
+        * editing/EditorCommand.cpp:
+        (WebCore::executeDefaultParagraphSeparator):
+        (WebCore):
+        (WebCore::valueDefaultParagraphSeparator):
+        (WebCore::createCommandMap):
+        * editing/htmlediting.cpp:
+        (WebCore::createDefaultParagraphElement):
+
+        * html/HTMLParagraphElement.cpp:
+        (WebCore::HTMLParagraphElement::create):
+        (WebCore):
+        * html/HTMLParagraphElement.h:
+        (HTMLParagraphElement):
+            Added create(Document*) method that defaults to pTag as the QualifiedName.
+
+2012-03-02  Kenneth Russell  <kbr@google.com>
+
+        [chromium] Fix errors in LayerRendererChromium cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=80064
+
+        Reviewed by James Robinson.
+
+        Tested manually by forcing lost context while rendering Flash on
+        Mac OS in a Debug build.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::cleanupSharedObjects):
+
+2012-03-02  Andy Estes  <aestes@apple.com>
+
+        Fix errors found when building the Mac port with ICONDATABASE disabled.
+        https://bugs.webkit.org/show_bug.cgi?id=80059
+
+        Reviewed by Brady Eidson.
+
+        * WebCore.exp.in: Only export IconDatabase symbols when the feature is
+        enabled.
+        * loader/icon/IconDatabase.h:
+        (WebCore::IconDatabase::create): WebKit calls this static method, so it
+        should be defined on the stub class.
+        (WebCore::IconDatabase::allowDatabaseCleanup): Ditto.
+        (WebCore::IconDatabase::checkIntegrityBeforeOpening): Ditto.
+
+2012-03-02  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertyWebkitColorCorrection in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=80056
+
+        Reviewed by Eric Seidel.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-02  John Bauman  <jbauman@chromium.org>
+
+        [chromium] Send didCommitAndDrawFrame after swap
+        https://bugs.webkit.org/show_bug.cgi?id=80052
+
+        Reviewed by James Robinson.
+
+        Sending didCommitAndDrawFrame before the swap was causing plugins to
+        redraw themselves between compositing and the swap, which reduces
+        opportunities for optimization.
+
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::compositeAndReadback):
+        (WebCore::CCSingleThreadProxy::compositeImmediately):
+        (WebCore::CCSingleThreadProxy::doComposite):
+        (WebCore):
+        (WebCore::CCSingleThreadProxy::didSwapFrame):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+
+2012-03-02  Raymond Toy  <rtoy@google.com>
+
+        AudioParam needs tests for the parameter automation routines.
+        https://bugs.webkit.org/show_bug.cgi?id=77666
+
+        Reviewed by Chris Rogers.
+
+        Tests: webaudio/audioparam-linearRampToValueAtTime.html
+               webaudio/audioparam-setTargetValueAtTime.html
+               webaudio/audioparam-setValueAtTime.html
+               webaudio/audioparam-setValueCurveAtTime.html
+
+        * webaudio/AudioParamTimeline.cpp:
+        (WebCore::AudioParamTimeline::valuesForTimeRangeImpl): Round the
+        curveIndex to fix timing issue in setValueCurveAtTime.
+
+2012-03-01  Pablo Flouret  <pablof@motorola.com>
+
+        Fix code generators to correctly guard header declarations that have a [Conditional] attribute.
+        https://bugs.webkit.org/show_bug.cgi?id=79375
+
+        Reviewed by Kentaro Hara.
+
+        In most cases code generators weren't checking the Conditional attribute
+        when generating code in headers for function/attribute/constants, they
+        were just guarding against the Conditional for the whole interface.
+
+        * bindings/scripts/CodeGeneratorCPP.pm:
+        (GenerateHeader):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateHeader):
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        (GenerateHeader):
+        * bindings/scripts/CodeGeneratorV8.pm:
+        (GenerateHeader):
+        * bindings/scripts/test/CPP/WebDOMTestInterface.h:
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestInterface.h:
+        (JSTestInterface):
+        (WebCore):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        (WebCore):
+        * bindings/scripts/test/ObjC/DOMTestInterface.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+
+
+2012-03-01  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Make opaque paint tracker aware of SkCanvas layers
+        https://bugs.webkit.org/show_bug.cgi?id=79145
+
+        Reviewed by Stephen White.
+
+        The current opaque paint tracker ignored SkCanvas layers entirely. But
+        SkCanvas layers can be used to apply things like alpha. So we make it
+        know about layers, and apply any clipping and SkPaint objects for layers
+        when tracking a paint.
+
+        Image clipping is done via a layer, so we can now also remove the
+        special-case code around image clipping in PlatformContextSkia and
+        OpaqueRegionSkia.
+
+        Unit test: PlatformContextSkiaTest.contextTransparencyLayerTest
+
+        Test: compositing/culling/clear-fixed-iframe.html
+
+        * platform/graphics/skia/OpaqueRegionSkia.cpp:
+        (WebCore::OpaqueRegionSkia::didDrawRect):
+        (WebCore::OpaqueRegionSkia::didDrawPath):
+        (WebCore::OpaqueRegionSkia::didDrawPoints):
+        (WebCore::OpaqueRegionSkia::didDrawBounded):
+        (WebCore::OpaqueRegionSkia::didDraw):
+        (WebCore):
+        * platform/graphics/skia/OpaqueRegionSkia.h:
+        (OpaqueRegionSkia):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        * platform/graphics/skia/PlatformContextSkia.h:
+        (PlatformContextSkia):
+
+2012-03-02  Kent Tamura  <tkent@chromium.org>
+
+        Add HTML-capable popup API to ChromeClient
+        https://bugs.webkit.org/show_bug.cgi?id=79078
+
+        Reviewed by Dimitri Glazkov.
+
+        This API will be used to implement a calendar picker of <input type=date>.
+        The code is enclosed with ENABLE_PAGE_POPUP, and doesn't change any
+        behavior for now.
+
+        * page/ChromeClient.h: Added declarations of openPagePopup() and closePagePopup().
+        * loader/EmptyClients.h:
+        (EmptyChromeClient): Add empty implementations of new ChromeClient functions.
+        * page/PagePopup.h: Added.
+        (PagePopup): Define an empty interface
+        * page/PagePopupClient.h: Added.
+        (PagePopupClient): Define an interface to provide various information to HTMLPopup.
+
+2012-03-01  Hironori Bono  <hbono@chromium.org>
+
+        Render overflow controls of an RTL element to its left-side.
+        https://bugs.webkit.org/show_bug.cgi?id=54623
+
+        This change adds a new flag WTF_USE_RTL_SCROLLBAR and render the
+        vertical scrollbars and resizers of RTL elements to their left side if
+        this new flag is enabled.
+
+        Reviewed by Ryosuke Niwa.
+
+        Test: platform/chromium/fast/events/rtl-scrollbar.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addOverflowFromPositionedObjects): Move child elements right.
+        (WebCore::RenderBlock::determineLogicalLeftPositionForChild): ditto.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::overflowClipRect): Move the content rectangle right.
+        * rendering/RenderLayer.cpp:
+        (WebCore::cornerStart): Added a function that calculates the X position of a resizer.
+        (WebCore):
+        (WebCore::cornerRect): Use cornerStart to move a resizer.
+        (WebCore::RenderLayer::verticalScrollbarStart): Added a function that calculates
+        the X position of a vertical scrollbar.
+        (WebCore::RenderLayer::horizontalScrollbarStart): Added a function that calculates
+        the X position of a horizontal scrollbar.
+        (WebCore::RenderLayer::scrollbarOffset): Render a vertical scrollbar to the left side
+        and move a horizontal scrollbar right by the width of the vertical scrollbar.
+        (WebCore::RenderLayer::invalidateScrollbarRect): ditto.
+        (WebCore::RenderLayer::positionOverflowControls): ditto.
+        (WebCore::RenderLayer::hitTestOverflowControls): ditto.
+        * rendering/RenderLayer.h:
+        (RenderLayer):
+        * rendering/style/RenderStyle.h: Added shouldPlaceBlockDirectionScrollbarOnLogicalLeft,
+        which returns if we need to move a left scrollbar to its right side.
+
+2012-03-01  Kent Tamura  <tkent@chromium.org>
+
+        REGRESSION(90089): Input type='search' text shakes up and down when the style is changed.
+        https://bugs.webkit.org/show_bug.cgi?id=79445
+
+        Reviewed by Dimitri Glazkov.
+
+        If the inner text height of a search field is smaller than the
+        content box height of the <input>, the height of the container
+        element should be same as the content box height.
+
+        When the element style is changed, the RenderStyle height of the
+        container element is cleared, but the renderer height of the
+        container element remains. We had a bug that layout() didn't set
+        the RenderStyle height in a case that the renderer height was the
+        desired height. It shrunk the renderer height as the result of
+        layout for children.
+
+        Tests: fast/forms/search/search-shaking-text.html
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::layout):
+        Always set the RenderStyle height explicitly.
+
+2012-03-01  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed, rebaselined run-bindings-tests results.
+
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp:
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+
+2012-03-01  Dan Bernstein  <mitz@apple.com>
+
+        <rdar://problem/10942540> REGRESSION (r108956): Safari Webpage Preview Fetcher crashes in WebCore::localizedString() when using a WebKit nightly build
+        https://bugs.webkit.org/show_bug.cgi?id=80034
+
+        Reviewed by Benjamin Poulain.
+
+        Safari Webpage Preview Fetcher can’t access the WebCore framework when launched from a WebKit
+        nightly build. After r108956, this causes it to crash.
+
+        * platform/mac/LocalizedStringsMac.cpp:
+        (WebCore::localizedString): Added a null-check for the value returned from
+        CFBundleGetBundleWithIdentifier(CFSTR("com.apple.WebCore")).
+
+2012-03-01  Jason Liu  <jason.liu@torchmobile.com.cn>
+
+        [BlackBerry]Array of Cookies in HTTP request header are not in order.
+        https://bugs.webkit.org/show_bug.cgi?id=79870
+
+        Std::sort and HashMap are not stable. So cookies with the same creating
+        time sometimes are sent disorder.
+        Change std::sort with std::stable-sort.
+        We don't need using HashMap to save so few cookies for one domain.
+        It is a wast of time to create HashMap, too.
+        So change it with vector.
+
+        Reviewed by George Staikos.
+
+        Test: http/tests/cookies/resources/setArraycookies.php
+
+        * platform/blackberry/CookieManager.cpp:
+        (WebCore::cookieSorter):
+        (WebCore::CookieManager::getRawCookies):
+        (WebCore::CookieManager::checkAndTreatCookie):
+        (WebCore::CookieManager::addCookieToMap):
+        * platform/blackberry/CookieManager.h:
+        * platform/blackberry/CookieMap.cpp:
+        (WebCore::CookieMap::addOrReplaceCookie):
+        (WebCore::CookieMap::removeCookieAtIndex):
+        (WebCore::CookieMap::removeCookie):
+        (WebCore):
+        (WebCore::CookieMap::getAllCookies):
+        (WebCore::CookieMap::updateOldestCookie):
+        (WebCore::CookieMap::deleteAllCookiesAndDomains):
+        * platform/blackberry/CookieMap.h:
+        (WebCore::CookieMap::count):
+        (CookieMap):
+
+2012-03-01  Adam Barth  <abarth@webkit.org>
+
+        Move WebCore/storage/IDB* files into WebCore/Modules/indexeddb
+        https://bugs.webkit.org/show_bug.cgi?id=80071
+
+        Reviewed by Kentaro Hara.
+
+        Now that we've removed all the ENABLE(INDEXED_DATABASE) ifdefs from
+        WebCore proper, we can move IndexedDB into its own module.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Modules/indexeddb/IDBAny.cpp: Copied from Source/WebCore/storage/IDBAny.cpp.
+        * Modules/indexeddb/IDBAny.h: Copied from Source/WebCore/storage/IDBAny.h.
+        * Modules/indexeddb/IDBAny.idl: Copied from Source/WebCore/storage/IDBAny.idl.
+        * Modules/indexeddb/IDBBackingStore.h: Copied from Source/WebCore/storage/IDBBackingStore.h.
+        * Modules/indexeddb/IDBCallbacks.h: Copied from Source/WebCore/storage/IDBCallbacks.h.
+        * Modules/indexeddb/IDBCursor.cpp: Copied from Source/WebCore/storage/IDBCursor.cpp.
+        * Modules/indexeddb/IDBCursor.h: Copied from Source/WebCore/storage/IDBCursor.h.
+        * Modules/indexeddb/IDBCursor.idl: Copied from Source/WebCore/storage/IDBCursor.idl.
+        * Modules/indexeddb/IDBCursorBackendImpl.cpp: Copied from Source/WebCore/storage/IDBCursorBackendImpl.cpp.
+        * Modules/indexeddb/IDBCursorBackendImpl.h: Copied from Source/WebCore/storage/IDBCursorBackendImpl.h.
+        * Modules/indexeddb/IDBCursorBackendInterface.h: Copied from Source/WebCore/storage/IDBCursorBackendInterface.h.
+        * Modules/indexeddb/IDBCursorWithValue.cpp: Copied from Source/WebCore/storage/IDBCursorWithValue.cpp.
+        * Modules/indexeddb/IDBCursorWithValue.h: Copied from Source/WebCore/storage/IDBCursorWithValue.h.
+        * Modules/indexeddb/IDBCursorWithValue.idl: Copied from Source/WebCore/storage/IDBCursorWithValue.idl.
+        * Modules/indexeddb/IDBDatabase.cpp: Copied from Source/WebCore/storage/IDBDatabase.cpp.
+        * Modules/indexeddb/IDBDatabase.h: Copied from Source/WebCore/storage/IDBDatabase.h.
+        * Modules/indexeddb/IDBDatabase.idl: Copied from Source/WebCore/storage/IDBDatabase.idl.
+        * Modules/indexeddb/IDBDatabaseBackendImpl.cpp: Copied from Source/WebCore/storage/IDBDatabaseBackendImpl.cpp.
+        * Modules/indexeddb/IDBDatabaseBackendImpl.h: Copied from Source/WebCore/storage/IDBDatabaseBackendImpl.h.
+        * Modules/indexeddb/IDBDatabaseBackendInterface.h: Copied from Source/WebCore/storage/IDBDatabaseBackendInterface.h.
+        * Modules/indexeddb/IDBDatabaseCallbacks.h: Copied from Source/WebCore/storage/IDBDatabaseCallbacks.h.
+        * Modules/indexeddb/IDBDatabaseCallbacksImpl.cpp: Copied from Source/WebCore/storage/IDBDatabaseCallbacksImpl.cpp.
+        * Modules/indexeddb/IDBDatabaseCallbacksImpl.h: Copied from Source/WebCore/storage/IDBDatabaseCallbacksImpl.h.
+        * Modules/indexeddb/IDBDatabaseError.h: Copied from Source/WebCore/storage/IDBDatabaseError.h.
+        * Modules/indexeddb/IDBDatabaseError.idl: Copied from Source/WebCore/storage/IDBDatabaseError.idl.
+        * Modules/indexeddb/IDBDatabaseException.cpp: Copied from Source/WebCore/storage/IDBDatabaseException.cpp.
+        * Modules/indexeddb/IDBDatabaseException.h: Copied from Source/WebCore/storage/IDBDatabaseException.h.
+        * Modules/indexeddb/IDBDatabaseException.idl: Copied from Source/WebCore/storage/IDBDatabaseException.idl.
+        * Modules/indexeddb/IDBEventDispatcher.cpp: Copied from Source/WebCore/storage/IDBEventDispatcher.cpp.
+        * Modules/indexeddb/IDBEventDispatcher.h: Copied from Source/WebCore/storage/IDBEventDispatcher.h.
+        * Modules/indexeddb/IDBFactory.cpp: Copied from Source/WebCore/storage/IDBFactory.cpp.
+        * Modules/indexeddb/IDBFactory.h: Copied from Source/WebCore/storage/IDBFactory.h.
+        * Modules/indexeddb/IDBFactory.idl: Copied from Source/WebCore/storage/IDBFactory.idl.
+        * Modules/indexeddb/IDBFactoryBackendImpl.cpp: Copied from Source/WebCore/storage/IDBFactoryBackendImpl.cpp.
+        * Modules/indexeddb/IDBFactoryBackendImpl.h: Copied from Source/WebCore/storage/IDBFactoryBackendImpl.h.
+        * Modules/indexeddb/IDBFactoryBackendInterface.cpp: Copied from Source/WebCore/storage/IDBFactoryBackendInterface.cpp.
+        * Modules/indexeddb/IDBFactoryBackendInterface.h: Copied from Source/WebCore/storage/IDBFactoryBackendInterface.h.
+        * Modules/indexeddb/IDBIndex.cpp: Copied from Source/WebCore/storage/IDBIndex.cpp.
+        * Modules/indexeddb/IDBIndex.h: Copied from Source/WebCore/storage/IDBIndex.h.
+        * Modules/indexeddb/IDBIndex.idl: Copied from Source/WebCore/storage/IDBIndex.idl.
+        * Modules/indexeddb/IDBIndexBackendImpl.cpp: Copied from Source/WebCore/storage/IDBIndexBackendImpl.cpp.
+        * Modules/indexeddb/IDBIndexBackendImpl.h: Copied from Source/WebCore/storage/IDBIndexBackendImpl.h.
+        * Modules/indexeddb/IDBIndexBackendInterface.h: Copied from Source/WebCore/storage/IDBIndexBackendInterface.h.
+        * Modules/indexeddb/IDBKey.cpp: Copied from Source/WebCore/storage/IDBKey.cpp.
+        * Modules/indexeddb/IDBKey.h: Copied from Source/WebCore/storage/IDBKey.h.
+        * Modules/indexeddb/IDBKey.idl: Copied from Source/WebCore/storage/IDBKey.idl.
+        * Modules/indexeddb/IDBKeyPath.cpp: Copied from Source/WebCore/storage/IDBKeyPath.cpp.
+        * Modules/indexeddb/IDBKeyPath.h: Copied from Source/WebCore/storage/IDBKeyPath.h.
+        * Modules/indexeddb/IDBKeyPathBackendImpl.cpp: Copied from Source/WebCore/storage/IDBKeyPathBackendImpl.cpp.
+        * Modules/indexeddb/IDBKeyPathBackendImpl.h: Copied from Source/WebCore/storage/IDBKeyPathBackendImpl.h.
+        * Modules/indexeddb/IDBKeyRange.cpp: Copied from Source/WebCore/storage/IDBKeyRange.cpp.
+        * Modules/indexeddb/IDBKeyRange.h: Copied from Source/WebCore/storage/IDBKeyRange.h.
+        * Modules/indexeddb/IDBKeyRange.idl: Copied from Source/WebCore/storage/IDBKeyRange.idl.
+        * Modules/indexeddb/IDBLevelDBBackingStore.cpp: Copied from Source/WebCore/storage/IDBLevelDBBackingStore.cpp.
+        * Modules/indexeddb/IDBLevelDBBackingStore.h: Copied from Source/WebCore/storage/IDBLevelDBBackingStore.h.
+        * Modules/indexeddb/IDBLevelDBCoding.cpp: Copied from Source/WebCore/storage/IDBLevelDBCoding.cpp.
+        * Modules/indexeddb/IDBLevelDBCoding.h: Copied from Source/WebCore/storage/IDBLevelDBCoding.h.
+        * Modules/indexeddb/IDBObjectStore.cpp: Copied from Source/WebCore/storage/IDBObjectStore.cpp.
+        * Modules/indexeddb/IDBObjectStore.h: Copied from Source/WebCore/storage/IDBObjectStore.h.
+        * Modules/indexeddb/IDBObjectStore.idl: Copied from Source/WebCore/storage/IDBObjectStore.idl.
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.cpp: Copied from Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp.
+        * Modules/indexeddb/IDBObjectStoreBackendImpl.h: Copied from Source/WebCore/storage/IDBObjectStoreBackendImpl.h.
+        * Modules/indexeddb/IDBObjectStoreBackendInterface.h: Copied from Source/WebCore/storage/IDBObjectStoreBackendInterface.h.
+        * Modules/indexeddb/IDBPendingTransactionMonitor.cpp: Copied from Source/WebCore/storage/IDBPendingTransactionMonitor.cpp.
+        * Modules/indexeddb/IDBPendingTransactionMonitor.h: Copied from Source/WebCore/storage/IDBPendingTransactionMonitor.h.
+        * Modules/indexeddb/IDBRequest.cpp: Copied from Source/WebCore/storage/IDBRequest.cpp.
+        * Modules/indexeddb/IDBRequest.h: Copied from Source/WebCore/storage/IDBRequest.h.
+        * Modules/indexeddb/IDBRequest.idl: Copied from Source/WebCore/storage/IDBRequest.idl.
+        * Modules/indexeddb/IDBTracing.h: Copied from Source/WebCore/storage/IDBTracing.h.
+        * Modules/indexeddb/IDBTransaction.cpp: Copied from Source/WebCore/storage/IDBTransaction.cpp.
+        * Modules/indexeddb/IDBTransaction.h: Copied from Source/WebCore/storage/IDBTransaction.h.
+        * Modules/indexeddb/IDBTransaction.idl: Copied from Source/WebCore/storage/IDBTransaction.idl.
+        * Modules/indexeddb/IDBTransactionBackendImpl.cpp: Copied from Source/WebCore/storage/IDBTransactionBackendImpl.cpp.
+        * Modules/indexeddb/IDBTransactionBackendImpl.h: Copied from Source/WebCore/storage/IDBTransactionBackendImpl.h.
+        * Modules/indexeddb/IDBTransactionBackendInterface.h: Copied from Source/WebCore/storage/IDBTransactionBackendInterface.h.
+        * Modules/indexeddb/IDBTransactionCallbacks.h: Copied from Source/WebCore/storage/IDBTransactionCallbacks.h.
+        * Modules/indexeddb/IDBTransactionCoordinator.cpp: Copied from Source/WebCore/storage/IDBTransactionCoordinator.cpp.
+        * Modules/indexeddb/IDBTransactionCoordinator.h: Copied from Source/WebCore/storage/IDBTransactionCoordinator.h.
+        * Modules/indexeddb/IDBVersionChangeEvent.cpp: Copied from Source/WebCore/storage/IDBVersionChangeEvent.cpp.
+        * Modules/indexeddb/IDBVersionChangeEvent.h: Copied from Source/WebCore/storage/IDBVersionChangeEvent.h.
+        * Modules/indexeddb/IDBVersionChangeEvent.idl: Copied from Source/WebCore/storage/IDBVersionChangeEvent.idl.
+        * Modules/indexeddb/IDBVersionChangeRequest.cpp: Copied from Source/WebCore/storage/IDBVersionChangeRequest.cpp.
+        * Modules/indexeddb/IDBVersionChangeRequest.h: Copied from Source/WebCore/storage/IDBVersionChangeRequest.h.
+        * Modules/indexeddb/IDBVersionChangeRequest.idl: Copied from Source/WebCore/storage/IDBVersionChangeRequest.idl.
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/IDBAny.cpp: Removed.
+        * storage/IDBAny.h: Removed.
+        * storage/IDBAny.idl: Removed.
+        * storage/IDBBackingStore.h: Removed.
+        * storage/IDBCallbacks.h: Removed.
+        * storage/IDBCursor.cpp: Removed.
+        * storage/IDBCursor.h: Removed.
+        * storage/IDBCursor.idl: Removed.
+        * storage/IDBCursorBackendImpl.cpp: Removed.
+        * storage/IDBCursorBackendImpl.h: Removed.
+        * storage/IDBCursorBackendInterface.h: Removed.
+        * storage/IDBCursorWithValue.cpp: Removed.
+        * storage/IDBCursorWithValue.h: Removed.
+        * storage/IDBCursorWithValue.idl: Removed.
+        * storage/IDBDatabase.cpp: Removed.
+        * storage/IDBDatabase.h: Removed.
+        * storage/IDBDatabase.idl: Removed.
+        * storage/IDBDatabaseBackendImpl.cpp: Removed.
+        * storage/IDBDatabaseBackendImpl.h: Removed.
+        * storage/IDBDatabaseBackendInterface.h: Removed.
+        * storage/IDBDatabaseCallbacks.h: Removed.
+        * storage/IDBDatabaseCallbacksImpl.cpp: Removed.
+        * storage/IDBDatabaseCallbacksImpl.h: Removed.
+        * storage/IDBDatabaseError.h: Removed.
+        * storage/IDBDatabaseError.idl: Removed.
+        * storage/IDBDatabaseException.cpp: Removed.
+        * storage/IDBDatabaseException.h: Removed.
+        * storage/IDBDatabaseException.idl: Removed.
+        * storage/IDBEventDispatcher.cpp: Removed.
+        * storage/IDBEventDispatcher.h: Removed.
+        * storage/IDBFactory.cpp: Removed.
+        * storage/IDBFactory.h: Removed.
+        * storage/IDBFactory.idl: Removed.
+        * storage/IDBFactoryBackendImpl.cpp: Removed.
+        * storage/IDBFactoryBackendImpl.h: Removed.
+        * storage/IDBFactoryBackendInterface.cpp: Removed.
+        * storage/IDBFactoryBackendInterface.h: Removed.
+        * storage/IDBIndex.cpp: Removed.
+        * storage/IDBIndex.h: Removed.
+        * storage/IDBIndex.idl: Removed.
+        * storage/IDBIndexBackendImpl.cpp: Removed.
+        * storage/IDBIndexBackendImpl.h: Removed.
+        * storage/IDBIndexBackendInterface.h: Removed.
+        * storage/IDBKey.cpp: Removed.
+        * storage/IDBKey.h: Removed.
+        * storage/IDBKey.idl: Removed.
+        * storage/IDBKeyPath.cpp: Removed.
+        * storage/IDBKeyPath.h: Removed.
+        * storage/IDBKeyPathBackendImpl.cpp: Removed.
+        * storage/IDBKeyPathBackendImpl.h: Removed.
+        * storage/IDBKeyRange.cpp: Removed.
+        * storage/IDBKeyRange.h: Removed.
+        * storage/IDBKeyRange.idl: Removed.
+        * storage/IDBLevelDBBackingStore.cpp: Removed.
+        * storage/IDBLevelDBBackingStore.h: Removed.
+        * storage/IDBLevelDBCoding.cpp: Removed.
+        * storage/IDBLevelDBCoding.h: Removed.
+        * storage/IDBObjectStore.cpp: Removed.
+        * storage/IDBObjectStore.h: Removed.
+        * storage/IDBObjectStore.idl: Removed.
+        * storage/IDBObjectStoreBackendImpl.cpp: Removed.
+        * storage/IDBObjectStoreBackendImpl.h: Removed.
+        * storage/IDBObjectStoreBackendInterface.h: Removed.
+        * storage/IDBPendingTransactionMonitor.cpp: Removed.
+        * storage/IDBPendingTransactionMonitor.h: Removed.
+        * storage/IDBRequest.cpp: Removed.
+        * storage/IDBRequest.h: Removed.
+        * storage/IDBRequest.idl: Removed.
+        * storage/IDBTracing.h: Removed.
+        * storage/IDBTransaction.cpp: Removed.
+        * storage/IDBTransaction.h: Removed.
+        * storage/IDBTransaction.idl: Removed.
+        * storage/IDBTransactionBackendImpl.cpp: Removed.
+        * storage/IDBTransactionBackendImpl.h: Removed.
+        * storage/IDBTransactionBackendInterface.h: Removed.
+        * storage/IDBTransactionCallbacks.h: Removed.
+        * storage/IDBTransactionCoordinator.cpp: Removed.
+        * storage/IDBTransactionCoordinator.h: Removed.
+        * storage/IDBVersionChangeEvent.cpp: Removed.
+        * storage/IDBVersionChangeEvent.h: Removed.
+        * storage/IDBVersionChangeEvent.idl: Removed.
+        * storage/IDBVersionChangeRequest.cpp: Removed.
+        * storage/IDBVersionChangeRequest.h: Removed.
+        * storage/IDBVersionChangeRequest.idl: Removed.
+
+2012-03-01  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertyWebkitBorderFit in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=79998
+
+        Reviewed by Andreas Kling.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-01  Anders Carlsson  <andersca@apple.com>
+
+        Crash when doing repeated double-tap-to-zoom gesture on apple startpage
+        https://bugs.webkit.org/show_bug.cgi?id=80081
+        <rdar://problem/10966391>
+
+        Reviewed by Sam Weinig.
+
+        Setting the contents scale on the tile cache layer was creating a WebTileCacheLayer presentation layer copy with a null _tileCache.
+
+        Implement -[WebTileCacheLayer actionForKey:] and have it always return nil so we'll avoid implicit animations, and thus creating presentation layers.
+
+        * platform/graphics/ca/mac/WebTileCacheLayer.mm:
+        (-[WebTileCacheLayer initWithLayer:]):
+        Implement this and assert that it's never reached. We should never create presentation layers since we don't animate this layer.
+
+        (-[WebTileCacheLayer actionForKey:]):
+        Implement this and always return nil.
+
+2012-03-01  Hajime Morrita  <morrita@chromium.org>
+
+        Custom scrollbars do not support transparency
+        https://bugs.webkit.org/show_bug.cgi?id=50547
+
+        Reviewed by James Robinson.
+
+        RenderScrollbar, which is used even for outermost frame when
+        -webkit-scrollbar is specified, assumes that its background is
+        painted by the enclosing container. But there is no such container
+        for outermost frame. This causes visual glitches when the
+        scrollbar has transparency.
+
+        This change clears background region for custom
+        outermostscrollbars to erase such glitches.
+
+        Test: fast/frames/transparent-scrollbar.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintScrollbar): The background is cleared here.
+        (WebCore):
+        * page/FrameView.h:
+        (FrameView):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::paintScrollbar): Added to hook in FrameView
+        (WebCore):
+        (WebCore::ScrollView::paintScrollbars):
+        * platform/ScrollView.h:
+        (ScrollView):
+
+2012-03-01  Kent Tamura  <tkent@chromium.org>
+
+        REGRESSION(r106388): Form state is restored to a wrong document.
+        https://bugs.webkit.org/show_bug.cgi?id=79206
+
+        Reviewed by Brady Eidson.
+
+        In some cases, the URL of the current HistoryItem and the document
+        URL are mismatched.
+        A form state should be restored only if the document was loaded
+        with a HistoryItem and the document is not loaded as a
+        redirection.
+
+        Test: fast/loader/form-state-restore-with-locked-back-forward-list.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkCompleted): Clear m_requestedHistoryItem.
+        (WebCore::FrameLoader::loadItem):
+        Save the requested HistoryItem for didLoadWithLodItem().
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::requestedHistoryItem):
+        Added. Accessor for m_requestedHistoryItem.
+        * loader/HistoryController.cpp:
+        (WebCore::HistoryController::restoreDocumentState):
+        Restore a form state only if the current document was loaded with
+        FrameLoader::loadItem() and not redirection.
+
+2012-03-01  Xingnan Wang  <xingnan.wang@intel.com>
+
+        SSE optimization for vsvesq and vmaxmgv
+        https://bugs.webkit.org/show_bug.cgi?id=77950
+
+        Reviewed by Chris Rogers.
+
+        Achieved the performance of 3.7x on vsvesq and 4.1x on vmaxmgv.
+
+        * platform/audio/VectorMath.cpp:
+        (WebCore::VectorMath::vsvesq):
+        (WebCore::VectorMath::vmaxmgv):
+
+2012-03-01  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertyBoxSizing in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=80001
+
+        Reviewed by Andreas Kling.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] LayerChromium::contentChanged is redundant with setNeedsDisplay
+        https://bugs.webkit.org/show_bug.cgi?id=79708
+
+        Reviewed by Adrienne Walker.
+
+        Some layer types need special handling when they receive damage. WebGL layers need to know if their texture is
+        updated for clear-on-swap behavior and both WebGL and canvas 2d layers have rate limiting mechanisms tied to
+        receiving invalidations. This mechanism was implemented by LayerChromium::contentChanged(), but this is
+        redundant with setNeedsDisplay().
+
+        Covered by existing tests.
+
+        * platform/graphics/chromium/Canvas2DLayerChromium.cpp:
+        (WebCore::Canvas2DLayerChromium::setNeedsDisplay):
+        * platform/graphics/chromium/Canvas2DLayerChromium.h:
+        (Canvas2DLayerChromium):
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setContentsNeedsDisplay):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::setNeedsDisplay):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::setNeedsDisplay):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+        (VideoLayerChromium):
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::setNeedsDisplay):
+        * platform/graphics/chromium/WebGLLayerChromium.h:
+        (WebGLLayerChromium):
+
+2012-03-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Rename LayerChromium::name to debugName to be more consistent with other debug properties, make threadsafe
+        https://bugs.webkit.org/show_bug.cgi?id=79723
+
+        Reviewed by Adrienne Walker.
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::updateNames):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::pushPropertiesTo):
+        (WebCore::LayerChromium::setDebugName):
+        (WebCore):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::dumpLayer):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (CCLayerImpl):
+        (WebCore::CCLayerImpl::setDebugName):
+        (WebCore::CCLayerImpl::debugName):
+        * platform/graphics/chromium/cc/CCRenderSurface.cpp:
+        (WebCore::CCRenderSurface::name):
+
+2012-03-01  Adam Barth  <abarth@webkit.org>
+
+        Remove last ENABLED(INDEXED_DATABASE) ifdef from WebCore proper
+        https://bugs.webkit.org/show_bug.cgi?id=80061
+
+        Reviewed by Dimitri Glazkov.
+
+        This patch removes the last ENABLED(INDEXED_DATABASE) ifdef from
+        WebCore proper by moving the backend factory out of PageGroup and into
+        a supplement for PageGroup.  After this patch, we're ready to move the
+        IDB code into Modules.
+
+        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
+        (WebCore::DOMWindowIndexedDatabase::webkitIndexedDB):
+        * WebCore.gypi:
+        * inspector/InspectorIndexedDBAgent.cpp:
+        (WebCore::assertIDBFactory):
+        * page/PageGroup.cpp:
+        (WebCore):
+        * page/PageGroup.h:
+        (PageGroup):
+
+2012-03-01  Dale Curtis  <dalecurtis@chromium.org>
+
+        Remove deprecated FFmpeg build directories.
+        https://bugs.webkit.org/show_bug.cgi?id=79282
+
+        We've switched the layout of the FFmpeg repo in Chrome and these paths
+        are no longer needed or valid.
+
+        Reviewed by Dirk Pranke.
+
+        No new tests. It either compiles or not.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-03-01  Xingnan Wang  <xingnan.wang@intel.com>
+
+        Enable IPP for Biquad filter
+        https://bugs.webkit.org/show_bug.cgi?id=77509
+
+        Reviewed by Chris Rogers.
+
+        Use IIR filter in IPP and improve ~27% performance in linux.
+        Changes are covered by current tests.
+
+        * platform/audio/Biquad.cpp:
+        (WebCore::Biquad::Biquad):
+        (WebCore::Biquad::~Biquad):
+        (WebCore):
+        (WebCore::Biquad::process):
+        (WebCore::Biquad::reset):
+        (WebCore::Biquad::setLowpassParams):
+        (WebCore::Biquad::setHighpassParams):
+        (WebCore::Biquad::setNormalizedCoefficients):
+        (WebCore::Biquad::setZeroPolePairs):
+        * platform/audio/Biquad.h:
+        (Biquad):
+
+2012-03-01  Peter Kotwicz  <pkotwicz@google.com>
+
+        Decouple scrollbar painting from Scrollbar object
+        https://bugs.webkit.org/show_bug.cgi?id=78028
+
+        Reviewed by James Robinson.
+
+        Added interface ScrollbarThemeClient which Scrollbar inherits from.
+        This allows painting via ScrollbarTheme with a proxy to a Scrollbar
+        object.
+
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::scrollbarOverlayStyle):
+        (WebCore):
+        (WebCore::Scrollbar::getTickmarks):
+        (WebCore::Scrollbar::isScrollableAreaActive):
+        (WebCore::Scrollbar::isScrollViewScrollbar):
+        (WebCore::Scrollbar::setFrameRect):
+        * platform/Scrollbar.h:
+        (Scrollbar):
+        (WebCore::Scrollbar::x):
+        (WebCore::Scrollbar::y):
+        (WebCore::Scrollbar::width):
+        (WebCore::Scrollbar::height):
+        (WebCore::Scrollbar::size):
+        (WebCore::Scrollbar::location):
+        (WebCore::Scrollbar::parent):
+        (WebCore::Scrollbar::root):
+        (WebCore::Scrollbar::frameRect):
+        (WebCore::Scrollbar::invalidate):
+        (WebCore::Scrollbar::convertFromContainingWindow):
+        (WebCore::Scrollbar::isCustomScrollbar):
+        (WebCore::Scrollbar::orientation):
+        (WebCore::Scrollbar::value):
+        (WebCore::Scrollbar::currentPos):
+        (WebCore::Scrollbar::visibleSize):
+        (WebCore::Scrollbar::totalSize):
+        (WebCore::Scrollbar::maximum):
+        (WebCore::Scrollbar::controlSize):
+        (WebCore::Scrollbar::lineStep):
+        (WebCore::Scrollbar::pageStep):
+        (WebCore::Scrollbar::pressedPart):
+        (WebCore::Scrollbar::hoveredPart):
+        (WebCore::Scrollbar::styleChanged):
+        (WebCore::Scrollbar::enabled):
+        * platform/ScrollbarTheme.h:
+        (WebCore):
+        (WebCore::ScrollbarTheme::updateEnabledState):
+        (WebCore::ScrollbarTheme::paint):
+        (WebCore::ScrollbarTheme::hitTest):
+        (WebCore::ScrollbarTheme::updateScrollbarOverlayStyle):
+        (WebCore::ScrollbarTheme::invalidateParts):
+        (WebCore::ScrollbarTheme::invalidatePart):
+        (WebCore::ScrollbarTheme::shouldCenterOnThumb):
+        (WebCore::ScrollbarTheme::shouldSnapBackToDragOrigin):
+        (WebCore::ScrollbarTheme::shouldDragDocumentInsteadOfThumb):
+        (WebCore::ScrollbarTheme::thumbPosition):
+        (WebCore::ScrollbarTheme::thumbLength):
+        (WebCore::ScrollbarTheme::trackPosition):
+        (WebCore::ScrollbarTheme::trackLength):
+        (WebCore::ScrollbarTheme::registerScrollbar):
+        (WebCore::ScrollbarTheme::unregisterScrollbar):
+        * platform/ScrollbarThemeClient.h: Added.
+        (WebCore):
+        (ScrollbarThemeClient):
+        (WebCore::ScrollbarThemeClient::~ScrollbarThemeClient):
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paint):
+        (WebCore::ScrollbarThemeComposite::hitTest):
+        (WebCore::ScrollbarThemeComposite::invalidatePart):
+        (WebCore::ScrollbarThemeComposite::splitTrack):
+        (WebCore::usedTotalSize):
+        (WebCore::ScrollbarThemeComposite::thumbPosition):
+        (WebCore::ScrollbarThemeComposite::thumbLength):
+        (WebCore::ScrollbarThemeComposite::minimumThumbLength):
+        (WebCore::ScrollbarThemeComposite::trackPosition):
+        (WebCore::ScrollbarThemeComposite::trackLength):
+        * platform/ScrollbarThemeComposite.h:
+        (ScrollbarThemeComposite):
+        (WebCore::ScrollbarThemeComposite::paintScrollbarBackground):
+        (WebCore::ScrollbarThemeComposite::paintTrackBackground):
+        (WebCore::ScrollbarThemeComposite::paintTrackPiece):
+        (WebCore::ScrollbarThemeComposite::paintButton):
+        (WebCore::ScrollbarThemeComposite::paintThumb):
+        (WebCore::ScrollbarThemeComposite::paintTickmarks):
+        (WebCore::ScrollbarThemeComposite::constrainTrackRectToTrackPieces):
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::hasThumb):
+        (WebCore::ScrollbarThemeChromium::backButtonRect):
+        (WebCore::ScrollbarThemeChromium::forwardButtonRect):
+        (WebCore::ScrollbarThemeChromium::trackRect):
+        (WebCore::ScrollbarThemeChromium::paintTrackBackground):
+        (WebCore::ScrollbarThemeChromium::paintTickmarks):
+        * platform/chromium/ScrollbarThemeChromium.h:
+        (WebCore::ScrollbarThemeChromium::hasButtons):
+        (ScrollbarThemeChromium):
+        * platform/chromium/ScrollbarThemeChromiumAndroid.cpp:
+        (WebCore::ScrollbarThemeChromiumAndroid::paintScrollbarBackground):
+        (WebCore::ScrollbarThemeChromiumAndroid::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeChromiumAndroid::buttonSize):
+        (WebCore::ScrollbarThemeChromiumAndroid::minimumThumbLength):
+        * platform/chromium/ScrollbarThemeChromiumAndroid.h:
+        (ScrollbarThemeChromiumAndroid):
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromiumLinux::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromiumLinux::paintButton):
+        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+        (WebCore::ScrollbarThemeChromiumLinux::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeChromiumLinux::buttonSize):
+        (WebCore::ScrollbarThemeChromiumLinux::minimumThumbLength):
+        * platform/chromium/ScrollbarThemeChromiumLinux.h:
+        (ScrollbarThemeChromiumLinux):
+        * platform/chromium/ScrollbarThemeChromiumMac.h:
+        (ScrollbarThemeChromiumMac):
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::scrollbarStateToThemeState):
+        (WebCore::ScrollbarThemeChromiumMac::paint):
+        (WebCore::ScrollbarThemeChromiumMac::paintGivenTickmarks):
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarThemeChromiumWin::shouldSnapBackToDragOrigin):
+        (WebCore::ScrollbarThemeChromiumWin::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromiumWin::paintButton):
+        (WebCore::ScrollbarThemeChromiumWin::paintThumb):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeState):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeArrowState):
+        (WebCore::ScrollbarThemeChromiumWin::getClassicThemeState):
+        (WebCore::ScrollbarThemeChromiumWin::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeChromiumWin::buttonSize):
+        * platform/chromium/ScrollbarThemeChromiumWin.h:
+        (ScrollbarThemeChromiumWin):
+        * platform/efl/ScrollbarThemeEfl.cpp:
+        (WebCore::ScrollbarThemeEfl::registerScrollbar):
+        (WebCore::ScrollbarThemeEfl::unregisterScrollbar):
+        * platform/efl/ScrollbarThemeEfl.h:
+        (ScrollbarThemeEfl):
+        * platform/gtk/ScrollbarThemeGtk.cpp:
+        (WebCore):
+        (WebCore::ScrollbarThemeGtk::registerScrollbar):
+        (WebCore::ScrollbarThemeGtk::unregisterScrollbar):
+        (WebCore::ScrollbarThemeGtk::updateScrollbarsFrameThickness):
+        (WebCore::ScrollbarThemeGtk::hasThumb):
+        (WebCore::ScrollbarThemeGtk::backButtonRect):
+        (WebCore::ScrollbarThemeGtk::forwardButtonRect):
+        (WebCore::ScrollbarThemeGtk::trackRect):
+        (WebCore::ScrollbarThemeGtk::thumbRect):
+        (WebCore::ScrollbarThemeGtk::paint):
+        (WebCore::ScrollbarThemeGtk::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeGtk::buttonSize):
+        (WebCore::ScrollbarThemeGtk::minimumThumbLength):
+        * platform/gtk/ScrollbarThemeGtk.h:
+        (WebCore::ScrollbarThemeGtk::hasButtons):
+        (ScrollbarThemeGtk):
+        * platform/gtk/ScrollbarThemeGtk2.cpp:
+        (WebCore::getWidgetForScrollbar):
+        (WebCore::ScrollbarThemeGtk::paintTrackBackground):
+        (WebCore::ScrollbarThemeGtk::paintScrollbarBackground):
+        (WebCore::ScrollbarThemeGtk::paintThumb):
+        (WebCore::ScrollbarThemeGtk::paintButton):
+        * platform/gtk/ScrollbarThemeGtk3.cpp:
+        (WebCore::ScrollbarThemeGtk::paintTrackBackground):
+        (WebCore::ScrollbarThemeGtk::paintScrollbarBackground):
+        (WebCore::ScrollbarThemeGtk::paintThumb):
+        (WebCore::ScrollbarThemeGtk::paintButton):
+        * platform/mac/ScrollbarThemeMac.h:
+        (ScrollbarThemeMac):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore):
+        (WebCore::ScrollbarThemeMac::registerScrollbar):
+        (WebCore::ScrollbarThemeMac::unregisterScrollbar):
+        (WebCore::ScrollbarThemeMac::setNewPainterForScrollbar):
+        (WebCore::ScrollbarThemeMac::painterForScrollbar):
+        (WebCore::ScrollbarThemeMac::updateScrollbarOverlayStyle):
+        (WebCore::ScrollbarThemeMac::hasButtons):
+        (WebCore::ScrollbarThemeMac::hasThumb):
+        (WebCore::ScrollbarThemeMac::backButtonRect):
+        (WebCore::ScrollbarThemeMac::forwardButtonRect):
+        (WebCore::ScrollbarThemeMac::trackRect):
+        (WebCore::ScrollbarThemeMac::minimumThumbLength):
+        (WebCore::ScrollbarThemeMac::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeMac::shouldDragDocumentInsteadOfThumb):
+        (WebCore::ScrollbarThemeMac::updateEnabledState):
+        (WebCore::ScrollbarThemeMac::paint):
+        * platform/mock/ScrollbarThemeMock.cpp:
+        (WebCore::ScrollbarThemeMock::trackRect):
+        (WebCore::ScrollbarThemeMock::paintTrackBackground):
+        (WebCore::ScrollbarThemeMock::paintThumb):
+        * platform/mock/ScrollbarThemeMock.h:
+        (WebCore::ScrollbarThemeMock::hasButtons):
+        (WebCore::ScrollbarThemeMock::hasThumb):
+        (WebCore::ScrollbarThemeMock::backButtonRect):
+        (WebCore::ScrollbarThemeMock::forwardButtonRect):
+        (ScrollbarThemeMock):
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::styleOptionSlider):
+        (WebCore::ScrollbarThemeQt::paint):
+        (WebCore::ScrollbarThemeQt::hitTest):
+        (WebCore::ScrollbarThemeQt::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeQt::invalidatePart):
+        (WebCore::ScrollbarThemeQt::thumbPosition):
+        (WebCore::ScrollbarThemeQt::thumbLength):
+        (WebCore::ScrollbarThemeQt::trackPosition):
+        (WebCore::ScrollbarThemeQt::trackLength):
+        * platform/qt/ScrollbarThemeQt.h:
+        (ScrollbarThemeQt):
+        * platform/win/ScrollbarThemeSafari.cpp:
+        (WebCore::ScrollbarThemeSafari::hasButtons):
+        (WebCore::ScrollbarThemeSafari::hasThumb):
+        (WebCore::ScrollbarThemeSafari::backButtonRect):
+        (WebCore::ScrollbarThemeSafari::forwardButtonRect):
+        (WebCore::ScrollbarThemeSafari::trackRect):
+        (WebCore::ScrollbarThemeSafari::minimumThumbLength):
+        (WebCore::ScrollbarThemeSafari::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeSafari::paintTrackBackground):
+        (WebCore::ScrollbarThemeSafari::paintButton):
+        (WebCore::ScrollbarThemeSafari::paintThumb):
+        * platform/win/ScrollbarThemeSafari.h:
+        (ScrollbarThemeSafari):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::hasThumb):
+        (WebCore::ScrollbarThemeWin::backButtonRect):
+        (WebCore::ScrollbarThemeWin::forwardButtonRect):
+        (WebCore::ScrollbarThemeWin::trackRect):
+        (WebCore::ScrollbarThemeWin::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeWin::shouldSnapBackToDragOrigin):
+        (WebCore::ScrollbarThemeWin::paintTrackBackground):
+        (WebCore::ScrollbarThemeWin::paintTrackPiece):
+        (WebCore::ScrollbarThemeWin::paintButton):
+        (WebCore::paintGripper):
+        (WebCore::ScrollbarThemeWin::paintThumb):
+        * platform/win/ScrollbarThemeWin.h:
+        (WebCore::ScrollbarThemeWin::hasButtons):
+        (ScrollbarThemeWin):
+        * platform/wx/ScrollbarThemeWx.cpp:
+        (WebCore::ScrollbarThemeWx::hasThumb):
+        (WebCore::ScrollbarThemeWx::minimumThumbLength):
+        (WebCore::ScrollbarThemeWx::buttonSize):
+        (WebCore::ScrollbarThemeWx::splitTrack):
+        (WebCore::ScrollbarThemeWx::backButtonRect):
+        (WebCore::ScrollbarThemeWx::forwardButtonRect):
+        (WebCore::ScrollbarThemeWx::trackRect):
+        (WebCore::ScrollbarThemeWx::paint):
+        * platform/wx/ScrollbarThemeWx.h:
+        (ScrollbarThemeWx):
+        (WebCore::ScrollbarThemeWx::hasButtons):
+        * rendering/RenderScrollbar.h:
+        (WebCore::toRenderScrollbar):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::buttonSizesAlongTrackAxis):
+        (WebCore::RenderScrollbarTheme::hasButtons):
+        (WebCore::RenderScrollbarTheme::hasThumb):
+        (WebCore::RenderScrollbarTheme::minimumThumbLength):
+        (WebCore::RenderScrollbarTheme::backButtonRect):
+        (WebCore::RenderScrollbarTheme::forwardButtonRect):
+        (WebCore::RenderScrollbarTheme::trackRect):
+        (WebCore::RenderScrollbarTheme::constrainTrackRectToTrackPieces):
+        (WebCore::RenderScrollbarTheme::paintScrollbarBackground):
+        (WebCore::RenderScrollbarTheme::paintTrackBackground):
+        (WebCore::RenderScrollbarTheme::paintTrackPiece):
+        (WebCore::RenderScrollbarTheme::paintButton):
+        (WebCore::RenderScrollbarTheme::paintThumb):
+        * rendering/RenderScrollbarTheme.h:
+        (WebCore::RenderScrollbarTheme::shouldCenterOnThumb):
+        (WebCore::RenderScrollbarTheme::registerScrollbar):
+        (WebCore::RenderScrollbarTheme::unregisterScrollbar):
+        (RenderScrollbarTheme):
+
+2012-03-01  Luke Macpherson   <macpherson@chromium.org>
+
+        Implement CSSPropertyImageRendering in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=79855
+
+        Reviewed by Eric Seidel.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-03-01  Alok Priyadarshi  <alokp@chromium.org>
+
+        [chromium] Partial texture updates not happening with accelerated painting path
+        https://bugs.webkit.org/show_bug.cgi?id=80040
+
+        Reviewed by James Robinson.
+
+        The order of y-flip and clip-rect was opposite of what it should be.
+        The clip rect was not properly transformed to account for y-flip and hence clipping everything.  
+
+        * platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp:
+        (WebCore::FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect):
+
+2012-03-01  Alexey Proskuryakov  <ap@apple.com>
+
+        FileReader read speed is way too low
+        https://bugs.webkit.org/show_bug.cgi?id=77272
+
+        Reviewed by Oliver Hunt.
+
+        This brings performance to reasonable range, but certainly doesn't exhaust improvement opportunities.
+
+        * platform/network/BlobResourceHandle.cpp: Use a more appropriate block size. Performing
+        cross-thread messaging for every 1024 bytes is slow.
+
+2012-03-01  Dan Bernstein  <mitz@apple.com>
+
+        ScrollView::setFrameRect() calls contentsResized() even when the frame size is unchanged
+        https://bugs.webkit.org/show_bug.cgi?id=80047
+
+        Reviewed by Anders Carlsson.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setFrameRect): Added a check that the new frame size differs from the
+        old one before calling contentsResized().
+
+2012-03-01  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Move pageScaleDirty logic from LayerChromium to GraphicsLayerChromium
+        https://bugs.webkit.org/show_bug.cgi?id=79714
+
+        Reviewed by Adrienne Walker.
+
+        When the page scale changes on a composited layer we need to invalidate all of the contents on the layer in
+        order to repaint them at the new scale. The sequence of calls we get make this a bit tricky, since we first
+        receive a page scale changed notification and then receive the new layer bounds. The solution is to defer the
+        invalidation until we have the new layer bounds, which landed in r99774.
+
+        This moves that logic from LayerChromium into GraphicsLayerChromium since IMO this is pretty particular to the
+        way WebCore is passing us invalidations and not something fundamental to the compositor.
+
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::GraphicsLayerChromium):
+        (WebCore::GraphicsLayerChromium::setSize):
+        (WebCore::GraphicsLayerChromium::deviceOrPageScaleFactorChanged):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        (WebCore::LayerChromium::setBounds):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+
+2012-03-01  Joe Thomas  <joethomas@motorola.com>
+
+        :empty still applies to elements made non-empty via page dynamics.
+        https://bugs.webkit.org/show_bug.cgi?id=79734
+
+        Check for :empty style change should be made even if the RenderStyle for the element is NULL
+        as changes to the element's children can trigger a change in :empty state of the parent element.
+
+        Reviewed by Antti Koivisto.
+
+        Test: fast/selectors/empty-element-made-non-empty.html
+
+        * dom/Element.cpp:
+        (WebCore::checkForSiblingStyleChanges):
+
+2012-02-29  Nat Duca  <nduca@chromium.org>
+
+        [chromium] Move context lost control code from CCSingleThreadProxy to CCLayerTreeHost
+        https://bugs.webkit.org/show_bug.cgi?id=79964
+
+        Reviewed by James Robinson.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::CCLayerTreeHost):
+        (WebCore::CCLayerTreeHost::initializeLayerRenderer):
+        (WebCore::CCLayerTreeHost::recreateContext):
+        (WebCore::CCLayerTreeHost::createContext):
+        (WebCore::CCLayerTreeHost::didLoseContext):
+        (WebCore::CCLayerTreeHost::compositeAndReadback):
+        (WebCore::CCLayerTreeHost::loseContext):
+        (WebCore::CCLayerTreeHost::updateLayers):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+        (CCLayerTreeHostClient):
+        (CCLayerTreeHost):
+        * platform/graphics/chromium/cc/CCProxy.h:
+        (CCProxy):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.cpp:
+        (WebCore::CCSingleThreadProxy::CCSingleThreadProxy):
+        (WebCore::CCSingleThreadProxy::compositeAndReadback):
+        (WebCore::CCSingleThreadProxy::initializeContext):
+        (WebCore::CCSingleThreadProxy::recreateContext):
+        (WebCore):
+        (WebCore::CCSingleThreadProxy::loseContext):
+        (WebCore::CCSingleThreadProxy::compositeImmediately):
+        (WebCore::CCSingleThreadProxy::doComposite):
+        * platform/graphics/chromium/cc/CCSingleThreadProxy.h:
+        (CCSingleThreadProxy):
+        * platform/graphics/chromium/cc/CCThreadProxy.cpp:
+        (WebCore::CCThreadProxy::initializeContext):
+        (WebCore::CCThreadProxy::recreateContext):
+        (WebCore):
+        (WebCore::CCThreadProxy::loseContext):
+        * platform/graphics/chromium/cc/CCThreadProxy.h:
+        (CCThreadProxy):
+
+2012-03-01  Abhishek Arya  <inferno@chromium.org>
+
+        Prevent layout root to remain set on renderers getting destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=79953
+
+        Reviewed by Eric Seidel.
+
+        Implement Julien Chaffraix's idea.
+
+        * page/FrameView.h:
+        (WebCore::FrameView::clearLayoutRoot): helper to clear layout root.
+        * rendering/RenderObject.cpp:
+        (WebCore::clearLayoutRootIfNeeded): if we know we are going
+        away and we are the view's layout root, then we need to reset the layout
+        root to prevent being used.
+        (WebCore):
+        (WebCore::RenderObject::willBeDestroyed): call clearLayoutRootIfNeeded at end.
+
+2012-03-01  Kangil Han  <kangil.han@samsung.com>
+
+        [DRT] Remove all PlainTextController usages in existing tests by adding internal API
+        https://bugs.webkit.org/show_bug.cgi?id=78570
+
+        Reviewed by Hajime Morita.
+
+        This patch will remove all PlainTextController usages
+        in existing DRT tests by adding internal API to WebCore/testing/Internals
+
+        Changed editing/text-iterator/script-tests/basic-iteration.js to use internals.rangeAsText
+
+        * testing/Internals.cpp:
+        (WebCore::Internals::rangeAsText):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-03-01  Adam Barth  <abarth@webkit.org>
+
+        DOMWindow shouldn't have any INDEXED_DATABASE ifdefs
+        https://bugs.webkit.org/show_bug.cgi?id=80013
+
+        Reviewed by Kentaro Hara.
+
+        Before this patch, DOMWindow still knew about IDB because of the
+        database factory.  This patch moves the factory to
+        DOMWindowIndexedDatabase.
+
+        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
+        (WebCore::DOMWindowIndexedDatabase::DOMWindowIndexedDatabase):
+        (WebCore::DOMWindowIndexedDatabase::from):
+        (WebCore):
+        (WebCore::DOMWindowIndexedDatabase::disconnectFrame):
+        (WebCore::DOMWindowIndexedDatabase::webkitIndexedDB):
+        * Modules/indexeddb/DOMWindowIndexedDatabase.h:
+        (DOMWindowIndexedDatabase):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::clear):
+        (WebCore):
+        * page/DOMWindow.h:
+        (DOMWindow):
+
+2012-03-01  Anders Carlsson  <andersca@apple.com>
+
+        Glitchy scrolling on pages where the scroll layer needs to be updated on the main thread
+        https://bugs.webkit.org/show_bug.cgi?id=80038
+        <rdar://problem/10933831>
+
+        Reviewed by Simon Fraser.
+
+        When we need to update the scroll layer position on the main thread, we need to cache the
+        scroll position we sent to the main thread and assume that that's the correct scroll position.
+
+        * page/scrolling/mac/ScrollingTreeNodeMac.h:
+        (ScrollingTreeNodeMac):
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::update):
+        (WebCore::ScrollingTreeNodeMac::setScrollPosition):
+        (WebCore::ScrollingTreeNodeMac::scrollPosition):
+
+2012-03-01  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Unreviewed, rolling out r109367.
+        http://trac.webkit.org/changeset/109367
+        https://bugs.webkit.org/show_bug.cgi?id=75568
+
+        Some tests started to fail in a non obvious way.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::isPointInOverflowControl):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::willBeDestroyed):
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+        (WebCore::RenderBox::scrollLeft):
+        (WebCore::RenderBox::scrollTop):
+        (WebCore::RenderBox::setScrollLeft):
+        (WebCore::RenderBox::setScrollTop):
+        (WebCore::RenderBox::includeVerticalScrollbarSize):
+        (WebCore::RenderBox::includeHorizontalScrollbarSize):
+        (WebCore::RenderBox::scrolledContentOffset):
+        (WebCore::RenderBox::cachedSizeForOverflowClip):
+        (WebCore::RenderBox::pushContentsClip):
+        (WebCore::RenderBox::popContentsClip):
+        (WebCore::RenderBox::addLayoutOverflow):
+        * rendering/RenderBox.h:
+        (RenderBox):
+        (WebCore):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore):
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::requiresLayer):
+        (RenderBoxModelObject):
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        * rendering/RenderTableRow.h:
+        (WebCore::RenderTableRow::requiresLayer):
+
+2012-03-01  Kenichi Ishibashi  <bashi@chromium.org>
+
+        REGRESSION: Outlook 2007 doesn't display fonts correctly on emails composed by WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=79448
+
+        Reviewed by Ryosuke Niwa.
+
+        Don't produce single quotes around face attribute of font elements.
+
+        Test: editing/style/font-face-unquote.html
+
+        * editing/EditingStyle.cpp:
+        (WebCore::StyleChange::extractTextStyles): Remove single quotes from m_applyFontFace.
+
+2012-03-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        Part of https://bugs.webkit.org/show_bug.cgi?id=79705
+
+        Here's some of that tweaking promised in the comment. Adjusting 
+        gMaximumUnpaintedAreaRatio down a bit.
+        * page/Page.cpp:
+        (WebCore):
+
+2012-03-01  Levi Weintraub  <leviw@chromium.org>
+
+        Add roundToInt method for LayoutUnits
+        https://bugs.webkit.org/show_bug.cgi?id=79283
+
+        Reviewed by Eric Seidel.
+
+        Adding a roundToInt method that rounds a LayoutUnit to the nearest integer. This
+        only has an effect once we switch to sub-pixel positioning. Points and offsets
+        are rounded for painting and hit testing.
+
+        No new tests. No change in behavior.
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::offsetX):
+        (WebCore::MouseRelatedEvent::offsetY):
+        * html/shadow/MediaControlElements.cpp:
+        (WebCore::MediaControlTextTrackContainerElement::updateSizes):
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::computeLineGridPaginationOrigin):
+        * rendering/LayoutTypes.h:
+        (WebCore::roundToInt): Stub until we switch to sub-pixel LayoutUnits.
+        (WebCore):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::pageLogicalTopForOffset):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::pixelSnappedLogicalLeftOffsetForLine): Correcting to use the
+        pixel snapped methods on FloatingObjects and removing the fixme.
+        (WebCore::RenderBlock::pixelSnappedLogicalTopForFloat): Ditto.
+        (WebCore::RenderBlock::pixelSnappedLogicalBottomForFloat): Ditto.
+        (WebCore::RenderBlock::pixelSnappedLogicalLeftForFloat): Ditto.
+        (WebCore::RenderBlock::pixelSnappedLogicalRightForFloat): Ditto.
+        (WebCore::RenderBlock::pixelSnappedLogicalWidthForFloat): Ditto.
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::LineWidth::updateAvailableWidth):
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine): Using
+        pixelSnappedLogicalLeft/RightOffsetForLine convenience methods for line layout. When
+        we switch to sub-pixel positioning, we still pixel snap blocks before painting them,
+        but text is rendered using floats. We need to ensure the text is laid out using the
+        actual pixel width of the containing block to avoid bleeding out of the block.
+        * rendering/RenderBoxModelObject.h: Moving the fixme to pixelSnappedWidth/Height and
+        adding the necessary rounding for Left/Top.
+        (WebCore::RenderBoxModelObject::pixelSnappedOffsetLeft):
+        (WebCore::RenderBoxModelObject::pixelSnappedOffsetTop):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollRectToVisible):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::scrollHeight): Rounding the height for scrollHeight. Scrolling
+        always uses rounded values.
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::localToParentTransform): Similar to the line box tree, since
+        SVG renders using floats, we need to start with pixel snapped values from the render
+        tree or we'll end up with the contents not properly aligned to the rest of the page.
+        * rendering/svg/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::prepareToRenderSVGContent):
+
+2012-03-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Web Inspector: arrays in object properties sections do not scale.
+        https://bugs.webkit.org/show_bug.cgi?id=64596
+
+        Reviewed by Vsevolod Vlasov.
+
+        Test: inspector/console/console-big-array.html
+
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype._formatParameterAsArray):
+        (WebInspector.ConsoleMessageImpl.prototype._printArray):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection.prototype.updateProperties):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate.callback):
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate):
+        (WebInspector.ObjectPropertyTreeElement.prototype.startEditing):
+        (WebInspector.ArrayGroupingTreeElement):
+        (WebInspector.ArrayGroupingTreeElement.populateAsArray):
+        (WebInspector.ArrayGroupingTreeElement._populate.appendElement):
+        (WebInspector.ArrayGroupingTreeElement._populate):
+        (WebInspector.ArrayGroupingTreeElement.prototype.onpopulate):
+        * inspector/front-end/RemoteObject.js:
+        (WebInspector.RemoteObject.prototype.release):
+        (WebInspector.RemoteObject.prototype.arrayLength):
+        (WebInspector.LocalJSONObject.prototype.isError):
+        (WebInspector.LocalJSONObject.prototype.arrayLength):
+        * inspector/front-end/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeVariableTreeElement.prototype.get propertyPath):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype._mouseDown):
+        * inspector/front-end/inspector.css:
+        (.console-formatted-object, .console-formatted-node, .console-formatted-array):
+        (.console-formatted-object .section, .console-formatted-node .section, .console-formatted-array .section):
+
+2012-03-01  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed, rolling out r109336.
+        http://trac.webkit.org/changeset/109336
+        https://bugs.webkit.org/show_bug.cgi?id=80013
+
+        It's causing some crashes
+
+        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
+        (WebCore::DOMWindowIndexedDatabase::DOMWindowIndexedDatabase):
+        (WebCore::DOMWindowIndexedDatabase::webkitIndexedDB):
+        * Modules/indexeddb/DOMWindowIndexedDatabase.h:
+        (DOMWindowIndexedDatabase):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::clear):
+        (WebCore):
+        (WebCore::DOMWindow::setIDBFactory):
+        * page/DOMWindow.h:
+        (DOMWindow):
+        (WebCore::DOMWindow::idbFactory):
+
+2012-03-01  Tom Sepez  <tsepez@chromium.org>
+
+        Move m_frame protector from FrameLoader::changeLocation to FrameLoader::urlSelected
+        https://bugs.webkit.org/show_bug.cgi?id=79882
+
+        Reviewed by Adam Barth.
+
+        Test: fast/frames/url-selected-crash.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected):
+
+2012-03-01  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Lazily allocate overflow: hidden layers if we have overflowing content
+        https://bugs.webkit.org/show_bug.cgi?id=75568
+
+        Reviewed by David Hyatt.
+
+        Change covered by the existing tests and the tons of rebaselines.
+
+        This change makes us lazily allocate our RenderLayer for overflow: hidden layers only.
+
+        Apart from saving some memory, it will also speed up the rendering as we don't need to
+        go through the layer's machinery when painting and hit testing.
+
+        On http://dglazkov.github.com/performance-tests/biggrid.html benchmark, this puts the
+        overflow: hidden case in par with the overflow: visible case when scrolling that is a
+        very-smooth scrolling vs a jerky one currently (mostly due to the painting speedup).
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateScrollInfoAfterLayout):
+        Changed this method to update our size cache if needed.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::isPointInOverflowControl):
+        * rendering/RenderBlock.h:
+        (RenderBlock):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+        (WebCore::RenderBox::scrollLeft):
+        (WebCore::RenderBox::scrollTop):
+        (WebCore::RenderBox::setScrollLeft):
+        (WebCore::RenderBox::setScrollTop):
+        (WebCore::RenderBox::includeVerticalScrollbarSize):
+        (WebCore::RenderBox::includeHorizontalScrollbarSize):
+        (WebCore::RenderBox::pushContentsClip):
+        (WebCore::RenderBox::popContentsClip):
+        (WebCore::RenderBox::addLayoutOverflow):
+        Added layer() check to the previous call sites.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::ensureLayer):
+        Added this function to create and add a new layer.
+
+        (WebCore::RenderBoxModelObject::willBeDestroyed):
+        (WebCore):
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        Patched those method to handle updating / removing
+        cached size entries.
+
+        (WebCore::cachedSizeForOverflowClipMap):
+        (WebCore::RenderBoxModelObject::cachedSizeForOverflowClip):
+        (WebCore::RenderBoxModelObject::updateCachedSizeForOverflowClip):
+        (WebCore::RenderBoxModelObject::clearCachedSizeForOverflowClip):
+        This logic stores the size information for later repainting.
+        It is in practice replicating what RenderLayer is doing.
+
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::requiresLayer):
+        Updated to call requiresLayerForOverflowClip.
+
+        (WebCore::RenderBoxModelObject::requiresLayerForOverflowClip):
+        Added this method to check if we can lazily allocate the layer.
+
+        * rendering/RenderDeprecatedFlexibleBox.cpp:
+        (WebCore::RenderDeprecatedFlexibleBox::layoutBlock):
+        Removed some checks as they are part of updateScrollInfoAfterLayout.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::scrolledContentOffset):
+        Added a layer() check.
+
+        * rendering/RenderTableRow.h:
+        (RenderTableRow):
+        Added a comment about why we need a layout for table rows.
+
+2012-03-01  Abhishek Arya  <inferno@chromium.org>
+
+        Protect functions using two container node function, each of which can fire mutation events.
+        https://bugs.webkit.org/show_bug.cgi?id=78397
+
+        Reviewed by Ryosuke Niwa.
+
+        Tests: fast/dom/document-set-title-mutation-crash.html
+               fast/dom/option-text-mutation-crash.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::setTextContent):
+        * dom/Text.cpp:
+        (WebCore::Text::replaceWholeText):
+        * editing/markup.cpp:
+        (WebCore::trimFragment):
+        (WebCore::replaceChildrenWithFragment):
+        (WebCore::replaceChildrenWithText):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::setText):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::setText):
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::insertRow):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setDefaultValue):
+        * html/HTMLTitleElement.cpp:
+        (WebCore::HTMLTitleElement::setText):
+
+2012-03-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Some trivial file stream cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=79955
+
+        Reviewed by Sam Weinig.
+
+        No change in functionality.
+
+        * fileapi/FileStreamProxy.cpp: Tweaked comment, and added copyright for earlier changes.
+
+        * fileapi/FileStreamProxy.h: Added a FIXME telling that this should be in platform.
+
+        * platform/AsyncFileStream.h: Tweaked includes and added a FIXME about this to stop being
+        a subclass.
+
+        * platform/FileStreamClient.h: Removed obvious comments, and added ones explaing in-band
+        error signals.
+
+        * platform/network/BlobResourceHandle.cpp: Removed an include outside of platform, and an
+        unused constant.
+
+2012-03-01  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Appending ShadowRoot into an element should not cause crash.
+        https://bugs.webkit.org/show_bug.cgi?id=79620
+
+        Reviewed by Dimitri Glazkov.
+
+        We should treat ShadowRoot as a document fragment.
+
+        Test: fast/dom/shadow/shadow-root-append.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::collectTargetNodes):
+
+2012-03-01  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: use live location to update console message bubbles.
+        https://bugs.webkit.org/show_bug.cgi?id=80023
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel):
+        (WebInspector.DebuggerPresentationModel.prototype._uiSourceCodeListChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._consoleMessageAdded):
+        (WebInspector.DebuggerPresentationModel.prototype._addConsoleMessageToScript.updateLocation):
+        (WebInspector.DebuggerPresentationModel.prototype._addConsoleMessageToScript):
+        (WebInspector.DebuggerPresentationModel.prototype._addPendingConsoleMessage):
+        (WebInspector.DebuggerPresentationModel.prototype._addPendingConsoleMessagesToScript):
+        (WebInspector.DebuggerPresentationModel.prototype._consoleCleared):
+        (WebInspector.DebuggerPresentationModel.prototype.messagesForUISourceCode):
+        (WebInspector.DebuggerPresentationModel.prototype._scriptForURLAndLocation):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerReset):
+        * inspector/front-end/RawSourceCode.js:
+        (WebInspector.RawSourceCode):
+
+2012-03-01  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [InspectorIndexedDB] Show tooltips with IndexedDB objects meta information
+        https://bugs.webkit.org/show_bug.cgi?id=80022
+
+        Reviewed by Pavel Feldman.
+
+        Added tooltips with meta information for IndexedDB databases, object stores and indexes.
+        Added keyPath: prefix to key columns in IndexedDB data grid.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/IndexedDBViews.js:
+        (WebInspector.IDBDataView.prototype._createDataGrid):
+        (WebInspector.IDBDataView.prototype._keyPathHeader):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.IDBDatabaseTreeElement.prototype.update):
+        (WebInspector.IDBDatabaseTreeElement.prototype._updateTooltip):
+        (WebInspector.IDBObjectStoreTreeElement.prototype.update):
+        (WebInspector.IDBObjectStoreTreeElement.prototype._updateTooltip):
+        (WebInspector.IDBIndexTreeElement.prototype.update):
+        (WebInspector.IDBIndexTreeElement.prototype._updateTooltip):
+
+2012-03-01  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: hide color picker on Esc and Enter.
+        https://bugs.webkit.org/show_bug.cgi?id=79915
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/Spectrum.js:
+        (WebInspector.Spectrum.prototype.reposition):
+        (WebInspector.Spectrum.prototype.hide):
+        (WebInspector.Spectrum.prototype._onKeyDown):
+
+2012-03-01  Huang Dongsung  <luxtella@company100.net>
+
+        [Qt] Fixed incorrect size pixmap creation for a new transparency layer.
+        https://bugs.webkit.org/show_bug.cgi?id=79658
+
+        If QPainter does not have clipping, beginPlatformTransparencyLayer can create
+        wrong size pixmap, so it causes incorrect rendering.
+
+        Reviewed by Simon Hausmann.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::beginPlatformTransparencyLayer):
+
+2012-03-01  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        [Qt] Remove dead style option code.
+        https://bugs.webkit.org/show_bug.cgi?id=80017
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        QtStyleOptionWebComboBox provides functionality (bool multiple()) that
+        is not called from anywhere (and the base class does not have it as a
+        virtual function).
+
+        * Target.pri:
+        * platform/qt/QtStyleOptionWebComboBox.h: Removed.
+        * platform/qt/RenderThemeQStyle.cpp:
+        (WebCore::RenderThemeQStyle::paintMenuList):
+        (WebCore::RenderThemeQStyle::paintMenuListButton):
+
+2012-03-01  Stephen Chenney  <schenney@chromium.org>
+
+        Crash in WebCore::SVGDocumentExtensions::removeAnimationElementFromTarget
+        https://bugs.webkit.org/show_bug.cgi?id=79831
+
+        Reviewed by Eric Seidel.
+
+        Out-of-order operations in the SVGSMILElement::removedFromDocument
+        method caused its target to be removed and then re-added due to a
+        later call. This led to the target being set on the animation while
+        the target element itself was unaware. At deletion time, this caused a
+        crash (or assert in debug builds). Thanks to Abhishek Arya for help
+        with the layout test.
+
+        Test: svg/animations/smil-element-target-crash-main.html
+
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::removedFromDocument):
+
+2012-03-01  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: move heap snapshot nodes data to external array.
+        https://bugs.webkit.org/show_bug.cgi?id=79911
+
+        Reviewed by Vsevolod Vlasov.
+
+        Tests:
+        heap-shapshot.html
+        heap-shapshot-loader.html
+
+        * inspector/front-end/HeapSnapshot.js:
+        (WebInspector.Int32Array):
+        (WebInspector.Int32Array.prototype.get array):
+        (WebInspector.HeapSnapshotLoader.prototype._parseNodes):
+        (WebInspector.HeapSnapshotLoader.prototype.pushJSONChunk):
+        (WebInspector.HeapSnapshot):
+        (WebInspector.HeapSnapshot.prototype._init):
+
+2012-03-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Introduce SMIL overrideStyle, to make SVG stop mutating CSS styles directly
+        https://bugs.webkit.org/show_bug.cgi?id=79790
+
+        Reviewed by Zoltan Herczeg.
+
+        Next step towards enabling animVal support for XML attribute animations.
+        When SVG CSS properties are animated using SMIL, we currently mutate
+        the target elements style, and have to keep a baseValue around as String
+        to be able to recover from the DOM mutations at the end, if fill!="freeze".
+
+        The approach required by SMIL is to keep around an override style declaration
+        set and apply it right after the inline style declarations. Implement that
+        finally, to avoid mutating styles directly.
+
+        Test: svg/animations/attributeTypes.html
+
+        * css/CSSStyleSelector.cpp: Model "SMIL animation style" applying just like "inline style" declarations.
+        (WebCore::CSSStyleSelector::addElementStyleProperties): Refactored common code from matchAllRules().
+        (WebCore::CSSStyleSelector::matchAllRules): Apply "SMIL animation style" after "inline style" declarations, as specified in SMIL2.
+        * css/CSSStyleSelector.h: Add new addElementStyleProperties() helper.
+        * svg/SVGAnimateElement.cpp: Keep track of animation state, if it's about to end, clear "SMIL animation style" upon next applyResultToTarget() call.
+        (WebCore::SVGAnimateElement::SVGAnimateElement):
+        (WebCore::SVGAnimateElement::applyResultsToTarget): Reset the CSS property we're animating int the "SMIL animation style", after animation ends.
+                                                            (Instead of resetting target->style() properties to the old baseValue, as we used to do).
+        (WebCore::SVGAnimateElement::endedActiveInterval): Set m_aboutToStopAnimation to true, so next call to applyResultsToTarget() knows the animation ends.
+        * svg/SVGAnimateElement.h: Store bool m_aboutToSTopAnimation;
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::setTargetAttributeAnimatedCSSValue):
+        (WebCore::setTargetAttributeAnimatedXMLValue):
+            Refactored both of these methods from setTargetAttributeAnimatedValue().
+            Changed the CSS part, to apply property changes to the "SMIL animation style" instead of the regular StylePropertySet.
+        (WebCore::SVGAnimationElement::setTargetAttributeAnimatedValue): Refactored code, use shouldApplyAnimation() to determine whether this animation should run.
+        (WebCore::SVGAnimationElement::resetAnimationState): New helper calling setTargetAttributeAnimatedValue with a null-string for CSS attributes, when the animation ends.
+                                                             This is used to detect that the CSS property should be removed from the "SMIL animation style".
+        (WebCore::SVGAnimationElement::shouldApplyAnimation): Refactored from existing code, and make it more obvious how attributeType influences the animation, all according to SVG 1.1/SMIL2.
+        * svg/SVGAnimationElement.h:
+        * svg/SVGElement.cpp: Manage the "SMIL animation style", in SVGElementRareData, if needed. Only gets created if SMIL animations on CSS properties run.
+        (WebCore::SVGElement::~SVGElement): Destroy SMIL animation style, upon destruction.
+        (WebCore::SVGElement::animatedSMILStyleProperties): Returns the StylePropertySet for the "SMIL animation style", if it's available.
+        (WebCore::SVGElement::ensureAnimatedSMILStyleProperties): Enforces creating the StylePropertySet for the "SMIL animation style".
+        * svg/SVGElement.h: Expose new methods.
+        * svg/SVGElementRareData.h: Stores the "SMIL animation style", actual managment is done by SVGElement, if needed.
+        (WebCore::SVGElementRareData::animatedSMILStyleProperties): Retrieve it.
+        (WebCore::SVGElementRareData::ensureAnimatedSMILStyleProperties): Create it.
+        (WebCore::SVGElementRareData::destroyAnimatedSMILStyleProperties): Destroy it.
+        * svg/animation/SVGSMILElement.h: Make endedActiveInterval() virtual again, its needed by SVGAnimateElement now.
+
+2012-03-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Unreviewed, rolling out r109255.
+        http://trac.webkit.org/changeset/109255
+        https://bugs.webkit.org/show_bug.cgi?id=79932
+
+        Breaks rounded rects with dashed strokes in SVG
+
+        * WebCore.exp.in:
+        * platform/graphics/Path.cpp:
+        (WebCore::Path::addRoundedRect):
+        * platform/graphics/Path.h:
+        (Path):
+        * platform/graphics/cg/PathCG.cpp:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2012-03-01  Adam Barth  <abarth@webkit.org>
+
+        DOMWindow shouldn't have any INDEXED_DATABASE ifdefs
+        https://bugs.webkit.org/show_bug.cgi?id=80013
+
+        Reviewed by Kentaro Hara.
+
+        Before this patch, DOMWindow still knew about IDB because of the
+        database factory.  This patch moves the factory to
+        DOMWindowIndexedDatabase.
+
+        * Modules/indexeddb/DOMWindowIndexedDatabase.cpp:
+        (WebCore::DOMWindowIndexedDatabase::DOMWindowIndexedDatabase):
+        (WebCore::DOMWindowIndexedDatabase::from):
+        (WebCore):
+        (WebCore::DOMWindowIndexedDatabase::disconnectFrame):
+        (WebCore::DOMWindowIndexedDatabase::webkitIndexedDB):
+        * Modules/indexeddb/DOMWindowIndexedDatabase.h:
+        (DOMWindowIndexedDatabase):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::~DOMWindow):
+        (WebCore::DOMWindow::clear):
+        (WebCore):
+        * page/DOMWindow.h:
+        (DOMWindow):
+
+2012-03-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        SVG <use> element allows invalid contents
+        https://bugs.webkit.org/show_bug.cgi?id=77764
+
+        Reviewed by Zoltan Herczeg.
+
+        Unbreak the world after r109299 - dozens of SVGUseElement tests fail in trunk because:
+        - text nodes weren't allowed in SVG shadow subtrees
+        - tagName matching ignores any prefixes, thus svg:circle fails to identify as SVGCircleElement
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::isDisallowedElement):
+
+2012-03-01  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertyWebkitHyphens in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=80004
+
+        Reviewed by Eric Seidel.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-02-29  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: abstract out the common pattern of creating auto-updated locations.
+        https://bugs.webkit.org/show_bug.cgi?id=79906
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.PresentationCallFrame.prototype.uiLocation):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard.prototype.discard):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard.prototype._update):
+        (WebInspector.DebuggerPresentationModel.LinkifierFormatter.prototype.formatRawSourceCodeAnchor):
+        (WebInspector.DebuggerPresentationModel.DefaultLinkifierFormatter.prototype.formatRawSourceCodeAnchor):
+        (WebInspector.DebuggerPresentationModel.Linkifier):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.linkifyRawSourceCode):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.reset):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype._updateAnchor):
+        * inspector/front-end/RawSourceCode.js:
+        (WebInspector.RawSourceCode.prototype.createLiveLocation):
+        (WebInspector.RawSourceCode.LiveLocation):
+        (WebInspector.RawSourceCode.LiveLocation.prototype.init):
+        (WebInspector.RawSourceCode.LiveLocation.prototype.dispose):
+        (WebInspector.RawSourceCode.LiveLocation.prototype._update):
+
+2012-03-01  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Make the tiling code slightly smarter
+        https://bugs.webkit.org/show_bug.cgi?id=80015
+
+        Reviewed by Simon Hausmann.
+
+        Avoid doing the same tranformations all over in each call to
+        tileRectForCoordinate.
+
+        Do not resize tiles and then drop them because they are not out of
+        the keep rect; instead drop before resizing.
+
+        Rename dropTilesOutsideRect to setKeepRect as it now stored the keep
+        rect. This is used to avoid unneeded iteration of all tiles for
+        invalidates outside the keep rect.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::invalidate):
+        (WebCore):
+        (WebCore::TiledBackingStore::commitScaleChange):
+        (WebCore::TiledBackingStore::coverageRatio):
+        (WebCore::TiledBackingStore::createTiles):
+        (WebCore::TiledBackingStore::adjustForContentsRect):
+        (WebCore::TiledBackingStore::resizeEdgeTiles):
+        (WebCore::TiledBackingStore::setKeepRect):
+        (WebCore::TiledBackingStore::removeAllNonVisibleTiles):
+        (WebCore::TiledBackingStore::tileRectForCoordinate):
+        (WebCore::TiledBackingStore::setSupportsAlpha):
+        * platform/graphics/TiledBackingStore.h:
+        (TiledBackingStore):
+
+2012-02-29  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Use the new createSnapshotFileAndReadMetadata API for FileEntry.file()
+        https://bugs.webkit.org/show_bug.cgi?id=79928
+
+        Reviewed by David Levin.
+
+        No new tests: no functionality changes.
+        fast/filesystem/ tests should use the new code (they should pass once
+        the corresponding chromium change is rolled in).
+
+        * fileapi/DOMFileSystem.cpp:
+        (WebCore::DOMFileSystem::createFile): Updated to use the new API.
+        * fileapi/DOMFileSystemSync.cpp:
+        (WebCore::DOMFileSystemSync::createFile): Updated to use the new API.
+        * fileapi/FileSystemCallbacks.cpp:
+        * fileapi/FileSystemCallbacks.h:
+        (FileSystemCallbacksBase):
+        * platform/AsyncFileSystem.h:
+        (AsyncFileSystem):
+        * platform/AsyncFileSystemCallbacks.h: Added default implementation (which just calls ASSERT_NOTREACHED()) so that subclasses can focus only on the callback methods that they're interested in.
+
+2012-02-29  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: add UISourceCode.isEditable property.
+        https://bugs.webkit.org/show_bug.cgi?id=79909
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.canEditScriptSource):
+        * inspector/front-end/RawSourceCode.js:
+        (WebInspector.RawSourceCode.prototype._createUISourceCode):
+        * inspector/front-end/UISourceCode.js:
+        (WebInspector.UISourceCode):
+
+2012-02-29  Shinya Kawanaka  <shinyak@chromium.org> 
+
+        Fallback elements in non-youngest shadow tree should not be rendered.
+        https://bugs.webkit.org/show_bug.cgi?id=80002
+
+        Reviewed by Hajime Morita.
+
+        Fallback elements in non-youngest shadow tree should not be rendered, so its phase should be
+        AttachingNotDistributed instead of AttachingFallbacked.
+
+        Tests: multiple-shadowroot-rendering.html covers this patch.
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+
+2012-02-29  Adam Barth  <abarth@webkit.org>
+
+        ScriptExecutionContext has too many ifdef ENABLE(SQL_DATABASE)
+        https://bugs.webkit.org/show_bug.cgi?id=79633
+
+        Reviewed by Eric Seidel.
+
+        This class creates a DatabaseContext object to supplement the
+        ScriptExecutionContext with database-specific information.  This new
+        object lets us remove a bunch of database-specific (and ifdefed) logic
+        from ScriptExecutionContext.(cpp|h).
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::ScriptExecutionContext):
+        (WebCore::ScriptExecutionContext::~ScriptExecutionContext):
+        (WebCore):
+        * dom/ScriptExecutionContext.h:
+        (WebCore):
+        (ScriptExecutionContext):
+        * history/PageCache.cpp:
+        (WebCore::logCanCacheFrameDecision):
+        (WebCore::PageCache::canCachePageContainingThisFrame):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        * platform/Supplementable.h:
+        (WebCore::Supplementable::provideSupplement):
+        (WebCore::Supplementable::requireSupplement):
+        (Supplementable):
+        * storage/AbstractDatabase.cpp:
+        (WebCore::AbstractDatabase::AbstractDatabase):
+        * storage/AbstractDatabase.h:
+        (WebCore):
+        (WebCore::AbstractDatabase::databaseContext):
+        (AbstractDatabase):
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::openAndVerifyVersion):
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::Database::close):
+        (WebCore::Database::closeImmediately):
+        (WebCore::Database::performOpenAndVerify):
+        (WebCore::Database::scheduleTransaction):
+        (WebCore::Database::scheduleTransactionStep):
+        (WebCore::Database::transactionClient):
+        (WebCore::Database::transactionCoordinator):
+        (WebCore::Database::tableNames):
+        (WebCore::Database::securityOrigin):
+        * storage/DatabaseContext.cpp: Added.
+        (WebCore):
+        (WebCore::existingDatabaseContextFrom):
+        (WebCore::DatabaseContext::DatabaseContext):
+        (WebCore::DatabaseContext::~DatabaseContext):
+        (WebCore::DatabaseContext::from):
+        (WebCore::DatabaseContext::databaseThread):
+        (WebCore::DatabaseContext::hasOpenDatabases):
+        (WebCore::DatabaseContext::stopDatabases):
+        * storage/DatabaseContext.h: Added.
+        (WebCore):
+        (DatabaseContext):
+        (WebCore::DatabaseContext::setHasOpenDatabases):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::checkAndHandleClosedOrInterruptedDatabase):
+        (WebCore::SQLTransaction::notifyDatabaseThreadIsShuttingDown):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadShutdownStartTask::performTask):
+
+2012-02-29  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Refactoring: HTMLContentSelector should be InsertionPoint-aware.
+        https://bugs.webkit.org/show_bug.cgi?id=79901
+
+        Reviewed by Hajime Morita.
+
+        ContentSelectorQuery took HTMLContentElement as argument, but patch changes it to take InsertionPoint instead.
+        If InsertionPoint is not HTMLContentElement, ContentSelectorQuery will selects the rest of light children.
+
+        Now InsertionPoint has pure virtual method 'select'. <shadow> will implement this as a method returning empty string.
+
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::hasInsertionPoint):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        * dom/ShadowTree.cpp:
+        (WebCore::ShadowTree::needsReattachHostChildrenAndShadow):
+        (WebCore::ShadowTree::hostChildrenChanged):
+        * html/shadow/ContentSelectorQuery.cpp:
+        (WebCore::ContentSelectorQuery::ContentSelectorQuery):
+        (WebCore::ContentSelectorQuery::matches):
+        * html/shadow/ContentSelectorQuery.h:
+        (WebCore):
+        (ContentSelectorQuery):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::detach):
+        * html/shadow/HTMLContentElement.h:
+        (WebCore::toHTMLContentElement):
+        (WebCore):
+        * html/shadow/HTMLContentSelector.cpp:
+        (WebCore::HTMLContentSelector::select):
+        * html/shadow/HTMLContentSelector.h:
+        (HTMLContentSelector):
+        * html/shadow/InsertionPoint.h:
+        (InsertionPoint):
+
+2012-02-29  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertySpeak in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=79879
+
+        Reviewed by Eric Seidel.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * rendering/style/RenderStyle.h:
+
+2012-02-29  Luke Macpherson   <macpherson@chromium.org>
+
+        Handle CSSPropertyWebkitColumnAxis in CSSStyleApplyProperty.
+        https://bugs.webkit.org/show_bug.cgi?id=79869
+
+        Reviewed by Eric Seidel.
+
+        No new tests / refactoring only.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-02-29  Erik Arvidsson  <arv@chromium.org>
+
+        Rename DOMSelection to Selection
+        https://bugs.webkit.org/show_bug.cgi?id=79688
+
+        Reviewed by Adam Barth.
+
+        No new tests. Existing tests have been updated to cover this.
+
+        * page/DOMSelection.idl:
+        * page/DOMWindow.idl:
+
+2012-02-29  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: IDBDatabase.objectStoreNames and IDObjectStore.indexNames results should be sorted
+        https://bugs.webkit.org/show_bug.cgi?id=79950
+
+        Reviewed by Tony Chang.
+
+        Test: storage/indexeddb/list-ordering.html
+
+        * dom/DOMStringList.cpp: Added sort method, not exposed via IDL.
+        (WebCore::DOMStringList::sort):
+        (WebCore):
+        * dom/DOMStringList.h:
+        (DOMStringList):
+        * storage/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::objectStoreNames):
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::indexNames):
+
+2012-02-29  W. James MacLean  <wjmaclean@chromium.org>
+
+        [chromium] Estimate pixel count for frame rate control
+        https://bugs.webkit.org/show_bug.cgi?id=74982
+
+        Reviewed by James Robinson.
+
+        Value checks added to unit tests.
+
+        Adds mechanism to compute and collect statistics on pixel overdraw for selected frames.
+
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::optimizeRenderPasses):
+        * platform/graphics/chromium/cc/CCQuadCuller.cpp:
+        (WebCore::wedgeProduct):
+        (WebCore):
+        (WebCore::quadArea):
+        (WebCore::CCQuadCuller::cullOccludedQuads):
+        * platform/graphics/chromium/cc/CCQuadCuller.h:
+        (CCQuadCuller):
+        * platform/graphics/chromium/cc/CCRenderPass.cpp:
+        (WebCore::CCRenderPass::optimizeQuads):
+        * platform/graphics/chromium/cc/CCRenderPass.h:
+        (CCOverdrawCounts):
+        (WebCore):
+        (CCRenderPass):
+
+2012-02-29  Jason Liu  <jason.liu@torchmobile.com.cn>
+
+        [BlackBerry]Make about:cache feature available in release version.
+        https://bugs.webkit.org/show_bug.cgi?id=79866
+
+        Reviewed by Antonio Gomes.
+
+        No tests.
+        * platform/network/blackberry/NetworkJob.cpp:
+        (WebCore::NetworkJob::handleAbout):
+
+2012-02-29  James Simonsen  <simonjam@chromium.org>
+
+        [chromium] Fix navigation start time on cross-renderer navigation
+        https://bugs.webkit.org/show_bug.cgi?id=75922
+
+        Reviewed by Darin Fisher.
+
+        * loader/DocumentLoadTiming.cpp:
+        (WebCore::DocumentLoadTiming::setNavigationStart): Added.
+        * loader/DocumentLoadTiming.h:
+
+2012-02-29  Stephen Chenney  <schenney@chromium.org>
+
+        SVG <use> element allows invalid contents
+        https://bugs.webkit.org/show_bug.cgi?id=77764
+
+        Reviewed by Nikolas Zimmermann.
+
+        Modify the isDisallowedElement method to disallow all of the
+        disallowed elements, instead of just a few. It is now a whitelist
+        implementation.
+
+        This also fixes bugs 78807, 78838 and 79798 related to memory
+        corruption issues.
+
+        Tests: svg/custom/bug78807.svg
+               svg/custom/bug78838.html
+               svg/custom/bug79798.html
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::isDisallowedElement):
+
+2012-02-29  Ami Fischman  <fischman@chromium.org>
+
+        Continue the search for playable mime types among <source> children of <video> even when using data: URLs
+        https://bugs.webkit.org/show_bug.cgi?id=79934
+
+        Reviewed by Eric Carlson.
+
+        Test: media/sources-fallback-codecs.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectNextSourceChild):
+
+2012-02-29  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Add impl-thread support for animation-timing-function
+        https://bugs.webkit.org/show_bug.cgi?id=79819
+
+        Reviewed by James Robinson.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp:
+        (WebCore::CCKeyframe::CCKeyframe):
+        (WebCore):
+        (WebCore::CCKeyframe::~CCKeyframe):
+        (WebCore::CCKeyframe::time):
+        (WebCore::CCKeyframe::timingFunction):
+        (WebCore::CCFloatKeyframe::create):
+        (WebCore::CCFloatKeyframe::CCFloatKeyframe):
+        (WebCore::CCFloatKeyframe::~CCFloatKeyframe):
+        (WebCore::CCFloatKeyframe::value):
+        (WebCore::CCFloatKeyframe::clone):
+        (WebCore::CCTransformKeyframe::create):
+        (WebCore::CCTransformKeyframe::CCTransformKeyframe):
+        (WebCore::CCTransformKeyframe::~CCTransformKeyframe):
+        (WebCore::CCTransformKeyframe::value):
+        (WebCore::CCTransformKeyframe::clone):
+        (WebCore::CCKeyframedFloatAnimationCurve::create):
+        (WebCore::CCKeyframedFloatAnimationCurve::CCKeyframedFloatAnimationCurve):
+        (WebCore::CCKeyframedFloatAnimationCurve::addKeyframe):
+        (WebCore::CCKeyframedFloatAnimationCurve::duration):
+        (WebCore::CCKeyframedFloatAnimationCurve::clone):
+        (WebCore::CCKeyframedFloatAnimationCurve::getValue):
+        (WebCore::CCKeyframedTransformAnimationCurve::create):
+        (WebCore::CCKeyframedTransformAnimationCurve::CCKeyframedTransformAnimationCurve):
+        (WebCore::CCKeyframedTransformAnimationCurve::~CCKeyframedTransformAnimationCurve):
+        (WebCore::CCKeyframedTransformAnimationCurve::addKeyframe):
+        (WebCore::CCKeyframedTransformAnimationCurve::duration):
+        (WebCore::CCKeyframedTransformAnimationCurve::clone):
+        (WebCore::CCKeyframedTransformAnimationCurve::getValue):
+        * platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h:
+        (CCKeyframe):
+        (CCFloatKeyframe):
+        (WebCore):
+        (CCTransformKeyframe):
+        (CCKeyframedFloatAnimationCurve):
+        (CCKeyframedTransformAnimationCurve):
+        * platform/graphics/chromium/cc/CCLayerAnimationController.cpp:
+        * platform/graphics/chromium/cc/CCTimingFunction.cpp: Added.
+        (WebCore):
+        (WebCore::CCTimingFunction::CCTimingFunction):
+        (WebCore::CCTimingFunction::~CCTimingFunction):
+        (WebCore::CCTimingFunction::duration):
+        (WebCore::CCCubicBezierTimingFunction::create):
+        (WebCore::CCCubicBezierTimingFunction::CCCubicBezierTimingFunction):
+        (WebCore::CCCubicBezierTimingFunction::~CCCubicBezierTimingFunction):
+        (WebCore::CCCubicBezierTimingFunction::getValue):
+        (WebCore::CCCubicBezierTimingFunction::clone):
+        (WebCore::CCEaseTimingFunction::create):
+        (WebCore::CCEaseInTimingFunction::create):
+        (WebCore::CCEaseOutTimingFunction::create):
+        (WebCore::CCEaseInOutTimingFunction::create):
+        * platform/graphics/chromium/cc/CCTimingFunction.h: Added.
+        (WebCore):
+        (CCTimingFunction):
+        (CCCubicBezierTimingFunction):
+        (CCEaseTimingFunction):
+        (CCEaseInTimingFunction):
+        (CCEaseOutTimingFunction):
+        (CCEaseInOutTimingFunction):
+
+2012-02-29  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Methods in ShadowTree and TreeScopeAdopter should be multiple shadow roots aware.
+        https://bugs.webkit.org/show_bug.cgi?id=79768
+
+        Reviewed by Hajime Morita.
+
+        Some methods in ShadowTree and TreeScopeAdopter were not multiple shadow roots aware.
+        They should consider multiple shadow roots.
+
+        Test: fast/dom/shadow/multiple-shadowroot-adopt.html
+
+        * dom/ShadowTree.cpp:
+        (WebCore::ShadowTree::setParentTreeScope):
+        (WebCore):
+        (WebCore::ShadowTree::childNeedsStyleRecalc):
+        (WebCore::ShadowTree::needsStyleRecalc):
+        * dom/ShadowTree.h:
+        (WebCore):
+        (ShadowTree):
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::shadowTreeFor):
+        (WebCore::TreeScopeAdopter::moveTreeToNewScope):
+        (WebCore::TreeScopeAdopter::moveTreeToNewDocument):
+        (WebCore::TreeScopeAdopter::moveShadowTreeToNewDocument):
+        (WebCore):
+        * dom/TreeScopeAdopter.h:
+        (TreeScopeAdopter):
+
+2012-02-29  David Levin  <levin@chromium.org>
+
+        [chromium] Add the ability to turn off autoresize.
+        https://bugs.webkit.org/show_bug.cgi?id=77452
+
+        Reviewed by Darin Fisher.
+
+        Test: fast/autoresize/turn-off-autoresize.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::enableAutoSizeMode): Fix the code
+        path for turning off autoresize to set the scrollbars to auto.
+
+2012-02-29  David Barton  <dbarton@mathscribe.com>
+
+        <msubsup> setNeedsLayout() correction
+        https://bugs.webkit.org/show_bug.cgi?id=79856
+
+        Reviewed by Julien Chaffraix.
+
+        m_scripts->setNeedsLayout(true, false); needs to be added to the fix for bug 79274.
+
+        No new tests. It's actually difficult to test the need for this with the current code,
+        because there are a lot of extra setNeedsLayout() calls right now. I caught this after
+        removing some of those calls that should be redundant, for a future patch. Actually
+        removing those calls now changes other behavior, due to other bugs, so I'll save all
+        that for future patches. We should land this fix now though I think, as it could
+        possibly matter in some cases.
+
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::layout):
+
+2012-02-29  Andreas Kling  <awesomekling@apple.com>
+
+        IsSynchronizingStyleAttributeFlag could be purged.
+        <http://webkit.org/b/79313>
+
+        Reviewed by Anders Carlsson.
+
+        We were using IsSynchronizingStyleAttributeFlag to prevent various things from
+        happening below setAttribute() when serializing the "style" attribute based on
+        an element's inline style.
+
+        Simplify the whole thing by adding a way to set an attribute without triggering
+        any callbacks (a 'notifyChanged' argument to Element::setAttribute().)
+        This removes the need for IsSynchronizingStyleAttributeFlag in the first place
+        and makes StyledElement::updateStyleAttribute() a bit cheaper to boot.
+
+        * dom/Element.cpp:
+        (WebCore::Element::setAttribute):
+        (WebCore::Element::setAttributeInternal):
+        (WebCore::Element::willModifyAttribute):
+        (WebCore::Element::didModifyAttribute):
+        (WebCore::Element::didRemoveAttribute):
+        * dom/Element.h:
+        * dom/Node.h:
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::updateStyleAttribute):
+        (WebCore::StyledElement::attributeChanged):
+        * html/HTMLElement.cpp:
+        (WebCore::StyledElement::copyNonAttributeProperties):
+
+2012-02-29  Daniel Cheng  <dcheng@chromium.org>
+
+        [chromium] REGRESSION: Cannot drag a file out
+        https://bugs.webkit.org/show_bug.cgi?id=79817
+
+        Reviewed by Ryosuke Niwa.
+
+        Temporary fix for file drag out. This change won't be needed once DataTransferItemList
+        support is better implemented.
+
+        Test: platform/chromium/fast/events/drag-downloadURL.html
+
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::types):
+
+2012-02-29  Luke Macpherson   <macpherson@chromium.org>
+
+        Clean up CSSPrimitiveValue::computeLengthDouble().
+        https://bugs.webkit.org/show_bug.cgi?id=77065
+
+        Reviewed by Eric Seidel.
+
+        Refactoring only / no behavioral change.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::computeLengthDouble):
+
+2012-02-29  Beth Dakin  <bdakin@apple.com>
+
+        Speculative build-fix.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+
+2012-02-29  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=79705
+        didNewFirstVisuallyNonEmptyLayout should be enhanced to look at size instead 
+        of a raw tally
+        -and corresponding-
+        <rdar://problem/10821314>
+
+        Reviewed by Dave Hyatt.
+
+        Instead of firing didNewFirstVisuallyNonEmptyLayout() when a raw tally of 
+        relevant painted objects has reached a port-defined threshold, this patch 
+        looks at the size of those objects with respect to the view area. The patch 
+        also looks at relevant objects that cannot yet be fully painted, such as 
+        incrementally loading images. 
+
+        We no longer need a HashSet for the relevant painted objects since Region can 
+        do all of the heavy lifting. We now have a Region for the painted and 
+        unpainted regions. We do need a HashSet for the unpainted objects though, 
+        because we need to know if a painted object needs to be subtracted from the 
+        unpainted region before being added to the painted region.
+        * page/Page.cpp:
+        (WebCore):
+        (WebCore::Page::isCountingRelevantRepaintedObjects):
+        (WebCore::Page::startCountingRelevantRepaintedObjects):
+        (WebCore::Page::resetRelevantPaintedObjectCounter):
+        (WebCore::Page::addRelevantRepaintedObject):
+        (WebCore::Page::addRelevantUnpaintedObject):
+        * page/Page.h:
+        (Page):
+
+        New function on Region iterates through the rects and calculates the total 
+        area.
+        * platform/graphics/Region.cpp:
+        (WebCore::Region::totalArea):
+        (WebCore):
+        * platform/graphics/Region.h:
+        (Region):
+
+        Remove code from these classes since they are not actually relevant objects.
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::paint):
+        * rendering/RenderRegion.cpp:
+        (WebCore::RenderRegion::paintReplaced):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+
+        All of these other callers send a rect that actually represents their size 
+        (usually the visualOverflowRect) instead of the paintInfo's paintRect, and 
+        they call addRelevantUnpaintedObject when appropriate.
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::paint):
+        (WebCore::RenderEmbeddedObject::paintReplaced):
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::paintReplaced):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::paintReplaced):
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paintReplaced):
+
+2012-02-29  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: Resource leak with IDBObjectStore.openCursor
+        https://bugs.webkit.org/show_bug.cgi?id=79835
+
+        IDBCursor object that were never continue()'d to the end would leak due to a 
+        reference cycle with IDBRequest. In addition, the IDBRequest would never be
+        marked "finished" which would prevent GC from reclaiming it. IDBTransactions
+        now track and notify IDBCursors to break these references when the transaction
+        can no longer not process requests.
+
+        Reviewed by Tony Chang.
+
+        Tests: storage/indexeddb/cursor-continue.html
+
+        * storage/IDBCursor.cpp:
+        (WebCore::IDBCursor::IDBCursor): Register with IDBTransaction bookkeeping.
+        (WebCore::IDBCursor::continueFunction): Early error if transaction has finished.
+        (WebCore::IDBCursor::close): Break the reference cycle with IDBRequest, and notify it
+        that the cursor is finished.
+        (WebCore):
+        * storage/IDBCursor.h:
+        (WebCore):
+        (IDBCursor):
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::IDBRequest):
+        (WebCore::IDBRequest::finishCursor): If there is no request in flight, mark itself as
+        finished to allow GC.
+        (WebCore):
+        (WebCore::IDBRequest::dispatchEvent): Once an in-flight request has been processed,
+        mark the request as finished if the cursor is finished, to allow GC.
+        * storage/IDBRequest.h:
+        (IDBRequest):
+        * storage/IDBTransaction.cpp: Track open cursors, close them when finished.
+        (WebCore::IDBTransaction::OpenCursorNotifier::OpenCursorNotifier):
+        (WebCore):
+        (WebCore::IDBTransaction::OpenCursorNotifier::~OpenCursorNotifier):
+        (WebCore::IDBTransaction::registerOpenCursor):
+        (WebCore::IDBTransaction::unregisterOpenCursor):
+        (WebCore::IDBTransaction::closeOpenCursors):
+        (WebCore::IDBTransaction::onAbort):
+        (WebCore::IDBTransaction::onComplete):
+        * storage/IDBTransaction.h:
+        (WebCore):
+        (OpenCursorNotifier):
+        (IDBTransaction):
+
+2012-02-29  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=79940
+        <rdar://problem/10080189>
+        
+        Add support in WebKit for an intra-line character grid for Japanese text layout.
+        
+        Patch logicalLeftOffsetForLine and logicalRightOffsetForLine in order to get the
+        basic edge snapping grid functionality up and running. See all the FIXMEs in the function for
+        some of the issues that still have to be dealt with for it to really work well.
+
+        Reviewed by Dan Bernstein.
+
+        Added new tests in fast/line-grid.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+
+2012-02-29  Anders Carlsson  <andersca@apple.com>
+
+        [Chromium] Some Layout Tests in platform/chromium/rubberbanding and platform/chromium/compositing/rubberbanding are failing
+        https://bugs.webkit.org/show_bug.cgi?id=79878
+
+        Reviewed by James Robinson.
+
+        Make sure that ScrollableArea::setScrollOffsetFromAnimation doesn't end up
+        setting the ScrollAnimator's current scroll position by making a new function, scrollPositionChanged,
+        that both notifyScrollPositionChanged and setScrollOffsetFromAnimation call and move the call to update
+        the position to notifyScrollPositionChanged.
+
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::notifyScrollPositionChanged):
+        (WebCore):
+        (WebCore::ScrollableArea::scrollPositionChanged):
+        (WebCore::ScrollableArea::setScrollOffsetFromAnimation):
+        * platform/ScrollableArea.h:
+        (ScrollableArea):
+
+2012-02-29  Dana Jansens  <danakj@chromium.org>
+
+        [chromium] Don't let invalidation for next frame prevent tile upload
+        https://bugs.webkit.org/show_bug.cgi?id=79841
+
+        Reviewed by James Robinson.
+
+        We currently don't push dirty tiles to the impl thread so there are no
+        tiles with garbage data on the impl thread. However, this judgement is
+        overzealous and blocks tiles that get invalidated by WebKit for the
+        next frame during the paint of the current frame.
+
+        Instead, check if a tile is dirty and was not painted for the current
+        frame when deciding to push the tile to the impl thread. This requires
+        that we know if a tile was painted during the current frame, which we
+        can do if we always reset m_updateRect to be empty each frame.
+
+        New unit tests: TiledLayerChromiumTest.pushTilesMarkedDirtyDuringPaint
+                        TiledLayerChromiumTest.pushTilesLayerMarkedDirtyDuringPaintOnNextLayer
+                        TiledLayerChromiumTest.pushTilesLayerMarkedDirtyDuringPaintOnPreviousLayer
+
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::UpdatableTile::isDirtyForCurrentFrame):
+        (WebCore::TiledLayerChromium::pushPropertiesTo):
+        (WebCore::TiledLayerChromium::prepareToUpdateTiles):
+        (WebCore::TiledLayerChromium::resetUpdateState):
+        (WebCore):
+        (WebCore::TiledLayerChromium::prepareToUpdate):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (TiledLayerChromium):
+
+2012-02-29  Tommy Widenflycht  <tommyw@google.com>
+
+        MediaStream API: MediaStreamTrackList out-of-bounds access fix
+        https://bugs.webkit.org/show_bug.cgi?id=79889
+
+        Reviewed by Adam Barth.
+
+        Out-of-bounds access to MediaStreamTrackList ASSERTS instead of returning 0,
+        this is not according to ecmascript standard. Also fixed a similar issue in MediaStreamList.
+
+        Test: fast/mediastream/peerconnection-mediastreamlist.html
+
+        * Modules/mediastream/MediaStreamList.cpp:
+        (WebCore::MediaStreamList::item):
+        * Modules/mediastream/MediaStreamTrackList.cpp:
+        (WebCore::MediaStreamTrackList::item):
+
+2012-02-29  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream the BlackBerry change to platform/graphics/FloatSize.h
+        https://bugs.webkit.org/show_bug.cgi?id=79893
+
+        Reviewed by Antonio Gomes.
+
+        Add conversion convenience between WebCore::FloatSize and BlackBerry::Platform::FloatSize.
+
+        The porting can't be built yet, no new tests.
+
+        * platform/graphics/FloatSize.h:
+        (Platform):
+        (FloatSize):
+
+2012-02-29  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream the BlackBerry change to platform/graphics/FloatRect.h
+        https://bugs.webkit.org/show_bug.cgi?id=79891
+
+        Reviewed by Antonio Gomes.
+
+        Add conversion convenience between WebCore::FloatRect and BlackBerry::Platform::FloatRect.
+
+        The porting can't be built yet, no new tests.
+
+        * platform/graphics/FloatRect.h:
+        (Platform):
+        (FloatRect):
+
+2012-02-29  Tim Horton  <timothy_horton@apple.com>
+
+        Make use of CG rounded-rect primitives
+        https://bugs.webkit.org/show_bug.cgi?id=79932
+        <rdar://problem/9274953>
+
+        Reviewed by Simon Fraser.
+
+        Dispatch to potentially platform-specific rounded rectangle path
+        construction from addPathForRoundedRect. Make use of this to call
+        wkCGPathAddRoundedRect on Lion and above, as long as the rounded
+        corners are all equivalent.
+
+        No new tests, as this is covered by many that use rounded corners,
+        and is only a performance improvement.
+
+        * WebCore.exp.in:
+        * platform/graphics/Path.cpp:
+        (WebCore::Path::addRoundedRect):
+        (WebCore):
+        (WebCore::Path::addPathForRoundedRect):
+        * platform/graphics/Path.h:
+        (Path):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::addPathForRoundedRect):
+        (WebCore):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2012-02-29  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream the BlackBerry change to platform/graphics/FloatPoint.h
+        https://bugs.webkit.org/show_bug.cgi?id=79887
+
+        Reviewed by Antonio Gomes.
+
+        Add conversion convenience between WebCore::FloatPoint and BlackBerry::Platform::FloatPoint.
+
+        The porting can't be built yet, no new tests.
+
+        * platform/graphics/FloatPoint.h:
+        (Platform):
+        (FloatPoint):
+
+2012-02-29  Kaustubh Atrawalkar  <kaustubh@motorola.com>
+
+        ShadowRoot need innerHTML
+        https://bugs.webkit.org/show_bug.cgi?id=78473
+
+        Reviewed by Hajime Morita.
+
+        Refactor code for sharing common code between HTMLElement & ShadowRoot.
+        Implement innerHTML attribute for ShadowRoot.
+
+        Test: fast/dom/shadow/shadow-root-innerHTML.html
+
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::cloneNode):
+        (WebCore):
+        (WebCore::ShadowRoot::innerHTML):
+        (WebCore::ShadowRoot::setInnerHTML):
+        * dom/ShadowRoot.h:
+        (ShadowRoot):
+        * dom/ShadowRoot.idl:
+        * editing/markup.cpp:
+        (WebCore::urlToMarkup):
+        (WebCore):
+        (WebCore::createFragmentFromSource):
+        (WebCore::hasOneChild):
+        (WebCore::hasOneTextChild):
+        (WebCore::replaceChildrenWithFragment):
+        (WebCore::replaceChildrenWithText):
+        * editing/markup.h:
+        * html/HTMLElement.cpp:
+        (WebCore):
+
+2012-02-29  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Stop doubling maximalOutlineSize during painting
+        https://bugs.webkit.org/show_bug.cgi?id=79724
+
+        Reviewed by Tony Chang.
+
+        Refactoring only, covered by existing tests (mostly repaint ones).
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::shouldPaint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paintCollapsedBorders):
+        Introduce a local repaint rectangle that we inflate by the maximalOutlineSize
+        to simplify the comparison logic. Also tried to make it clearer what's going on
+        by tweaking the existing code.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::paintObject):
+        Remove the doubling.
+
+2012-02-29  Ken Buchanan  <kenrb@chromium.org>
+
+        Crash when changing list marker locations
+        https://bugs.webkit.org/show_bug.cgi?id=79681
+
+        Reviewed by David Hyatt.
+
+        This fixes a regression crash from r108548.
+
+        There are some conditions where removing the anonymous block
+        parent at that point can cause problems. One is when there is
+        a continuation from it, and another when it is a sibling of
+        lineBoxParent and it causes lineBoxParent to be deleted
+        incidentally. This patch delays the destruction until after
+        lineBoxParent has been used and makes an exception for
+        continuations.
+
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::updateMarkerLocation)
+
+2012-02-29  Max Feil  <mfeil@rim.com>
+
+        [BlackBerry] Add support for FLAC audio and OGG/Vorbis audio
+        https://bugs.webkit.org/show_bug.cgi?id=79519
+
+        Reviewed by Antonio Gomes.
+
+        A layout test already exists for OGG. We do not support OGG
+        video at this time, only audio.
+
+        Test: media/media-can-play-flac-audio.html
+
+        * platform/blackberry/MIMETypeRegistryBlackBerry.cpp:
+        (WebCore):
+
+2012-02-28  Beth Dakin  <bdakin@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=79868
+        Overlay scrollbars should respond to AppKit's NSEventPhaseMayBegin
+        -and corresponding-
+        <rdar://problem/10688637>
+
+        Reviewed by Anders Carlsson.
+
+        Scrollbars are currently drawn on the main thread even when scrolling happens 
+        on the scrolling thread, so we have to call back to the main thread for the 
+        time being to make the right drawing calls for NSEventPhaseMayBegin.
+        * page/scrolling/ScrollingCoordinator.cpp:
+        (WebCore::ScrollingCoordinator::handleWheelEventPhase):
+        (WebCore):
+        * page/scrolling/ScrollingCoordinator.h:
+        (ScrollingCoordinator):
+        * page/scrolling/ScrollingTree.cpp:
+        (WebCore::ScrollingTree::handleWheelEventPhase):
+        (WebCore):
+        * page/scrolling/ScrollingTree.h:
+        * page/scrolling/mac/ScrollingTreeNodeMac.mm:
+        (WebCore::ScrollingTreeNodeMac::handleWheelEvent):
+        * platform/ScrollAnimator.h:
+        (WebCore::ScrollAnimator::handleWheelEventPhase):
+        (ScrollAnimator):
+
+        Call into AppKit on NSEventPhaseMayBegin.
+        * platform/mac/ScrollAnimatorMac.h:
+        (ScrollAnimatorMac):
+        * platform/mac/ScrollAnimatorMac.mm:
+        (WebCore::ScrollAnimatorMac::mayBeginScrollGesture):
+        (WebCore):
+        (WebCore::ScrollAnimatorMac::handleWheelEventPhase):
+        (WebCore::ScrollAnimatorMac::handleWheelEvent):
+
+2012-02-28  Jer Noble  <jer.noble@apple.com>
+
+        Full screen video volume slider has "progress bar"
+        https://bugs.webkit.org/show_bug.cgi?id=79812
+
+        Reviewed by Eric Carlson.
+
+        No new tests; strictly a platform-specific look-and-feel change.
+
+        The full-screen volume slider has a "media-slider"" appearance, which is rendering as if
+        the volume slider has a "progress".  Make a concrete "media-fullscreen-volume-slider" appearance
+        which has the correct look-and-feel.
+
+        Add two new appearance keywords, media-fullscreen-volume-slider and thumb, and their associated
+        types and CSS keywords:
+        * css/CSSValueKeywords.in:
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        * html/shadow/MediaControlElements.h:
+        * platform/ThemeTypes.h:
+
+        Handle the new slider and thumb types when rendering:
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::adjustMediaSliderThumbSize):
+        (WebCore::RenderMediaControls::paintMediaControlsPart):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintMediaFullScreenVolumeSliderTrack):
+        (WebCore::RenderTheme::paintMediaFullScreenVolumeSliderThumb):
+        * rendering/RenderThemeMac.h:
+        (RenderThemeMac):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustMediaSliderThumbSize):
+        (WebCore::RenderThemeMac::paintMediaFullScreenVolumeSliderTrack):
+        (WebCore::RenderThemeMac::paintMediaFullScreenVolumeSliderThumb):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):
+
+        * accessibility/AccessibilitySlider.cpp:
+        (WebCore::AccessibilitySlider::orientation): Mark the fullscreen volume slider as horizontal.
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::RenderSliderThumb::updateAppearance): Give MediaFullScreenVolumeSliderParts 
+            MediaFullScreenVolumeSliderThumbParts.
+        * css/fullscreenQuickTime.css: Change the styles for the fullscreen slider, min, and max buttons.
+        (video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-min-button):
+        (video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-slider):
+        (video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-max-button):
+        * html/shadow/MediaControlRootElement.cpp:
+        (WebCore::MediaControlRootElement::reset): Set the value of the fullscreen volume slider
+            when resetting.
+
+2012-02-29  Antti Koivisto  <antti@apple.com>
+
+        Applying region style should not need to access parent rules
+        https://bugs.webkit.org/show_bug.cgi?id=79910 
+         
+        Reviewed by Andreas Kling.
+
+        Currently CSSStyleSelector::applyProperties looks into parent rules to see if a rule is
+        part of region style. The plan is to eliminate the rule parent pointer so this needs to be refactored.
+        
+        Add a bit to RuleData to indicate if the StyleRule is part of a region style.
+
+        * css/CSSStyleSelector.cpp:
+        (RuleData):
+        (WebCore::RuleData::isInRegionRule):
+        (RuleSet):
+        (WebCore::CSSStyleSelector::addMatchedProperties):
+        (WebCore::CSSStyleSelector::sortAndTransferMatchedRules):
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/CSSStyleSelector.h:
+        (CSSStyleSelector):
+
+2012-02-27  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: [InspectorIndexedDB] Add refresh to IndexedDB support.
+        https://bugs.webkit.org/show_bug.cgi?id=79695
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/IndexedDBViews.js:
+        (WebInspector.IDBDataView):
+        (WebInspector.IDBDataView.prototype._refreshButtonClicked):
+        (WebInspector.IDBDataView.prototype.get statusBarItems):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.IndexedDBTreeElement):
+        (WebInspector.IndexedDBTreeElement.prototype.onattach):
+        (WebInspector.IndexedDBTreeElement.prototype._handleContextMenuEvent):
+        (WebInspector.IDBDatabaseTreeElement.prototype.onattach):
+        (WebInspector.IDBDatabaseTreeElement.prototype._handleContextMenuEvent):
+        (WebInspector.IDBDatabaseTreeElement.prototype._refreshIndexedDB):
+
+2012-02-29  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: timeline markers are not shown on the timeline panel
+        https://bugs.webkit.org/show_bug.cgi?id=79921
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline.addTimestampRecords):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+
+2012-02-29  Kenichi Ishibashi  <bashi@chromium.org>
+
+        Align InlineBox::m_expansion to a byte boundary
+        https://bugs.webkit.org/show_bug.cgi?id=79761
+
+        Add a bit to m_expansion to align a byte boundary.
+        This will make valgrind memcheck happy.
+        I confirmed sizeof(InlineBox) is unchanged.
+
+        Reviewed by Hajime Morita.
+
+        No new tests. No behavior changes.
+
+        * rendering/InlineBox.h:
+        (InlineBox): Aligned m_expansion to a byte boundary.
+
+2012-02-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Do not iterate all tiles for resizing when the content didn't change
+        https://bugs.webkit.org/show_bug.cgi?id=79787
+
+        Reviewed by Simon Hausmann.
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::createTiles):
+
+2012-02-29  Parag Radke  <parag@motorola.com>
+
+        Crash in WebCore::CompositeEditCommand::insertNodeAt
+        https://bugs.webkit.org/show_bug.cgi?id=67764
+
+        Reviewed by Ryosuke Niwa.
+
+        If caret position after deletion and destination position coincides then
+        removing the node will result in removing the destination node also. Hence crash.
+
+        Test: editing/deleting/delete-block-merge-contents-025.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::cleanupAfterDeletion):
+        If the caret position after delete and the destination position
+        renderes at the same place, pruning the node and making an early exit.
+
+2012-02-29  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: remove calculator's updateBoundaries in the timeline panel.
+        https://bugs.webkit.org/show_bug.cgi?id=79907
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkBaseCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.NetworkBaseCalculator.prototype.formatTime):
+        (WebInspector.NetworkTimeCalculator.prototype.computeBarGraphLabels):
+        (WebInspector.NetworkTimeCalculator.prototype.formatTime):
+        (WebInspector.NetworkTransferTimeCalculator.prototype.formatTime):
+        (WebInspector.NetworkTransferDurationCalculator.prototype.formatTime):
+        * inspector/front-end/TimelineGrid.js:
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewCalculator.prototype.formatTime):
+        (WebInspector.TimelineStartAtZeroOverview):
+        (WebInspector.TimelineStartAtZeroOverview.prototype.update):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._toggleStartAtZeroButtonClicked):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype.get timelinePaddingLeft):
+        (WebInspector.TimelineCalculator):
+        (WebInspector.TimelineCalculator.prototype.setWindow):
+        (WebInspector.TimelineCalculator.prototype.setRecords):
+        (WebInspector.TimelineCalculator.prototype.formatTime):
+        (WebInspector.TimelineFitInWindowCalculator):
+        (WebInspector.TimelineFitInWindowCalculator.prototype.setWindow):
+        (WebInspector.TimelineFitInWindowCalculator.prototype.setRecords):
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):
+
+2012-02-29  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: enable Profiles panel for workers
+        https://bugs.webkit.org/show_bug.cgi?id=79908
+
+        Introduced worker profiler agent. Enabled script profiling for
+        workers.
+
+        Reviewed by Pavel Feldman.
+
+        * bindings/js/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::startForPage):
+        (WebCore):
+        (WebCore::ScriptProfiler::startForWorkerContext):
+        (WebCore::ScriptProfiler::stopForPage):
+        (WebCore::ScriptProfiler::stopForWorkerContext):
+        * bindings/js/ScriptProfiler.h:
+        (WebCore):
+        (ScriptProfiler):
+        * bindings/v8/ScriptProfiler.cpp:
+        (WebCore::ScriptProfiler::startForPage):
+        (WebCore):
+        (WebCore::ScriptProfiler::startForWorkerContext):
+        (WebCore::ScriptProfiler::stopForPage):
+        (WebCore::ScriptProfiler::stopForWorkerContext):
+        * bindings/v8/ScriptProfiler.h:
+        (WebCore):
+        (ScriptProfiler):
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore):
+        (PageProfilerAgent):
+        (WebCore::PageProfilerAgent::PageProfilerAgent):
+        (WebCore::PageProfilerAgent::~PageProfilerAgent):
+        (WebCore::PageProfilerAgent::startProfiling):
+        (WebCore::PageProfilerAgent::stopProfiling):
+        (WebCore::InspectorProfilerAgent::create):
+        (WorkerProfilerAgent):
+        (WebCore::WorkerProfilerAgent::WorkerProfilerAgent):
+        (WebCore::WorkerProfilerAgent::~WorkerProfilerAgent):
+        (WebCore::WorkerProfilerAgent::startProfiling):
+        (WebCore::WorkerProfilerAgent::stopProfiling):
+        (WebCore::InspectorProfilerAgent::InspectorProfilerAgent):
+        (WebCore::InspectorProfilerAgent::start):
+        (WebCore::InspectorProfilerAgent::stop):
+        * inspector/InspectorProfilerAgent.h:
+        (WebCore):
+        (InspectorProfilerAgent):
+        * inspector/WorkerInspectorController.cpp:
+        (WebCore::WorkerInspectorController::WorkerInspectorController):
+        (WebCore::WorkerInspectorController::connectFrontend):
+        (WebCore::WorkerInspectorController::disconnectFrontend):
+        (WebCore::WorkerInspectorController::restoreInspectorStateFromCookie):
+        * inspector/WorkerInspectorController.h:
+        (WebCore):
+        (WorkerInspectorController):
+        * inspector/front-end/ProfilesPanel.js:
+        * inspector/front-end/inspector.js:
+        (WebInspector._createPanels):
+
+2012-02-29  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: Clicking relative links fails when query string contains a slash
+        https://bugs.webkit.org/show_bug.cgi?id=79905
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/ResourceUtils.js:
+        (WebInspector.completeURL):
+
+2012-02-29  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: Ctrl R should reload page from the console panel as well.
+        https://bugs.webkit.org/show_bug.cgi?id=79883
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2012-02-28  Pavel Podivilov  <podivilov@chromium.org>
+
+        Extended attributes list should go before 'static' and 'const' modifiers in IDLs.
+        https://bugs.webkit.org/show_bug.cgi?id=79807
+
+        Reviewed by Kentaro Hara.
+
+        No new tests. Generated code isn't changed.
+
+        * bindings/scripts/IDLParser.pm:
+        (ParseInterface):
+        * bindings/scripts/IDLStructure.pm:
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/TestSupplemental.idl:
+        * html/DOMURL.idl:
+        * html/HTMLMediaElement.idl:
+        * html/HTMLTrackElement.idl:
+
+2012-02-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: move DOM counter graphs out of experimental
+        https://bugs.webkit.org/show_bug.cgi?id=79802
+
+        Enable DOM counter graphs by default.
+
+        Reveal nearest record from the left hand side when there is no
+        record containing the point where the user clicked.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._endSplitterDragging):
+        (WebInspector.TimelinePanel.prototype._onTimelineEventRecorded):
+        (WebInspector.TimelinePanel.prototype.sidebarResized):
+        (WebInspector.TimelinePanel.prototype._resetPanel):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype.revealRecordAt):
+
+2012-02-28  MORITA Hajime  <morrita@google.com>
+
+        [Refactoring] Shadow related attach paths should be in ShadowTree.
+        https://bugs.webkit.org/show_bug.cgi?id=79854
+
+        Reviewed by Ryosuke Niwa.
+
+        No new tests. No behavior change.
+
+        This change introduces ShadowTree::attachHost() and ShadowTree::detachHost()
+        and moves shadow-enabled attachment code from Element to ShadowRoot.
+        This also factored out small ContainerNode method to use it from ShadowTree.
+
+        Even after this change, the traveral order in ShadowTree
+        attachment has some unclear part. Coming changes will clarify
+        these. This change is aimed to be purely textural.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::attach):
+        (WebCore::ContainerNode::detach):
+        * dom/ContainerNode.h:
+        (ContainerNode):
+        (WebCore::ContainerNode::attachAsNode): Added.
+        (WebCore::ContainerNode::attachChildren): Added.
+        (WebCore::ContainerNode::attachChildrenIfNeeded): Added.
+        (WebCore::ContainerNode::attachChildrenLazily): Added.
+        (WebCore::ContainerNode::detachAsNode): Added.
+        (WebCore::ContainerNode::detachChildrenIfNeeded): Added.
+        (WebCore::ContainerNode::detachChildren): Added.
+        * dom/Element.cpp:
+        (WebCore::Element::attach):
+        (WebCore::Element::detach):
+        * dom/ShadowTree.cpp:
+        (WebCore::ShadowTree::addShadowRoot):
+        (WebCore::ShadowTree::removeAllShadowRoots):
+        (WebCore::ShadowTree::detachHost):
+        (WebCore):
+        (WebCore::ShadowTree::attachHost):
+        (WebCore::ShadowTree::reattachHostChildrenAndShadow):
+        * dom/ShadowTree.h:
+        (ShadowTree):
+
+2012-02-28  Arko Saha  <arko@motorola.com>
+
+        Microdata: Implement HTMLPropertiesCollection collection.namedItem().
+        https://bugs.webkit.org/show_bug.cgi?id=73156
+
+        Reviewed by Kentaro Hara.
+
+        Tests: fast/dom/MicroData/nameditem-must-be-case-sensitive.html
+               fast/dom/MicroData/nameditem-must-return-correct-item-properties.html
+               fast/dom/MicroData/properties-collection-nameditem-test.html
+
+        * bindings/scripts/CodeGeneratorJS.pm: Modified code generator to generate
+        JS bindings code for HTMLPropertiesCollection [NamedGetter] property.
+        (GenerateImplementation):
+        * html/HTMLPropertiesCollection.cpp:
+        (WebCore::HTMLPropertiesCollection::names):
+        (WebCore):
+        (WebCore::HTMLPropertiesCollection::namedItem): Returns a NodeList object
+        containing any elements that add a property named name.
+        (WebCore::HTMLPropertiesCollection::hasNamedItem): Checks if the items can
+        be retrieved or not based on the property named name.
+        * html/HTMLPropertiesCollection.h: Added namedItem(), hasProperty(),
+        hasNamedItem() methods.
+        (HTMLPropertiesCollection):
+        * html/HTMLPropertiesCollection.idl: Added namedItem() IDL method.
+
+2012-02-28  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Add size field to Metadata in FileSystem API
+        https://bugs.webkit.org/show_bug.cgi?id=79813
+
+        Reviewed by David Levin.
+
+        Test: fast/filesystem/op-get-metadata.html
+
+        * fileapi/FileSystemCallbacks.cpp:
+        (WebCore::MetadataCallbacks::didReadMetadata):
+        * fileapi/Metadata.h:
+        (WebCore::Metadata::create):
+        (WebCore::Metadata::modificationTime):
+        (WebCore::Metadata::size): Added.
+        (WebCore::Metadata::Metadata):
+        * fileapi/Metadata.idl:
+
+2012-02-28  Dmitry Lomov  <dslomov@google.com>
+
+        [JSC] Implement ArrayBuffer transfer
+        https://bugs.webkit.org/show_bug.cgi?id=73493.
+        Implement ArrayBuffer transfer, per Khronos spec:  http://www.khronos.org/registry/typedarray/specs/latest/#9.
+        This brings parity with V8 implementation of transferable typed arrays.
+
+        Reviewed by Oliver Hunt.
+
+        Covered by existing tests.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::handlePostMessage):
+        * bindings/js/JSDictionary.cpp:
+        (WebCore::JSDictionary::convertValue):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::pushState):
+        (WebCore::JSHistory::replaceState):
+        * bindings/js/JSMessageEventCustom.cpp:
+        (WebCore::handleInitMessageEvent):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::fillMessagePortArray):
+        * bindings/js/JSMessagePortCustom.h:
+        (WebCore):
+        (WebCore::handlePostMessage):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::serialize):
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore):
+        (WebCore::CloneSerializer::serialize):
+        (CloneSerializer):
+        (WebCore::CloneSerializer::CloneSerializer):
+        (WebCore::CloneSerializer::fillTransferMap):
+        (WebCore::CloneSerializer::dumpArrayBufferView):
+        (WebCore::CloneSerializer::dumpIfTerminal):
+        (WebCore::CloneDeserializer::deserialize):
+        (WebCore::CloneDeserializer::CloneDeserializer):
+        (WebCore::CloneDeserializer::readTerminal):
+        (CloneDeserializer):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        (WebCore::SerializedScriptValue::transferArrayBuffers):
+        (WebCore::SerializedScriptValue::create):
+        (WebCore::SerializedScriptValue::deserialize):
+        * bindings/js/SerializedScriptValue.h:
+        (WebCore):
+        (SerializedScriptValue):
+
+2012-02-28  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Unreviewed. Build fixes after recent bindings changes.
+
+        * bindings/scripts/CodeGeneratorCPP.pm: 
+        (ShouldSkipType):
+        * testing/Internals.idl:
+
+2012-02-28  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Spin button sometimes ignores Indeterminate of m_upDownState
+        https://bugs.webkit.org/show_bug.cgi?id=79754
+
+        Reviewed by Kent Tamura.
+
+        This patch checks enum value Indeterminate before using m_upDownState. This make
+        sure Indeterminate state doesn't act like Down state.
+
+        m_upDownState can be Indeterminate at mousedown event if mouse pointer is on
+        spin button when it is displayed.
+
+        Test: fast/forms/number/spin-button-state.html
+
+        * html/shadow/TextControlInnerElements.cpp:
+        (WebCore::SpinButtonElement::defaultEventHandler):
+        (WebCore::SpinButtonElement::repeatingTimerFired):
+
+2012-02-27  MORITA Hajime  <morrita@google.com>
+
+        [Refactoring] RenderSummary and RenderDetail is no longer needed.
+        https://bugs.webkit.org/show_bug.cgi?id=79641
+
+        Reviewed by Kent Tamura.
+
+        Removed RenderDetails and RenderSummary because its only
+        modification they had is already handled by RenderBlock::styleWillChange().
+        These are just a historical artifact. We could have removed these
+        classes when they were switched to shadow-based implementations.
+
+        Tests: fast/html/details-inline-expected.html
+               fast/html/details-inline.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::createRenderer):
+        * html/HTMLSummaryElement.cpp:
+        (WebCore::HTMLSummaryElement::createRenderer):
+        (WebCore::HTMLSummaryElement::defaultEventHandler):
+        * rendering/RenderDetails.cpp: Removed.
+        * rendering/RenderDetails.h: Removed.
+        * rendering/RenderDetailsMarker.cpp:
+        (WebCore::RenderDetailsMarker::isOpen):
+        * rendering/RenderDetailsMarker.h:
+        (RenderDetailsMarker):
+        * rendering/RenderObject.h:
+        (RenderObject):
+        * rendering/RenderSummary.cpp: Removed.
+        * rendering/RenderSummary.h: Removed.
+        * rendering/RenderingAllInOne.cpp:
+
+2012-02-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Optimize the rects being drawn into compositing layers
+        https://bugs.webkit.org/show_bug.cgi?id=79852
+
+        Reviewed by Dan Bernstein.
+
+        Use the newly added WebKitSystemInterface method
+        to limit the area being painted in a CALayer
+        -drawInContext callback. This avoids redundant drawing,
+        for performance.
+
+        * platform/graphics/mac/WebLayer.mm:
+        (drawLayerContents):
+
+2012-02-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the SnowLeopard build.
+
+        * WebCore.exp.in:
+
+2012-02-28  Anders Carlsson  <andersca@apple.com>
+
+        With tiled drawing enabled, pressing Down arrow after scrolling via mouse gesture causes page to jump back up to top
+        https://bugs.webkit.org/show_bug.cgi?id=79249
+        <rdar://problem/10866273>
+
+        Reviewed by Sam Weinig.
+
+        ScrollableArea::notifyScrollPositionChanged must make sure that the scroll animator position is kept up to date.
+
+        * platform/ScrollAnimator.cpp:
+        (WebCore::ScrollAnimator::setCurrentPosition):
+        (WebCore):
+        * platform/ScrollAnimator.h:
+        (ScrollAnimator):
+        * platform/ScrollableArea.cpp:
+        (WebCore::ScrollableArea::notifyScrollPositionChanged):
+
+2012-02-28  Daniel Cheng  <dcheng@chromium.org>
+
+        Unreviewed, rolling out r107894.
+        http://trac.webkit.org/changeset/107894
+        https://bugs.webkit.org/show_bug.cgi?id=30416
+
+        dataTransfer.types should be an Array since DOMStringList is deprecated.
+
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore::JSClipboard::types):
+        (WebCore):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::V8Clipboard::typesAccessorGetter):
+        (WebCore):
+        * dom/Clipboard.cpp:
+        (WebCore::Clipboard::hasStringOfType):
+        * dom/Clipboard.h:
+        (Clipboard):
+        * dom/Clipboard.idl:
+        * platform/blackberry/ClipboardBlackBerry.cpp:
+        (WebCore::ClipboardBlackBerry::types):
+        * platform/blackberry/ClipboardBlackBerry.h:
+        (ClipboardBlackBerry):
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::types):
+        * platform/chromium/ChromiumDataObject.h:
+        (ChromiumDataObject):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::types):
+        (WebCore::ClipboardChromium::mayUpdateItems):
+        * platform/chromium/ClipboardChromium.h:
+        (ClipboardChromium):
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::containsHTML):
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::containsPlainText):
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::DragData::asFragment):
+        * platform/efl/ClipboardEfl.cpp:
+        (WebCore::ClipboardEfl::types):
+        * platform/efl/ClipboardEfl.h:
+        (ClipboardEfl):
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::types):
+        * platform/gtk/ClipboardGtk.h:
+        (ClipboardGtk):
+        * platform/mac/ClipboardMac.h:
+        (ClipboardMac):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::addHTMLClipboardTypesForCocoaType):
+        (WebCore::ClipboardMac::types):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::types):
+        * platform/qt/ClipboardQt.h:
+        (ClipboardQt):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::addMimeTypesForFormat):
+        (WebCore::ClipboardWin::types):
+        * platform/win/ClipboardWin.h:
+        (ClipboardWin):
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::types):
+        * platform/wx/ClipboardWx.h:
+        (ClipboardWx):
+
+2012-02-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Update WebKitSystemInterface.
+
+        Reviewed by Sam Weinig.
+
+        * WebCore.exp.in:
+        (drawLayerContents):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2012-02-27  MORITA Hajime  <morrita@google.com>
+
+        <content> element should behave as HTMLUnknownElement outside of a shadow DOM subtree
+        https://bugs.webkit.org/show_bug.cgi?id=79551
+
+        Reviewed by Dimitri Glazkov.
+
+        The problem happened because HTMLContentElement doesn't create renderer anytime.
+        
+        This change allows it to create a renderer unless the HTMLContentElement is shadowed.
+        Since this could happen not only on <content> but also on upcoming <shadow>,
+        the corresponding part of the code is pulled up to InsertionPoint.
+
+        Tests: fast/dom/shadow/content-element-outside-shadow-style-expected.html
+               fast/dom/shadow/content-element-outside-shadow-style.html
+
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        * dom/ShadowRoot.h:
+        (WebCore):
+        (WebCore::TreeScope::isShadowRoot):
+        * dom/TreeScope.h:
+        (TreeScope):
+        * html/shadow/HTMLContentElement.h:
+        * html/shadow/InsertionPoint.cpp:
+        (WebCore::InsertionPoint::isShadowBoundary):
+        (WebCore):
+        * html/shadow/InsertionPoint.h:
+        (InsertionPoint):
+        (WebCore::isShadowBoundary):
+        (WebCore):
+
+2012-02-28  Daniel Cheng  <dcheng@chromium.org>
+
+        Clipboard::getData should return an empty string instead of undefined
+        https://bugs.webkit.org/show_bug.cgi?id=79712
+
+        Reviewed by Tony Chang.
+
+        Per the spec, an empty string should be returned when there is no data for the given typestring.
+
+        Test: fast/events/dataTransfer-getData-returns-empty-string.html
+
+        * bindings/js/JSClipboardCustom.cpp:
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * dom/Clipboard.h:
+        (Clipboard):
+        * dom/Clipboard.idl:
+        * platform/blackberry/ClipboardBlackBerry.cpp:
+        (WebCore::ClipboardBlackBerry::getData):
+        * platform/blackberry/ClipboardBlackBerry.h:
+        (ClipboardBlackBerry):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::getData):
+        * platform/chromium/ClipboardChromium.h:
+        (ClipboardChromium):
+        * platform/efl/ClipboardEfl.cpp:
+        (WebCore::ClipboardEfl::getData):
+        * platform/efl/ClipboardEfl.h:
+        (ClipboardEfl):
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::getData):
+        * platform/gtk/ClipboardGtk.h:
+        (ClipboardGtk):
+        * platform/mac/ClipboardMac.h:
+        (ClipboardMac):
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::getData):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::getData):
+        * platform/qt/ClipboardQt.h:
+        (ClipboardQt):
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::getFullCFHTML):
+        (WebCore::getURL):
+        (WebCore::getPlainText):
+        (WebCore::getTextHTML):
+        (WebCore::getCFHTML):
+        (WebCore::fragmentFromHTML):
+        * platform/win/ClipboardUtilitiesWin.h:
+        (WebCore):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::getData):
+        * platform/win/ClipboardWin.h:
+        (ClipboardWin):
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::getData):
+        * platform/wx/ClipboardWx.h:
+        (ClipboardWx):
+
+2012-02-28  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] Uninitialized value in LocaleToScriptCodeForFontSelection
+        https://bugs.webkit.org/show_bug.cgi?id=79779
+
+        Set USCRIPT_COMMON to scriptCode as the initial value.
+
+        Reviewed by Kent Tamura.
+
+        No new tests. No behavior change.
+
+        * platform/text/LocaleToScriptMappingICU.cpp:
+        (WebCore::localeToScriptCodeForFontSelection):
+
+2012-02-28  Kenneth Russell  <kbr@google.com>
+
+        [chromium] Work around IOSurface-related corruption during readback
+        https://bugs.webkit.org/show_bug.cgi?id=79735
+
+        Reviewed by James Robinson.
+
+        Copy the compositor's IOSurface-backed output into a temporary
+        texture and perform the ReadPixels operation against that texture.
+
+        It is infeasible to write an automated test for this issue.
+        Tested manually by performing print preview multiple times against
+        pages containing WebGL content on 10.7 and observing that the
+        corruption in the output is no longer present.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::getFramebufferPixels):
+
+2012-02-28  Adrienne Walker  <enne@google.com>
+
+        [chromium] Inform v8 about extra memory used for PatternSkia clamp mode
+        https://bugs.webkit.org/show_bug.cgi?id=79846
+
+        Reviewed by James Robinson.
+
+        For large images, creating a non-repeating Pattern in Skia can
+        allocate a lot of memory. Inform v8 about this so that it can
+        potentially garbage collect any Pattern objects that aren't being used
+        and that are holding onto large image copies.
+
+        * platform/graphics/Pattern.cpp:
+        (WebCore::Pattern::Pattern):
+        * platform/graphics/Pattern.h:
+        (Pattern):
+        * platform/graphics/skia/PatternSkia.cpp:
+        (WebCore::Pattern::platformDestroy):
+        (WebCore::Pattern::platformPattern):
+
+2012-02-28  Jonathan Backer  <backer@chromium.org>
+
+        [chromium] Reset damage tracker on visibility change.
+        https://bugs.webkit.org/show_bug.cgi?id=79267
+
+        Reviewed by James Robinson.
+
+        Unit tests: CCLayerTreeHostImplTest.cpp
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::setVisible):
+
+2012-02-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108834.
+        http://trac.webkit.org/changeset/108834
+        https://bugs.webkit.org/show_bug.cgi?id=79840
+
+        Seems to cause a number of crashes under
+        FrameView::doDeferredRepaints (Requested by jamesr__ on
+        #webkit).
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::draw):
+        * svg/graphics/SVGImage.h:
+        * svg/graphics/SVGImageCache.cpp:
+        (WebCore::SVGImageCache::imageContentChanged):
+        (WebCore::SVGImageCache::redrawTimerFired):
+        * svg/graphics/SVGImageCache.h:
+        (SVGImageCache):
+
+2012-02-29  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add support for nested event loops in RunLoop
+        https://bugs.webkit.org/show_bug.cgi?id=79499
+
+        Reviewed by Martin Robinson.
+
+        Run a new nested mainloop if the main event loop is already
+        running when calling to RunLoop::run(), and take care of stopping
+        the right main loop too when RunLoop::stop() is invoked.
+
+        * platform/RunLoop.h:
+        (RunLoop):
+        * platform/gtk/RunLoopGtk.cpp:
+        (WebCore::RunLoop::RunLoop):
+        (WebCore::RunLoop::~RunLoop):
+        (WebCore::RunLoop::run):
+        (WebCore::RunLoop::innermostLoop):
+        (WebCore::RunLoop::pushNestedMainLoop):
+        (WebCore::RunLoop::popNestedMainLoop):
+        (WebCore):
+        (WebCore::RunLoop::stop):
+
+2012-02-28  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Move RenderLayer::size() calls to a common function
+        https://bugs.webkit.org/show_bug.cgi?id=76972
+
+        Reviewed by Simon Fraser.
+
+        Refactoring only.
+
+        This change introduces RenderBox::cachedSizeForOverflowClip() that handles all the cached size
+        requests that currently goes through the RenderLayer. This indirection helps to decouple the need
+        for a RenderLayer so that we can lazily allocate RenderLayers as part of bug 75568.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::cachedSizeForOverflowClip):
+        Added this function to handle the calls to RenderLayer's size(). Unfortunately a lot of the
+        code calls RenderLayer::size() directly so I could not make it private.
+
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderBox.h:
+        (RenderBox):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        (WebCore::RenderInline::computeRectForRepaint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::computeRectForRepaint):
+        Fixed the call sites above.
+
+2012-02-28  Tim Dresser  <tdresser@chromium.org>
+
+        Provide DefaultDeviceScaleFactor though WebSettings
+        https://bugs.webkit.org/show_bug.cgi?id=79534
+
+        Reviewed by Darin Fisher.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setDefaultDeviceScaleFactor):
+        (WebCore):
+        * page/Settings.h:
+        (Settings):
+        (WebCore::Settings::defaultDeviceScaleFactor):
+
+2012-02-28  Oliver Hunt  <oliver@apple.com>
+
+        Fix build.
+
+        * mathml/MathMLElement.cpp:
+        (WebCore::MathMLElement::collectStyleForAttribute):
+
+2012-02-28  Dean Jackson  <dino@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=79824
+
+        Unreviewed build fix for when ENABLE(CSS_FILTERS) is on
+        but ENABLE(CSS_SHADERS) is off.
+
+        * css/WebKitCSSFilterValue.cpp:
+        (WebCore::WebKitCSSFilterValue::typeUsesSpaceSeparator):
+
+2012-02-28  Dave Moore  <davemoore@chromium.org>
+
+        Slow content causes choppy scrolling
+        https://bugs.webkit.org/show_bug.cgi?id=79403
+
+        Reviewed by James Robinson.
+
+        This code helps make scrolling (via wheel or pad) less choppy
+        when the content takes a long time to respond to the fake mouse moves
+        generated during scrolls.
+
+
+ * page/EventHandler.cpp:
+        (WebCore):
+        (MaximumDurationTracker):
+        (WebCore::MaximumDurationTracker::MaximumDurationTracker):
+        (WebCore::MaximumDurationTracker::~MaximumDurationTracker):
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::mouseMoved):
+        (WebCore::EventHandler::dispatchFakeMouseMoveEventSoon):
+        (WebCore::EventHandler::dispatchFakeMouseMoveEventSoonInQuad):
+        * page/EventHandler.h:
+
+2012-02-28  Andreas Kling  <awesomekling@apple.com>
+
+        StyledElement::isPresentationAttribute() only needs the attribute name.
+        <http://webkit.org/b/79828>
+
+        Reviewed by Anders Carlsson.
+
+        Pass the QualifiedName to isPresentationAttribute instead of the whole
+        Attribute. We only need the name to know what kind of attribute it is.
+
+        This makes the code a little less ugly and makes it possible to use
+        the function without having an Attribute object.
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged):
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::isPresentationAttribute):
+        * html/HTMLBRElement.cpp:
+        (WebCore::HTMLBRElement::isPresentationAttribute):
+        * html/HTMLBRElement.h:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::isPresentationAttribute):
+        * html/HTMLBodyElement.h:
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::isPresentationAttribute):
+        * html/HTMLButtonElement.h:
+        * html/HTMLDivElement.cpp:
+        (WebCore::HTMLDivElement::isPresentationAttribute):
+        * html/HTMLDivElement.h:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::isPresentationAttribute):
+        * html/HTMLElement.h:
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::isPresentationAttribute):
+        * html/HTMLEmbedElement.h:
+        * html/HTMLFontElement.cpp:
+        (WebCore::HTMLFontElement::isPresentationAttribute):
+        * html/HTMLFontElement.h:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::isPresentationAttribute):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLHRElement.cpp:
+        (WebCore::HTMLHRElement::isPresentationAttribute):
+        * html/HTMLHRElement.h:
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::isPresentationAttribute):
+        * html/HTMLIFrameElement.h:
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::isPresentationAttribute):
+        * html/HTMLImageElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::isPresentationAttribute):
+        * html/HTMLInputElement.h:
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::isPresentationAttribute):
+        * html/HTMLLIElement.h:
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::isPresentationAttribute):
+        * html/HTMLMarqueeElement.h:
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::isPresentationAttribute):
+        * html/HTMLOListElement.h:
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::isPresentationAttribute):
+        * html/HTMLObjectElement.h:
+        * html/HTMLParagraphElement.cpp:
+        (WebCore::HTMLParagraphElement::isPresentationAttribute):
+        * html/HTMLParagraphElement.h:
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::isPresentationAttribute):
+        * html/HTMLPlugInElement.h:
+        * html/HTMLPreElement.cpp:
+        (WebCore::HTMLPreElement::isPresentationAttribute):
+        * html/HTMLPreElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::isPresentationAttribute):
+        * html/HTMLSelectElement.h:
+        * html/HTMLTableCaptionElement.cpp:
+        (WebCore::HTMLTableCaptionElement::isPresentationAttribute):
+        * html/HTMLTableCaptionElement.h:
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::isPresentationAttribute):
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::isPresentationAttribute):
+        * html/HTMLTableColElement.h:
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::isPresentationAttribute):
+        * html/HTMLTableElement.h:
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::isPresentationAttribute):
+        * html/HTMLTablePartElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::isPresentationAttribute):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLUListElement.cpp:
+        (WebCore::HTMLUListElement::isPresentationAttribute):
+        * html/HTMLUListElement.h:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::isPresentationAttribute):
+        * html/HTMLVideoElement.h:
+        * mathml/MathMLElement.cpp:
+        (WebCore::MathMLElement::isPresentationAttribute):
+        * mathml/MathMLElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::isPresentationAttribute):
+        * svg/SVGImageElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::isPresentationAttribute):
+        * svg/SVGStyledElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::isPresentationAttribute):
+        * svg/SVGTextContentElement.h:
+
+2012-02-28  Enrica Casucci  <enrica@apple.com>
+
+        More Pasteboard code cleanup.
+        https://bugs.webkit.org/show_bug.cgi?id=79816
+
+        Removing the last references to NSPasteboard.
+
+        Reviewed by Alexey Proskuryakov.
+
+        No new tests. No change in functionality.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/mac/EditorMac.mm:
+        (WebCore::Editor::pasteWithPasteboard):
+        (WebCore::Editor::takeFindStringFromSelection):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyEditorClient::setInsertionPasteboard):
+        * page/DragClient.h:
+        * page/EditorClient.h:
+        * platform/DragData.h:
+        * platform/Pasteboard.h:
+        * platform/mac/ClipboardMac.h:
+        * platform/mac/PasteboardHelper.h: Removed.
+
+2012-02-28  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r109137.
+        http://trac.webkit.org/changeset/109137
+        https://bugs.webkit.org/show_bug.cgi?id=79833
+
+        Broke cr-mac build (Requested by aklein on #webkit).
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore):
+        (WebCore::pathFromFont):
+
+2012-02-28  Jungshik Shin  <jshin@chromium.org>
+
+        Add a fallback path to LineBreakIteratorPoolICU when the locale
+        name from a web page is invalid and ICU fails to get a line break
+        iterator instance. Also add a null check to 
+        TextBreakIteratorICU::acquireLineBreakIterator.
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=67640
+
+        Test: fast/text/invalid-locale.html
+
+        * platform/text/LineBreakIteratorPoolICU.h:
+        (WebCore::LineBreakIteratorPool::take):
+        * platform/text/TextBreakIteratorICU.cpp:
+        (WebCore::acquireLineBreakIterator):
+
+2012-02-28  Abhishek Arya  <inferno@chromium.org>
+
+        Crash due to accessing removed continuation in multi-column layout.
+        https://bugs.webkit.org/show_bug.cgi?id=78417
+
+        Reviewed by David Hyatt.
+
+        This patch addresses two problems:
+        1. Run-in block got split due to addition of a column-span child.
+        The clone part was incorrectly intruding into the sibling block,
+        even when it was part of the continuation chain.
+        2. Like r73296, we don't need to set continuation on an
+        anonymous block since we haven't split a real element.
+
+        Test: fast/multicol/span/runin-continuation-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChildIgnoringAnonymousColumnBlocks):
+        (WebCore::RenderBlock::handleRunInChild):
+
+2012-02-28  Abhishek Arya  <inferno@chromium.org>
+
+        Incorrect before child parent calculation when adding new children
+        to anonymous column blocks.
+        https://bugs.webkit.org/show_bug.cgi?id=79755
+
+        Reviewed by David Hyatt.
+
+        before child can be wrapped in anonymous containers, so need to
+        take care of that in before child parent calculation.
+
+        Test: fast/multicol/span/before-child-anonymous-column-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChildToAnonymousColumnBlocks):
+
+2012-02-28  Ned Holbrook  <nholbrook@apple.com>
+
+        Reimplement pathFromFont() in SimpleFontDataMac.mm
+        https://bugs.webkit.org/show_bug.cgi?id=79811
+
+        Reviewed by Dan Bernstein.
+
+        Debug-only function, so no new tests.
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::pathFromFont): Reimplemented.
+
+2012-02-28  Alexis Menard  <alexis.menard@openbossa.org>
+
+        getComputedStyle fails for 'first-line' pseudo-element
+        https://bugs.webkit.org/show_bug.cgi?id=57505
+
+        Reviewed by Tony Chang.
+
+        Querying the selector with a pseudo-element using getComputedStyle should work
+        even if the selector was not declared in the stylesheet. When not declared, we need
+        to use the RenderStyle created to do the rendering as there is no pseudo-style.
+        This match the behavior of Firefox.
+
+        No new tests : Updated expectation and extended getComputedStyle-with-pseudo-element.html.
+
+        * dom/Element.cpp:
+        (WebCore::Element::computedStyle):
+
+2012-02-28  Ashod Nakashian  <ashodnakashian@yahoo.com>
+
+        Move FILE_SYSTEM code out of WorkerContext and into the fileapi folder
+        https://bugs.webkit.org/show_bug.cgi?id=79449
+
+        Reviewed by Adam Barth.
+
+        This moves FILE_SYSTEM code out of WorkerContext and into the fileapi/WorkerContextFileSystem.
+        None-functional changes, no new tests necessary.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * fileapi/WorkerContextFileSystem.cpp: Added.
+        (WebCore):
+        (WebCore::WorkerContextFileSystem::webkitRequestFileSystem):
+        (WebCore::WorkerContextFileSystem::webkitRequestFileSystemSync):
+        (WebCore::WorkerContextFileSystem::webkitResolveLocalFileSystemURL):
+        (WebCore::WorkerContextFileSystem::webkitResolveLocalFileSystemSyncURL):
+        * fileapi/WorkerContextFileSystem.h: Added.
+        (WebCore):
+        (WorkerContextFileSystem):
+        * fileapi/WorkerContextFileSystem.idl: Added.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::ensureEventTargetData):
+        * workers/WorkerContext.h:
+        (WebCore):
+        (WorkerContext):
+        * workers/WorkerContext.idl:
+
+2012-02-28  Alexey Proskuryakov  <ap@apple.com>
+
+        FileReader crashes when file is not readable
+        https://bugs.webkit.org/show_bug.cgi?id=79715
+
+        Reviewed by Jian Li.
+
+        Test: fast/files/file-reader-directory-crash.html
+
+        * platform/SharedBuffer.cpp: (WebCore::SharedBuffer::SharedBuffer): Crash early if a caller
+        mixed up in-band error signal with length again.
+
+        * platform/network/BlobResourceHandle.cpp:
+        (WebCore): Changed errors into an enum. Added a proper domain for blob errors.
+        (WebCore::BlobResourceHandle::didReceiveResponse): There is already a constant for INT_MAX
+        in C/C++.
+        (WebCore::BlobResourceHandle::didRead): Don't send "-1" for failure down the success path.
+        (WebCore::BlobResourceHandle::notifyFail): Use a proper domain for blob errors, and a non-
+        empty message.
+
+2012-02-28  Adam Klein  <adamk@chromium.org>
+
+        Unreviewed, fix cr-win build after r109119.
+
+        * platform/graphics/chromium/TransparencyWin.h:
+        (TransparencyWin):
+
+2012-02-28  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        [GTK] Add GMainLoop and GMainContext to be handled by GRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=79496
+
+        Reviewed by Martin Robinson.
+
+        Updated places where raw pointers to GMainLoop and GMainContext
+        were being used, replacing them with GRefPtr-based code.
+
+        * platform/RunLoop.h:
+        (RunLoop):
+        * platform/gtk/RunLoopGtk.cpp:
+        (WebCore::RunLoop::RunLoop):
+        (WebCore::RunLoop::~RunLoop):
+        (WebCore::RunLoop::mainLoop):
+        (WebCore::RunLoop::stop):
+        (WebCore::RunLoop::wakeUp):
+        (WebCore::RunLoop::TimerBase::start):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::~WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::run):
+
+2012-02-28  Alok Priyadarshi  <alokp@chromium.org>
+
+        Heap-use-after-free in WebCore::RenderLayer::addChild
+        https://bugs.webkit.org/show_bug.cgi?id=79698
+
+        Reviewed by Simon Fraser.
+
+        This patch fixes a regression introduced in r108659.
+        The reflection layer was moved to the parent by mistake. It was then
+        deleted and the parent was left holding on to a deleted pointer. This
+        patch restores the location where reflection layer is removed - before
+        moving the child layers.
+
+        Test: fast/reflections/toggle-reflection-crash.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::removeOnlyThisLayer):
+
+2012-02-28  Ken Buchanan  <kenrb@chromium.org>
+
+        Crash from list marker having inline and block children
+        https://bugs.webkit.org/show_bug.cgi?id=79793
+
+        Reviewed by Julien Chaffraix.
+
+        Crashing condition in which an anonymous block was being collapsed
+        even though it had a block sibling. removeChild() was not checking
+        for siblings that might precede :before content renderers, such
+        as list items. This patch corrects that.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild)
+
+2012-02-28  Adam Klein  <adamk@chromium.org>
+
+        Unreviewed, speculative test fix after r109016.
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::OwnedBuffers::OwnedBuffers): Explicitly pass a scale of 1 to ImageBuffer::create.
+        * platform/graphics/chromium/TransparencyWin.h:
+        (WebCore): Update names of re-enabled tests.
+
+2012-02-28  Antti Koivisto  <antti@apple.com>
+
+        Give StyleRule files of its own
+        https://bugs.webkit.org/show_bug.cgi?id=79778
+
+        Totally rubber-stamped by Andreas Kling.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSParser.cpp:
+        * css/CSSStyleRule.cpp:
+        (WebCore):
+        (WebCore::CSSStyleRule::style):
+        * css/CSSStyleRule.h:
+        (WebCore):
+        (CSSStyleRule):
+        * css/CSSStyleSelector.cpp:
+        * css/CSSStyleSheet.cpp:
+        * css/StyleRule.cpp: Copied from Source/WebCore/css/CSSStyleRule.cpp.
+        (WebCore):
+        * css/StyleRule.h: Copied from Source/WebCore/css/CSSStyleRule.h.
+        (WebCore):
+        * editing/EditingStyle.cpp:
+        * inspector/InspectorCSSAgent.cpp:
+        * inspector/InspectorInstrumentation.cpp:
+        * inspector/InspectorStyleSheet.cpp:
+        * page/PageSerializer.cpp:
+
+2012-02-28  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: remove window aspects from the timeline presentation model.
+        https://bugs.webkit.org/show_bug.cgi?id=79803
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype.accept):
+        (WebInspector.TimelineOverviewPane.prototype._setWindowIndices):
+        (WebInspector.TimelineOverviewPane.prototype.windowLeft):
+        (WebInspector.TimelineOverviewPane.prototype.windowRight):
+        (WebInspector.TimelineOverviewPane.prototype._fireWindowChanged):
+        (WebInspector.TimelineOverviewWindow.prototype._dragWindow):
+        (WebInspector.TimelineOverviewPane.WindowSelector):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._onCategoryCheckboxClicked):
+        (WebInspector.TimelinePanel.prototype._updateBoundaries):
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel.prototype.reset):
+        (WebInspector.TimelineCategory):
+        (WebInspector.TimelineCategory.prototype.get hidden):
+        (WebInspector.TimelineCategory.prototype.set hidden):
+
+2012-02-28  Kenneth Rohde Christiansen  <kenneth@webkit.org>
+
+        Improve the visual of the tiling
+        https://bugs.webkit.org/show_bug.cgi?id=79648
+
+        Reviewed by Noam Rosenthal.
+
+        When we cover the view with tiles[1], we do so from the center
+        and out, in bigger and bigger cicles by finding the current minimum
+        covered distance.
+
+        This looks like painting a rect, then a cross, then a rect, ...
+        and can be noticed when a page blocks during tiling.
+
+        We can do this better by only covering with tiles in rects at a time.
+
+        The original code was done so that it gave preference to tiles in
+        vertical direction due to that being the most common scrolling
+        direction. This is not needed anymore as we are now using the
+        trajectory vector when panning, which always gives preference for
+        creating tiles in the panned direction.
+
+        [1] It should be noted that we always cover the visibleRect in one go,
+            and that we here are talking about covering the coverRect beyond
+            the visibleRect
+
+        * platform/graphics/TiledBackingStore.cpp:
+        (WebCore::TiledBackingStore::tileDistance):
+
+2012-02-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: preserve memory counters size after frontend reopening
+        https://bugs.webkit.org/show_bug.cgi?id=79792
+
+        Clear collected counter values when timeline panel is reset. Persist
+        timeline grid/counters splitter position to restore it when front-end
+        is opened next time.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.prototype.reset):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._setSplitterPosition):
+        (WebInspector.TimelinePanel.prototype._resetPanel):
+        * inspector/front-end/timelinePanel.css:
+        (#counter-values-bar):
+
+2012-02-28  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: move filtering of the timeline records into the presentation model.
+        https://bugs.webkit.org/show_bug.cgi?id=79789
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/TimelineModel.js:
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype.setStartAtZero):
+        (WebInspector.TimelineOverviewPane.prototype.scrollWindow):
+        (WebInspector.TimelineOverviewPane.prototype.accept):
+        (WebInspector.TimelineOverviewPane.prototype._setWindowIndices):
+        (WebInspector.TimelineStartAtZeroOverview):
+        (WebInspector.TimelineStartAtZeroOverview.prototype._onWindowChanged):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._createStatusbarButtons):
+        (WebInspector.TimelinePanel.prototype._updateRecordsCounter):
+        (WebInspector.TimelinePanel.prototype._glueParentButtonClicked):
+        (WebInspector.TimelinePanel.prototype._toggleStartAtZeroButtonClicked):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._resetPanel):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype.revealRecordAt):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelineExpandableElement.prototype._update):
+        (WebInspector.TimelineCategoryFilter):
+        (WebInspector.TimelineCategoryFilter.prototype.accept):
+        (WebInspector.TimelineIsLongFilter):
+        (WebInspector.TimelineIsLongFilter.prototype.accept):
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel):
+        (WebInspector.TimelinePresentationModel.prototype.addFilter):
+        (WebInspector.TimelinePresentationModel.prototype.reset):
+        (WebInspector.TimelinePresentationModel.prototype.minimumRecordTime):
+        (WebInspector.TimelinePresentationModel.prototype.maximumRecordTime):
+        (WebInspector.TimelinePresentationModel.prototype.addRecord):
+        (WebInspector.TimelinePresentationModel.prototype._updateBoundaries):
+        (WebInspector.TimelinePresentationModel.prototype._findParentRecord):
+        (WebInspector.TimelinePresentationModel.prototype.setGlueRecords):
+        (WebInspector.TimelinePresentationModel.prototype.fireWindowChanged):
+        (WebInspector.TimelinePresentationModel.prototype.get _recordStyles):
+        (WebInspector.TimelinePresentationModel.prototype.filteredRecords):
+        (WebInspector.TimelinePresentationModel.prototype._filterRecords):
+        (WebInspector.TimelinePresentationModel.Record.prototype.get visibleChildrenCount):
+        (WebInspector.TimelinePresentationModel.Record.prototype.get invisibleChildrenCount):
+        (WebInspector.TimelinePresentationModel.Filter):
+        (WebInspector.TimelinePresentationModel.Filter.prototype.accept):
+
+2012-02-28  Florin Malita  <fmalita@google.com>
+
+        Percent width/height SVG not always scaled on window resize
+        https://bugs.webkit.org/show_bug.cgi?id=79490
+
+        Reviewed by Nikolas Zimmermann.
+
+        Tests: fast/repaint/percent-minheight-resize-expected.html
+               fast/repaint/percent-minheight-resize.html
+               svg/custom/svg-percent-scale-expected.html
+               svg/custom/svg-percent-scale-vonly-expected.html
+               svg/custom/svg-percent-scale-vonly.html
+               svg/custom/svg-percent-scale.html
+
+        Fix a couple of problems preventing correct SVG scaling on window resize:
+
+        - RenderReplaced::computePreferredLogicalWidths is not SVG attribute aware and computes
+        a non-zero m_minPreferredLogicalWidth even when the SVG widh/height are percentages.
+
+        - RenderBlock::layoutInlineChildren is also not SVG attribute aware and does not trigger
+        percent height child layouts on vertical-only resizes.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+        Use hasRelativeDimensions() instead of direct width/height->isPercent tests. This also fixes
+        an HTML issue where percent {min,max}Height inline elements are not updated on vertical-only resizes.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::hasRelativeDimensions):
+        (WebCore):
+        * rendering/RenderBox.h:
+        (RenderBox):
+        Add virtual hasRelativeDimensions() method.
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::computePreferredLogicalWidths):
+        Use hasRelativeDimensions() instead of direct width/height->isPercent tests.
+
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight):
+        (WebCore::RenderSVGRoot::willBeDestroyed):
+        Register percent-height SVG elements with the gPercentHeightDescendantsMap, and clean-up on destruction
+        or height unit change.
+
+        (WebCore::RenderSVGRoot::hasRelativeDimensions):
+        (WebCore):
+        * rendering/svg/RenderSVGRoot.h:
+        (RenderSVGRoot):
+        SVG-aware hasRelativeDimensions() override.
+
+2012-02-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: show resource dividers on memory counter graphs
+        https://bugs.webkit.org/show_bug.cgi?id=79782
+
+        Resource dividers are drawn on the memory counter graphs.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.prototype.updateDividers):
+        (WebInspector.MemoryStatistics.prototype.setMainTimelineGrid):
+        (WebInspector.MemoryStatistics.prototype._updateSize):
+        (WebInspector.MemoryStatistics.prototype.show):
+        (WebInspector.MemoryStatistics.prototype.refresh):
+        (WebInspector.MemoryStatistics.prototype._refreshDividers):
+        * inspector/front-end/TimelineGrid.js:
+        (WebInspector.TimelineGrid.prototype.get dividersElement):
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._timelinesOverviewModeChanged):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.prototype.get timlinePaddingLeft):
+        * inspector/front-end/timelinePanel.css:
+        (#memory-graphs-canvas-container):
+        (#memory-graphs-canvas-container .resources-dividers):
+
+2012-02-28  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Integrate SVGUseElement within the new shadow root concept
+        https://bugs.webkit.org/show_bug.cgi?id=78902
+
+        Reviewed by Zoltan Herczeg.
+
+        Replace SVG shadow tree implementation with the new, modern #shadow-root implementation.
+
+        Current situation in trunk:
+        SVGUseElement doesn't create/hold the shadow tree, unlike its expected in
+        the modern #shadow-root concept, but its renderer RenderSVGShadowTreeRootContainer.
+        That creates a cycle, as the actual DOM tree is stored as RefPtr<SVGGElement> inside
+        a renderer - that's weak conceptually, and has lead to sublte security bugs in the past.
+
+        Whenever a target element of a <use> element changed, invalidateShadowTree() is called
+        which calls setNeedsStyleRecalc(), and sets m_needsShadodwTreeRecreation to true.
+        Once style recalculation happens, the RenderSVGShadowTreeRootContainer then eventually
+        built the shadow tree, by cloning the target node, building the SVGElementInstance tree
+        etc, -- all within the render tree.
+
+        To easy reviewing, here's a dump of the current render tree for a simple <use> example:
+        <defs><rect id="rect"/></defs><use xlink:href="#rect"/>
+
+        Dump of render tree:
+        RenderSVGHiddenContainer {defs}        // <defs> (SVGDefsElement)
+            RenderSVGRect {rect}               // <rect> (SVGRectElement)
+        RenderSVGShadowTreeRootContainer {use} // <use> (SVGUseElement)
+            RenderSVGContainer {g}             // <g> (SVGShadowTreeRootElement)
+                RenderSVGRect {rect}           // <rect> (SVGRectElement, clone of <rect> in <defs>)
+
+        The SVGShadowTreeRootElement is created & stored by RenderSVGShadowTreeRootContainer,
+        the renderer of the <use> element. The RenderSVGTransformableContainer renderer created
+        for the SVGShadowTreeRootElement stores the x/y translation induced by the <use> attributes.
+
+        There are lots of places all over WebCore that assume the existance of a <g> renderer
+        as first child of the <use> element, representing the "SVG shadow tree root".
+
+        Summary of this patch:
+        Let SVGUseElement create&maintain a #shadow-root, and append the cloned target elements
+        into this shadow root. We no longer have to take care of attachment/detachment, style
+        recalculation, etc. - that's handled transparenly by ShadowRoot(List) now.
+
+        This makes SVGShadowTreeElements & RenderSVGShadowTreeRootContainer obsolete. Switch
+        SVGUseElement to create a RenderSVGTransformableContainer as its renderer, and make
+        it respect the translation induced by the x/y attributes, given for a <use> element.
+
+        Remove all occourences of SVGShadowRoot, remove all special cases it induced.
+
+        It's all covered by existing tests, took a while to make them all pass again.
+
+        * CMakeLists.txt: Remove SVGShadowTreeElements/RenderSVGShadowTreeRootContainer from build.
+        * GNUmakefile.list.am: Ditto.
+        * Target.pri: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList): Enable fast path for selector checking, now that special shadow tree rules are gone.
+        * css/SelectorChecker.cpp:
+        (WebCore::linkAttribute): No need to guard this code with ENABLE(SVG).
+        (WebCore::SelectorChecker::checkSelector): Remove obsolete SVG shadow root special case.
+        * dom/EventDispatcher.cpp:
+        (WebCore::eventTargetRespectingSVGTargetRules): Remove loop, simplify & cleanup this code.
+        (WebCore::EventDispatcher::adjustToShadowBoundaries): s/isShadowRootOrSVGShadowRoot/isShadowRoot/.
+        (WebCore::EventDispatcher::adjustRelatedTarget): Ditto.
+        (WebCore::EventDispatcher::ensureEventAncestors): Simplify logic for SVG, fixed a FIXME.
+        * dom/Node.cpp: Remove obsolete svgShadowHost().
+        (WebCore::Node::shadowTreeRootNode): Remove obsolete isSVGShadowRoot() checks.
+        (WebCore::Node::nonBoundaryShadowTreeRootNode): Ditto.
+        (WebCore::Node::isInShadowTree): Make it const.
+        * dom/Node.h: Remove isSVGShadowRoot/svgShadowHost.
+        (WebCore::Node::isShadowRoot): s/IsShadowRootOrSVGShadowRootFlag/isShadowRoot/.
+        (WebCore::Node::parentNode): Augment comments.
+        (WebCore::Node::parentNodeGuaranteedHostFree): Ditto.
+        * dom/Range.cpp:
+        (WebCore::Range::checkNodeBA): Remove obsolete SVG shadow root special case.
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::prepareScript): Ditto.
+        * rendering/RenderObject.h: Remove isSVGShadowTreeRootContainer.
+        (WebCore::RenderObject::isSVGTransformableContainer): Added.
+        * rendering/svg/RenderSVGAllInOne.cpp: Remove SVGShadowTreeElements/RenderSVGShadowTreeRootContainer from build.
+        * rendering/svg/RenderSVGModelObject.cpp:
+        (WebCore::isGraphicsElement): To check for <use>, a tag name comparision is needed now, as it no longer has a special renderer.
+        * rendering/svg/RenderSVGResourceClipper.cpp:
+        (WebCore::RenderSVGResourceClipper::drawContentIntoMaskImage): Ditto.
+        (WebCore::RenderSVGResourceClipper::calculateClipContentRepaintRect): Ditto.
+        (WebCore::RenderSVGResourceClipper::hitTestClipContent): Ditto.
+        * rendering/svg/RenderSVGResourceContainer.cpp: Remove RenderSVGShadowTreeRootContainer.h include.
+        * rendering/svg/RenderSVGShadowTreeRootContainer.cpp: Removed.
+        * rendering/svg/RenderSVGShadowTreeRootContainer.h: Removed.
+        * rendering/svg/RenderSVGTransformableContainer.cpp: Keep track of last used additional x/y translation.
+        (WebCore::RenderSVGTransformableContainer::calculateLocalTransform): Handle x/y translation for <use> contains here, instead of storing it in the SVGShadowTreeRootElement.
+        * rendering/svg/RenderSVGTransformableContainer.h: Store last used x/y translation.
+        (WebCore::RenderSVGTransformableContainer::isSVGTransformableContainer): Return true.
+        (WebCore::toRenderSVGTransformableContainer): Add conversion helpers.
+        * rendering/svg/RenderSVGViewportContainer.cpp: Ditto.
+        (WebCore::RenderSVGViewportContainer::calcViewport): Handle width/height attributes inheritance from the <use> element, if we're a <svg> or <symbol> replacement in the shadow tree.
+        * rendering/svg/RenderSVGViewportContainer.h: Remove isSVGContainer() override which is not needed here (already present in RenderSVGContainer).
+        * rendering/svg/SVGShadowTreeElements.cpp: Removed.
+        * rendering/svg/SVGShadowTreeElements.h: Removed.
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::createRenderer): Check if parentNode is really a SVGElement, before casting.
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::isOutermostSVGSVGElement): Early exit if tag name isn't <svg>, or if we're in a shadow tree (can't be an outermost <svg> element then).
+        (WebCore::hasLoadListener): Deploy parentOrHostElement() usage to remove any special cases, related to shadow boundaries.
+        (WebCore::SVGElement::sendSVGLoadEventIfPossible): Ditto.
+        (WebCore::SVGElement::customStyleForRenderer): Ditto.
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::invalidateAllInstancesOfElement): Call updateStyleIfNeeded() instead of updateLayoutIgnorePendingStylesheets().
+        * svg/SVGGElement.cpp:
+        (WebCore::SVGGElement::rendererIsNeeded): s/parentNode/parentOrHostElement/ - we need to cross shadow boundaries now.
+        * svg/SVGGElement.h: Remove obsolete isShadowTreeContainerElement().
+        * svg/SVGLocatable.cpp:
+        (WebCore::SVGLocatable::nearestViewportElement): s/parentNode/parentOrHostElement/ - we need to cross shadow boundaries now.
+        (WebCore::SVGLocatable::farthestViewportElement): Ditto.
+        (WebCore::SVGLocatable::computeCTM): Ditto.
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::title): Ditto. (+ simplify code a lot, no need to walk the shadow tree to find its root anymore, use isInShadowTree() helper.)
+        (WebCore::SVGStyledElement::rendererIsNeeded): Ditto.
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::SVGUseElement): Remove no longer needed m_updatesBlocked.
+        (WebCore::SVGUseElement::create): Always call ensureShadowRoot(), to create a #shadow-root, upon creating a SVGUseElement.
+        (WebCore::SVGUseElement::insertedIntoDocument): Align with SVGFEImageElement/SVGTRefElement - call buildPendingResource() from insertedIntoDocument(), finally! (no renderer needed anymore to update the SVG shadow subtree).
+        (WebCore::SVGUseElement::removedFromDocument): Align with SVGFEImageElement/SVGTRefElement - immediately release the SVGElementInstance & shadow tree, once we're removed from the document.
+        (WebCore::SVGUseElement::svgAttributeChanged): Simplify code a lot, no longer need to deal with x/y/width/height attributes, the renderes in the shadow tree grab these values from their corresponding <use> elements automatically now.
+        (WebCore::SVGUseElement::willRecalcStyle):
+            New main part of the logic. invalidateShadowTree() calls setNeedsStyleRecalc, and sets m_needsShadowTreeRecreation=true. If we encounter this case, force rebuilding the SVG shadow tree
+            and the SVGElementInstance tree, immediately, before executing the actual style recalc. This allows us to lazily rebuild the SVG shadow tree for the <use> element. Consider:
+            <defs><rect id="rect"></defs> <use xlink:href="#rect"/>. Now from a script we change the rect x/y/width/height attributes:
+            rect.setAttribute("x", "10"); rect.setAttribute("y", "10")... each call will lead to a SVGUseElement::invalidateShadowTree() call by SVGElementInstance::invalidateAllInstancesOfElement, invoked after the <rect> element got parsed.
+            This won't update the shadow tree four times, but only once upon the next style recalculation - otherwise performance is a nightmare.
+            This will serve as future starting point, to explore partial SVG subtree re-clones, which should easily be doable now.
+        (WebCore::dumpInstanceTree): Add a 'static' to allow DUMP_INSTANCE_TREE to be used in clang builds.
+        (WebCore::SVGUseElement::clearResourceReferences): Added helper to release instance & shadow tree.
+        (WebCore::SVGUseElement::buildPendingResource): Modeled exactly like SVGFEImageElement/SVGTRefElement. It's possible to share more code between these in future.
+        (WebCore::SVGUseElement::buildShadowAndInstanceTree): Cleanup code, adapt to new shadow-root concept.
+        (WebCore::SVGUseElement::createRenderer): Create a RenderSVGTransformableContainer, no longer a <use> specific renderer.
+        (WebCore::removeDisallowedElementsFromSubtree): Use new replacedChild/appendChild variants, that don't require a ExceptionCode to be passed in.
+        (WebCore::SVGUseElement::buildShadowTree): Ditto.
+        (WebCore::SVGUseElement::expandUseElementsInShadowTree): Ditto.
+        (WebCore::SVGUseElement::expandSymbolElementsInShadowTree): Ditto.
+        (WebCore::SVGUseElement::invalidateShadowTree): Only trigger style recalculations if needed.
+        * svg/SVGUseElement.h: Remove lots of now unnecessary overrides: attach/detach/didRecalcStyle/updateContainerOffset/updateContainerSizes/etc..
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::insertedIntoDocument): No need to walk the shadow tree to find its root anymore, use isInShadowTree() helper.
+
+2012-02-28  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Element should be able to have multiple shadow roots.
+        https://bugs.webkit.org/show_bug.cgi?id=77931
+
+        Reviewed by Hajime Morita.
+
+        This patch enables us to add multiple shadow subtrees into elements.
+        Note that multiple shadow subtrees are enabled
+        only if RuntimeEnabledFeatures::multipleShadowSubtrees is enabled.
+
+        Since we don't have <shadow> element yet, only the youngest shadow tree
+        will be rendered. This patch includes tests to confirm adding a new shadow
+        tree dynamically to confirm only the youngest shadow tree is renderered.
+
+        Tests: fast/dom/shadow/multiple-shadowroot-rendering.html
+               fast/dom/shadow/multiple-shadowroot.html
+
+        * WebCore.exp.in:
+        * dom/Element.cpp:
+          Uses ShadowRootList interfaces directly instead of ShadowRootList emulation methods.
+        (WebCore::Element::~Element):
+        (WebCore::Element::attach):
+        (WebCore::Element::addShadowRoot):
+        (WebCore::Element::removeShadowRootList):
+        * dom/Element.h:
+        (Element):
+        * dom/NodeRenderingContext.cpp:
+          Makes non-youngest shadow subtrees hidden.
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::NodeRenderingContext::hostChildrenChanged):
+          Since non-youngest children may be changed, make sure host children are changed.
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::create):
+        * dom/ShadowRoot.h:
+          Utility methods to make code intention clear are added.
+        (WebCore::ShadowRoot::youngerShadowRoot):
+        (WebCore::ShadowRoot::olderShadowRoot):
+        (ShadowRoot):
+        (WebCore::ShadowRoot::isYoungest):
+        (WebCore::ShadowRoot::isOldest):
+        * dom/ShadowRootList.cpp:
+        (WebCore::ShadowRootList::popShadowRoot):
+        (WebCore::ShadowRootList::attach):
+        (WebCore::ShadowRootList::detach):
+          Detaches shadow subtrees.
+        * testing/Internals.cpp:
+        (WebCore::Internals::address):
+        (WebCore):
+        (WebCore::Internals::youngerShadowRoot):
+        (WebCore::Internals::olderShadowRoot):
+        (WebCore::Internals::removeShadowRoot):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-02-28  Antti Koivisto  <antti@apple.com>
+
+        Split CSSStyleRule into internal and CSSOM type
+        https://bugs.webkit.org/show_bug.cgi?id=79763
+
+        Reviewed by Andreas Kling.
+
+        - Split the data out as StyleRule
+        - Make CSSStyleSelector operate on StyleRule instead of CSSStyleRule
+        
+        This is an intermediate step. Both CSSStyleRule and StyleRule are still always constructed so
+        the patch increases memory consumption by a few pointers per css rule. Upcoming
+        patches will make CSSStyleRules to be constructed on demand.
+        
+        The patch does not yet move StyleRule to a file of its own.
+
+        * css/CSSPageRule.cpp:
+        (WebCore::CSSPageRule::CSSPageRule):
+        * css/CSSPageRule.h:
+        (WebCore::CSSPageRule::create):
+        (CSSPageRule):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::createPageRule):
+        * css/CSSRule.h:
+        (WebCore::CSSRule::CSSRule):
+        (CSSRule):
+        * css/CSSStyleRule.cpp:
+        (WebCore::StyleRule::StyleRule):
+        (WebCore):
+        (WebCore::StyleRule::~StyleRule):
+        (WebCore::StyleRule::addSubresourceStyleURLs):
+        (WebCore::StyleRule::ensureCSSStyleRule):
+        (WebCore::CSSStyleRule::CSSStyleRule):
+        (WebCore::CSSStyleRule::~CSSStyleRule):
+        (WebCore::CSSStyleRule::generateSelectorText):
+        (WebCore::CSSStyleRule::setSelectorText):
+        (WebCore::CSSStyleRule::cssText):
+        * css/CSSStyleRule.h:
+        (WebCore):
+        (StyleRule):
+        (WebCore::StyleRule::selectorList):
+        (WebCore::StyleRule::properties):
+        (WebCore::StyleRule::sourceLine):
+        (WebCore::StyleRule::adoptSelectorVector):
+        (WebCore::StyleRule::adoptSelectorList):
+        (WebCore::StyleRule::setProperties):
+        (WebCore::CSSStyleRule::create):
+        (WebCore::CSSStyleRule::style):
+        (CSSStyleRule):
+        (WebCore::CSSStyleRule::styleRule):
+        * css/CSSStyleSelector.cpp:
+        (RuleData):
+        (WebCore::RuleData::rule):
+        (RuleSet):
+        (WebCore::CSSStyleSelector::addMatchedProperties):
+        (WebCore::CSSStyleSelector::sortAndTransferMatchedRules):
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+        * css/CSSStyleSelector.h:
+        (WebCore::CSSStyleSelector::RuleSelectorPair::RuleSelectorPair):
+        (RuleSelectorPair):
+        (MatchResult):
+        (CSSStyleSelector):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addSubresourceStyleURLs):
+        * editing/EditingStyle.cpp:
+        (WebCore::styleFromMatchedRulesForElement):
+        * inspector/InspectorCSSAgent.cpp:
+        (WebCore::SelectorProfile::startSelector):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::willMatchRuleImpl):
+        (WebCore::InspectorInstrumentation::willProcessRuleImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore):
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::willMatchRule):
+        (WebCore::InspectorInstrumentation::willProcessRule):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::buildObjectForRule):
+        (WebCore::InspectorStyleSheet::revalidateStyle):
+        * page/PageSerializer.cpp:
+        (WebCore::PageSerializer::serializeFrame):
+        (WebCore::PageSerializer::serializeCSSStyleSheet):
+        (WebCore::PageSerializer::retrieveResourcesForRule):
+        (WebCore::PageSerializer::retrieveResourcesForProperties):
+        * page/PageSerializer.h:
+        (WebCore):
+        (PageSerializer):
+
+2012-02-28  Roland Steiner  <rolandsteiner@chromium.org>
+
+        RuntimeEnabledFeatures::setMultipleShadowSubtreesEnabled should not be inline
+        https://bugs.webkit.org/show_bug.cgi?id=79753
+
+        Moved the function implementation to the .cpp file.
+
+        Reviewed by Hajime Morita.
+
+        No new tests. (no functional change)
+
+        * bindings/generic/RuntimeEnabledFeatures.cpp:
+        (WebCore::RuntimeEnabledFeatures::setMultipleShadowSubtreesEnabled):
+        (WebCore):
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (RuntimeEnabledFeatures):
+
+2012-02-28  Noel Gordon  <noel.gordon@gmail.com>
+
+        Fix comment about RGB swizzle decoding and Adobe transform=0 images
+        https://bugs.webkit.org/show_bug.cgi?id=79457
+
+        Unreviewed. No new tests, comment change only.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::decode):
+
+2012-02-27  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Element::removeShadowRoot() and setShadowRoot() should be moved into ShadowTree.
+        https://bugs.webkit.org/show_bug.cgi?id=78313
+
+        Reviewed by Hajime Morita.
+
+        This patch is for refactoring ShadowTree related code.
+          (1) Element::removeShadowRoot() and Element::setShadowRoot() are moved into ShadowTree.
+          (2) ShadowTree is now put on its own heap.
+
+        No new tests, no change in behavior.
+
+        * WebCore.exp.in:
+        * dom/Element.cpp:
+        (WebCore::Element::~Element):
+        (WebCore::Element::shadowTree):
+        (WebCore::Element::ensureShadowTree):
+          Ensure the existence of ShadowTree. This does not ensure ShadowRoot exists.
+        * dom/Element.h:
+        (Element):
+        * dom/ElementRareData.h:
+          Makes ShadowTree on Heap.
+        (ElementRareData):
+        (WebCore::ElementRareData::~ElementRareData):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::create):
+        * dom/ShadowTree.cpp:
+        (WebCore::validateShadowRoot):
+        (WebCore):
+        (WebCore::ShadowTree::addShadowRoot):
+        (WebCore::ShadowTree::removeAllShadowRoots):
+        * dom/ShadowTree.h:
+        (ShadowTree):
+        * testing/Internals.cpp:
+        (WebCore::Internals::removeShadowRoot):
+
+2012-02-27  David Barton  <dbarton@mathscribe.com>
+
+        Fix <msubsup> formatting, especially for a tall base, subscript, or superscript
+        https://bugs.webkit.org/show_bug.cgi?id=79274
+
+        Reviewed by Julien Chaffraix.
+
+        Move the <msubsup> formatting code in stretchToHeight() to layout(). Then revise the
+        combined code to produce more vertically accurate results, and without extra white
+        space. Finally, don't multiply msub/msup/msubsup operator stretching by 1.2.
+
+        Test: Added the bug report's attached test case to mathml/presentation/subsup.xhtml, and
+        it and 5 other test files in mathml/presentation now produce improved results. The
+        integral sign in mo-stretch.html is no longer scaled up by an extra 1.2, and baselines
+        are more accurate so the base is higher in msubsup-sub-changed.png. Several examples are
+        slightly tighter vertically, because their (somewhat) anonymous blocks wrapping
+        subscripts and superscripts now have the correct font size.
+
+        * rendering/mathml/RenderMathMLSubSup.cpp:
+        (WebCore):
+        (WebCore::RenderMathMLSubSup::addChild):
+        (WebCore::RenderMathMLSubSup::stretchToHeight):
+        (WebCore::RenderMathMLSubSup::layout):
+        * rendering/mathml/RenderMathMLSubSup.h:
+        (RenderMathMLSubSup):
+        * rendering/style/RenderStyle.h:
+
+2012-02-27  Ned Holbrook  <nholbrook@apple.com>
+
+        kCTFontTableOptionExcludeSynthetic is unneeded
+        https://bugs.webkit.org/show_bug.cgi?id=79744
+
+        Reviewed by Dan Bernstein.
+
+        The aforementioned option is a no-op, so no new tests.
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::fontHasVerticalGlyphs): Specify no options.
+
+2012-02-27  Wei James  <james.wei@intel.com>
+
+        Multi-Channel support in AudioBufferSourceNode
+        https://bugs.webkit.org/show_bug.cgi?id=79202
+
+        Reviewed by Chris Rogers.
+
+        Test: webaudio/audiobuffersource-multi-channels.html
+
+        * webaudio/AudioBufferSourceNode.cpp:
+        (WebCore::AudioBufferSourceNode::renderSilenceAndFinishIfNotLooping):
+        (WebCore::AudioBufferSourceNode::renderFromBuffer):
+        (WebCore::AudioBufferSourceNode::setBuffer):
+        * webaudio/AudioBufferSourceNode.h:
+        (AudioBufferSourceNode):
+
+2012-02-27  Leo Yang  <leo.yang@torchmobile.com.cn>
+
+        [BlackBerry] Upstream the BlackBerry change to platform/graphics/IntRect.h
+        https://bugs.webkit.org/show_bug.cgi?id=79732
+
+        Reviewed by Antonio Gomes.
+
+        Add conversion convenience between WebCore::IntRect and BlackBerry::Platform::IntRect.
+
+        The porting can't be built yet, no new tests.
+
+        * platform/graphics/IntRect.h:
+        (Platform):
+        (IntRect):
+
+2012-02-27  Emil A Eklund  <eae@chromium.org>
+
+        Printed font-size should not be dependant on zoom level
+        https://bugs.webkit.org/show_bug.cgi?id=79717
+
+        Reviewed by Adam Barth.
+
+        Ignore full page zoom level when printing a document.
+
+        Test: printing/zoomed-document.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-02-27  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] Unreviewed gardening, further compile fixes for
+        TransparencyWinTest.
+
+        * platform/graphics/chromium/TransparencyWin.h:
+        (WebCore):
+
+2012-02-27  Kenichi Ishibashi  <bashi@chromium.org>
+
+        [Chromium] Unreviewed gardening, fix compile error after r109043
+
+        * platform/graphics/chromium/TransparencyWin.h:
+        (TransparencyWin):
+
+2012-02-27  Adam Barth  <abarth@webkit.org>
+
+        EventFactory.in should be named EventNames.in
+        https://bugs.webkit.org/show_bug.cgi?id=79727
+
+        Reviewed by Kentaro Hara.
+
+        Originally EventFactory.in was just used to generate EventFactory.cpp,
+        but now we're able to generate a bunch of other Event-related code from
+        this "in" file.
+
+        In writing some documentation about how to use these mechanisms, the
+        name EventFactory.in didn't seem like the right name.  This patch
+        renames EventFactory.in to EventNames.in, which more accurately
+        describes the role of this file (and matches the naming convention of
+        HTMLTagNames.in).
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gyp/scripts/action_makenames.py:
+        (main):
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/EventNames.in: Copied from Source/WebCore/dom/EventFactory.in.
+        * dom/EventFactory.in: Removed.
+
+2012-02-27  Yoshifumi Inoue  <yosin@chromium.org>
+
+        [Forms] Make order of attribute/method in HTMLInputElement.idl as same as specification
+        https://bugs.webkit.org/show_bug.cgi?id=79622
+
+        For ease of maintainability, this patch reorders attributes and methods declaration
+        matching with specification.
+
+        Reviewed by Adam Barth.
+
+        No new tests. No behavior change.
+
+        * html/HTMLInputElement.idl: Reorder and remove obsolete comments.
+
+2012-02-27  Luke Macpherson   <macpherson@chromium.org>
+
+        Sort CSSStyleSelector property handler constructors by CSS property name.
+        https://bugs.webkit.org/show_bug.cgi?id=79713
+
+        Reviewed by Andreas Kling.
+
+        No new tests / refactoring only.
+
+        This patch is simply an automated sort of the property constructors.
+        Presently they are all over the place and it is difficult to know where to insert new rules.
+        This patch provides a clear pattern and should reduce future conflicts when adding properties.
+
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+
+2012-02-27  James Kozianski  <koz@chromium.org>
+
+        [chromium] Plumb extensionGroup into didCreateScriptContext().
+        https://bugs.webkit.org/show_bug.cgi?id=79072
+
+        Reviewed by Darin Fisher.
+
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::initContextIfNeeded):
+        * bindings/v8/V8IsolatedContext.cpp:
+        (WebCore::V8IsolatedContext::V8IsolatedContext):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didCreateScriptContext):
+        * loader/FrameLoaderClient.h:
+        (FrameLoaderClient):
+
+2012-02-27  Huang Dongsung  <luxtella@company100.net>
+
+        Fixed a typo in CanvasRenderingContext2D::drawImage(HTMLCanvasElement);
+        incorrect source and destination rect used.
+        https://bugs.webkit.org/show_bug.cgi?id=79566
+
+        Pass dstRect and bufferSrcRect to
+        CanvasRenderingContext2D::fullCanvasCompositedDrawImage() for the destination
+        and source rect, respectively.
+
+        Reviewed by Daniel Bates.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+
+2012-02-27  Hyowon Kim  <hw1008.kim@samsung.com>
+
+        [EFL] Initial implementation of GraphicsContext3DPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=62961
+
+        Reviewed by Noam Rosenthal.
+
+        This patch adds the GraphicsContext3DPrivate class using Evas_GL.
+        GraphicsContext3DPrivate delegates all GL function calls to Evas_GL_API.
+
+        * platform/graphics/efl/GraphicsContext3DPrivate.cpp: Added.
+        (WebCore):
+        (WebCore::GraphicsContext3DPrivate::create):
+        (WebCore::GraphicsContext3DPrivate::GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::~GraphicsContext3DPrivate):
+        (WebCore::GraphicsContext3DPrivate::initialize):
+        (WebCore::GraphicsContext3DPrivate::createSurface):
+        (WebCore::GraphicsContext3DPrivate::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3DPrivate::makeContextCurrent):
+        (WebCore::GraphicsContext3DPrivate::isGLES2Compliant):
+        (WebCore::GraphicsContext3DPrivate::activeTexture):
+        (WebCore::GraphicsContext3DPrivate::attachShader):
+        (WebCore::GraphicsContext3DPrivate::bindAttribLocation):
+        (WebCore::GraphicsContext3DPrivate::bindBuffer):
+        (WebCore::GraphicsContext3DPrivate::bindFramebuffer):
+        (WebCore::GraphicsContext3DPrivate::bindRenderbuffer):
+        (WebCore::GraphicsContext3DPrivate::bindTexture):
+        (WebCore::GraphicsContext3DPrivate::blendColor):
+        (WebCore::GraphicsContext3DPrivate::blendEquation):
+        (WebCore::GraphicsContext3DPrivate::blendEquationSeparate):
+        (WebCore::GraphicsContext3DPrivate::blendFunc):
+        (WebCore::GraphicsContext3DPrivate::blendFuncSeparate):
+        (WebCore::GraphicsContext3DPrivate::bufferData):
+        (WebCore::GraphicsContext3DPrivate::bufferSubData):
+        (WebCore::GraphicsContext3DPrivate::checkFramebufferStatus):
+        (WebCore::GraphicsContext3DPrivate::clear):
+        (WebCore::GraphicsContext3DPrivate::clearColor):
+        (WebCore::GraphicsContext3DPrivate::clearDepth):
+        (WebCore::GraphicsContext3DPrivate::clearStencil):
+        (WebCore::GraphicsContext3DPrivate::colorMask):
+        (WebCore::GraphicsContext3DPrivate::compileShader):
+        (WebCore::GraphicsContext3DPrivate::copyTexImage2D):
+        (WebCore::GraphicsContext3DPrivate::copyTexSubImage2D):
+        (WebCore::GraphicsContext3DPrivate::cullFace):
+        (WebCore::GraphicsContext3DPrivate::depthFunc):
+        (WebCore::GraphicsContext3DPrivate::depthMask):
+        (WebCore::GraphicsContext3DPrivate::depthRange):
+        (WebCore::GraphicsContext3DPrivate::detachShader):
+        (WebCore::GraphicsContext3DPrivate::disable):
+        (WebCore::GraphicsContext3DPrivate::disableVertexAttribArray):
+        (WebCore::GraphicsContext3DPrivate::drawArrays):
+        (WebCore::GraphicsContext3DPrivate::drawElements):
+        (WebCore::GraphicsContext3DPrivate::enable):
+        (WebCore::GraphicsContext3DPrivate::enableVertexAttribArray):
+        (WebCore::GraphicsContext3DPrivate::finish):
+        (WebCore::GraphicsContext3DPrivate::flush):
+        (WebCore::GraphicsContext3DPrivate::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3DPrivate::framebufferTexture2D):
+        (WebCore::GraphicsContext3DPrivate::frontFace):
+        (WebCore::GraphicsContext3DPrivate::generateMipmap):
+        (WebCore::GraphicsContext3DPrivate::getActiveAttrib):
+        (WebCore::GraphicsContext3DPrivate::getActiveUniform):
+        (WebCore::GraphicsContext3DPrivate::getAttachedShaders):
+        (WebCore::GraphicsContext3DPrivate::getAttribLocation):
+        (WebCore::GraphicsContext3DPrivate::getBooleanv):
+        (WebCore::GraphicsContext3DPrivate::getBufferParameteriv):
+        (WebCore::GraphicsContext3DPrivate::getContextAttributes):
+        (WebCore::GraphicsContext3DPrivate::getError):
+        (WebCore::GraphicsContext3DPrivate::getFloatv):
+        (WebCore::GraphicsContext3DPrivate::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3DPrivate::getIntegerv):
+        (WebCore::GraphicsContext3DPrivate::getProgramiv):
+        (WebCore::GraphicsContext3DPrivate::getProgramInfoLog):
+        (WebCore::GraphicsContext3DPrivate::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3DPrivate::getShaderiv):
+        (WebCore::GraphicsContext3DPrivate::getShaderInfoLog):
+        (WebCore::GraphicsContext3DPrivate::getShaderSource):
+        (WebCore::GraphicsContext3DPrivate::getString):
+        (WebCore::GraphicsContext3DPrivate::getTexParameterfv):
+        (WebCore::GraphicsContext3DPrivate::getTexParameteriv):
+        (WebCore::GraphicsContext3DPrivate::getUniformfv):
+        (WebCore::GraphicsContext3DPrivate::getUniformiv):
+        (WebCore::GraphicsContext3DPrivate::getUniformLocation):
+        (WebCore::GraphicsContext3DPrivate::getVertexAttribfv):
+        (WebCore::GraphicsContext3DPrivate::getVertexAttribiv):
+        (WebCore::GraphicsContext3DPrivate::getVertexAttribOffset):
+        (WebCore::GraphicsContext3DPrivate::hint):
+        (WebCore::GraphicsContext3DPrivate::isBuffer):
+        (WebCore::GraphicsContext3DPrivate::isEnabled):
+        (WebCore::GraphicsContext3DPrivate::isFramebuffer):
+        (WebCore::GraphicsContext3DPrivate::isProgram):
+        (WebCore::GraphicsContext3DPrivate::isRenderbuffer):
+        (WebCore::GraphicsContext3DPrivate::isShader):
+        (WebCore::GraphicsContext3DPrivate::isTexture):
+        (WebCore::GraphicsContext3DPrivate::lineWidth):
+        (WebCore::GraphicsContext3DPrivate::linkProgram):
+        (WebCore::GraphicsContext3DPrivate::pixelStorei):
+        (WebCore::GraphicsContext3DPrivate::polygonOffset):
+        (WebCore::GraphicsContext3DPrivate::readPixels):
+        (WebCore::GraphicsContext3DPrivate::renderbufferStorage):
+        (WebCore::GraphicsContext3DPrivate::sampleCoverage):
+        (WebCore::GraphicsContext3DPrivate::scissor):
+        (WebCore::GraphicsContext3DPrivate::shaderSource):
+        (WebCore::GraphicsContext3DPrivate::stencilFunc):
+        (WebCore::GraphicsContext3DPrivate::stencilFuncSeparate):
+        (WebCore::GraphicsContext3DPrivate::stencilMask):
+        (WebCore::GraphicsContext3DPrivate::stencilMaskSeparate):
+        (WebCore::GraphicsContext3DPrivate::stencilOp):
+        (WebCore::GraphicsContext3DPrivate::stencilOpSeparate):
+        (WebCore::GraphicsContext3DPrivate::texImage2D):
+        (WebCore::GraphicsContext3DPrivate::texParameterf):
+        (WebCore::GraphicsContext3DPrivate::texParameteri):
+        (WebCore::GraphicsContext3DPrivate::texSubImage2D):
+        (WebCore::GraphicsContext3DPrivate::uniform1f):
+        (WebCore::GraphicsContext3DPrivate::uniform1fv):
+        (WebCore::GraphicsContext3DPrivate::uniform1i):
+        (WebCore::GraphicsContext3DPrivate::uniform1iv):
+        (WebCore::GraphicsContext3DPrivate::uniform2f):
+        (WebCore::GraphicsContext3DPrivate::uniform2fv):
+        (WebCore::GraphicsContext3DPrivate::uniform2i):
+        (WebCore::GraphicsContext3DPrivate::uniform2iv):
+        (WebCore::GraphicsContext3DPrivate::uniform3f):
+        (WebCore::GraphicsContext3DPrivate::uniform3fv):
+        (WebCore::GraphicsContext3DPrivate::uniform3i):
+        (WebCore::GraphicsContext3DPrivate::uniform3iv):
+        (WebCore::GraphicsContext3DPrivate::uniform4f):
+        (WebCore::GraphicsContext3DPrivate::uniform4fv):
+        (WebCore::GraphicsContext3DPrivate::uniform4i):
+        (WebCore::GraphicsContext3DPrivate::uniform4iv):
+        (WebCore::GraphicsContext3DPrivate::uniformMatrix2fv):
+        (WebCore::GraphicsContext3DPrivate::uniformMatrix3fv):
+        (WebCore::GraphicsContext3DPrivate::uniformMatrix4fv):
+        (WebCore::GraphicsContext3DPrivate::useProgram):
+        (WebCore::GraphicsContext3DPrivate::validateProgram):
+        (WebCore::GraphicsContext3DPrivate::vertexAttrib1f):
+        (WebCore::GraphicsContext3DPrivate::vertexAttrib1fv):
+        (WebCore::GraphicsContext3DPrivate::vertexAttrib2f):
+        (WebCore::GraphicsContext3DPrivate::vertexAttrib2fv):
+        (WebCore::GraphicsContext3DPrivate::vertexAttrib3f):
+        (WebCore::GraphicsContext3DPrivate::vertexAttrib3fv):
+        (WebCore::GraphicsContext3DPrivate::vertexAttrib4f):
+        (WebCore::GraphicsContext3DPrivate::vertexAttrib4fv):
+        (WebCore::GraphicsContext3DPrivate::vertexAttribPointer):
+        (WebCore::GraphicsContext3DPrivate::viewport):
+        (WebCore::GraphicsContext3DPrivate::createBuffer):
+        (WebCore::GraphicsContext3DPrivate::createFramebuffer):
+        (WebCore::GraphicsContext3DPrivate::createProgram):
+        (WebCore::GraphicsContext3DPrivate::createRenderbuffer):
+        (WebCore::GraphicsContext3DPrivate::createShader):
+        (WebCore::GraphicsContext3DPrivate::createTexture):
+        (WebCore::GraphicsContext3DPrivate::deleteBuffer):
+        (WebCore::GraphicsContext3DPrivate::deleteFramebuffer):
+        (WebCore::GraphicsContext3DPrivate::deleteProgram):
+        (WebCore::GraphicsContext3DPrivate::deleteRenderbuffer):
+        (WebCore::GraphicsContext3DPrivate::deleteShader):
+        (WebCore::GraphicsContext3DPrivate::deleteTexture):
+        (WebCore::GraphicsContext3DPrivate::synthesizeGLError):
+        (WebCore::GraphicsContext3DPrivate::getExtensions):
+        * platform/graphics/efl/GraphicsContext3DPrivate.h: Added.
+        (WebCore):
+        (GraphicsContext3DPrivate):
+
+2012-02-27  Shawn Singh  <shawnsingh@chromium.org>
+
+        RenderLayer ClipRect not accounting for transforms
+        https://bugs.webkit.org/show_bug.cgi?id=76486
+
+        Reviewed by Simon Fraser.
+
+        Test: compositing/layer-creation/overlap-transformed-and-clipped.html
+
+        This patch changes calculateClipRects() so that the clipRect
+        offset is allowed to be converted across layers with
+        transforms. This is necessary because the RenderLayerCompositor
+        needs clipRects in document space, rather than with respect to
+        some local clipping layer.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateClipRects):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localToContainerPoint):
+        (WebCore):
+        * rendering/RenderObject.h:
+        (RenderObject):
+
+2012-02-27  Adam Klein  <adamk@chromium.org>
+
+        [MutationObservers] Clear pending mutation records on disconnect()
+        https://bugs.webkit.org/show_bug.cgi?id=78639
+
+        Reviewed by Ojan Vafai.
+
+        Test: fast/mutation/disconnect-cancel-pending.html
+
+        * dom/WebKitMutationObserver.cpp:
+        (WebCore::WebKitMutationObserver::disconnect): Clear pending records.
+        (WebCore::WebKitMutationObserver::deliver): Avoid calling the callback if no records are pending delivery.
+
+2012-02-27  Adam Klein  <adamk@chromium.org>
+
+        Always notify subtree of removal in ContainerNode::removeChildren
+        https://bugs.webkit.org/show_bug.cgi?id=79316
+
+        Reviewed by Ryosuke Niwa.
+
+        In the inDocument case, Node::removedFromDocument is called.
+        In the out-of-document case, call ContainerNode::removedFromTree to ensure,
+        e.g., form-associated elements are properly disconnected.
+
+        Test: fast/forms/form-associated-element-removal.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren):
+
+2012-02-27  Adam Barth  <abarth@webkit.org>
+
+        Repair license blocks for files created during modularization
+        https://bugs.webkit.org/show_bug.cgi?id=79721
+
+        Reviewed by Eric Seidel.
+
+        We failed to copy the license blocks correctly when moving code into
+        these files.  This patch restores the correct license blocks.
+
+        * Modules/geolocation/NavigatorGeolocation.cpp:
+        * Modules/geolocation/NavigatorGeolocation.h:
+        * Modules/mediastream/NavigatorMediaStream.cpp:
+        * Modules/mediastream/NavigatorMediaStream.h:
+        * bindings/js/JSDOMWindowWebAudioCustom.cpp:
+        * bindings/js/JSDOMWindowWebSocketCustom.cpp:
+        * storage/DOMWindowSQLDatabase.cpp:
+        * storage/DOMWindowSQLDatabase.h:
+
+2012-02-27  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Extract the logic for computing the dirty rows / columns out of RenderTableSection::paintObject
+        https://bugs.webkit.org/show_bug.cgi?id=79580
+
+        Reviewed by Eric Seidel.
+
+        Refactoring only.
+
+        * rendering/RenderTableSection.h:
+        (CellSpan):
+        (WebCore::CellSpan::CellSpan):
+        (WebCore::CellSpan::start):
+        (WebCore::CellSpan::end):
+        Added this class to hold the span information.
+
+        (WebCore::RenderTableSection::fullTableRowSpan):
+        (WebCore::RenderTableSection::fullTableColumnSpan):
+        Those functions return the span corresponding to the full table.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::dirtiedRows):
+        (WebCore::RenderTableSection::dirtiedColumns):
+        Those functions compute the rows / columns impacted by a |damageRect|. On the slow painting path, they
+        return the full table span.
+
+        (WebCore::RenderTableSection::paintObject):
+        Updated this function to call the new ones. Also we now inflate the local rectangle with the outlineSize.
+        This wasn't done previously and we had to manually patch some size comparison to account for the outline.
+
+2012-02-27  Kentaro Hara  <haraken@chromium.org>
+
+        Rename resolve-supplemental.pl to preprocess-idls.pl
+        https://bugs.webkit.org/show_bug.cgi?id=79660
+
+        Reviewed by Adam Barth.
+
+        Due to r108322, resolve-supplemental.pl not only resolves supplemental
+        dependencies but also runs IDL attribute checker. For clarification,
+        this patch renames resolve-supplemental.pl to preprocess-idls.pl.
+
+        No tests. Confirm that all builds pass.
+
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * UseJSC.cmake:
+        * UseV8.cmake:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.vcproj/MigrateScripts:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/scripts/preprocess-idls.pl: Renamed from Source/WebCore/bindings/scripts/resolve-supplemental.pl.
+
+2012-02-27  Kentaro Hara  <haraken@chromium.org>
+
+        [JSC] Add [ConstructorParameters=] to all custom constructors
+        https://bugs.webkit.org/show_bug.cgi?id=78221
+
+        Reviewed by Adam Barth.
+
+        This patch adds [ConstructorParameters=X] to IDL files that have
+        custom constructors, where X is the maximum number of arguments
+        of the constructor. [ConstructorParameters=X] is needed for custom
+        constructors, because custom constructors do not have a signature
+        in IDL files and thus CodeGeneratorJS.pm cannot know the number of
+        constructor arguments.
+
+        Test: fast/js/constructor-length.html
+
+        * dom/WebKitMutationObserver.idl:
+        * html/DOMFormData.idl:
+        * html/canvas/ArrayBuffer.idl:
+        * html/canvas/DataView.idl:
+        * html/canvas/Float32Array.idl:
+        * html/canvas/Float64Array.idl:
+        * html/canvas/Int16Array.idl:
+        * html/canvas/Int32Array.idl:
+        * html/canvas/Int8Array.idl:
+        * html/canvas/Uint16Array.idl:
+        * html/canvas/Uint32Array.idl:
+        * html/canvas/Uint8Array.idl:
+        * html/canvas/Uint8ClampedArray.idl:
+        * webaudio/AudioContext.idl:
+
+        * bindings/scripts/test/TestTypedArray.idl:
+
+        * bindings/scripts/test/JS/JSFloat64Array.cpp: Updated run-bindings-tests results.
+        (WebCore::JSFloat64ArrayConstructor::finishCreation):
+
+2012-02-23  Raphael Kubo da Costa  <kubo@profusion.mobi>
+
+        [BlackBerry][EFL] Provide dummy RunLoop implementations.
+        https://bugs.webkit.org/show_bug.cgi?id=79398
+
+        Reviewed by Antonio Gomes.
+
+        r108067 fixed the EFL build by not building RunLoop.cpp on EFL and
+        BlackBerry, as both platforms lack an implementation that provides the
+        missing methods for the RunLoop class.
+
+        However, RunLoop.cpp is a generic file which should not be included
+        directly in PlatformWinCE.cmake (plus it helps in converting the
+        AppleWin port to CMake).
+
+        Fix this by providing a dummy implementation of the missing RunLoop
+        methods for both EFL and BlackBerry.
+
+        * CMakeLists.txt:
+        * PlatformBlackBerry.cmake:
+        * PlatformEfl.cmake:
+        * PlatformWinCE.cmake:
+        * platform/blackberry/RunLoopBlackBerry.cpp: Added.
+        (WebCore):
+        (WebCore::RunLoop::RunLoop):
+        (WebCore::RunLoop::~RunLoop):
+        (WebCore::RunLoop::wakeUp):
+        * platform/efl/RunLoopEfl.cpp: Added.
+        (WebCore):
+        (WebCore::RunLoop::RunLoop):
+        (WebCore::RunLoop::~RunLoop):
+        (WebCore::RunLoop::wakeUp):
+
+2012-02-27  John Sullivan  <sullivan@apple.com>
+
+        Build fix (on Lion at least).
+
+        * dom/Attr.cpp:
+        (WebCore::Attr::childrenChanged):
+        Removed names of unused parameters.
+        
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::childrenChanged):
+        Ditto.
+
+2012-02-27  Kentaro Hara  <haraken@chromium.org>
+
+        Remove [ConstructorParameters] from IDL files that have [Constructor]
+        https://bugs.webkit.org/show_bug.cgi?id=79643
+
+        Reviewed by Adam Barth.
+
+        This patch removes [ConstructorParameters] from IDL files that have [Constructor],
+        since CodeGeneratorJS.pm can automatically detect the number of constructor
+        arguments by the [Constructor(...)] signature.
+
+        Test: fast/js/constructor-length.html
+
+        * Modules/mediastream/PeerConnection.idl:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateConstructorDefinition):
+        * css/WebKitCSSMatrix.idl:
+        * page/EventSource.idl:
+        * workers/SharedWorker.idl:
+        * workers/Worker.idl:
+
+2012-02-27  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Avoid doing 2 hash lookups if we override RenderBox's logical width / height
+        https://bugs.webkit.org/show_bug.cgi?id=79591
+
+        Reviewed by Antonio Gomes.
+
+        Refactoring only.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clearOverrideSize):
+        Instead of doing one hash lookup as part of hasOverride{Height|Width}, let's
+        just directly call HashMap::remove that will do the lookup instead.
+
+2012-02-27  Adam Klein  <adamk@chromium.org>
+
+        Move WebCore-internal DOM notification methods from Node to ContainerNode where appropriate
+        https://bugs.webkit.org/show_bug.cgi?id=79697
+
+        Reviewed by Ryosuke Niwa.
+
+        insertedIntoTree/removedFromTree are only used by subclasses of
+        ContainerNode. Moreover, attempting to make use of these notifications
+        in a non-container Node would currently not work, because
+        Node::removedFromDocument/insertedIntoDocument do not dispatch to these methods.
+        Rather than adding useless calls to an always-empty virtual method,
+        this patch moves these methods to ContainerNode.
+
+        Meanwhile, childrenChanged moves to ContainerNode for an obvious reason:
+        non-container Nodes have no children to change.
+
+        No new tests, refactoring only.
+
+        * dom/Attr.cpp:
+        (WebCore::Attr::childrenChanged): Remove call to now-nonexistent Node::childrenChanged.
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChild): Check that the removed child is a container node before notifying it of removal.
+        (WebCore::ContainerNode::parserRemoveChild): ditto.
+        (WebCore::ContainerNode::insertedIntoTree): Remove call to now-nonexistent Node::insertedIntoTree.
+        (WebCore::ContainerNode::removedFromTree): Remove call to now-nonexistent Node::removedFromTree.
+        (WebCore::ContainerNode::childrenChanged): Remove call to now-nonexistent Node::childrenChanged.
+        (WebCore::notifyChildInserted): Check that the inserted child is a container node before notifying it of insertion.
+        * dom/ContainerNode.h:
+        (ContainerNode): Migrate comments from Node.h, point back at it for more notification methods.
+        * dom/Node.h:
+        (Node): Move methods, update comments to point at ContainerNode.h.
+
+2012-02-27  Chris Rogers  <crogers@google.com>
+
+        Implement static compression curve parameters for DynamicsCompressorNode
+        https://bugs.webkit.org/show_bug.cgi?id=78937
+
+        Reviewed by Kenneth Russell.
+
+        Test: webaudio/dynamicscompressor-basic.html
+
+        * platform/audio/DynamicsCompressor.cpp:
+        (WebCore::DynamicsCompressor::setParameterValue):
+        (WebCore):
+        (WebCore::DynamicsCompressor::initializeParameters):
+        (WebCore::DynamicsCompressor::process):
+        * platform/audio/DynamicsCompressor.h:
+        * platform/audio/DynamicsCompressorKernel.cpp:
+        (WebCore):
+        (WebCore::DynamicsCompressorKernel::DynamicsCompressorKernel):
+        (WebCore::DynamicsCompressorKernel::setPreDelayTime):
+        (WebCore::DynamicsCompressorKernel::kneeCurve):
+        (WebCore::DynamicsCompressorKernel::saturate):
+        (WebCore::DynamicsCompressorKernel::slopeAt):
+        (WebCore::DynamicsCompressorKernel::kAtSlope):
+        (WebCore::DynamicsCompressorKernel::updateStaticCurveParameters):
+        (WebCore::DynamicsCompressorKernel::process):
+        * platform/audio/DynamicsCompressorKernel.h:
+        (DynamicsCompressorKernel):
+        (WebCore::DynamicsCompressorKernel::meteringGain):
+        * webaudio/DynamicsCompressorNode.cpp:
+        (WebCore::DynamicsCompressorNode::DynamicsCompressorNode):
+        (WebCore::DynamicsCompressorNode::process):
+        * webaudio/DynamicsCompressorNode.h:
+        (WebCore):
+        (WebCore::DynamicsCompressorNode::create):
+        (DynamicsCompressorNode):
+        (WebCore::DynamicsCompressorNode::threshold):
+        (WebCore::DynamicsCompressorNode::knee):
+        (WebCore::DynamicsCompressorNode::ratio):
+        (WebCore::DynamicsCompressorNode::reduction):
+        * webaudio/DynamicsCompressorNode.idl:
+
+2012-02-27  Enrica Casucci  <enrica@apple.com>
+
+        WebKit2: implement platform strategy to access Pasteboard in the UI process.
+        https://bugs.webkit.org/show_bug.cgi?id=79253
+        <rdar://problem/9971876>
+
+        Reviewed by Alexey Proskuryakov.
+
+        No new tests. No behavior change.
+
+        * platform/mac/PlatformPasteboardMac.mm:
+        (WebCore::PlatformPasteboard::bufferForType): There is no need
+        to create a SharedBuffer object if there is no NSData in the pasteboard
+        for the given pasteboard type.
+
+2012-02-27  Adrienne Walker  <enne@google.com>
+
+        [chromium] Unreviewed speculative Chromium win build fix.
+
+        mdelaney's http://trac.webkit.org/changeset/109016 changed the
+        interface on ImageBuffer, but didn't update TransparencyWin.
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::OwnedBuffers::canHandleSize):
+
+2012-02-27  Matthew Delaney  <mdelaney@apple.com>
+
+        Add ImageBuffer support for having a hi-res backing store. This allows
+        ImageBuffer clients to specify a scale factor upon creation so that they
+        don't have to maintain that info themselves as they use/pass around the ImageBuffer.
+        https://bugs.webkit.org/show_bug.cgi?id=79395
+
+        Reviewed by Dan Bernstein.
+
+        No new tests. This patch doesn't change behavior.
+
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::ImageBuffer::create): Scale the backing store by the resolution scale.
+        (WebCore::ImageBuffer::logicalSize): Differentiate the logical size from the backing store's size.
+        (WebCore::ImageBuffer::internalSize): The backing store's size.
+
+        * platform/graphics/cg/ImageBufferCG.cpp: Prefer the explicit use of logicalSize and internalSize.
+
+        Explicitly state a 1x scale for all ImageBuffer creation sites
+        since this is what they currently assume.
+        * html/HTMLCanvasElement.cpp:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        * html/canvas/WebGLRenderingContext.cpp:
+        * page/Frame.cpp:
+        * platform/graphics/CrossfadeGeneratedImage.cpp:
+        * platform/graphics/ShadowBlur.cpp:
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        * platform/graphics/filters/FEDropShadow.cpp:
+        * platform/graphics/filters/FilterEffect.cpp:
+        * platform/mac/ScrollbarThemeMac.mm:
+        * rendering/FilterEffectRenderer.cpp:
+        * rendering/RenderThemeMac.mm:
+        * rendering/svg/SVGImageBufferTools.cpp:
+        * svg/graphics/SVGImage.cpp:
+        * svg/graphics/SVGImageCache.cpp:
+
+        Update ImageBuffer::size() calls to new versions.
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/ImageBuffer.cpp:
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+
+2012-02-27  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSSRegions]-webkit-flow-into initial value should be none instead of auto
+        https://bugs.webkit.org/show_bug.cgi?id=79670
+
+        Reviewed by Simon Fraser.
+
+        No new tests, modified expectations for existing tests.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFlowThread):
+        * css/CSSStyleApplyProperty.cpp:
+        (WebCore::CSSStyleApplyProperty::CSSStyleApplyProperty):
+
+2012-02-27  Ojan Vafai  <ojan@chromium.org>
+
+        implement display: -webkit-inline-flexbox
+        https://bugs.webkit.org/show_bug.cgi?id=77772
+
+        Reviewed by David Hyatt.
+
+        Tests: css3/flexbox/inline-flexbox-expected.html
+               css3/flexbox/inline-flexbox.html
+
+        * rendering/style/RenderStyle.h:
+        -Add INLINE_FLEXBOX to the list of replaced display types.
+        -Restructure the isDisplayInline methods to avoid code duplication.
+
+2012-02-27  Ken Buchanan  <kenrb@chromium.org>
+
+        Absolute positioned elements with Inline Relative Positioned Container are not layout correctly
+        https://bugs.webkit.org/show_bug.cgi?id=78713
+
+        Reviewed by David Hyatt.
+
+        Test: fast/css/positioned-in-relative-position-inline-crash.html
+
+        Patch originally by Robin Cao.
+
+        This is a regression. r104183 changes containingBlock() so that it returns the container
+        of an anonymous block for positioned objects, not the anonymous block itself. We should
+        change markContainingBlocksForLayout() to match the change in containingBlock().
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+
+2012-02-27  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: move record formatting into the timeline presentation model.
+        https://bugs.webkit.org/show_bug.cgi?id=79684
+
+        Drive-by: fix for stop recording in reset; cpu time restored.
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/TimelineModel.js:
+        (WebInspector.TimelineModel.prototype.reset):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype.update.updateBoundaries):
+        (WebInspector.TimelineOverviewCalculator.prototype.updateBoundaries):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel):
+        (WebInspector.TimelinePanel.prototype._rootRecord):
+        (WebInspector.TimelinePanel.prototype._updateRecordsCounter):
+        (WebInspector.TimelinePanel.prototype._repopulateRecords):
+        (WebInspector.TimelinePanel.prototype._onTimelineEventRecorded):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._resetPanel):
+        (WebInspector.TimelinePanel.prototype._refresh):
+        (WebInspector.TimelinePanel.prototype._updateBoundaries):
+        (WebInspector.TimelinePanel.prototype._filterRecords):
+        (WebInspector.TimelinePanel.prototype.revealRecordAt):
+        (WebInspector.TimelinePanel.prototype._showPopover):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineCalculator.prototype.computeBarGraphWindowPosition):
+        (WebInspector.TimelineCalculator.prototype.updateBoundaries):
+        (WebInspector.TimelineStartAtZeroCalculator.prototype.computeBarGraphPercentages):
+        (WebInspector.TimelineRecordGraphRow):
+        (WebInspector.TimelineRecordGraphRow.prototype.update):
+        * inspector/front-end/TimelinePresentationModel.js:
+        (WebInspector.TimelinePresentationModel):
+        (WebInspector.TimelinePresentationModel.prototype.createFormattedRecord):
+        (WebInspector.TimelinePresentationModel.prototype._createRootRecord):
+        (WebInspector.TimelinePresentationModel.prototype.rootRecord):
+        (WebInspector.TimelinePresentationModel.prototype.reset):
+        (WebInspector.TimelinePresentationModel.prototype._findParentRecord):
+        (WebInspector.TimelinePresentationModel.prototype._resetWindow):
+        (WebInspector.TimelinePresentationModel.prototype._addCategory):
+        (WebInspector.TimelinePresentationModel.prototype.setCategoryVisibility):
+        (WebInspector.TimelinePresentationModel.prototype.get _recordStyles):
+        (WebInspector.TimelinePresentationModel.Record):
+        (WebInspector.TimelinePresentationModel.Record.prototype.get lastChildEndTime):
+        (WebInspector.TimelinePresentationModel.Record.prototype.set lastChildEndTime):
+        (WebInspector.TimelinePresentationModel.Record.prototype.get selfTime):
+        (WebInspector.TimelinePresentationModel.Record.prototype.set selfTime):
+        (WebInspector.TimelinePresentationModel.Record.prototype.get cpuTime):
+        (WebInspector.TimelinePresentationModel.Record.prototype.isLong):
+        (WebInspector.TimelinePresentationModel.Record.prototype.get children):
+        (WebInspector.TimelinePresentationModel.Record.prototype.containsTime):
+        (WebInspector.TimelinePresentationModel.Record.prototype._generateAggregatedInfo):
+        (WebInspector.TimelinePresentationModel.Record.prototype.generatePopupContent):
+        (WebInspector.TimelinePresentationModel.Record.prototype._refreshDetails):
+        (WebInspector.TimelinePresentationModel.Record.prototype._getRecordDetails):
+        (WebInspector.TimelinePresentationModel.Record.prototype._linkifyLocation):
+        (WebInspector.TimelinePresentationModel.Record.prototype._linkifyCallFrame):
+        (WebInspector.TimelinePresentationModel.Record.prototype._linkifyTopCallFrame):
+        (WebInspector.TimelinePresentationModel.Record.prototype._linkifyScriptLocation):
+        (WebInspector.TimelinePresentationModel.Record.prototype.calculateAggregatedStats):
+        (WebInspector.TimelinePresentationModel.Record.prototype.get aggregatedStats):
+        (WebInspector.TimelinePresentationModel.PopupContentHelper):
+        (WebInspector.TimelinePresentationModel.PopupContentHelper.prototype._createCell):
+        (WebInspector.TimelinePresentationModel.PopupContentHelper.prototype._appendTextRow):
+        (WebInspector.TimelinePresentationModel.PopupContentHelper.prototype._appendElementRow):
+        (WebInspector.TimelinePresentationModel.PopupContentHelper.prototype._appendStackTrace):
+        * inspector/front-end/timelinePanel.css:
+        (.timeline-graph-bar.cpu):
+
+2012-02-27  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Scripts navigator overlay should not consume mouse actions.
+        https://bugs.webkit.org/show_bug.cgi?id=79674
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/Panel.js:
+        (WebInspector.Panel.prototype.registerShortcut):
+        (WebInspector.Panel.prototype.unregisterShortcut):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._editorClosed):
+        (WebInspector.ScriptsPanel.prototype._editorSelected):
+        (WebInspector.ScriptsPanel.prototype._fileSelected):
+        (WebInspector.ScriptsPanel.prototype._escDownWhileNavigatorOverlayOpen):
+        (WebInspector.ScriptsPanel.prototype.set _showNavigatorOverlay):
+        (WebInspector.ScriptsPanel.prototype._hideNavigatorOverlay):
+        (WebInspector.ScriptsPanel.prototype._navigatorOverlayWasShown):
+        * inspector/front-end/SidebarOverlay.js:
+        (WebInspector.SidebarOverlay):
+        (WebInspector.SidebarOverlay.prototype.show):
+        (WebInspector.SidebarOverlay.prototype._containingElementFocused):
+        (WebInspector.SidebarOverlay.prototype.position):
+        (WebInspector.SidebarOverlay.prototype.hide):
+        (WebInspector.SidebarOverlay.prototype._setWidth):
+        * inspector/front-end/dialog.css:
+        (.go-to-line-dialog button:active):
+        * inspector/front-end/scriptsPanel.css:
+        (#scripts-editor-view .sidebar-overlay):
+        * inspector/front-end/splitView.css:
+        (.split-view-resizer):
+        (.sidebar-overlay):
+        (.sidebar-overlay-resizer):
+
+2012-02-27  Philippe Normand  <pnormand@igalia.com>
+
+        [GStreamer] 0.11 support in MediaPlayerPrivateGStreamer
+        https://bugs.webkit.org/show_bug.cgi?id=77089
+
+        Reviewed by Martin Robinson.
+
+        Basic port to GStreamer 0.11 APIs. This patch excludes the video
+        painting changes and the GStreamerGWorld changes which are handled
+        in two other patches (bugs 77087 and 77088).
+
+        * GNUmakefile.list.am: Add GStreamerVersioning files to the build.
+        * Source/WebCore/PlatformEfl.cmake: Ditto.
+        * Source/WebCore/Target.pri: Ditto.
+        * platform/graphics/gstreamer/GRefPtrGStreamer.cpp:
+        (WTF::GstElement):
+        (WTF::GstPad):
+        (WTF::GstPadTemplate):
+        (WTF::GstTask):
+        * platform/graphics/gstreamer/GStreamerVersioning.cpp: Added.
+        (webkit_gst_object_ref_sink):
+        (webkit_gst_element_get_pad_caps):
+        * platform/graphics/gstreamer/GStreamerVersioning.h: Added.
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::isAvailable):
+        (WebCore::MediaPlayerPrivateGStreamer::duration):
+        (WebCore::MediaPlayerPrivateGStreamer::naturalSize):
+
+2012-02-27  Philip Rogers  <pdr@google.com>
+
+        Stop recomputing SVG path data twice during layout
+        https://bugs.webkit.org/show_bug.cgi?id=79672
+
+        Reviewed by Nikolas Zimmermann.
+
+        * rendering/svg/RenderSVGShape.cpp:
+        (WebCore::RenderSVGShape::layout):
+
+2012-02-27  Timothy Hatcher  <timothy@apple.com>
+
+        Updated for WebKit2 string changes.
+
+        https://webkit.org/b/79649
+
+        Reviewed by John Sullivan.
+
+        * English.lproj/Localizable.strings: Updated.
+
+2012-02-27  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: Ctrl+K should not zoom in
+        https://bugs.webkit.org/show_bug.cgi?id=79676
+
+        Reviewed by Vsevolod Vlasov.
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentKeyDown):
+
+2012-02-27  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: extract TimelineModel and TimelinePresentationModel into their own files.
+        https://bugs.webkit.org/show_bug.cgi?id=79675
+
+        Reviewed by Vsevolod Vlasov.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/compile-front-end.sh:
+        * inspector/front-end/TimelineAgent.js: Removed.
+        * inspector/front-end/TimelineModel.js: Added.
+        (WebInspector.TimelineModel):
+        (WebInspector.TimelineModel.prototype.startRecord):
+        (WebInspector.TimelineModel.prototype.stopRecord):
+        (WebInspector.TimelineModel.prototype.get records):
+        (WebInspector.TimelineModel.prototype._onRecordAdded):
+        (WebInspector.TimelineModel.prototype._addRecord):
+        (WebInspector.TimelineModel.prototype._loadNextChunk):
+        (WebInspector.TimelineModel.prototype._loadFromFile):
+        (WebInspector.TimelineModel.prototype._loadFromFile.onError):
+        (WebInspector.TimelineModel.prototype._saveToFile):
+        (WebInspector.TimelineModel.prototype._reset):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.get _recordStyles):
+        (WebInspector.TimelinePanel.prototype._createEventDivider):
+        (WebInspector.TimelinePanel.prototype._findParentRecord):
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):
+        * inspector/front-end/TimelinePresentationModel.js: Added.
+        (WebInspector.TimelinePresentationModel):
+        (WebInspector.TimelinePresentationModel.prototype.reset):
+        (WebInspector.TimelinePresentationModel.prototype.get categories):
+        (WebInspector.TimelinePresentationModel.prototype.addCategory):
+        (WebInspector.TimelinePresentationModel.prototype.setWindowPosition):
+        (WebInspector.TimelinePresentationModel.prototype.setWindowIndices):
+        (WebInspector.TimelinePresentationModel.prototype.setCategoryVisibility):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2012-02-27  Alexander Pavlov  <apavlov@chromium.org>
+
+        Web Inspector: [Styles] Allow adding CSS properties anywhere in the style declaration, not only at the end
+        https://bugs.webkit.org/show_bug.cgi?id=79662
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/CSSStyleModel.js:
+        (WebInspector.CSSStyleDeclaration.prototype.newBlankProperty):
+        (WebInspector.CSSProperty.prototype.setText):
+        (WebInspector.CSSProperty.prototype.setValue):
+        * inspector/front-end/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype._applyUserInput):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertiesSection):
+        (WebInspector.StylePropertiesSection.prototype._handleSelectorContainerClick):
+        (WebInspector.StylePropertiesSection.prototype.addNewBlankProperty):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        (WebInspector.StylePropertyTreeElement.prototype.element.userInput.previousContent.context.moveDirection):
+        (WebInspector.StylePropertyTreeElement.prototype.styleText.updateInterface.majorChange.isRevert):
+
+2012-02-27  Pavel Feldman  <pfeldman@google.com>
+
+        [Shadow]: Expose one ShadowRoot in the Elements panel (under experiment flag)
+        https://bugs.webkit.org/show_bug.cgi?id=78202
+
+        Reviewed by Yury Semikhatsky.
+
+        * dom/ShadowTree.cpp:
+        (WebCore::ShadowTree::pushShadowRoot):
+        (WebCore::ShadowTree::popShadowRoot):
+        * inspector/Inspector.json:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::unbind):
+        (WebCore::InspectorDOMAgent::assertEditableNode):
+        (WebCore::InspectorDOMAgent::assertEditableElement):
+        (WebCore::InspectorDOMAgent::pushChildNodesToFrontend):
+        (WebCore::InspectorDOMAgent::setAttributeValue):
+        (WebCore::InspectorDOMAgent::setAttributesAsText):
+        (WebCore::InspectorDOMAgent::removeAttribute):
+        (WebCore::InspectorDOMAgent::removeNode):
+        (WebCore::InspectorDOMAgent::setOuterHTML):
+        (WebCore::InspectorDOMAgent::setNodeValue):
+        (WebCore::InspectorDOMAgent::moveTo):
+        (WebCore::InspectorDOMAgent::buildObjectForNode):
+        (WebCore::InspectorDOMAgent::didPushShadowRoot):
+        (WebCore):
+        (WebCore::InspectorDOMAgent::willPopShadowRoot):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore):
+        (InspectorDOMAgent):
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didPushShadowRootImpl):
+        (WebCore):
+        (WebCore::InspectorInstrumentation::willPopShadowRootImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore):
+        (InspectorInstrumentation):
+        (WebCore::InspectorInstrumentation::didPushShadowRoot):
+        (WebCore::InspectorInstrumentation::willPopShadowRoot):
+        * inspector/PageConsoleAgent.cpp:
+        (WebCore::PageConsoleAgent::addInspectedNode):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.DOMNode.prototype.hasChildNodes):
+        (WebInspector.DOMNode.prototype.isInShadowTree):
+        (WebInspector.DOMNode.prototype._insertChild):
+        (WebInspector.DOMNode.prototype._setChildrenPayload):
+        (WebInspector.DOMDocument):
+        (WebInspector.DOMAgent.prototype._setDetachedRoot):
+        (WebInspector.DOMAgent.prototype._shadowRootPopped):
+        (WebInspector.DOMDispatcher.prototype.childNodeRemoved):
+        (WebInspector.DOMDispatcher.prototype.shadowRootPushed):
+        (WebInspector.DOMDispatcher.prototype.shadowRootPopped):
+        * inspector/front-end/ElementsTreeOutline.js:
+        * inspector/front-end/MemoryStatistics.js:
+        * inspector/front-end/Settings.js:
+        (WebInspector.ExperimentsSettings):
+        * inspector/front-end/inspector.css:
+        (.webkit-html-tag.shadow, .webkit-html-fragment.shadow):
+
+2012-02-27  Andrey Kosyakov  <caseq@chromium.org>
+
+        Web Inspector: [refactoring] remove dependencies from TimelinePanel from most of FormattedRecord
+        https://bugs.webkit.org/show_bug.cgi?id=79665
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._innerAddRecordToTimeline):
+        (WebInspector.TimelinePanel.FormattedRecord):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._generatePopupContent):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._getRecordDetails):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._linkifyLocation):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._linkifyCallFrame):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._linkifyTopCallFrame):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype._linkifyScriptLocation):
+        (WebInspector.TimelinePanel.PopupContentHelper):
+        (WebInspector.TimelinePanel.PopupContentHelper.prototype._appendStackTrace):
+
+2012-02-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: reveal corresponding timeline record when user clicks on memory graph
+        https://bugs.webkit.org/show_bug.cgi?id=79669
+
+        When user clicks on DOM counter graph corresponding timeline record is
+        revealed in timelime grid and all its ancestors are expanded.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.prototype._onClick):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane.prototype.update):
+        (WebInspector.HeapGraph.prototype.update):
+        (WebInspector.HeapGraph.prototype._clear):
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype.revealRecordAt.recordFinder):
+        (WebInspector.TimelinePanel.prototype.revealRecordAt):
+        (WebInspector.TimelinePanel.prototype._refreshRecords):
+        (WebInspector.TimelinePanel.forAllRecords):
+        (WebInspector.TimelinePanel.FormattedRecord.prototype.containsTime):
+
+2012-02-27  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed single line fix for r108983.
+
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotView.prototype.willHide):
+
+2012-02-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: repaint counter graphs when timeline splitter moves
+        https://bugs.webkit.org/show_bug.cgi?id=79644
+
+        Immediately refresh timeline panel on splitter move.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TimelinePanel.js:
+        (WebInspector.TimelinePanel.prototype._splitterDragging):
+
+2012-02-27  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Unreviewed. Fix make distcheck.
+
+        * GNUmakefile.am: Add missing files.
+        * GNUmakefile.list.am: Ditto.
+
+2012-02-27  Patrick Gansterer  <paroga@webkit.org>
+
+        [CMake] Build fix after r108709.
+
+        * CMakeLists.txt: Move DOMWindowSVG.idl to the other IDL files.
+
+2012-02-27  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Web Inspector: [chromium] Profiles - Tooltip with object/property types stays on screen when another tab selected
+        https://bugs.webkit.org/show_bug.cgi?id=79654
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/DetailedHeapshotView.js:
+        (WebInspector.DetailedHeapshotView.prototype.willHide):
+
+2012-02-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Remove page/PageSupplement.h from WebCore's Target.pri
+
+        The file itself was removed in r108958.
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        * Target.pri:
+
+2012-02-27  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        [Qt] Use USE() macro instead of ENABLE() for using the Qt image decoder
+
+        Reviewed by Kenneth Rohde Christiansen..
+
+        * Target.pri:
+        * WebCore.pri:
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageFrame::getAddr):
+        (ImageFrame):
+        * platform/image-decoders/qt/ImageFrameQt.cpp:
+        (WebCore):
+        (WebCore::ImageFrame::asNewNativeImage):
+
+2012-02-27  MORITA Hajime  <morrita@google.com>
+
+        Removing <ul>, <li> inside shadow DOM triggers assertion in updateListMarkerNumbers
+        https://bugs.webkit.org/show_bug.cgi?id=72440
+
+        Reviewed by Ryosuke Niwa.
+
+        This problem was caused by the inconsistent detach order of DOM tree where
+        Element::detach() called ContainerNode::detach() before shadow tree is detached.
+        This resulted the renderer of the element being destroyed even if its children,
+        each of which came from an element in the shadow tree, are alive.
+        In principle, child renderers should be destroyed before its parent.
+
+        This change aligns the detach order with the attach order. The shadow tree is
+        now deatched before parent's ContainerNode::detach() is called.
+
+        Test: fast/dom/shadow/shadow-ul-li.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::detach):
+
+2012-02-27  Keishi Hattori  <keishi@webkit.org>
+
+        Color input type should be clickable through keyboard
+        https://bugs.webkit.org/show_bug.cgi?id=79629
+
+        Reviewed by Kent Tamura.
+
+        Introduced BaseClickableWithKeyInputType that represents an input type
+        that can be clicked by pressing space/return keys.
+        ColorInputType, FileInputType directly inherit it because it doesn't
+        want the other methods(like appendFormData) in BaseButtonInputType.
+
+        * CMakeLists.txt: Added BaseClickableWithKeyInputType.cpp
+        * GNUmakefile.list.am: Added BaseClickableWithKeyInputType.{cpp,h}
+        * Target.pri: Added BaseClickableWithKeyInputType.{cpp,h}
+        * WebCore.gypi: Added BaseClickableWithKeyInputType.{cpp,h}
+        * WebCore.vcproj/WebCore.vcproj: Added BaseClickableWithKeyInputType.{cpp,h}
+        * WebCore.xcodeproj/project.pbxproj: Added BaseClickableWithKeyInputType.{cpp,h}
+        * html/BaseButtonInputType.cpp:
+        * html/BaseButtonInputType.h:
+        (WebCore::BaseButtonInputType::BaseButtonInputType): Inherits BaseClickableWithKeyInputType now.
+        (BaseButtonInputType):
+        * html/BaseCheckableInputType.cpp: Changed comment.
+        * html/BaseClickableWithKeyInputType.cpp:
+        (WebCore):
+        (WebCore::BaseClickableWithKeyInputType::handleKeydownEvent): Moved from BaseButtonInputType
+        (WebCore::BaseClickableWithKeyInputType::handleKeypressEvent): Moved from BaseButtonInputType
+        (WebCore::BaseClickableWithKeyInputType::handleKeyupEvent): Moved from BaseButtonInputType
+        (WebCore::BaseClickableWithKeyInputType::accessKeyAction): Moved from BaseButtonInputType
+        * html/BaseClickableWithKeyInputType.h:
+        (WebCore):
+        (BaseClickableWithKeyInputType): Input type that can be clicked by pressing space/return keys.
+        (WebCore::BaseClickableWithKeyInputType::BaseClickableWithKeyInputType):
+        * html/ColorInputType.h:
+        (WebCore::ColorInputType::ColorInputType): Inherits BaseClickableWithKeyInputType now.
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::FileInputType):
+        * html/FileInputType.h:
+        (FileInputType): Inherits BaseClickableWithKeyInputType now.
+        * html/RangeInputType.cpp: Changed comment.
+        (WebCore):
+
+2012-02-27  Keishi Hattori  <keishi@webkit.org>
+
+        Add missing include to ColorInputType.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=79632
+
+        Reviewed by Kent Tamura.
+
+        * html/ColorInputType.cpp: Include ShadowTree.h
+
+2012-02-27  Andrey Kosyakov  <caseq@chromium.org>
+
+        Use built-in bind in ExtensionAPI.js
+
+        Web Inspector: [Extensions API] get rid of custom bind() in favor of built-in
+        https://bugs.webkit.org/show_bug.cgi?id=79570
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ExtensionAPI.js:
+        (injectedExtensionAPI.EventSinkImpl.prototype.addListener):
+        (injectedExtensionAPI):
+        (injectedExtensionAPI.Panels.prototype.create):
+        (injectedExtensionAPI.AuditResultImpl):
+        (injectedExtensionAPI.ExtensionServerClient):
+
+2012-02-21  Pavel Podivilov  <podivilov@chromium.org>
+
+        Web Inspector: get rid of RawSourceCode.sourceMapping getter.
+        https://bugs.webkit.org/show_bug.cgi?id=79461
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.uiSourceCodeAdded):
+        (WebInspector.BreakpointManager.prototype.setBreakpoint):
+        (WebInspector.BreakpointManager.prototype._materializeBreakpoint):
+        (WebInspector.BreakpointManager.prototype._breakpointDebuggerLocationChanged):
+        * inspector/front-end/ConsoleMessage.js:
+        (WebInspector.ConsoleMessageImpl.prototype.get location):
+        * inspector/front-end/DebuggerPresentationModel.js:
+        (WebInspector.DebuggerPresentationModel.prototype.rawLocationToUILocation):
+        (WebInspector.DebuggerPresentationModel.prototype.uiSourceCodes):
+        (WebInspector.DebuggerPresentationModel.prototype._handleUISourceCodeListChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._uiSourceCodeListChanged):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreBreakpoints):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreConsoleMessages):
+        (WebInspector.DebuggerPresentationModel.prototype._restoreExecutionLine):
+        (WebInspector.DebuggerPresentationModel.prototype._consoleMessageAdded):
+        (WebInspector.DebuggerPresentationModel.prototype.continueToLine):
+        (WebInspector.DebuggerPresentationModel.prototype.set selectedCallFrame):
+        (WebInspector.DebuggerPresentationModel.prototype._debuggerReset):
+        (WebInspector.PresentationCallFrame.prototype.uiLocation):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard.prototype.discard):
+        (WebInspector.DebuggerPresentationModel.CallFramePlacard.prototype._update):
+        (WebInspector.DebuggerPresentationModelResourceBinding.prototype.canSetContent):
+        (WebInspector.DebuggerPresentationModelResourceBinding.prototype.setContent):
+        (WebInspector.DebuggerPresentationModel.DefaultLinkifierFormatter.prototype.formatRawSourceCodeAnchor):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.linkifyRawSourceCode):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype.reset):
+        (WebInspector.DebuggerPresentationModel.Linkifier.prototype._updateAnchor):
+        * inspector/front-end/RawSourceCode.js:
+        (WebInspector.RawSourceCode.prototype.rawLocationToUILocation):
+        (WebInspector.RawSourceCode.prototype.uiLocationToRawLocation):
+        (WebInspector.RawSourceCode.prototype.uiSourceCodeList):
+        (WebInspector.RawSourceCode.prototype._saveSourceMapping):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._updateCallFrame):
+        * inspector/front-end/ScriptsSearchScope.js:
+        (WebInspector.ScriptsSearchResultsPane.prototype.createAnchor):
+
+2012-02-27  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        [CSSRegions]Implement NamedFlow::getRegionsByContentNode
+        https://bugs.webkit.org/show_bug.cgi?id=77746
+
+        Reviewed by David Hyatt.
+
+        Tests: fast/regions/get-regions-by-content-node-horiz-bt.html
+               fast/regions/get-regions-by-content-node-horiz-tb.html
+               fast/regions/get-regions-by-content-node-vert-lr.html
+               fast/regions/get-regions-by-content-node-vert-rl.html
+               fast/regions/get-regions-by-content-node.html
+               fast/regions/get-regions-by-content-node2.html
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Node.cpp:
+        (WebCore::Node::removeCachedRegionNodeList):
+        (WebCore):
+        (WebCore::Node::getRegionsByContentNode):
+        (WebCore::NodeListsNodeData::invalidateCaches):
+        (WebCore::NodeListsNodeData::isEmpty):
+        * dom/Node.h:
+        (WebCore):
+        (Node):
+        * dom/NodeRareData.h:
+        (NodeListsNodeData):
+        * dom/RegionNodeList.cpp:
+        (WebCore):
+        (WebCore::RegionNodeList::RegionNodeList):
+        (WebCore::RegionNodeList::~RegionNodeList):
+        (WebCore::RegionNodeList::nodeMatches):
+        * dom/RegionNodeList.h:
+        (WebCore):
+        (RegionNodeList):
+        (WebCore::RegionNodeList::create):
+        * dom/WebKitNamedFlow.cpp:
+        (WebCore::WebKitNamedFlow::getRegionsByContentNode):
+        (WebCore):
+        * dom/WebKitNamedFlow.h:
+        (WebCore):
+        (WebKitNamedFlow):
+        * dom/WebKitNamedFlow.idl:
+        * rendering/RenderFlowThread.cpp:
+        (WebCore::RenderFlowThread::regionInRange):
+        (WebCore):
+        (WebCore::RenderFlowThread::objectInFlowRegion):
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderRegion.h:
+        (WebCore::RenderRegion::flowThread):
+
+2012-02-27  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: counter graphs should resize after console showing
+        https://bugs.webkit.org/show_bug.cgi?id=79640
+
+        Invoke Panel.doResize after showing drawer.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/Drawer.js:
+        (WebInspector.Drawer.prototype.show.animationFinished):
+        (WebInspector.Drawer.prototype.show):
+
+2012-02-27  Dan Beam  <dbeam@chromium.org>
+
+        Web Inspector: Close TabbedPanes on middle click of tab handle
+        https://bugs.webkit.org/show_bug.cgi?id=79518
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/TabbedPane.js:
+        (WebInspector.TabbedPaneTab.prototype._createTabElement):
+        (WebInspector.TabbedPaneTab.prototype._tabClicked):
+
+2012-02-26  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: crash in fake workers
+        https://bugs.webkit.org/show_bug.cgi?id=79637
+
+        Notify front-end about worker creation/destruction synchronously instead of
+        posting a task.
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/InspectorAgent.cpp:
+        (WebCore):
+        (WebCore::InspectorAgent::didCreateWorker):
+        (WebCore::InspectorAgent::didDestroyWorker):
+        * inspector/InspectorAgent.h:
+        (InspectorAgent):
+
+2012-02-26  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        Fix some warnings in the build from referencing the non-existent
+        websockets directory.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-02-26  Shinya Kawanaka  <shinyak@chromium.org>
+
+        Rename ShadowRootList to ShadowTree.
+        https://bugs.webkit.org/show_bug.cgi?id=79342
+
+        Reviewed by Hajime Morita.
+
+        This patch renames ShadowRootList ot ShadowTree.
+
+        No new tests, no change in behavior.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DOMAllInOne.cpp:
+        * dom/Document.cpp:
+        (WebCore::Document::buildAccessKeyMap):
+        * dom/Element.cpp:
+        (WebCore::Element::willRemove):
+        (WebCore::Element::insertedIntoDocument):
+        (WebCore::Element::removedFromDocument):
+        (WebCore::Element::insertedIntoTree):
+        (WebCore::Element::removedFromTree):
+        (WebCore::Element::attach):
+        (WebCore::Element::detach):
+        (WebCore::Element::recalcStyle):
+        (WebCore::Element::hasShadowRoot):
+        (WebCore::Element::shadowTree):
+        (WebCore::Element::setShadowRoot):
+        (WebCore::Element::ensureShadowRoot):
+        (WebCore::Element::removeShadowRoot):
+        (WebCore::Element::childrenChanged):
+        * dom/Element.h:
+        (WebCore):
+        (Element):
+        * dom/ElementRareData.h:
+        (ElementRareData):
+        (WebCore::ElementRareData::~ElementRareData):
+        * dom/Node.cpp:
+        (WebCore::oldestShadowRoot):
+        * dom/NodeRenderingContext.cpp:
+        (WebCore::NodeRenderingContext::NodeRenderingContext):
+        (WebCore::NodeRenderingContext::hostChildrenChanged):
+        (WebCore::NodeRenderingContext::shouldCreateRenderer):
+        * dom/NodeRenderingContext.h:
+        (WebCore):
+        * dom/ShadowRoot.cpp:
+        (WebCore::ShadowRoot::tree):
+        (WebCore::ShadowRoot::attach):
+        * dom/ShadowRoot.h:
+        (WebCore):
+        (ShadowRoot):
+        * dom/ShadowTree.cpp: Renamed from Source/WebCore/dom/ShadowRootList.cpp.
+        (WebCore):
+        (WebCore::ShadowTree::ShadowTree):
+        (WebCore::ShadowTree::~ShadowTree):
+        (WebCore::ShadowTree::pushShadowRoot):
+        (WebCore::ShadowTree::popShadowRoot):
+        (WebCore::ShadowTree::insertedIntoDocument):
+        (WebCore::ShadowTree::removedFromDocument):
+        (WebCore::ShadowTree::insertedIntoTree):
+        (WebCore::ShadowTree::removedFromTree):
+        (WebCore::ShadowTree::willRemove):
+        (WebCore::ShadowTree::attach):
+        (WebCore::ShadowTree::detach):
+        (WebCore::ShadowTree::insertionPointFor):
+        (WebCore::ShadowTree::isSelectorActive):
+        (WebCore::ShadowTree::reattach):
+        (WebCore::ShadowTree::childNeedsStyleRecalc):
+        (WebCore::ShadowTree::needsStyleRecalc):
+        (WebCore::ShadowTree::recalcShadowTreeStyle):
+        (WebCore::ShadowTree::needsReattachHostChildrenAndShadow):
+        (WebCore::ShadowTree::hostChildrenChanged):
+        (WebCore::ShadowTree::setNeedsReattachHostChildrenAndShadow):
+        (WebCore::ShadowTree::reattachHostChildrenAndShadow):
+        (WebCore::ShadowTree::ensureSelector):
+        * dom/ShadowTree.h: Renamed from Source/WebCore/dom/ShadowRootList.h.
+        (WebCore):
+        (ShadowTree):
+        (WebCore::ShadowTree::hasShadowRoot):
+        (WebCore::ShadowTree::youngestShadowRoot):
+        (WebCore::ShadowTree::oldestShadowRoot):
+        (WebCore::ShadowTree::selector):
+        (WebCore::ShadowTree::clearNeedsReattachHostChildrenAndShadow):
+        (WebCore::ShadowTree::host):
+        * dom/TreeScopeAdopter.cpp:
+        (WebCore::shadowRootFor):
+        * html/ColorInputType.cpp:
+        (WebCore::ColorInputType::createShadowSubtree):
+        (WebCore::ColorInputType::shadowColorSwatch):
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::createShadowSubtree):
+        (WebCore::FileInputType::multipleAttributeChanged):
+        * html/HTMLDetailsElement.cpp:
+        (WebCore::HTMLDetailsElement::findMainSummary):
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::shadowSelect):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaControls):
+        (WebCore::HTMLMediaElement::hasMediaControls):
+        * html/HTMLSummaryElement.cpp:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::innerTextElement):
+        (WebCore::HTMLTextAreaElement::updatePlaceholderText):
+        * html/InputType.cpp:
+        (WebCore::InputType::destroyShadowSubtree):
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::handleMouseDownEvent):
+        (WebCore::RangeInputType::createShadowSubtree):
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::createShadowSubtree):
+        (WebCore::TextFieldInputType::updatePlaceholderText):
+        * html/ValidationMessage.cpp:
+        (WebCore::ValidationMessage::deleteBubbleTree):
+        * html/shadow/HTMLContentElement.cpp:
+        (WebCore::HTMLContentElement::attach):
+        (WebCore::HTMLContentElement::detach):
+        (WebCore::HTMLContentElement::parseAttribute):
+        * html/shadow/SliderThumbElement.cpp:
+        (WebCore::sliderThumbElementOf):
+        (WebCore::RenderSliderContainer::layout):
+        (WebCore::trackLimiterElementOf):
+        * page/FocusController.cpp:
+        (WebCore::shadowRoot):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::uploadButton):
+        * svg/SVGTRefElement.cpp:
+        (WebCore::SVGTRefElement::updateReferencedText):
+        (WebCore::SVGTRefElement::detachTarget):
+        * testing/Internals.cpp:
+        (WebCore::Internals::ensureShadowRoot):
+        (WebCore::Internals::youngestShadowRoot):
+        (WebCore::Internals::oldestShadowRoot):
+
+2012-02-26  Adam Barth  <abarth@webkit.org>
+
+        Extract Supplementable base class from Page and Navigator
+        https://bugs.webkit.org/show_bug.cgi?id=79624
+
+        Reviewed by Hajime Morita.
+
+        We'll use this pattern again soon for ScriptExecutionContext.
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Modules/gamepad/NavigatorGamepad.cpp:
+        (WebCore::NavigatorGamepad::from):
+        * Modules/gamepad/NavigatorGamepad.h:
+        * Modules/geolocation/NavigatorGeolocation.cpp:
+        (WebCore::NavigatorGeolocation::from):
+        * Modules/geolocation/NavigatorGeolocation.h:
+        * Modules/mediastream/NavigatorMediaStream.cpp:
+        (WebCore::NavigatorMediaStream::webkitGetUserMedia):
+        * Modules/mediastream/UserMediaController.cpp:
+        (WebCore::provideUserMediaTo):
+        * Modules/mediastream/UserMediaController.h:
+        (WebCore::UserMediaController::from):
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DeviceMotionController.cpp:
+        (WebCore::provideDeviceMotionTo):
+        * dom/DeviceMotionController.h:
+        (WebCore::DeviceMotionController::from):
+        * dom/DeviceOrientationController.cpp:
+        (WebCore::provideDeviceOrientationTo):
+        * dom/DeviceOrientationController.h:
+        (WebCore):
+        (WebCore::DeviceOrientationController::from):
+        * notifications/NotificationController.cpp:
+        (WebCore::provideNotification):
+        * notifications/NotificationController.h:
+        (WebCore):
+        (WebCore::NotificationController::from):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::page):
+        (WebCore):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        * page/DOMWindow.h:
+        (WebCore):
+        (DOMWindow):
+        * page/Navigator.cpp:
+        (WebCore):
+        * page/Navigator.h:
+        (Navigator):
+        * page/NavigatorSupplement.cpp: Removed.
+        * page/NavigatorSupplement.h: Removed.
+        * page/Page.cpp:
+        (WebCore):
+        * page/Page.h:
+        (Page):
+        * page/PageSupplement.cpp: Removed.
+        * page/PageSupplement.h: Removed.
+        * page/SpeechInput.cpp:
+        (WebCore::provideSpeechInputTo):
+        * page/SpeechInput.h:
+        (WebCore::SpeechInput::from):
+        * platform/Supplementable.h: Added.
+        (WebCore):
+        (Supplement):
+        (WebCore::Supplement::~Supplement):
+        (WebCore::Supplement::provideTo):
+        (WebCore::Supplement::from):
+        (Supplementable):
+        (WebCore::Supplementable::provideSupplement):
+        (WebCore::Supplementable::requireSupplement):
+
+2012-02-26  Hajime Morrita  <morrita@chromium.org>
+
+        Move ChromeClient::showContextMenu() to ContextMenuClient
+        https://bugs.webkit.org/show_bug.cgi?id=79427
+
+        Reviewed by Adam Barth.
+
+        - Removed ChromeClient::showContextMenu(), Chrome::showContextMenu()
+        - Added ContextMenuController::showContextMenuAt(), ContextMenuClient::showContextMenu()
+        - Hided showContextMenu() behind ACCESSIBILITY_CONTEXT_MENUS
+
+        This change localizes context menu related code and will make it easy to
+        modularize CONTEXT_MENUS code.
+
+        Refactoring. No new tests.
+
+        * WebCore.exp.in:
+        * accessibility/mac/WebAccessibilityObjectWrapper.mm:
+        (-[WebAccessibilityObjectWrapper accessibilityShowContextMenu]):
+        * loader/EmptyClients.h:
+        (EmptyContextMenuClient):
+        (WebCore::EmptyContextMenuClient::showContextMenu):
+        * page/ContextMenuClient.h:
+        (ContextMenuClient):
+        * page/ContextMenuController.cpp:
+        (WebCore):
+        (WebCore::ContextMenuController::showContextMenuAt):
+        * page/ContextMenuController.h:
+        (ContextMenuController):
+        * page/Chrome.cpp:
+        * page/Chrome.h:
+        (Chrome):
+        * page/ChromeClient.h:
+        (ChromeClient):
+
+2012-02-26  Benjamin Poulain  <bpoulain@apple.com>
+
+        [Mac] Release localized Strings instead of AutoRelease
+        https://bugs.webkit.org/show_bug.cgi?id=79552
+
+        Reviewed by Sam Weinig.
+
+        By using the CoreFoundation API, we can release the memory as soon as
+        the WTF::String is created.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/mac/LocalizedStringsMac.cpp: Renamed from Source/WebCore/platform/mac/LocalizedStringsMac.mm.
+        (WebCore):
+        (WebCore::localizedString):
+
+2012-02-26  Adam Barth  <abarth@webkit.org>
+
+        ContextDestructionObserver should live in its own file
+        https://bugs.webkit.org/show_bug.cgi?id=79619
+
+        Reviewed by Hajime Morita.
+
+        WebKit prefers to have one class per file.  (This patch is paying a
+        build system hacking debt I incurred earlier.)
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ActiveDOMObject.cpp:
+        (WebCore):
+        * dom/ActiveDOMObject.h:
+        (ActiveDOMObject):
+        (WebCore::ActiveDOMObject::suspendIfNeededCalled):
+        (WebCore::ActiveDOMObject::setPendingActivity):
+        (WebCore::ActiveDOMObject::unsetPendingActivity):
+        * dom/ContextDestructionObserver.cpp: Added.
+        (WebCore):
+        (WebCore::ContextDestructionObserver::ContextDestructionObserver):
+        (WebCore::ContextDestructionObserver::~ContextDestructionObserver):
+        (WebCore::ContextDestructionObserver::contextDestroyed):
+        * dom/ContextDestructionObserver.h: Added.
+        (WebCore):
+        (ContextDestructionObserver):
+        (WebCore::ContextDestructionObserver::scriptExecutionContext):
+        * dom/DOMAllInOne.cpp:
+
+2012-02-26  Dirk Schulze  <krit@webkit.org>
+
+        Cleanup of Adobes copyright text. The text got harmonized with copyright texts of other companies. 
+
+        Rubber stamped by.
+
+        * css/CSSWrapShapes.cpp:
+        * css/CSSWrapShapes.h:
+        * css/WebKitCSSRegionRule.cpp:
+        * css/WebKitCSSRegionRule.h:
+        * css/WebKitCSSRegionRule.idl:
+        * css/WebKitCSSShaderValue.cpp:
+        * css/WebKitCSSShaderValue.h:
+        * dom/WebKitNamedFlow.cpp:
+        * dom/WebKitNamedFlow.h:
+        * dom/WebKitNamedFlow.idl:
+        * loader/cache/CachedShader.cpp:
+        * loader/cache/CachedShader.h:
+        * platform/graphics/filters/CustomFilterMesh.cpp:
+        * platform/graphics/filters/CustomFilterMesh.h:
+        * platform/graphics/filters/CustomFilterNumberParameter.h:
+        * platform/graphics/filters/CustomFilterOperation.cpp:
+        * platform/graphics/filters/CustomFilterOperation.h:
+        * platform/graphics/filters/CustomFilterParameter.h:
+        * platform/graphics/filters/CustomFilterProgram.cpp:
+        * platform/graphics/filters/CustomFilterProgram.h:
+        * platform/graphics/filters/CustomFilterProgramClient.h:
+        * platform/graphics/filters/CustomFilterShader.cpp:
+        * platform/graphics/filters/CustomFilterShader.h:
+        * platform/graphics/filters/FECustomFilter.cpp:
+        * platform/graphics/filters/FECustomFilter.h:
+        * rendering/FilterEffectObserver.h:
+        * rendering/RenderFlowThread.cpp:
+        * rendering/RenderFlowThread.h:
+        * rendering/RenderRegion.cpp:
+        * rendering/RenderRegion.h:
+        * rendering/style/StyleCachedShader.cpp:
+        * rendering/style/StyleCachedShader.h:
+        * rendering/style/StyleCustomFilterProgram.h:
+        * rendering/style/StylePendingShader.h:
+        * rendering/style/StyleShader.h:
+
+2012-02-26  Hyowon Kim  <hw1008.kim@samsung.com>
+
+        [EFL] Implementation of GraphicsContext3D for EFL port
+        https://bugs.webkit.org/show_bug.cgi?id=79452
+
+        Reviewed by Noam Rosenthal.
+
+        Evas_GL is used to do OpenGL rendering on Evas, in which
+        a structure 'Evas_GL_API' contains all the OpenGL functions.
+
+        GraphicsContext3D in EFL port should call OpenGL functions indirectly
+        through the Evas_GL_API, and not use GraphicsContext3DOpenGL(Common).
+
+        So, we use the GraphicsContext3DPrivate to delegate all OpenGL function calls,
+        and it will be implemented to use Evas_GL (bug 62961).
+
+        No new tests. No behavior change.
+
+        * platform/graphics/efl/GraphicsContext3DEfl.cpp: Added.
+        (WebCore):
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::GraphicsContext3D):
+        (WebCore::GraphicsContext3D::~GraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3D::platformLayer):
+        (WebCore::GraphicsContext3D::makeContextCurrent):
+        (WebCore::GraphicsContext3D::isGLES2Compliant):
+        (WebCore::GraphicsContext3D::activeTexture):
+        (WebCore::GraphicsContext3D::attachShader):
+        (WebCore::GraphicsContext3D::bindAttribLocation):
+        (WebCore::GraphicsContext3D::bindBuffer):
+        (WebCore::GraphicsContext3D::bindFramebuffer):
+        (WebCore::GraphicsContext3D::bindRenderbuffer):
+        (WebCore::GraphicsContext3D::bindTexture):
+        (WebCore::GraphicsContext3D::blendColor):
+        (WebCore::GraphicsContext3D::blendEquation):
+        (WebCore::GraphicsContext3D::blendEquationSeparate):
+        (WebCore::GraphicsContext3D::blendFunc):
+        (WebCore::GraphicsContext3D::blendFuncSeparate):
+        (WebCore::GraphicsContext3D::bufferData):
+        (WebCore::GraphicsContext3D::bufferSubData):
+        (WebCore::GraphicsContext3D::checkFramebufferStatus):
+        (WebCore::GraphicsContext3D::clear):
+        (WebCore::GraphicsContext3D::clearColor):
+        (WebCore::GraphicsContext3D::clearDepth):
+        (WebCore::GraphicsContext3D::clearStencil):
+        (WebCore::GraphicsContext3D::colorMask):
+        (WebCore::GraphicsContext3D::compileShader):
+        (WebCore::GraphicsContext3D::copyTexImage2D):
+        (WebCore::GraphicsContext3D::copyTexSubImage2D):
+        (WebCore::GraphicsContext3D::cullFace):
+        (WebCore::GraphicsContext3D::depthFunc):
+        (WebCore::GraphicsContext3D::depthMask):
+        (WebCore::GraphicsContext3D::depthRange):
+        (WebCore::GraphicsContext3D::detachShader):
+        (WebCore::GraphicsContext3D::disable):
+        (WebCore::GraphicsContext3D::disableVertexAttribArray):
+        (WebCore::GraphicsContext3D::drawArrays):
+        (WebCore::GraphicsContext3D::drawElements):
+        (WebCore::GraphicsContext3D::enable):
+        (WebCore::GraphicsContext3D::enableVertexAttribArray):
+        (WebCore::GraphicsContext3D::finish):
+        (WebCore::GraphicsContext3D::flush):
+        (WebCore::GraphicsContext3D::framebufferRenderbuffer):
+        (WebCore::GraphicsContext3D::framebufferTexture2D):
+        (WebCore::GraphicsContext3D::frontFace):
+        (WebCore::GraphicsContext3D::generateMipmap):
+        (WebCore::GraphicsContext3D::getActiveAttrib):
+        (WebCore::GraphicsContext3D::getActiveUniform):
+        (WebCore::GraphicsContext3D::getAttachedShaders):
+        (WebCore::GraphicsContext3D::getAttribLocation):
+        (WebCore::GraphicsContext3D::getBooleanv):
+        (WebCore::GraphicsContext3D::getBufferParameteriv):
+        (WebCore::GraphicsContext3D::getContextAttributes):
+        (WebCore::GraphicsContext3D::getError):
+        (WebCore::GraphicsContext3D::getFloatv):
+        (WebCore::GraphicsContext3D::getFramebufferAttachmentParameteriv):
+        (WebCore::GraphicsContext3D::getIntegerv):
+        (WebCore::GraphicsContext3D::getProgramiv):
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
+        (WebCore::GraphicsContext3D::getRenderbufferParameteriv):
+        (WebCore::GraphicsContext3D::getShaderiv):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+        (WebCore::GraphicsContext3D::getShaderSource):
+        (WebCore::GraphicsContext3D::getString):
+        (WebCore::GraphicsContext3D::getTexParameterfv):
+        (WebCore::GraphicsContext3D::getTexParameteriv):
+        (WebCore::GraphicsContext3D::getUniformfv):
+        (WebCore::GraphicsContext3D::getUniformiv):
+        (WebCore::GraphicsContext3D::getUniformLocation):
+        (WebCore::GraphicsContext3D::getVertexAttribfv):
+        (WebCore::GraphicsContext3D::getVertexAttribiv):
+        (WebCore::GraphicsContext3D::getVertexAttribOffset):
+        (WebCore::GraphicsContext3D::hint):
+        (WebCore::GraphicsContext3D::isBuffer):
+        (WebCore::GraphicsContext3D::isEnabled):
+        (WebCore::GraphicsContext3D::isFramebuffer):
+        (WebCore::GraphicsContext3D::isProgram):
+        (WebCore::GraphicsContext3D::isRenderbuffer):
+        (WebCore::GraphicsContext3D::isShader):
+        (WebCore::GraphicsContext3D::isTexture):
+        (WebCore::GraphicsContext3D::lineWidth):
+        (WebCore::GraphicsContext3D::linkProgram):
+        (WebCore::GraphicsContext3D::pixelStorei):
+        (WebCore::GraphicsContext3D::polygonOffset):
+        (WebCore::GraphicsContext3D::readPixels):
+        (WebCore::GraphicsContext3D::releaseShaderCompiler):
+        (WebCore::GraphicsContext3D::renderbufferStorage):
+        (WebCore::GraphicsContext3D::sampleCoverage):
+        (WebCore::GraphicsContext3D::scissor):
+        (WebCore::GraphicsContext3D::shaderSource):
+        (WebCore::GraphicsContext3D::stencilFunc):
+        (WebCore::GraphicsContext3D::stencilFuncSeparate):
+        (WebCore::GraphicsContext3D::stencilMask):
+        (WebCore::GraphicsContext3D::stencilMaskSeparate):
+        (WebCore::GraphicsContext3D::stencilOp):
+        (WebCore::GraphicsContext3D::stencilOpSeparate):
+        (WebCore::GraphicsContext3D::texImage2D):
+        (WebCore::GraphicsContext3D::texParameterf):
+        (WebCore::GraphicsContext3D::texParameteri):
+        (WebCore::GraphicsContext3D::texSubImage2D):
+        (WebCore::GraphicsContext3D::uniform1f):
+        (WebCore::GraphicsContext3D::uniform1fv):
+        (WebCore::GraphicsContext3D::uniform1i):
+        (WebCore::GraphicsContext3D::uniform1iv):
+        (WebCore::GraphicsContext3D::uniform2f):
+        (WebCore::GraphicsContext3D::uniform2fv):
+        (WebCore::GraphicsContext3D::uniform2i):
+        (WebCore::GraphicsContext3D::uniform2iv):
+        (WebCore::GraphicsContext3D::uniform3f):
+        (WebCore::GraphicsContext3D::uniform3fv):
+        (WebCore::GraphicsContext3D::uniform3i):
+        (WebCore::GraphicsContext3D::uniform3iv):
+        (WebCore::GraphicsContext3D::uniform4f):
+        (WebCore::GraphicsContext3D::uniform4fv):
+        (WebCore::GraphicsContext3D::uniform4i):
+        (WebCore::GraphicsContext3D::uniform4iv):
+        (WebCore::GraphicsContext3D::uniformMatrix2fv):
+        (WebCore::GraphicsContext3D::uniformMatrix3fv):
+        (WebCore::GraphicsContext3D::uniformMatrix4fv):
+        (WebCore::GraphicsContext3D::useProgram):
+        (WebCore::GraphicsContext3D::validateProgram):
+        (WebCore::GraphicsContext3D::vertexAttrib1f):
+        (WebCore::GraphicsContext3D::vertexAttrib1fv):
+        (WebCore::GraphicsContext3D::vertexAttrib2f):
+        (WebCore::GraphicsContext3D::vertexAttrib2fv):
+        (WebCore::GraphicsContext3D::vertexAttrib3f):
+        (WebCore::GraphicsContext3D::vertexAttrib3fv):
+        (WebCore::GraphicsContext3D::vertexAttrib4f):
+        (WebCore::GraphicsContext3D::vertexAttrib4fv):
+        (WebCore::GraphicsContext3D::vertexAttribPointer):
+        (WebCore::GraphicsContext3D::viewport):
+        (WebCore::GraphicsContext3D::reshape):
+        (WebCore::GraphicsContext3D::markContextChanged):
+        (WebCore::GraphicsContext3D::markLayerComposited):
+        (WebCore::GraphicsContext3D::layerComposited):
+        (WebCore::GraphicsContext3D::paintRenderingResultsToCanvas):
+        (WebCore::GraphicsContext3D::paintRenderingResultsToImageData):
+        (WebCore::GraphicsContext3D::paintCompositedResultsToCanvas):
+        (WebCore::GraphicsContext3D::createBuffer):
+        (WebCore::GraphicsContext3D::createFramebuffer):
+        (WebCore::GraphicsContext3D::createProgram):
+        (WebCore::GraphicsContext3D::createRenderbuffer):
+        (WebCore::GraphicsContext3D::createShader):
+        (WebCore::GraphicsContext3D::createTexture):
+        (WebCore::GraphicsContext3D::deleteBuffer):
+        (WebCore::GraphicsContext3D::deleteFramebuffer):
+        (WebCore::GraphicsContext3D::deleteProgram):
+        (WebCore::GraphicsContext3D::deleteRenderbuffer):
+        (WebCore::GraphicsContext3D::deleteShader):
+        (WebCore::GraphicsContext3D::deleteTexture):
+        (WebCore::GraphicsContext3D::synthesizeGLError):
+        (WebCore::GraphicsContext3D::getExtensions):
+        (WebCore::GraphicsContext3D::getInternalFramebufferSize):
+        (WebCore::GraphicsContext3D::setContextLostCallback):
+        (WebCore::GraphicsContext3D::getImageData):
+        (WebCore::GraphicsContext3D::validateAttributes):
+        (WebCore::GraphicsContext3D::readRenderingResults):
+        (WebCore::GraphicsContext3D::reshapeFBOs):
+        (WebCore::GraphicsContext3D::resolveMultisamplingIfNecessary):
+        (WebCore::GraphicsContext3D::isResourceSafe):
+
+2012-02-26  James Robinson  <jamesr@chromium.org>
+
+        [chromium] Wire up shouldUpdateScrollPositionOnMainThread and nonFastScrollableRegion to compositor
+        https://bugs.webkit.org/show_bug.cgi?id=79155
+
+        Reviewed by Adam Barth.
+
+        This hooks up ScrollingCoordinator::setNonFastScrollableRegion() and
+        ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread() to the chromium compositor
+        implementation and implements them on the impl thread.
+
+        New compositor behavior is covered by unit tests in LayerChromiumTests and CCLayerTreeHostImplTests. The rest is
+        just glue code.
+
+        * page/scrolling/chromium/ScrollingCoordinatorChromium.cpp:
+        (WebCore::ScrollingCoordinator::setNonFastScrollableRegion):
+        (WebCore::ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        (WebCore::LayerChromium::setShouldScrollOnMainThread):
+        (WebCore):
+        (WebCore::LayerChromium::setNonFastScrollableRegion):
+        (WebCore::LayerChromium::pushPropertiesTo):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore):
+        (LayerChromium):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::shouldScrollOnMainThread):
+        (WebCore::CCLayerImpl::setShouldScrollOnMainThread):
+        (CCLayerImpl):
+        (WebCore::CCLayerImpl::nonFastScrollableRegion):
+        (WebCore::CCLayerImpl::setNonFastScrollableRegion):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::scrollBegin):
+
+2012-02-26  Kentaro Hara  <haraken@chromium.org>
+
+        Unreviewed. Rebaselined run-bindings-tests results.
+
+        * bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp:
+        (webkit_dom_test_interface_supplemental_method4):
+
+2012-02-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108547.
+        http://trac.webkit.org/changeset/108547
+        https://bugs.webkit.org/show_bug.cgi?id=79606
+
+        Crashes on ClusterFuzz (Requested by inferno-sec on #webkit).
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2012-02-25  Adam Barth  <abarth@webkit.org>
+
+        Move websockets to Modules/websockets
+        https://bugs.webkit.org/show_bug.cgi?id=79598
+
+        Reviewed by Eric Seidel.
+
+        Nowadays, the only ENABLE(WEB_SOCKETS) ifdef in WebCore proper is in
+        WebCore::Settings, and that will be removed (soon?) once Apple drops
+        support for the old WebSockets protocol.
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pri:
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * Modules/websockets: Copied from Source/WebCore/websockets.
+        * Target.pri:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+        * WebCore.xcodeproj/project.pbxproj:
+        * websockets: Removed.
+        * websockets/CloseEvent.h: Removed.
+        * websockets/CloseEvent.idl: Removed.
+        * websockets/DOMWindowWebSocket.idl: Removed.
+        * websockets/ThreadableWebSocketChannel.cpp: Removed.
+        * websockets/ThreadableWebSocketChannel.h: Removed.
+        * websockets/ThreadableWebSocketChannelClientWrapper.cpp: Removed.
+        * websockets/ThreadableWebSocketChannelClientWrapper.h: Removed.
+        * websockets/WebSocket.cpp: Removed.
+        * websockets/WebSocket.h: Removed.
+        * websockets/WebSocket.idl: Removed.
+        * websockets/WebSocketChannel.cpp: Removed.
+        * websockets/WebSocketChannel.h: Removed.
+        * websockets/WebSocketChannelClient.h: Removed.
+        * websockets/WebSocketDeflater.cpp: Removed.
+        * websockets/WebSocketDeflater.h: Removed.
+        * websockets/WebSocketExtensionDispatcher.cpp: Removed.
+        * websockets/WebSocketExtensionDispatcher.h: Removed.
+        * websockets/WebSocketExtensionProcessor.h: Removed.
+        * websockets/WebSocketFrame.h: Removed.
+        * websockets/WebSocketHandshake.cpp: Removed.
+        * websockets/WebSocketHandshake.h: Removed.
+        * websockets/WebSocketHandshakeRequest.cpp: Removed.
+        * websockets/WebSocketHandshakeRequest.h: Removed.
+        * websockets/WebSocketHandshakeResponse.cpp: Removed.
+        * websockets/WebSocketHandshakeResponse.h: Removed.
+        * websockets/WorkerThreadableWebSocketChannel.cpp: Removed.
+        * websockets/WorkerThreadableWebSocketChannel.h: Removed.
+
+2012-02-25  Benjamin Poulain  <benjamin@webkit.org>
+
+        Get rid of KURL::deprecatedString()
+        https://bugs.webkit.org/show_bug.cgi?id=79594
+
+        Reviewed by Andreas Kling.
+
+        The method KURL::deprecatedString() is unused, remove it from WebCore.
+
+        The last reference to the method was removed in r96779.
+
+        * platform/KURL.cpp:
+        (WebCore):
+        * platform/KURL.h:
+        (KURL):
+        * platform/KURLGoogle.cpp:
+        (WebCore):
+        * platform/KURLWTFURL.cpp:
+        (WebCore):
+
+2012-02-25  Benjamin Poulain  <benjamin@webkit.org>
+
+        Get rid of copyParsedQueryTo()
+        https://bugs.webkit.org/show_bug.cgi?id=79590
+
+        Reviewed by Andreas Kling.
+
+        The function KURL::copyParsedQueryTo() is unused. Remove it from WebCore.
+
+        The function was used by HTMLAnchorElement::getParameter() but that feature
+        was removed in r100164.
+
+        * WebCore.order:
+        * platform/KURL.cpp:
+        (WebCore):
+        * platform/KURL.h:
+        (WebCore):
+        (KURL):
+        * platform/KURLGoogle.cpp:
+        (WebCore):
+        * platform/KURLWTFURL.cpp:
+        (WebCore):
+
+2012-02-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r108924.
+        http://trac.webkit.org/changeset/108924
+        https://bugs.webkit.org/show_bug.cgi?id=79597
+
+        broke 4 inspector tests (Requested by kling on #webkit).
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::parseAttribute):
+
+2012-02-25  Adam Barth  <abarth@webkit.org>
+
+        Fix typo in comment.  This #endif is for a different ENABLE macro.
+
+        * page/NavigatorRegisterProtocolHandler.cpp:
+
+2012-02-25  Anders Carlsson  <andersca@apple.com>
+
+        Move an ASSERT to avoid it firing due to a race condition
+        https://bugs.webkit.org/show_bug.cgi?id=79596
+
+        Reviewed by Andreas Kling.
+
+        ScrollingThread::isCurrentThread() can return false if called too early.
+        Move it into ScrollingThread::initializeRunLoop where we know that the thread has
+        been set up correctly.
+
+        * page/scrolling/ScrollingThread.cpp:
+        (WebCore::ScrollingThread::threadBody):
+        * page/scrolling/mac/ScrollingThreadMac.mm:
+        (WebCore::ScrollingThread::initializeRunLoop):
+
+2012-02-25  Andreas Kling  <awesomekling@apple.com>
+
+        Setting style="" should destroy the element's inline style.
+        <http://webkit.org/b/79595>
+
+        Reviewed by Anders Carlsson.
+
+        There's no reason for an element with style="" to have an inline style object.
+        Remove the inline style in that case, just like we do when removing the style
+        attribute altogether.
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::parseAttribute):
+
+2012-02-25  Andreas Kling  <awesomekling@apple.com>
+
+        Allow matched property cache for elements with additional attribute style.
+        <http://webkit.org/b/79583>
+
+        Reviewed by Antti Koivisto.
+
+        There's no reason to disallow the matched style property cache for elements
+        that return something from additionalAttributeStyle(). The only requirement
+        for a property set to be cached is that it either doesn't mutate OR that it
+        invalidates the document's CSSStyleSelector when doing so.
+
+        This allows some more match caching for table-related elements, though we
+        are still held back by explicitly 'inherited' properties in html.css.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::collectMatchingRulesForList):
+
+2012-02-25  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Clean-up RenderTableSection::calcRowLogicalHeight
+        https://bugs.webkit.org/show_bug.cgi?id=77705
+
+        Reviewed by Nikolas Zimmermann.
+
+        Refactoring / simplication of the code.
+
+        This change removes some variables that were unneeded and were
+        hiding what the code was really doing. Also some of the code was
+        split and moved down to RenderTableCell.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::logicalHeightForRowSizing):
+        * rendering/RenderTableCell.h:
+        (RenderTableCell):
+        Added the previous helper function to calculate the cell's
+        adjusted logical height.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
+        Removed some variables, simplified the rowspan logic to be clearer
+        (and added a comment about how we handle rowspans).
+
+2012-02-25  Benjamin Poulain  <benjamin@webkit.org>
+
+        Add an empty skeleton of KURL for WTFURL
+        https://bugs.webkit.org/show_bug.cgi?id=78990
+
+        Reviewed by Adam Barth.
+
+        Add an empty skeleton of KURL based on WTFURL.
+
+        With WTFURL, the data of KURL is in an implicitely shared object
+        named KURLWTFURLImpl.
+
+        In KURLWTFURLImpl, KURL created with invalid URL would be stored
+        as a String. A valid URL would be stored as a ParsedURL.
+
+        * ForwardingHeaders/wtf/url/ParsedURL.h: Added.
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/KURL.cpp:
+        (WebCore):
+        * platform/KURL.h:
+        (KURL):
+        (WebCore::KURL::KURL):
+        (WebCore::KURL::isHashTableDeletedValue):
+        (WebCore):
+        * platform/KURLWTFURL.cpp: Added.
+        (WebCore):
+        (WebCore::KURL::KURL):
+        (WebCore::KURL::copy):
+        (WebCore::KURL::isNull):
+        (WebCore::KURL::isEmpty):
+        (WebCore::KURL::isValid):
+        (WebCore::KURL::hasPath):
+        (WebCore::KURL::string):
+        (WebCore::KURL::protocol):
+        (WebCore::KURL::host):
+        (WebCore::KURL::port):
+        (WebCore::KURL::hasPort):
+        (WebCore::KURL::user):
+        (WebCore::KURL::pass):
+        (WebCore::KURL::path):
+        (WebCore::KURL::lastPathComponent):
+        (WebCore::KURL::query):
+        (WebCore::KURL::fragmentIdentifier):
+        (WebCore::KURL::hasFragmentIdentifier):
+        (WebCore::KURL::copyParsedQueryTo):
+        (WebCore::KURL::baseAsString):
+        (WebCore::KURL::deprecatedString):
+        (WebCore::KURL::fileSystemPath):
+        (WebCore::KURL::protocolIs):
+        (WebCore::KURL::protocolIsInHTTPFamily):
+        (WebCore::KURL::setProtocol):
+        (WebCore::KURL::setHost):
+        (WebCore::KURL::removePort):
+        (WebCore::KURL::setPort):
+        (WebCore::KURL::setHostAndPort):
+        (WebCore::KURL::setUser):
+        (WebCore::KURL::setPass):
+        (WebCore::KURL::setPath):
+        (WebCore::KURL::setQuery):
+        (WebCore::KURL::setFragmentIdentifier):
+        (WebCore::KURL::removeFragmentIdentifier):
+        (WebCore::KURL::hostStart):
+        (WebCore::KURL::hostEnd):
+        (WebCore::KURL::pathStart):
+        (WebCore::KURL::pathEnd):
+        (WebCore::KURL::pathAfterLastSlash):
+        (WebCore::KURL::invalidate):
+        (WebCore::KURL::isHierarchical):
+        (WebCore::protocolIs):
+        (WebCore::equalIgnoringFragmentIdentifier):
+        (WebCore::protocolHostAndPortAreEqual):
+        (WebCore::encodeWithURLEscapeSequences):
+        (WebCore::decodeURLEscapeSequences):
+        * platform/KURLWTFURLImpl.h: Copied from Source/WebCore/platform/mac/KURLMac.mm.
+        (WebCore):
+        (KURLWTFURLImpl):
+        * platform/cf/KURLCFNet.cpp:
+        (WebCore):
+        (WebCore::KURL::KURL):
+        (WebCore::KURL::createCFURL):
+        * platform/mac/KURLMac.mm:
+        (WebCore):
+        (WebCore::KURL::KURL):
+        (WebCore::KURL::operator NSURL *):
+
+2012-02-25  Anders Carlsson  <andersca@apple.com>
+
+        Make the libc++ workaround more targeted
+        https://bugs.webkit.org/show_bug.cgi?id=79578
+        <rdar://problem/10933150>
+
+        Reviewed by Sam Weinig.
+
+        Change the std::move implementation to take a WebCore::TimerHeapReference directly so 
+        WebCore still builds with a version of libc++ that has the right std::move function template.
+
+        * WebCorePrefix.h:
+        (WebCore):
+        (move):
+
+2012-02-25  Andreas Kling  <awesomekling@apple.com>
+
+        Remove HTMLEmbedElement::insertedIntoDocument().
+        <http://webkit.org/b/79576>
+
+        Reviewed by Anders Carlsson.
+
+        * html/HTMLEmbedElement.cpp:
+        * html/HTMLEmbedElement.h:
+
+2012-02-25  Adrienne Walker  <enne@google.com>
+
+        Fix unused variable warnings in HarfBuzzShaperBase
+        https://bugs.webkit.org/show_bug.cgi?id=79575
+
+        Reviewed by Andreas Kling.
+
+        In builds where asserts are not enabled, the error variable is unused.
+
+        * platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp:
+        (WebCore::normalizeSpacesAndMirrorChars):
+
+2012-02-25  Andreas Kling  <awesomekling@apple.com>
+
+        Remove HTMLTableElement::attach().
+        <http://webkit.org/b/79574>
+
+        Reviewed by Anders Carlsson.
+
+        Remove this attach() override since it was only used to assert that
+        we're not already attached, and this is already done by Node::attach().
+
+        * html/HTMLTableElement.cpp:
+        * html/HTMLTableElement.h:
+
+2012-02-25  Andreas Kling  <awesomekling@apple.com>
+
+        HTMLTableElement: Avoid CSSParser in createSharedCellStyle().
+        <http://webkit.org/b/79573>
+
+        Reviewed by Anders Carlsson.
+
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::createSharedCellStyle):
+
+2012-02-25  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Unreviewed, rolling out r108557.
+        http://trac.webkit.org/changeset/108557
+        https://bugs.webkit.org/show_bug.cgi?id=77705
+
+        Broke svg/zoom/page/zoom-replated-intrinsic-ratio-001.htm.
+
+        * rendering/RenderTableCell.cpp:
+        * rendering/RenderTableCell.h:
+        (RenderTableCell):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowLogicalHeight):
+
+2012-02-25  Andreas Kling  <awesomekling@apple.com>
+
+        HTMLParamElement: Clean up name/value attribute handling.
+        <http://webkit.org/b/79559>
+
+        Reviewed by Anders Carlsson.
+
+        Out-of-line name() and value(), and move the logic from parseAttribute()
+        into them instead. This makes the class a bit simpler and shrinks it by
+        two AtomicStrings. Also reduced isURLAttribute() to a two-liner.
+
+        * html/HTMLParamElement.cpp:
+        (WebCore::HTMLParamElement::name):
+        (WebCore::HTMLParamElement::value):
+        (WebCore::HTMLParamElement::isURLAttribute):
+        * html/HTMLParamElement.h:
+
+2012-02-24  Tien-Ren Chen  <trchen@chromium.org>
+
+        [chromium] Replace RefPtr with OwnPtr for CCLayerImpl tree structure
+        https://bugs.webkit.org/show_bug.cgi?id=78404
+
+        Reviewed by James Robinson.
+
+        No new tests. Updated existing test to reflect changes.
+
+        * platform/graphics/chromium/CanvasLayerChromium.cpp:
+        (WebCore::CanvasLayerChromium::createCCLayerImpl):
+        * platform/graphics/chromium/CanvasLayerChromium.h:
+        (CanvasLayerChromium):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::createCCLayerImpl):
+        * platform/graphics/chromium/LayerChromium.h:
+        (LayerChromium):
+        * platform/graphics/chromium/PluginLayerChromium.cpp:
+        (WebCore::PluginLayerChromium::createCCLayerImpl):
+        * platform/graphics/chromium/PluginLayerChromium.h:
+        (PluginLayerChromium):
+        * platform/graphics/chromium/SolidColorLayerChromium.cpp:
+        (WebCore::SolidColorLayerChromium::createCCLayerImpl):
+        * platform/graphics/chromium/SolidColorLayerChromium.h:
+        (SolidColorLayerChromium):
+        * platform/graphics/chromium/TiledLayerChromium.cpp:
+        (WebCore::TiledLayerChromium::createCCLayerImpl):
+        * platform/graphics/chromium/TiledLayerChromium.h:
+        (TiledLayerChromium):
+        * platform/graphics/chromium/TreeSynchronizer.cpp:
+        (WebCore::TreeSynchronizer::synchronizeTrees):
+        (WebCore::TreeSynchronizer::collectExistingCCLayerImplRecursive):
+        (WebCore):
+        (WebCore::TreeSynchronizer::reuseOrCreateCCLayerImpl):
+        (WebCore::TreeSynchronizer::synchronizeTreeRecursive):
+        * platform/graphics/chromium/TreeSynchronizer.h:
+        (TreeSynchronizer):
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::createCCLayerImpl):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+        (VideoLayerChromium):
+        * platform/graphics/chromium/cc/CCCanvasLayerImpl.h:
+        (WebCore::CCCanvasLayerImpl::create):
+        * platform/graphics/chromium/cc/CCDamageTracker.cpp:
+        (WebCore::CCDamageTracker::updateDamageTrackingState):
+        (WebCore::CCDamageTracker::trackDamageFromActiveLayers):
+        * platform/graphics/chromium/cc/CCDamageTracker.h:
+        (CCDamageTracker):
+        * platform/graphics/chromium/cc/CCLayerImpl.cpp:
+        (WebCore::CCLayerImpl::CCLayerImpl):
+        (WebCore::CCLayerImpl::addChild):
+        (WebCore::sortLayers):
+        (WebCore::CCLayerImpl::setMaskLayer):
+        (WebCore::CCLayerImpl::setReplicaLayer):
+        * platform/graphics/chromium/cc/CCLayerImpl.h:
+        (WebCore::CCLayerImpl::create):
+        (WebCore::CCLayerImpl::children):
+        (CCLayerImpl):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerIterator.cpp:
+        (WebCore):
+        (WebCore::CCLayerIteratorActions::BackToFront::begin):
+        (WebCore::CCLayerIteratorActions::BackToFront::end):
+        (WebCore::CCLayerIteratorActions::BackToFront::next):
+        (WebCore::CCLayerIteratorActions::FrontToBack::begin):
+        (WebCore::CCLayerIteratorActions::FrontToBack::end):
+        (WebCore::CCLayerIteratorActions::FrontToBack::next):
+        (WebCore::CCLayerIteratorActions::FrontToBack::goToHighestInSubtree):
+        * platform/graphics/chromium/cc/CCLayerIterator.h:
+        (WebCore):
+        (CCLayerIterator):
+        (WebCore::CCLayerIterator::begin):
+        (WebCore::CCLayerIterator::end):
+        (WebCore::CCLayerIterator::targetRenderSurfaceLayer):
+        (WebCore::CCLayerIterator::CCLayerIterator):
+        (WebCore::CCLayerIterator::getRawPtr):
+        (WebCore::CCLayerIterator::currentLayer):
+        (WebCore::CCLayerIterator::targetRenderSurfaceChildren):
+        (BackToFront):
+        (FrontToBack):
+        * platform/graphics/chromium/cc/CCLayerSorter.cpp:
+        (WebCore::CCLayerSorter::createGraphNodes):
+        * platform/graphics/chromium/cc/CCLayerSorter.h:
+        (CCLayerSorter):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::finishCommitOnImplThread):
+        (WebCore::CCLayerTreeHost::didBecomeInvisibleOnImplThread):
+        (WebCore::CCLayerTreeHost::reserveTextures):
+        (WebCore::CCLayerTreeHost::paintLayerContents):
+        (WebCore::CCLayerTreeHost::updateCompositorResources):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp:
+        (WebCore):
+        (WebCore::calculateDrawTransformsAndVisibilityInternal):
+        (WebCore::walkLayersAndCalculateVisibleLayerRects):
+        (WebCore::CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility):
+        * platform/graphics/chromium/cc/CCLayerTreeHostCommon.h:
+        (CCLayerTreeHostCommon):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp:
+        (WebCore::CCLayerTreeHostImpl::CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::trackDamageForAllSurfaces):
+        (WebCore::CCLayerTreeHostImpl::calculateRenderPasses):
+        (WebCore::CCLayerTreeHostImpl::drawLayers):
+        (WebCore::CCLayerTreeHostImpl::setRootLayer):
+        * platform/graphics/chromium/cc/CCLayerTreeHostImpl.h:
+        (CCLayerTreeHostImpl):
+        (WebCore::CCLayerTreeHostImpl::releaseRootLayer):
+        (WebCore::CCLayerTreeHostImpl::scrollLayer):
+        * platform/graphics/chromium/cc/CCPluginLayerImpl.h:
+        (WebCore::CCPluginLayerImpl::create):
+        * platform/graphics/chromium/cc/CCRenderSurface.h:
+        (WebCore::CCRenderSurface::layerList):
+        (CCRenderSurface):
+        * platform/graphics/chromium/cc/CCSolidColorLayerImpl.h:
+        (WebCore::CCSolidColorLayerImpl::create):
+        * platform/graphics/chromium/cc/CCTiledLayerImpl.h:
+        (WebCore::CCTiledLayerImpl::create):
+        * platform/graphics/chromium/cc/CCVideoLayerImpl.h:
+        (WebCore::CCVideoLayerImpl::create):
+
+2012-02-24  Andreas Kling  <awesomekling@apple.com>
+
+        Don't pass constant strings to CSSParser for presentation attributes.
+        <http://webkit.org/b/79530>
+
+        Reviewed by Anders Carlsson.
+
+        "both" -> CSSValueBoth.
+        "center" -> CSSValueCenter.
+
+        * html/HTMLBRElement.cpp:
+        (WebCore::HTMLBRElement::collectStyleForAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::collectStyleForAttribute):
+
+2012-02-24  Yael Aharon  <yael.aharon@nokia.com>
+
+        [Texmap] Add const-ness to TextureMapperShaderManager
+        https://bugs.webkit.org/show_bug.cgi?id=79545
+
+        Reviewed by Noam Rosenthal.
+        
+        Add const to new methods.
+        No new tests.
+
+        * platform/graphics/texmap/TextureMapperShaderManager.cpp:
+        (WebCore::TextureMapperShaderProgramSimple::vertexShaderSource):
+        (WebCore::TextureMapperShaderProgramSimple::fragmentShaderSource):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::vertexShaderSource):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::fragmentShaderSource):
+        * platform/graphics/texmap/TextureMapperShaderManager.h:
+        (WebCore::TextureMapperShaderProgram::matrixVariable):
+        (WebCore::TextureMapperShaderProgram::sourceMatrixVariable):
+        (WebCore::TextureMapperShaderProgram::sourceTextureVariable):
+        (WebCore::TextureMapperShaderProgram::opacityVariable):
+        (TextureMapperShaderProgram):
+        (TextureMapperShaderProgramSimple):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::maskMatrixVariable):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::maskTextureVariable):
+        (TextureMapperShaderProgramOpacityAndMask):
+
+2012-02-24  Tom Sepez  <tsepez@chromium.org>
+
+        XSS Auditor targeting legitimate frames as false positives.
+        https://bugs.webkit.org/show_bug.cgi?id=79397
+
+        Reviewed by Adam Barth.
+
+        Test: http/tests/security/xssAuditor/script-tag-safe4.html
+
+        * html/parser/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::filterCharacterToken):
+        (WebCore::XSSAuditor::filterScriptToken):
+        (WebCore::XSSAuditor::filterObjectToken):
+        (WebCore::XSSAuditor::filterEmbedToken):
+        (WebCore::XSSAuditor::filterAppletToken):
+        (WebCore::XSSAuditor::filterIframeToken):
+        (WebCore::XSSAuditor::decodedSnippetForToken):
+        (WebCore):
+        (WebCore::XSSAuditor::decodedSnippetForName):
+        (WebCore::XSSAuditor::decodedSnippetForAttribute):
+        (WebCore::XSSAuditor::decodedSnippetForJavascript):
+        (WebCore::XSSAuditor::isContainedInRequest):
+        (WebCore::XSSAuditor::isSameOriginResource):
+        * html/parser/XSSAuditor.h:
+
+2012-02-24  Ian Vollick  <vollick@chromium.org>
+
+        [chromium] Plumb animation started notifications from CCLayerTreeHost to GraphicsLayerChromium
+        https://bugs.webkit.org/show_bug.cgi?id=77646
+
+        Reviewed by James Robinson.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (std):
+        (WebCore::GraphicsLayerChromium::~GraphicsLayerChromium):
+        (WebCore::GraphicsLayerChromium::addAnimation):
+        (WebCore::GraphicsLayerChromium::pauseAnimation):
+        (WebCore::GraphicsLayerChromium::removeAnimation):
+        (WebCore::GraphicsLayerChromium::suspendAnimations):
+        (WebCore::GraphicsLayerChromium::resumeAnimations):
+        (WebCore::GraphicsLayerChromium::updateLayerPreserves3D):
+        (WebCore::GraphicsLayerChromium::mapAnimationNameToId):
+        (WebCore):
+        (WebCore::GraphicsLayerChromium::notifyAnimationStarted):
+        (WebCore::GraphicsLayerChromium::notifyAnimationFinished):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        (GraphicsLayerChromium):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::LayerChromium):
+        (WebCore::LayerChromium::setAnimationEvent):
+        (WebCore):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore):
+        (LayerChromium):
+        (WebCore::LayerChromium::setLayerAnimationDelegate):
+        * platform/graphics/chromium/cc/CCAnimationEvents.cpp: Added.
+        (WebCore):
+        (WebCore::CCAnimationEvent::CCAnimationEvent):
+        (WebCore::CCAnimationEvent::~CCAnimationEvent):
+        (WebCore::CCAnimationEvent::toAnimationStartedEvent):
+        (WebCore::CCAnimationEvent::toAnimationFinishedEvent):
+        (WebCore::CCAnimationStartedEvent::create):
+        (WebCore::CCAnimationStartedEvent::CCAnimationStartedEvent):
+        (WebCore::CCAnimationStartedEvent::~CCAnimationStartedEvent):
+        (WebCore::CCAnimationStartedEvent::type):
+        (WebCore::CCAnimationFinishedEvent::create):
+        (WebCore::CCAnimationFinishedEvent::CCAnimationFinishedEvent):
+        (WebCore::CCAnimationFinishedEvent::~CCAnimationFinishedEvent):
+        (WebCore::CCAnimationFinishedEvent::type):
+        * platform/graphics/chromium/cc/CCAnimationEvents.h:
+        (WebCore):
+        (CCAnimationEvent):
+        (WebCore::CCAnimationEvent::layerId):
+        (CCAnimationStartedEvent):
+        (WebCore::CCAnimationStartedEvent::startTime):
+        (CCAnimationFinishedEvent):
+        (WebCore::CCAnimationFinishedEvent::animationId):
+        * platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp:
+        (WebCore::CCLayerAnimationControllerImpl::animate):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForNextTick):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForStartTime):
+        (WebCore::CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability):
+        (WebCore::CCLayerAnimationControllerImpl::purgeFinishedAnimations):
+        (WebCore::CCLayerAnimationControllerImpl::tickAnimations):
+        * platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h:
+        (CCLayerAnimationControllerImpl):
+        * platform/graphics/chromium/cc/CCLayerAnimationDelegate.h: Copied from Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.h.
+        (WebCore):
+        (CCLayerAnimationDelegate):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.cpp:
+        (WebCore::CCLayerTreeHost::setAnimationEvents):
+        (WebCore::CCLayerTreeHost::setAnimationEventsRecursive):
+        (WebCore):
+        * platform/graphics/chromium/cc/CCLayerTreeHost.h:
+
+2012-02-24  Abhishek Arya  <inferno@chromium.org>
+
+        Regression(r107477): Crash in StaticNodeList::itemWithName.
+        https://bugs.webkit.org/show_bug.cgi?id=79532
+
+        Reviewed by Andreas Kling.
+
+        Make sure that node is an element node before checking its id attribute.
+
+        Test: fast/mutation/mutation-callback-non-element-crash.html
+
+        * dom/StaticNodeList.cpp:
+        (WebCore::StaticNodeList::itemWithName):
+
+2012-02-24  Tony Chang  <tony@chromium.org>
+
+        More refactoring in RenderFlexibleBox
+        https://bugs.webkit.org/show_bug.cgi?id=79533
+
+        Reviewed by Ojan Vafai.
+
+        No new tests, just refactoring.
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutFlexItems): Move the flipping of RTL+column positions to its own method.
+        This might be a tiny bit slower, but it's clearer since it's not related to alignment.
+        (WebCore::RenderFlexibleBox::layoutAndPlaceChildren): Move the logical height calculation out of the loop.  We only need the final height.
+        (WebCore::RenderFlexibleBox::alignChildren):
+        (WebCore::RenderFlexibleBox::flipForRightToLeftColumn):
+        * rendering/RenderFlexibleBox.h:
+        (RenderFlexibleBox):
+
+2012-02-24  Abhishek Arya  <inferno@chromium.org>
+
+        Positioned objects not cleared when moving children
+        to clone block in multi-column layout.
+        https://bugs.webkit.org/show_bug.cgi?id=78416
+
+        Reviewed by Eric Seidel.
+
+        Test: fast/multicol/span/positioned-child-not-removed-crash.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::splitBlocks):
+
+2012-02-24  Michael Saboff  <msaboff@apple.com>
+
+        Unreviewed, Windows build fix.  Changed "-1" to newly
+        created constant JSC::Yarr::offsetNoMatch added in r108858.
+
+        * platform/text/RegularExpression.cpp:
+        (WebCore::RegularExpression::match):
+
+2012-02-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Update TextTrackCue API
+        https://bugs.webkit.org/show_bug.cgi?id=79368
+
+        Change TextTrackCue.alignment to .align, TextTrackCue.linePosition and .textPosition to .line
+        and .position, and TextTrackCue.direction to .vertical. Change direction values "horizontal" 
+        to "","vertical" to "rl", and "vertical-lr" to "lr".
+
+        Reviewed by Eric Seidel.
+
+        No new tests, updated existing tests for API changes.
+
+        * html/track/TextTrackCue.cpp:
+        (WebCore::horizontalKeyword):
+        (WebCore::verticalGrowingLeftKeyword):
+        (WebCore):
+        (WebCore::verticalGrowingRightKeyword):
+        (WebCore::verticalKeywordOLD):
+        (WebCore::verticallrKeywordOLD):
+        (WebCore::TextTrackCue::TextTrackCue):
+        (WebCore::TextTrackCue::vertical):
+        (WebCore::TextTrackCue::setVertical):
+        (WebCore::TextTrackCue::setLine):
+        (WebCore::TextTrackCue::setPosition):
+        (WebCore::TextTrackCue::align):
+        (WebCore::TextTrackCue::setAlign):
+        (WebCore::TextTrackCue::parseSettings):
+        * html/track/TextTrackCue.h:
+        (TextTrackCue):
+        (WebCore::TextTrackCue::line):
+        (WebCore::TextTrackCue::position):
+        * html/track/TextTrackCue.idl:
+
+2012-02-24  Adrienne Walker  <enne@google.com>
+
+        Fix uninitialized variables in HarfBuzzShaperBase
+        https://bugs.webkit.org/show_bug.cgi?id=79546
+
+        Reviewed by Dirk Pranke.
+
+        These were introduced in r108733.
+
+        * platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp:
+        (WebCore::HarfBuzzShaperBase::HarfBuzzShaperBase):
+
+2012-02-24  Noel Gordon  <noel.gordon@gmail.com>
+
+        [chromium] JPEG RGB image with Adode Marker fails to turbo swizzle decode
+        https://bugs.webkit.org/show_bug.cgi?id=79457
+
+        Reviewed by Adam Barth.
+
+        If a JPEG has no JFIF marker, the Adode Marker must be used to determine the image
+        color space for decoding via that markers transform value. Transform 0 images with
+        3 color components (RGB) fail to decode with libjpeg-turbo when a swizzle decoding
+        is active. Detect this case and decode using JCS_RGB output color space instead.
+
+        Test: fast/images/rgb-jpeg-with-abode-marker-only.html
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::decode):
+
+2012-02-24  Joshua Bell  <jsbell@chromium.org>
+
+        [V8] IndexedDB: IDBTransaction objects leak in Workers
+        https://bugs.webkit.org/show_bug.cgi?id=79308
+
+        Use a V8RecursionScope whenever Workers call into script, so that
+        post-script side-effects can be executed.
+
+        Reviewed by Tony Chang.
+
+        Test: storage/indexeddb/transaction-abort-workers.html
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/V8WorkerContextErrorHandler.cpp:
+        (WebCore::V8WorkerContextErrorHandler::callListenerFunction):
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::callListenerFunction):
+        * bindings/v8/WorkerContextExecutionProxy.cpp: Replace custom recursion tracking.
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::runScript):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        (WorkerContextExecutionProxy):
+
+2012-02-24  Gregg Tavares  <gman@google.com>
+
+        Limit WebGL Errors in Console to 10 per context
+        https://bugs.webkit.org/show_bug.cgi?id=79387
+
+        Reviewed by Kenneth Russell.
+        
+        Some apps generated enough errors to overload
+        the Dev Tools so limit the number of errors.
+        For a correct app there should never be any
+        errors so seeing the first few should be enough
+        to debug.
+
+        No new tests as no new functionality
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore):
+        (WebCore::WebGLRenderingContextErrorMessageCallback::onErrorMessage):
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
+        (WebCore::WebGLRenderingContext::initializeNewContext):
+        (WebCore::WebGLRenderingContext::printGLErrorToConsole):
+        (WebCore::WebGLRenderingContext::synthesizeGLError):
+        * html/canvas/WebGLRenderingContext.h:
+        (WebGLRenderingContext):
+
+2012-02-24  Michael Saboff  <msaboff@apple.com>
+
+        ASSERT(position < 0) in JSC::Yarr::Interpreter::InputStream::readChecked
+        https://bugs.webkit.org/show_bug.cgi?id=73728
+
+        Reviewed by Gavin Barraclough.
+
+        No new tests, refactored usage of JSC::Yarr interpreter.
+        Should be covered by existing tests.
+
+        Changed WebCore callers of JSC::Yarr:Interpreter::interpret() to match the
+        new signature with unsigned offsets.
+
+        * inspector/ContentSearchUtils.cpp:
+        (WebCore::ContentSearchUtils::findMagicComment):
+        * platform/text/RegularExpression.cpp:
+        (WebCore::RegularExpression::match):
+
+2012-02-24  Hans Muller  <hmuller@adobe.com>
+
+        onclick is not reliable for transformed SVG elements
+        https://bugs.webkit.org/show_bug.cgi?id=34714
+
+        Reviewed by Dirk Schulze.
+
+        Use FloatPoints in RenderSVGRoot::nodeAtPoint() when converting the incoming
+        point to local coordinates.
+
+        Test: svg/hittest/svg-small-viewbox.xhtml
+
+        * rendering/svg/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::nodeAtPoint):
+
+2012-02-24  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Implement limited parsing of -webkit-grid-column and -webkit-grid-row
+        https://bugs.webkit.org/show_bug.cgi?id=79151
+
+        Reviewed by Ojan Vafai.
+
+        Test: fast/css-grid-layout/grid-item-column-row-get-set.html
+
+        This change implements a subset of the grammar:
+
+        -webkit-grid-{row|column} := <integer> | 'auto'
+
+        * CMakeLists.txt:
+        * GNUmakefile.list.am:
+        * Target.pri:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Added the new files to our build systems.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::valueForGridPosition): Check that we have the right translated grammar
+        (this function will be more useful once we implement more of the grammar).
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        Added handling for the new properties.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        Allow only 'auto' or <integer>.
+
+        * css/CSSProperty.cpp:
+        (WebCore::CSSProperty::isInheritedProperty):
+        grid-colum and grid-row are not inherited.
+
+        * css/CSSPropertyNames.in:
+        Added the 2 new properties.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::RenderStyle):
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleGridItemData.cpp: Added.
+        (WebCore::StyleGridItemData::StyleGridItemData):
+        * rendering/style/StyleGridItemData.h: Added.
+        (StyleGridItemData):
+        (WebCore::StyleGridItemData::create):
+        (WebCore::StyleGridItemData::copy):
+        (WebCore::StyleGridItemData::operator==):
+        (WebCore::StyleGridItemData::operator!=):
+        Implemented the minimum working class.
+
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h:
+        (StyleRareNonInheritedData):
+        Added StyleGridItemData to the class StyleRareNonInheritedData.
+
+2012-02-24  Joshua Bell  <jsbell@chromium.org>
+
+        IndexedDB: IDBObjectStore.count() and IDBIndex.count() should accept key argument
+        https://bugs.webkit.org/show_bug.cgi?id=79422
+
+        Reviewed by Tony Chang.
+
+        Tests: storage/indexeddb/index-count.html
+               storage/indexeddb/objectstore-count.html
+
+        * storage/IDBIndex.cpp:
+        (WebCore::IDBIndex::count):
+        (WebCore):
+        * storage/IDBIndex.h:
+        (WebCore::IDBIndex::count):
+        (IDBIndex):
+        * storage/IDBIndex.idl:
+        * storage/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::deleteFunction):
+        (WebCore::IDBObjectStore::count):
+        (WebCore):
+        * storage/IDBObjectStore.h:
+        (WebCore::IDBObjectStore::count):
+        (IDBObjectStore):
+        * storage/IDBObjectStore.idl:
+
+2012-02-24  Adam Barth  <abarth@webkit.org>
+
+        Move mediastream into Modules/mediastream
+        https://bugs.webkit.org/show_bug.cgi?id=79517
+
+        Reviewed by Eric Seidel.
+
+        This patch moves the mediastream directory into Modules.  mediastream
+        is a self-contained feature and is a good candidate for being a module.
+
+        * GNUmakefile.am:
+        * GNUmakefile.list.am:
+        * Modules/mediastream: Copied from Source/WebCore/mediastream.
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * mediastream: Removed.
+        * mediastream/DOMWindowMediaStream.idl: Removed.
+        * mediastream/LocalMediaStream.cpp: Removed.
+        * mediastream/LocalMediaStream.h: Removed.
+        * mediastream/LocalMediaStream.idl: Removed.
+        * mediastream/MediaStream.cpp: Removed.
+        * mediastream/MediaStream.h: Removed.
+        * mediastream/MediaStream.idl: Removed.
+        * mediastream/MediaStreamEvent.cpp: Removed.
+        * mediastream/MediaStreamEvent.h: Removed.
+        * mediastream/MediaStreamEvent.idl: Removed.
+        * mediastream/MediaStreamList.cpp: Removed.
+        * mediastream/MediaStreamList.h: Removed.
+        * mediastream/MediaStreamList.idl: Removed.
+        * mediastream/MediaStreamRegistry.cpp: Removed.
+        * mediastream/MediaStreamRegistry.h: Removed.
+        * mediastream/MediaStreamTrack.cpp: Removed.
+        * mediastream/MediaStreamTrack.h: Removed.
+        * mediastream/MediaStreamTrack.idl: Removed.
+        * mediastream/MediaStreamTrackList.cpp: Removed.
+        * mediastream/MediaStreamTrackList.h: Removed.
+        * mediastream/MediaStreamTrackList.idl: Removed.
+        * mediastream/NavigatorMediaStream.cpp: Removed.
+        * mediastream/NavigatorMediaStream.h: Removed.
+        * mediastream/NavigatorMediaStream.idl: Removed.
+        * mediastream/NavigatorUserMediaError.h: Removed.
+        * mediastream/NavigatorUserMediaError.idl: Removed.
+        * mediastream/NavigatorUserMediaErrorCallback.h: Removed.
+        * mediastream/NavigatorUserMediaErrorCallback.idl: Removed.
+        * mediastream/NavigatorUserMediaSuccessCallback.h: Removed.
+        * mediastream/NavigatorUserMediaSuccessCallback.idl: Removed.
+        * mediastream/PeerConnection.cpp: Removed.
+        * mediastream/PeerConnection.h: Removed.
+        * mediastream/PeerConnection.idl: Removed.
+        * mediastream/SignalingCallback.h: Removed.
+        * mediastream/SignalingCallback.idl: Removed.
+        * mediastream/UserMediaClient.h: Removed.
+        * mediastream/UserMediaController.cpp: Removed.
+        * mediastream/UserMediaController.h: Removed.
+        * mediastream/UserMediaRequest.cpp: Removed.
+        * mediastream/UserMediaRequest.h: Removed.
+
+2012-02-24  Abhishek Arya  <inferno@chromium.org>
+
+        Overhanging floats not removed from new flex box.
+        https://bugs.webkit.org/show_bug.cgi?id=79522
+
+        Reviewed by Ojan Vafai.
+
+        Similar to r69476.
+
+        Test: fast/flexbox/overhanging-floats-not-removed-crash.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
+
+2012-02-24  Brent Fulgham  <bfulgham@webkit.org>
+
+        [WinCairo] Compute more acurate font heights.
+        https://bugs.webkit.org/show_bug.cgi?id=79524
+
+        Reviewed by Adam Roben.
+
+        Adjust font handling as suggested by Lynn Neir to use the proper
+        xHeight value for the font, rather than the fall-back guess
+        used in the current code.
+
+        css1/text_properties/line_height.html
+
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        (WebCore::SimpleFontData::platformInit): Properly initialize a
+          few elements.
+        (WebCore::SimpleFontData::platformWidthForGlyph): Use the Cairo
+          cairo_scaled_font_text_extents call, rather than attempting
+          to compute the value from ::GetGlyphOutline.
+
+2012-02-24  Tim Horton  <timothy_horton@apple.com>
+
+        Infinite repaint loop with SVGImageCache and deferred repaint timers
+        https://bugs.webkit.org/show_bug.cgi?id=78315
+        <rdar://problem/10651634>
+
+        Reviewed by Dean Jackson.
+
+        Only defer image redraw on a timer if we're in layout. This breaks
+        the repaint loop while still preventing us from drawing inside layout.
+
+        No new tests, as the problem only occurs in a nonstandard configuration.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::draw):
+        (WebCore::SVGImage::frameView):
+        (WebCore):
+        * svg/graphics/SVGImage.h:
+        (WebCore):
+        * svg/graphics/SVGImageCache.cpp:
+        (WebCore::SVGImageCache::imageContentChanged):
+        (WebCore::SVGImageCache::redraw):
+        (WebCore::SVGImageCache::redrawTimerFired):
+        (WebCore):
+        * svg/graphics/SVGImageCache.h:
+        (SVGImageCache):
+
+2012-02-24  Tim Horton  <timothy_horton@apple.com>
+
+        SVG should be supported in Dashboard compatibility mode
+        https://bugs.webkit.org/show_bug.cgi?id=78322
+        <rdar://problem/5861278>
+
+        Reviewed by Dean Jackson.
+
+        Enable SVG elements inside Dashboard, more or less reverting r21418.
+
+        Tests: http/tests/xmlhttprequest/svg-created-by-xhr-allowed-in-dashboard.html
+               svg/custom/embedded-svg-allowed-in-dashboard.xml
+               svg/custom/manually-parsed-embedded-svg-allowed-in-dashboard.html
+               svg/custom/manually-parsed-svg-allowed-in-dashboard.html
+               svg/custom/svg-allowed-in-dashboard-object.html
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * dom/Document.cpp:
+        (WebCore::Document::importNode):
+        * dom/make_names.pl:
+        (printFactoryCppFile):
+
+2012-02-24  Min Qin  <qinmin@google.com>
+
+        Expose a setting to exempt media playback from user gesture requirement after a user gesture is initiated on loading/playing a media
+        https://bugs.webkit.org/show_bug.cgi?id=79167
+
+        Reviewed by Adam Barth.
+
+        Test: media/video-play-require-user-gesture.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::load):
+        (WebCore::HTMLMediaElement::play):
+        (WebCore::HTMLMediaElement::removeBehaviorsRestrictionsAfterFirstUserGesture):
+        (WebCore):
+        * html/HTMLMediaElement.h:
+        (HTMLMediaElement):
+        * testing/Internals.cpp:
+        (WebCore::Internals::setMediaPlaybackRequiresUserGesture):
+        (WebCore):
+        * testing/Internals.h:
+        (Internals):
+        * testing/Internals.idl:
+
+2012-02-24  Adam Barth  <abarth@webkit.org>
+
+        DOMWindow*.idl should have had the same license block as DOMWindow.idl did originally
+        https://bugs.webkit.org/show_bug.cgi?id=79507
+
+        Reviewed by Alexey Proskuryakov.
+
+        In moving pieces of DOMWindow.idl into separate files, we mistakenly
+        changed some of the license blocks.  All these files should have a
+        license block that matches the file that originally contained the code.
+
+        * Modules/intents/DOMWindowIntents.idl:
+        * fileapi/DOMWindowFileSystem.idl:
+        * html/DOMWindowHTML.idl:
+        * html/canvas/DOMWindowWebGL.idl:
+        * mediastream/DOMWindowMediaStream.idl:
+        * storage/DOMWindowSQLDatabase.idl:
+        * svg/DOMWindowSVG.idl:
+        * webaudio/DOMWindowWebAudio.idl:
+        * websockets/DOMWindowWebSocket.idl:
+        * workers/DOMWindowWorker.idl:
+        * xml/DOMWindowXML.idl:
+
+2012-02-24  David Kilzer  <ddkilzer@apple.com>
+
+        Use xcrun to find compiler paths for Generate Derived Sources build phase script
+        <http://webkit.org/b/79512>
+
+        Reviewed by Mark Rowe.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        (Generate Derived Sources): Use xcrun to find the path to the
+        compiler since that works on both iOS and OS X.
+
+2012-02-24  Anders Carlsson  <andersca@apple.com>
+
+        Crash in TileCache::revalidateTiles
+        https://bugs.webkit.org/show_bug.cgi?id=79510
+        <rdar://problem/10928035>
+
+        Reviewed by Sam Weinig.
+
+        Handle the tile cache layer's PlatformCALayer going away before the
+        CALayer itself has been deallocated.
+
+        * platform/graphics/ca/mac/TileCache.mm:
+        (WebCore::TileCache::revalidateTiles):
+
+2012-02-24  Adam Klein  <adamk@chromium.org>
+
+        Don't notify the inspector of Node insertions initiated by the parser
+        https://bugs.webkit.org/show_bug.cgi?id=79388
+
+        Reviewed by Adam Barth.
+
+        This is part of a series of changes to make ContainerNode's
+        implementation simpler and more internally consistent.
+
+        I don't know of a way to break on parser-initiated insertions,
+        and the code already doesn't notify on parser-initiated removes
+        (in ContainerNode::parserRemoveChild).
+
+        No new tests, should already be covered by
+        inspector/debugger/dom-breakpoints.html.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::parserInsertBefore):
+        (WebCore::ContainerNode::parserAddChild):
+
+2012-02-24  Daniel Bates  <dbates@webkit.org>
+
+        Attempt to fix the Windows and WinCE build after changeset r108809
+        <http://trac.webkit.org/changeset/108809> (https://bugs.webkit.org/show_bug.cgi?id=38995)
+
+        Substitute styleLoadEventSender() for loadEventSender() in HTMLStyleElement.cpp
+        and substitute linkLoadEventSender() for loadEventSender() in HTMLLinkElement.cpp. 
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::linkLoadEventSender):
+        (WebCore::HTMLLinkElement::~HTMLLinkElement):
+        (WebCore::HTMLLinkElement::dispatchPendingLoadEvents):
+        (WebCore::HTMLLinkElement::dispatchPendingEvent):
+        (WebCore::HTMLLinkElement::notifyLoadedSheetAndAllCriticalSubresources):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::styleLoadEventSender):
+        (WebCore::HTMLStyleElement::~HTMLStyleElement):
+        (WebCore::HTMLStyleElement::dispatchPendingLoadEvents):
+        (WebCore::HTMLStyleElement::dispatchPendingEvent):
+        (WebCore::HTMLStyleElement::notifyLoadedSheetAndAllCriticalSubresources):
+
+2012-02-24  Peter Beverloo  <peter@chromium.org>
+
+        [Chromium] Fix Chromium Android build by building HarfBuzzShaperBase.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=79497
+
+        Reviewed by Tony Gentilcore.
+
+        The Chromium Android build was broken by revision r108733, as the
+        HarfBuzzShaperBase.cpp file also should have been included for Android.
+        Fix the build by including it.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2012-02-24  Yael Aharon  <yael.aharon@nokia.com>
+
+        [Texmap] Consolidate the common parts of TextureMapperGL::drawTexture
+        https://bugs.webkit.org/show_bug.cgi?id=79143
+
+        Reviewed by Noam Rosenthal.
+
+        Combine the two drawTexture methods into one, and extract the part that
+        could not be combined into its own method.
+        No new tests. Refactoring only.
+
+        * platform/graphics/texmap/TextureMapperGL.cpp:
+        (WebCore):
+        (WebCore::TextureMapperGL::drawTexture):
+        * platform/graphics/texmap/TextureMapperGL.h:
+        (WebCore):
+        (BitmapTextureGL):
+        (WebCore::BitmapTextureGL::~BitmapTextureGL):
+        (WebCore::BitmapTextureGL::id):
+        (WebCore::BitmapTextureGL::relativeSize):
+        (WebCore::BitmapTextureGL::setTextureMapper):
+        (WebCore::BitmapTextureGL::BitmapTextureGL):
+        * platform/graphics/texmap/TextureMapperShaderManager.cpp:
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::fragmentShaderSource):
+        (WebCore):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::prepare):
+        * platform/graphics/texmap/TextureMapperShaderManager.h:
+        (WebCore):
+        (WebCore::TextureMapperShaderProgram::prepare):
+        (WebCore::TextureMapperShaderProgram::matrixVariable):
+        (WebCore::TextureMapperShaderProgram::sourceMatrixVariable):
+        (WebCore::TextureMapperShaderProgram::sourceTextureVariable):
+        (WebCore::TextureMapperShaderProgram::opacityVariable):
+        (TextureMapperShaderProgram):
+        (TextureMapperShaderProgramSimple):
+        (TextureMapperShaderProgramOpacityAndMask):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::maskMatrixVariable):
+        (WebCore::TextureMapperShaderProgramOpacityAndMask::maskTextureVariable):
+
+2012-02-24  Daniel Bates  <dbates@webkit.org>
+
+        style element and link element for CSS stylesheet should emit load/error event when sheet loads/fails to load
+        https://bugs.webkit.org/show_bug.cgi?id=38995
+
+        Reviewed by Adam Barth and Nate Chapin.
+
+        Tests: fast/dom/HTMLLinkElement/link-onerror-stylesheet-with-existent-and-non-existent-import.html
+               fast/dom/HTMLLinkElement/link-onerror-stylesheet-with-non-existent-import.html
+               fast/dom/HTMLLinkElement/link-onerror.html
+               fast/dom/HTMLLinkElement/link-onload-before-page-load.html
+               fast/dom/HTMLLinkElement/link-onload-stylesheet-with-import.html
+               fast/dom/HTMLLinkElement/link-onload.html
+               fast/dom/HTMLLinkElement/link-onload2.html
+               fast/dom/HTMLLinkElement/programmatically-add-link-with-onerror-handler.html
+               fast/dom/HTMLLinkElement/programmatically-add-link-with-onload-handler.html
+               fast/dom/HTMLStyleElement/programmatically-add-style-with-onerror-handler.html
+               fast/dom/HTMLStyleElement/programmatically-add-style-with-onload-handler.html
+               fast/dom/HTMLStyleElement/style-onerror-with-existent-and-non-existent-import.html
+               fast/dom/HTMLStyleElement/style-onerror.html
+               fast/dom/HTMLStyleElement/style-onload-before-page-load.html
+               fast/dom/HTMLStyleElement/style-onload.html
+               fast/dom/HTMLStyleElement/style-onload2.html
+
+        Implements support for firing Load and Error events at HTML Link and HTML Style elements as per
+        the HTML5 spec. (draft 05/25/2011) section "The link element" <http://www.w3.org/TR/html5/semantics.html#the-link-element>
+        and "The style element" <http://www.w3.org/TR/html5/semantics.html#the-style-element>, respectively.
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::setCSSStyleSheet): Modified to call CSSStyleSheet::notifyLoadedSheet()
+        after the style sheet associated with the @import rule loaded.
+        * css/CSSStyleSheet.cpp: Added instance variable m_didLoadErrorOccur to track whether a network error
+        occurred while loading any @import style sheets.
+        (WebCore::CSSStyleSheet::CSSStyleSheet):
+        (WebCore::CSSStyleSheet::checkLoaded):
+        (WebCore):
+        (WebCore::CSSStyleSheet::notifyLoadedSheet): Added; update m_didLoadErrorOccur to reflect if a network
+        error occurred while loading a style sheet associated with an @import rule.
+        * css/CSSStyleSheet.h:
+        (WebCore):
+        (CSSStyleSheet):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): Call HTML{LinkElement, StyleElement}::dispatchPendingLoadEvents() to
+        ensure that all pending Load events for link and style elements are dispatched before we fire the Load
+        event for the window.
+        * dom/Node.h:
+        (WebCore::Node::notifyLoadedSheetAndAllCriticalSubresources): Added; as stated in its name, this method is
+        called once a style sheet and all its critical subresources (@imports) have loaded.
+        * html/HTMLLinkElement.cpp:
+        (WebCore::loadEventSender):
+        (WebCore):
+        (WebCore::HTMLLinkElement::HTMLLinkElement):
+        (WebCore::HTMLLinkElement::~HTMLLinkElement): Modified to cancel all pending Load events on destruction.
+        (WebCore::HTMLLinkElement::parseAttribute): Register event listeners for Load and Error events regardless of whether we
+        built with link prefetch support.
+        (WebCore::HTMLLinkElement::setCSSStyleSheet):
+        (WebCore::HTMLLinkElement::dispatchPendingLoadEvents): Added; called from Document::implicitClose() to
+        ensure that all pending Load events for link elements have been dispatched before we fire the Load event
+        for the window.
+        (WebCore::HTMLLinkElement::dispatchPendingEvent): Added; called by EventSender.
+        (WebCore::HTMLLinkElement::notifyLoadedSheetAndAllCriticalSubresources): Added.
+        * html/HTMLLinkElement.h:
+        (WebCore):
+        (HTMLLinkElement):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::loadEventSender):
+        (WebCore):
+        (WebCore::HTMLStyleElement::HTMLStyleElement):
+        (WebCore::HTMLStyleElement::~HTMLStyleElement): Modified to cancel all pending Load events on destruction.
+        (WebCore::HTMLStyleElement::parseAttribute): Register event listeners for Load and Error events.
+        (WebCore::HTMLStyleElement::dispatchPendingLoadEvents): Added; called from Document::implicitClose() to
+        ensure that all pending Load events for link elements have been dispatched before we fire the Load event
+        for the window.
+        (WebCore::HTMLStyleElement::dispatchPendingEvent): Added; called by EventSender.
+        (WebCore::HTMLStyleElement::notifyLoadedSheetAndAllCriticalSubresources): Added.
+        * html/HTMLStyleElement.h:
+        (WebCore):
+        (HTMLStyleElement):
+
+2012-02-24  Adam Roben  <aroben@apple.com>
+
+        Mac build fix after r108698
+
+        * page/scrolling/mac/ScrollingCoordinatorMac.mm: Added missing #import.
+
+2012-02-24  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed speculative buildfix after r108785 for ENABLE(SVG) && !ENABLE(XSLT) case.
+
+        * loader/cache/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::canRequest):
+
+2012-02-24  Vsevolod Vlasov  <vsevik@chromium.org>
+
+        Web Inspector: Do not show scripts panel navigator automatically more than once to the same user.
+        https://bugs.webkit.org/show_bug.cgi?id=79489
+
+        Reviewed by Pavel Feldman.
+
+        * inspector/front-end/ScriptsPanel.js:
+
+2012-02-24  Philippe Normand  <pnormand@igalia.com>
+
+        Fix GTK WebAudio build for WebKitGTK 1.7.90.
+
+        Patch by Priit Laes <plaes@plaes.org> on 2012-02-24
+        Rubber-stamped by Philippe Normand.
+
+        * GNUmakefile.list.am: Add AudioBufferCallback.h and
+        DenormalDisabler.h to the list of files so they get disted in the
+        tarballs.
+
+2012-02-24  Yury Semikhatsky  <yurys@chromium.org>
+
+        Web Inspector: show all counters on one graph
+        https://bugs.webkit.org/show_bug.cgi?id=79484
+
+        Now it is possible to hide any counter. All graphs share the same area.
+        Current values are displayed above that area.
+
+        Reviewed by Pavel Feldman.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/MemoryStatistics.js:
+        (WebInspector.MemoryStatistics.getDocumentCount):
+        (WebInspector.MemoryStatistics.getNodeCount):
+        (WebInspector.MemoryStatistics.getListenerCount):
+        (WebInspector.MemoryStatistics):
+        (WebInspector.SwatchCheckbox):
+        (WebInspector.SwatchCheckbox.prototype.get checked):
+        (WebInspector.SwatchCheckbox.prototype.set checked):
+        (WebInspector.SwatchCheckbox.prototype._toggleCheckbox):
+        (WebInspector.CounterUI):
+        (WebInspector.CounterUI.prototype._toggleCounterGraph):
+        (WebInspector.CounterUI.prototype.setRange):
+        (WebInspector.CounterUI.prototype.updateCurrentValue):
+        (WebInspector.CounterUI.prototype.clearCurrentValueAndMarker):
+        (WebInspector.CounterUI.prototype.get visible):
+        (WebInspector.CounterUI.prototype.saveImageUnderMarker):
+        (WebInspector.CounterUI.prototype.restoreImageUnderMarker):
+        (WebInspector.CounterUI.prototype.discardImageUnderMarker):
+        (WebInspector.MemoryStatistics.prototype._updateSize):
+        (WebInspector.MemoryStatistics.prototype._draw):
+        (WebInspector.MemoryStatistics.prototype._onMouseOut):
+        (WebInspector.MemoryStatistics.prototype._refreshCurrentValues):
+        (WebInspector.MemoryStatistics.prototype._highlightCurrentPositionOnGraphs):
+        (WebInspector.MemoryStatistics.prototype._drawGraph):
+        (WebInspector.MemoryStatistics.prototype._clear):
+        * inspector/front-end/timelinePanel.css:
+        (.memory-counter-sidebar-info):
+        (.memory-counter-sidebar-info .swatch):
+        (.memory-counter-sidebar-info .title):
+        (.memory-counter-value):
+        (#counter-values-bar):
+
+2012-02-24  Pavel Feldman  <pfeldman@google.com>
+
+        Web Inspector: map Ctrl/Cmd +/- to zoom in hosted mode.
+        https://bugs.webkit.org/show_bug.cgi?id=79475
+
+        (In remote front-end mode, default zoom actions are working.)
+
+        Reviewed by Yury Semikhatsky.
+
+        * inspector/InspectorFrontendHost.cpp:
+        (WebCore::InspectorFrontendHost::setZoomFactor):
+        (WebCore):
+        * inspector/InspectorFrontendHost.h:
+        (InspectorFrontendHost):
+        * inspector/InspectorFrontendHost.idl:
+        * inspector/front-end/InspectorFrontendHostStub.js:
+        (.WebInspector.InspectorFrontendHostStub):
+        (.WebInspector.InspectorFrontendHostStub.prototype.loadResourceSynchronously):
+        (.WebInspector.InspectorFrontendHostStub.prototype.setZoomFactor):
+        * inspector/front-end/Settings.js:
+        (WebInspector.Settings):
+        * inspector/front-end/inspector.js:
+        (WebInspector._initializeCapability):
+        (WebInspector._zoomIn):
+        (WebInspector._zoomOut):
+        (WebInspector._resetZoom):
+        (WebInspector._requestZoom.set InspectorFrontendHost):
+        (WebInspector._requestZoom):
+        (WebInspector._doLoadedDoneWithCapabilities.get if):
+        (WebInspector.documentKeyDown):
+
+2012-02-24  Allan Sandfeld Jensen  <allan.jensen@nokia.com>
+
+        Refactor EventHandler::handleGestureEvent.
+        https://bugs.webkit.org/show_bug.cgi?id=79476
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        No new tests. No behavior change.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleGestureEvent):
+        (WebCore::EventHandler::handleGestureTap):
+        (WebCore::EventHandler::handleGestureScrollUpdate):
+        * page/EventHandler.h:
+
+2012-02-24  Zoltan Horvath  <zoltan@webkit.org>
+
+        [Qt] Allow to use WebCore imagedecoders
+        https://bugs.webkit.org/show_bug.cgi?id=32410
+
+        Add ENABLE(QT_IMAGE_DECODER) guards around Qt imagedecoders and set it to default.
+        By passing ENABLE_QT_IMAGE_DECODER=0 define to the build system, WebKit will build
+        with WebCore's imagedecoders.
+
+        I added NO_RETURN attribute and PLATFORM(QT) conditionals to 2 functions of PNG and
+        JPEG decoders to avoid compiler warnings because in Qt-port we treat warning as errors (-Werror).
+
+        I'm continuing the refactoring of this area and try to use Qt imagedecoders only in
+        cases when WebCore doesn't support the image format.
+
+        Reviewed by Simon Hausmann.
+
+        No behavior change, no need new tests.
+
+        * Target.pri:
+        * WebCore.pri:
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageFrame::getAddr):
+        (ImageFrame):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        NO_RETURN has been added to a function to avoid warning message.
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        NO_RETURN has been added to a function to avoid warning message.
+        (WebCore):
+        * platform/image-decoders/qt/ImageFrameQt.cpp:
+        (WebCore):
+        (WebCore::ImageFrame::asNewNativeImage):
+
+2012-02-24  Lynn Neir <lynn.neir@skype.net>
+
+        [Windows, WinCairo] Handle indeterminate checkbox state
+        https://bugs.webkit.org/show_bug.cgi?id=79288
+
+        Reviewed by Adam Roben.
+
+        Tested by fast/forms/indeterminate.html
+
+        * rendering/RenderThemeWin.cpp: Add code to check for indeterminate
+          state in CheckBox.
+
 2012-02-24  Simon Hausmann  <simon.hausmann@nokia.com>
 
         [Qt] Font related problem with newer Qt5
@@ -2508,7 +21141,6 @@
         (WebCore::ContainerNode::insertBefore):
         (WebCore::ContainerNode::replaceChild):
         (WebCore::ContainerNode::removeChild):
-
 2012-02-22  Dmitry Lomov  <dslomov@google.com>
 
         [JSC] Implement ArrayBuffer and typed array cloning in JSC
diff --git a/Source/WebCore/Configurations/FeatureDefines.xcconfig b/Source/WebCore/Configurations/FeatureDefines.xcconfig
index 3e2090355..58a02f521 100644
--- a/Source/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/Source/WebCore/Configurations/FeatureDefines.xcconfig
@@ -90,12 +90,14 @@ ENABLE_INDEXED_DATABASE = ;
 ENABLE_INPUT_COLOR = ;
 ENABLE_INPUT_SPEECH = ;
 ENABLE_JAVASCRIPT_DEBUGGER = ENABLE_JAVASCRIPT_DEBUGGER;
+ENABLE_LEGACY_NOTIFICATIONS = ENABLE_LEGACY_NOTIFICATIONS;
 ENABLE_LINK_PREFETCH = ;
 ENABLE_MATHML = ENABLE_MATHML;
 ENABLE_MEDIA_SOURCE = ;
 ENABLE_MEDIA_STATISTICS = ;
 ENABLE_METER_TAG = ENABLE_METER_TAG;
 ENABLE_MHTML = ;
+ENABLE_MICRODATA = ;
 ENABLE_MUTATION_OBSERVERS = ENABLE_MUTATION_OBSERVERS;
 
 ENABLE_NOTIFICATIONS = $(ENABLE_NOTIFICATIONS_$(REAL_PLATFORM_NAME));
@@ -109,6 +111,7 @@ ENABLE_PROGRESS_TAG = ENABLE_PROGRESS_TAG;
 ENABLE_QUOTA = ;
 ENABLE_REGISTER_PROTOCOL_HANDLER = ;
 ENABLE_REQUEST_ANIMATION_FRAME = ENABLE_REQUEST_ANIMATION_FRAME;
+ENABLE_SCRIPTED_SPEECH = ;
 ENABLE_SHADOW_DOM = ;
 ENABLE_SHARED_WORKERS = ENABLE_SHARED_WORKERS;
 ENABLE_SQL_DATABASE = ENABLE_SQL_DATABASE;
@@ -118,7 +121,10 @@ ENABLE_SVG_FONTS = ENABLE_SVG_FONTS;
 ENABLE_TEXT_NOTIFICATIONS_ONLY = ENABLE_TEXT_NOTIFICATIONS_ONLY;
 ENABLE_TOUCH_ICON_LOADING = ;
 ENABLE_VIDEO = ENABLE_VIDEO;
-ENABLE_VIDEO_TRACK = ENABLE_VIDEO_TRACK;
+
+ENABLE_VIDEO_TRACK = $(ENABLE_VIDEO_TRACK_$(REAL_PLATFORM_NAME));
+ENABLE_VIDEO_TRACK_macosx = ENABLE_VIDEO_TRACK;
+
 ENABLE_WEBGL = ENABLE_WEBGL;
 ENABLE_WEB_AUDIO = ENABLE_WEB_AUDIO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
@@ -126,4 +132,4 @@ ENABLE_WEB_TIMING = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_GRID_LAYOUT) $(ENABLE_CSS_SHADERS) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LINK_PREFETCH) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_RENDERING) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_ANIMATION_API) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_CSS_FILTERS) $(ENABLE_CSS_GRID_LAYOUT) $(ENABLE_CSS_SHADERS) $(ENABLE_DASHBOARD_SUPPORT) $(ENABLE_DATALIST) $(ENABLE_DATA_TRANSFER_ITEMS) $(ENABLE_DETAILS) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_FILE_SYSTEM) $(ENABLE_FILTERS) $(ENABLE_FULLSCREEN_API) $(ENABLE_GAMEPAD) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_COLOR) $(ENABLE_INPUT_SPEECH) $(ENABLE_INPUT_TYPE_DATE) $(ENABLE_INPUT_TYPE_DATETIME) $(ENABLE_INPUT_TYPE_DATETIMELOCAL) $(ENABLE_INPUT_TYPE_MONTH) $(ENABLE_INPUT_TYPE_TIME) $(ENABLE_INPUT_TYPE_WEEK) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_LEGACY_NOTIFICATIONS) $(ENABLE_LINK_PREFETCH) $(ENABLE_MATHML) $(ENABLE_MEDIA_SOURCE) $(ENABLE_MEDIA_STATISTICS) $(ENABLE_METER_TAG) $(ENABLE_MICRODATA) $(ENABLE_MUTATION_OBSERVERS) $(ENABLE_NOTIFICATIONS) $(ENABLE_PAGE_VISIBILITY_API) $(ENABLE_PROGRESS_TAG) $(ENABLE_QUOTA) $(ENABLE_REGISTER_PROTOCOL_HANDLER) $(ENABLE_REQUEST_ANIMATION_FRAME) $(ENABLE_SCRIPTED_SPEECH) $(ENABLE_SHADOW_DOM) $(ENABLE_SHARED_WORKERS) $(ENABLE_SQL_DATABASE) $(ENABLE_STYLE_SCOPED) $(ENABLE_SVG) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_TEXT_NOTIFICATIONS_ONLY) $(ENABLE_TOUCH_ICON_LOADING) $(ENABLE_VIDEO) $(ENABLE_VIDEO_TRACK) $(ENABLE_WEBGL) $(ENABLE_WEB_AUDIO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WORKERS) $(ENABLE_XSLT);
diff --git a/Source/WebCore/Configurations/Version.xcconfig b/Source/WebCore/Configurations/Version.xcconfig
index 14e0bdc80..0f427a3ac 100644
--- a/Source/WebCore/Configurations/Version.xcconfig
+++ b/Source/WebCore/Configurations/Version.xcconfig
@@ -21,8 +21,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-MAJOR_VERSION = 535;
-MINOR_VERSION = 23;
+MAJOR_VERSION = 536;
+MINOR_VERSION = 3;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/Source/WebCore/Configurations/WebCore.xcconfig b/Source/WebCore/Configurations/WebCore.xcconfig
index 662e99427..7624aad8b 100644
--- a/Source/WebCore/Configurations/WebCore.xcconfig
+++ b/Source/WebCore/Configurations/WebCore.xcconfig
@@ -26,10 +26,11 @@
 
 EXPORTED_SYMBOLS_FILE = $(EXPORTED_SYMBOLS_FILE_$(CURRENT_ARCH));
 EXPORTED_SYMBOLS_FILE_ = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.exp;
-EXPORTED_SYMBOLS_FILE_armv5 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.exp;
-EXPORTED_SYMBOLS_FILE_armv6 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.exp;
-EXPORTED_SYMBOLS_FILE_armv7 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.exp;
-EXPORTED_SYMBOLS_FILE_i386 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.exp;
+EXPORTED_SYMBOLS_FILE_armv6 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.armv6.exp;
+EXPORTED_SYMBOLS_FILE_armv7 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.armv7.exp;
+EXPORTED_SYMBOLS_FILE_i386 = $(EXPORTED_SYMBOLS_FILE_i386_$(REAL_PLATFORM_NAME));
+EXPORTED_SYMBOLS_FILE_i386_iphonesimulator = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.i386.exp;
+EXPORTED_SYMBOLS_FILE_i386_macosx = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.exp;
 EXPORTED_SYMBOLS_FILE_ppc = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.exp;
 EXPORTED_SYMBOLS_FILE_ppc64 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.exp;
 EXPORTED_SYMBOLS_FILE_x86_64 = $(BUILT_PRODUCTS_DIR)/DerivedSources/WebCore/WebCore.LP64.exp;
@@ -49,8 +50,15 @@ STAGED_FRAMEWORKS_SEARCH_PATH_YES = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/StagedFram
 HEADER_SEARCH_PATHS = ForwardingHeaders icu /usr/include/libxslt /usr/include/libxml2 $(SQLITE3_HEADER_SEARCH_PATHS) "${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore" "${BUILT_PRODUCTS_DIR}/usr/local/include" $(HEADER_SEARCH_PATHS);
 INFOPLIST_FILE = Info.plist;
 INSTALL_PATH = $(INSTALL_PATH_$(REAL_PLATFORM_NAME));
+INSTALL_PATH_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
+INSTALL_PATH_iphonesimulator = $(INDIGO_INSTALL_PATH_PREFIX)$(INSTALL_PATH_ACTUAL);
 INSTALL_PATH_macosx = $(WEBCORE_FRAMEWORKS_DIR);
-DYLIB_INSTALL_NAME_BASE = $(NORMAL_WEBCORE_FRAMEWORKS_DIR);
+INSTALL_PATH_ACTUAL = $(INSTALL_PATH_ACTUAL_$(REAL_PLATFORM_NAME));
+INSTALL_PATH_ACTUAL_iphonesimulator = $(INSTALL_PATH_iphoneos);
+DYLIB_INSTALL_NAME_BASE = $(DYLIB_INSTALL_NAME_BASE_$(REAL_PLATFORM_NAME));
+DYLIB_INSTALL_NAME_BASE_macosx = $(NORMAL_WEBCORE_FRAMEWORKS_DIR);
+DYLIB_INSTALL_NAME_BASE_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
+DYLIB_INSTALL_NAME_BASE_iphonesimulator =  $(SDKROOT)$(DYLIB_INSTALL_NAME_BASE_iphoneos);
 INSTALLHDRS_COPY_PHASE = YES;
 INSTALLHDRS_SCRIPT_PHASE = YES;
 PRODUCT_NAME = WebCore;
@@ -77,7 +85,7 @@ WEBCORE_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_NO = $(NORMAL_WEBCORE_FRA
 WEBCORE_FRAMEWORKS_DIR_macosx_USE_STAGING_INSTALL_PATH_YES = $(SYSTEM_LIBRARY_DIR)/StagedFrameworks/Safari;
 
 NORMAL_PRODUCTION_FRAMEWORKS_DIR = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_$(REAL_PLATFORM_NAME));
-NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos = $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
+NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos = $(SDKROOT)$(SYSTEM_LIBRARY_DIR)/PrivateFrameworks;
 NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphonesimulator = $(NORMAL_PRODUCTION_FRAMEWORKS_DIR_iphoneos);
 NORMAL_PRODUCTION_FRAMEWORKS_DIR_macosx = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks;
 
diff --git a/Source/WebCore/DerivedSources.make b/Source/WebCore/DerivedSources.make
index 828d9b233..24606833a 100644
--- a/Source/WebCore/DerivedSources.make
+++ b/Source/WebCore/DerivedSources.make
@@ -29,6 +29,9 @@
 VPATH = \
     $(WebCore) \
     $(WebCore)/Modules/geolocation \
+    $(WebCore)/Modules/indexeddb \
+    $(WebCore)/Modules/webdatabase \
+    $(WebCore)/Modules/websockets \
     $(WebCore)/bindings/generic \
     $(WebCore)/bindings/js \
     $(WebCore)/bindings/objc \
@@ -60,6 +63,39 @@ BINDING_IDLS = \
     $(WebCore)/Modules/geolocation/PositionCallback.idl \
     $(WebCore)/Modules/geolocation/PositionError.idl \
     $(WebCore)/Modules/geolocation/PositionErrorCallback.idl \
+    $(WebCore)/Modules/indexeddb/DOMWindowIndexedDatabase.idl \
+    $(WebCore)/Modules/indexeddb/IDBAny.idl \
+    $(WebCore)/Modules/indexeddb/IDBCursor.idl \
+    $(WebCore)/Modules/indexeddb/IDBDatabase.idl \
+    $(WebCore)/Modules/indexeddb/IDBDatabaseError.idl \
+    $(WebCore)/Modules/indexeddb/IDBDatabaseException.idl \
+    $(WebCore)/Modules/indexeddb/IDBFactory.idl \
+    $(WebCore)/Modules/indexeddb/IDBIndex.idl \
+    $(WebCore)/Modules/indexeddb/IDBKey.idl \
+    $(WebCore)/Modules/indexeddb/IDBKeyRange.idl \
+    $(WebCore)/Modules/indexeddb/IDBObjectStore.idl \
+    $(WebCore)/Modules/indexeddb/IDBRequest.idl \
+    $(WebCore)/Modules/indexeddb/IDBTransaction.idl \
+    $(WebCore)/Modules/indexeddb/WorkerContextIndexedDatabase.idl \
+    $(WebCore)/Modules/webdatabase/DOMWindowSQLDatabase.idl \
+    $(WebCore)/Modules/webdatabase/Database.idl \
+    $(WebCore)/Modules/webdatabase/DatabaseCallback.idl \
+    $(WebCore)/Modules/webdatabase/DatabaseSync.idl \
+    $(WebCore)/Modules/webdatabase/SQLError.idl \
+    $(WebCore)/Modules/webdatabase/SQLException.idl \
+    $(WebCore)/Modules/webdatabase/SQLResultSet.idl \
+    $(WebCore)/Modules/webdatabase/SQLResultSetRowList.idl \
+    $(WebCore)/Modules/webdatabase/SQLStatementCallback.idl \
+    $(WebCore)/Modules/webdatabase/SQLStatementErrorCallback.idl \
+    $(WebCore)/Modules/webdatabase/SQLTransaction.idl \
+    $(WebCore)/Modules/webdatabase/SQLTransactionCallback.idl \
+    $(WebCore)/Modules/webdatabase/SQLTransactionErrorCallback.idl \
+    $(WebCore)/Modules/webdatabase/SQLTransactionSync.idl \
+    $(WebCore)/Modules/webdatabase/SQLTransactionSyncCallback.idl \
+    $(WebCore)/Modules/webdatabase/WorkerContextSQLDatabase.idl \
+    $(WebCore)/Modules/websockets/CloseEvent.idl \
+    $(WebCore)/Modules/websockets/DOMWindowWebSocket.idl \
+    $(WebCore)/Modules/websockets/WebSocket.idl \
     $(WebCore)/css/CSSCharsetRule.idl \
     $(WebCore)/css/CSSFontFaceRule.idl \
     $(WebCore)/css/CSSImportRule.idl \
@@ -187,11 +223,11 @@ BINDING_IDLS = \
     $(WebCore)/fileapi/MetadataCallback.idl \
     $(WebCore)/fileapi/OperationNotAllowedException.idl \
     $(WebCore)/fileapi/WebKitBlobBuilder.idl \
+    $(WebCore)/fileapi/WorkerContextFileSystem.idl \
     $(WebCore)/html/DOMFormData.idl \
     $(WebCore)/html/DOMSettableTokenList.idl \
     $(WebCore)/html/DOMTokenList.idl \
     $(WebCore)/html/DOMURL.idl \
-    $(WebCore)/html/DOMWindowHTML.idl \
     $(WebCore)/html/HTMLAllCollection.idl \
     $(WebCore)/html/HTMLAnchorElement.idl \
     $(WebCore)/html/HTMLAppletElement.idl \
@@ -277,8 +313,8 @@ BINDING_IDLS = \
     $(WebCore)/html/canvas/CanvasPattern.idl \
     $(WebCore)/html/canvas/CanvasRenderingContext.idl \
     $(WebCore)/html/canvas/CanvasRenderingContext2D.idl \
-    $(WebCore)/html/canvas/DOMWindowWebGL.idl \
     $(WebCore)/html/canvas/DataView.idl \
+    $(WebCore)/html/canvas/EXTTextureFilterAnisotropic.idl \
     $(WebCore)/html/canvas/Float32Array.idl \
     $(WebCore)/html/canvas/Float64Array.idl \
     $(WebCore)/html/canvas/Int16Array.idl \
@@ -346,40 +382,12 @@ BINDING_IDLS = \
     $(WebCore)/plugins/DOMMimeTypeArray.idl \
     $(WebCore)/plugins/DOMPlugin.idl \
     $(WebCore)/plugins/DOMPluginArray.idl \
-    $(WebCore)/storage/DOMWindowSQLDatabase.idl \
-    $(WebCore)/storage/Database.idl \
-    $(WebCore)/storage/DatabaseCallback.idl \
-    $(WebCore)/storage/DatabaseSync.idl \
-    $(WebCore)/storage/IDBAny.idl \
-    $(WebCore)/storage/IDBCursor.idl \
-    $(WebCore)/storage/IDBDatabase.idl \
-    $(WebCore)/storage/IDBDatabaseError.idl \
-    $(WebCore)/storage/IDBDatabaseException.idl \
-    $(WebCore)/storage/IDBFactory.idl \
-    $(WebCore)/storage/IDBIndex.idl \
-    $(WebCore)/storage/IDBKey.idl \
-    $(WebCore)/storage/IDBKeyRange.idl \
-    $(WebCore)/storage/IDBObjectStore.idl \
-    $(WebCore)/storage/IDBRequest.idl \
-    $(WebCore)/storage/IDBTransaction.idl \
-    $(WebCore)/storage/SQLError.idl \
-    $(WebCore)/storage/SQLException.idl \
-    $(WebCore)/storage/SQLResultSet.idl \
-    $(WebCore)/storage/SQLResultSetRowList.idl \
-    $(WebCore)/storage/SQLStatementCallback.idl \
-    $(WebCore)/storage/SQLStatementErrorCallback.idl \
-    $(WebCore)/storage/SQLTransaction.idl \
-    $(WebCore)/storage/SQLTransactionCallback.idl \
-    $(WebCore)/storage/SQLTransactionErrorCallback.idl \
-    $(WebCore)/storage/SQLTransactionSync.idl \
-    $(WebCore)/storage/SQLTransactionSyncCallback.idl \
     $(WebCore)/storage/Storage.idl \
     $(WebCore)/storage/StorageEvent.idl \
     $(WebCore)/storage/StorageInfo.idl \
     $(WebCore)/storage/StorageInfoErrorCallback.idl \
     $(WebCore)/storage/StorageInfoQuotaCallback.idl \
     $(WebCore)/storage/StorageInfoUsageCallback.idl \
-    $(WebCore)/svg/DOMWindowSVG.idl \
     $(WebCore)/svg/ElementTimeControl.idl \
     $(WebCore)/svg/SVGAElement.idl \
     $(WebCore)/svg/SVGAltGlyphDefElement.idl \
@@ -561,18 +569,13 @@ BINDING_IDLS = \
     $(WebCore)/webaudio/OfflineAudioCompletionEvent.idl \
     $(WebCore)/webaudio/RealtimeAnalyserNode.idl \
     $(WebCore)/webaudio/WaveShaperNode.idl \
-    $(WebCore)/websockets/CloseEvent.idl \
-    $(WebCore)/websockets/DOMWindowWebSocket.idl \
-    $(WebCore)/websockets/WebSocket.idl \
     $(WebCore)/workers/AbstractWorker.idl \
-    $(WebCore)/workers/DOMWindowWorker.idl \
     $(WebCore)/workers/DedicatedWorkerContext.idl \
     $(WebCore)/workers/SharedWorker.idl \
     $(WebCore)/workers/SharedWorkerContext.idl \
     $(WebCore)/workers/Worker.idl \
     $(WebCore)/workers/WorkerContext.idl \
     $(WebCore)/workers/WorkerLocation.idl \
-    $(WebCore)/xml/DOMWindowXML.idl \
     $(WebCore)/xml/DOMParser.idl \
     $(WebCore)/xml/XMLHttpRequest.idl \
     $(WebCore)/xml/XMLHttpRequestException.idl \
@@ -635,14 +638,15 @@ ADDITIONAL_IDL_DEFINES :=
 ifeq ($(OS),MACOS)
 
 FRAMEWORK_FLAGS = $(shell echo $(BUILT_PRODUCTS_DIR) $(FRAMEWORK_SEARCH_PATHS) | perl -e 'print "-F " . join(" -F ", split(" ", <>));')
+HEADER_FLAGS = $(shell echo $(BUILT_PRODUCTS_DIR) $(HEADER_SEARCH_PATHS) | perl -e 'print "-I" . join(" -I", split(" ", <>));')
 
-ifeq ($(shell $(CC) -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_DASHBOARD_SUPPORT | cut -d' ' -f3), 1)
+ifeq ($(shell $(CC) -x c++ -E -P -dM $(FRAMEWORK_FLAGS) $(HEADER_FLAGS) -include "wtf/Platform.h" /dev/null | grep ENABLE_DASHBOARD_SUPPORT | cut -d' ' -f3), 1)
     ENABLE_DASHBOARD_SUPPORT = 1
 else
     ENABLE_DASHBOARD_SUPPORT = 0
 endif
 
-ifeq ($(shell $(CC) -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_ORIENTATION_EVENTS | cut -d' ' -f3), 1)
+ifeq ($(shell $(CC) -x c++ -E -P -dM $(FRAMEWORK_FLAGS) $(HEADER_FLAGS) -include "wtf/Platform.h" /dev/null | grep ENABLE_ORIENTATION_EVENTS | cut -d' ' -f3), 1)
     ENABLE_ORIENTATION_EVENTS = 1
 else
     ENABLE_ORIENTATION_EVENTS = 0
@@ -865,8 +869,8 @@ XLinkNames.cpp : dom/make_names.pl svg/xlinkattrs.in
  
 # Register event constructors and targets
 
-EventFactory.cpp EventHeaders.h EventInterfaces.h : dom/make_event_factory.pl dom/EventFactory.in
-	perl -I $(WebCore)/bindings/scripts $< --input $(WebCore)/dom/EventFactory.in
+EventFactory.cpp EventHeaders.h EventInterfaces.h : dom/make_event_factory.pl dom/EventNames.in
+	perl -I $(WebCore)/bindings/scripts $< --input $(WebCore)/dom/EventNames.in
 
 EventTargetHeaders.h EventTargetInterfaces.h : dom/make_event_factory.pl dom/EventTargetFactory.in
 	perl -I $(WebCore)/bindings/scripts $< --input $(WebCore)/dom/EventTargetFactory.in
@@ -892,13 +896,13 @@ GENERATE_SCRIPTS = \
     bindings/scripts/generate-bindings.pl \
     bindings/scripts/preprocessor.pm
 
-RESOLVE_SUPPLEMENTAL_SCRIPTS = \
+PREPROCESS_IDLS_SCRIPTS = \
     bindings/scripts/IDLParser.pm \
-    bindings/scripts/resolve-supplemental.pl
+    bindings/scripts/preprocess-idls.pl
 
 generator_script = perl $(addprefix -I $(WebCore)/, $(sort $(dir $(1)))) $(WebCore)/bindings/scripts/generate-bindings.pl
 
-resolve_supplemental_script = perl $(addprefix -I $(WebCore)/, $(sort $(dir $(1)))) $(WebCore)/bindings/scripts/resolve-supplemental.pl
+preprocess_idls_script = perl $(addprefix -I $(WebCore)/, $(sort $(dir $(1)))) $(WebCore)/bindings/scripts/preprocess-idls.pl
 
 # JS bindings generator
 
@@ -926,9 +930,9 @@ IDL_ATTRIBUTES_FILE = $(WebCore)/bindings/scripts/IDLAttributes.txt
 space :=
 space +=
 
-$(SUPPLEMENTAL_DEPENDENCY_FILE) : $(RESOLVE_SUPPLEMENTAL_SCRIPTS) $(BINDING_IDLS) $(ADDITIONAL_IDLS) $(IDL_ATTRIBUTES_FILE)
+$(SUPPLEMENTAL_DEPENDENCY_FILE) : $(PREPROCESS_IDLS_SCRIPTS) $(BINDING_IDLS) $(ADDITIONAL_IDLS) $(IDL_ATTRIBUTES_FILE)
 	printf "$(subst $(space),,$(patsubst %,%\n,$(BINDING_IDLS) $(ADDITIONAL_IDLS)))" > $(IDL_FILES_TMP)
-	$(call resolve_supplemental_script, $(RESOLVE_SUPPLEMENTAL_SCRIPTS)) --defines "$(FEATURE_DEFINES) $(ADDITIONAL_IDL_DEFINES) LANGUAGE_JAVASCRIPT" --idlFilesList $(IDL_FILES_TMP) --supplementalDependencyFile $@ --idlAttributesFile $(IDL_ATTRIBUTES_FILE)
+	$(call preprocess_idls_script, $(PREPROCESS_IDLS_SCRIPTS)) --defines "$(FEATURE_DEFINES) $(ADDITIONAL_IDL_DEFINES) LANGUAGE_JAVASCRIPT" --idlFilesList $(IDL_FILES_TMP) --supplementalDependencyFile $@ --idlAttributesFile $(IDL_ATTRIBUTES_FILE)
 	rm -f $(IDL_FILES_TMP)
 
 JS%.h : %.idl $(JS_BINDINGS_SCRIPTS) $(SUPPLEMENTAL_DEPENDENCY_FILE)
diff --git a/Source/WebCore/DerivedSources.pri b/Source/WebCore/DerivedSources.pri
index a6976b4cb..af4f5b50b 100644
--- a/Source/WebCore/DerivedSources.pri
+++ b/Source/WebCore/DerivedSources.pri
@@ -43,7 +43,7 @@ XMLNS_NAMES = $$PWD/xml/xmlnsattrs.in
 
 HTML_ENTITIES = $$PWD/html/parser/HTMLEntityNames.in
 
-EVENT_FACTORY = $$PWD/dom/EventFactory.in
+EVENTS_NAMES = $$PWD/dom/EventNames.in
 
 EVENT_TARGET_FACTORY = $$PWD/dom/EventTargetFactory.in
 
@@ -92,6 +92,39 @@ IDL_BINDINGS += \
     $$PWD/Modules/geolocation/PositionCallback.idl \
     $$PWD/Modules/geolocation/PositionError.idl \
     $$PWD/Modules/geolocation/PositionErrorCallback.idl \
+    $$PWD/Modules/indexeddb/DOMWindowIndexedDatabase.idl \
+    $$PWD/Modules/indexeddb/IDBAny.idl \
+    $$PWD/Modules/indexeddb/IDBCursor.idl \
+    $$PWD/Modules/indexeddb/IDBDatabaseError.idl \
+    $$PWD/Modules/indexeddb/IDBDatabaseException.idl \
+    $$PWD/Modules/indexeddb/IDBDatabase.idl \
+    $$PWD/Modules/indexeddb/IDBFactory.idl \
+    $$PWD/Modules/indexeddb/IDBIndex.idl \
+    $$PWD/Modules/indexeddb/IDBKey.idl \
+    $$PWD/Modules/indexeddb/IDBKeyRange.idl \
+    $$PWD/Modules/indexeddb/IDBObjectStore.idl \
+    $$PWD/Modules/indexeddb/IDBRequest.idl \
+    $$PWD/Modules/indexeddb/IDBTransaction.idl \
+    $$PWD/Modules/indexeddb/WorkerContextIndexedDatabase.idl \
+    $$PWD/Modules/webdatabase/DOMWindowSQLDatabase.idl \
+    $$PWD/Modules/webdatabase/Database.idl \
+    $$PWD/Modules/webdatabase/DatabaseCallback.idl \
+    $$PWD/Modules/webdatabase/DatabaseSync.idl \
+    $$PWD/Modules/webdatabase/SQLError.idl \
+    $$PWD/Modules/webdatabase/SQLException.idl \
+    $$PWD/Modules/webdatabase/SQLResultSet.idl \
+    $$PWD/Modules/webdatabase/SQLResultSetRowList.idl \
+    $$PWD/Modules/webdatabase/SQLStatementCallback.idl \
+    $$PWD/Modules/webdatabase/SQLStatementErrorCallback.idl \
+    $$PWD/Modules/webdatabase/SQLTransaction.idl \
+    $$PWD/Modules/webdatabase/SQLTransactionCallback.idl \
+    $$PWD/Modules/webdatabase/SQLTransactionErrorCallback.idl \
+    $$PWD/Modules/webdatabase/SQLTransactionSync.idl \
+    $$PWD/Modules/webdatabase/SQLTransactionSyncCallback.idl \
+    $$PWD/Modules/webdatabase/WorkerContextSQLDatabase.idl \
+    $$PWD/Modules/websockets/CloseEvent.idl \
+    $$PWD/Modules/websockets/DOMWindowWebSocket.idl \
+    $$PWD/Modules/websockets/WebSocket.idl \
     $$PWD/css/Counter.idl \
     $$PWD/css/CSSCharsetRule.idl \
     $$PWD/css/CSSFontFaceRule.idl \
@@ -213,9 +246,9 @@ IDL_BINDINGS += \
     $$PWD/fileapi/Metadata.idl \
     $$PWD/fileapi/MetadataCallback.idl \
     $$PWD/fileapi/WebKitBlobBuilder.idl \
+    $$PWD/fileapi/WorkerContextFileSystem.idl \
     $$PWD/html/canvas/ArrayBufferView.idl \
     $$PWD/html/canvas/ArrayBuffer.idl \
-    $$PWD/html/canvas/DOMWindowWebGL.idl \
     $$PWD/html/canvas/DataView.idl \
     $$PWD/html/canvas/Int8Array.idl \
     $$PWD/html/canvas/Float32Array.idl \
@@ -225,6 +258,7 @@ IDL_BINDINGS += \
     $$PWD/html/canvas/CanvasPattern.idl \
     $$PWD/html/canvas/CanvasRenderingContext.idl \
     $$PWD/html/canvas/CanvasRenderingContext2D.idl \
+    $$PWD/html/canvas/EXTTextureFilterAnisotropic.idl \
     $$PWD/html/canvas/OESStandardDerivatives.idl \
     $$PWD/html/canvas/OESTextureFloat.idl \
     $$PWD/html/canvas/OESVertexArrayObject.idl \
@@ -253,7 +287,6 @@ IDL_BINDINGS += \
     $$PWD/html/DOMSettableTokenList.idl \
     $$PWD/html/DOMTokenList.idl \
     $$PWD/html/DOMURL.idl \
-    $$PWD/html/DOMWindowHTML.idl \
     $$PWD/html/HTMLAllCollection.idl \
     $$PWD/html/HTMLAudioElement.idl \
     $$PWD/html/HTMLAnchorElement.idl \
@@ -370,39 +403,12 @@ IDL_BINDINGS += \
     $$PWD/plugins/DOMMimeType.idl \
     $$PWD/plugins/DOMPluginArray.idl \
     $$PWD/plugins/DOMMimeTypeArray.idl \
-    $$PWD/storage/DOMWindowSQLDatabase.idl \
-    $$PWD/storage/Database.idl \
-    $$PWD/storage/DatabaseCallback.idl \
-    $$PWD/storage/DatabaseSync.idl \
-    $$PWD/storage/IDBAny.idl \
-    $$PWD/storage/IDBCursor.idl \
-    $$PWD/storage/IDBDatabaseError.idl \
-    $$PWD/storage/IDBDatabaseException.idl \
-    $$PWD/storage/IDBDatabase.idl \
-    $$PWD/storage/IDBFactory.idl \
-    $$PWD/storage/IDBIndex.idl \
-    $$PWD/storage/IDBKey.idl \
-    $$PWD/storage/IDBKeyRange.idl \
-    $$PWD/storage/IDBObjectStore.idl \
-    $$PWD/storage/IDBRequest.idl \
-    $$PWD/storage/IDBTransaction.idl \
     $$PWD/storage/Storage.idl \
     $$PWD/storage/StorageEvent.idl \
     $$PWD/storage/StorageInfo.idl \
     $$PWD/storage/StorageInfoErrorCallback.idl \
     $$PWD/storage/StorageInfoQuotaCallback.idl \
     $$PWD/storage/StorageInfoUsageCallback.idl \
-    $$PWD/storage/SQLError.idl \
-    $$PWD/storage/SQLException.idl \
-    $$PWD/storage/SQLResultSet.idl \
-    $$PWD/storage/SQLResultSetRowList.idl \
-    $$PWD/storage/SQLStatementCallback.idl \
-    $$PWD/storage/SQLStatementErrorCallback.idl \
-    $$PWD/storage/SQLTransaction.idl \
-    $$PWD/storage/SQLTransactionCallback.idl \
-    $$PWD/storage/SQLTransactionErrorCallback.idl \
-    $$PWD/storage/SQLTransactionSync.idl \
-    $$PWD/storage/SQLTransactionSyncCallback.idl \
     $$PWD/testing/Internals.idl \
     $$PWD/testing/InternalSettings.idl \
     $$PWD/webaudio/AudioBuffer.idl \
@@ -426,18 +432,13 @@ IDL_BINDINGS += \
     $$PWD/webaudio/JavaScriptAudioNode.idl \
     $$PWD/webaudio/LowPass2FilterNode.idl \
     $$PWD/webaudio/RealtimeAnalyserNode.idl \
-    $$PWD/websockets/CloseEvent.idl \
-    $$PWD/websockets/DOMWindowWebSocket.idl \
-    $$PWD/websockets/WebSocket.idl \
     $$PWD/workers/AbstractWorker.idl \
-    $$PWD/workers/DOMWindowWorker.idl \
     $$PWD/workers/DedicatedWorkerContext.idl \
     $$PWD/workers/SharedWorker.idl \
     $$PWD/workers/SharedWorkerContext.idl \
     $$PWD/workers/Worker.idl \
     $$PWD/workers/WorkerContext.idl \
     $$PWD/workers/WorkerLocation.idl \
-    $$PWD/xml/DOMWindowXML.idl \
     $$PWD/xml/DOMParser.idl \
     $$PWD/xml/XMLHttpRequest.idl \
     $$PWD/xml/XMLHttpRequestException.idl \
@@ -460,7 +461,6 @@ v8 {
 
 contains(DEFINES, ENABLE_SVG=1) {
   IDL_BINDINGS += \
-    $$PWD/svg/DOMWindowSVG.idl \
     $$PWD/svg/SVGZoomEvent.idl \
     $$PWD/svg/SVGAElement.idl \
     $$PWD/svg/SVGAltGlyphDefElement.idl \
@@ -665,23 +665,28 @@ GENERATORS += cssvalues
 # GENERATOR 0: Resolve [Supplemental] dependency in IDLs
 SUPPLEMENTAL_DEPENDENCY_FILE = supplemental_dependency.tmp
 IDL_FILES_TMP = ${QMAKE_FUNC_FILE_OUT_PATH}/idl_files.tmp
-RESOLVE_SUPPLEMENTAL_SCRIPT = $$PWD/bindings/scripts/resolve-supplemental.pl
+PREPROCESS_IDLS_SCRIPT = $$PWD/bindings/scripts/preprocess-idls.pl
 IDL_ATTRIBUTES_FILE = $$PWD/bindings/scripts/IDLAttributes.txt
 
-resolveSupplemental.input = IDL_ATTRIBUTES_FILE
-resolveSupplemental.script = $$RESOLVE_SUPPLEMENTAL_SCRIPT
+preprocessIdls.input = IDL_ATTRIBUTES_FILE
+preprocessIdls.script = $$PREPROCESS_IDLS_SCRIPT
 # FIXME : We need to use only perl at some point.
-resolveSupplemental.commands = echo $$IDL_BINDINGS | tr \' \' \'\\n\' > $$IDL_FILES_TMP && \
-                               perl -I$$PWD/bindings/scripts $$resolveSupplemental.script \
+EOC = $$escape_expand(\\n\\t)
+win_cmd_shell: preprocessIdls.commands = type nul > $$IDL_FILES_TMP $$EOC
+else: preprocessIdls.commands = cat /dev/null > $$IDL_FILES_TMP $$EOC
+for(binding, IDL_BINDINGS) {
+    preprocessIdls.commands += echo $$binding >> $$IDL_FILES_TMP $$EOC
+}
+preprocessIdls.commands += perl -I$$PWD/bindings/scripts $$preprocessIdls.script \
                                --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" \
                                --idlFilesList $$IDL_FILES_TMP \
                                --supplementalDependencyFile ${QMAKE_FUNC_FILE_OUT_PATH}/$$SUPPLEMENTAL_DEPENDENCY_FILE \
                                --idlAttributesFile $${IDL_ATTRIBUTES_FILE} \
                                --preprocessor \"$${QMAKE_MOC} -E\"
-resolveSupplemental.output = $$SUPPLEMENTAL_DEPENDENCY_FILE
-resolveSupplemental.add_output_to_sources = false
-resolveSupplemental.depends = $$PWD/bindings/scripts/IDLParser.pm $$IDL_BINDINGS
-GENERATORS += resolveSupplemental
+preprocessIdls.output = $$SUPPLEMENTAL_DEPENDENCY_FILE
+preprocessIdls.add_output_to_sources = false
+preprocessIdls.depends = $$PWD/bindings/scripts/IDLParser.pm $$IDL_BINDINGS
+GENERATORS += preprocessIdls
 
 # GENERATOR 1: Generate .h and .cpp from IDLs
 generateBindings.input = IDL_BINDINGS
@@ -692,6 +697,9 @@ generateBindings.commands = perl -I$$PWD/bindings/scripts $$generateBindings.scr
                             --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" \
                             --generator $$generator \
                             --include $$PWD/Modules/geolocation \
+                            --include $$PWD/Modules/indexeddb \
+                            --include $$PWD/Modules/webdatabase \
+                            --include $$PWD/Modules/websockets \
                             --include $$PWD/dom \
                             --include $$PWD/fileapi \
                             --include $$PWD/html \
@@ -814,10 +822,10 @@ GENERATORS += fontnames
 
 # GENERATOR 5-E:
 eventfactory.output = EventFactory.cpp
-eventfactory.input = EVENT_FACTORY
+eventfactory.input = EVENTS_NAMES
 eventfactory.script = $$PWD/dom/make_event_factory.pl
-eventfactory.commands = perl -I$$PWD/bindings/scripts $$eventfactory.script --input $$EVENT_FACTORY --outputDir ${QMAKE_FUNC_FILE_OUT_PATH}
-eventfactory.depends = $$PWD/dom/make_event_factory.pl $$EVENT_FACTORY
+eventfactory.commands = perl -I$$PWD/bindings/scripts $$eventfactory.script --input $$EVENTS_NAMES --outputDir ${QMAKE_FUNC_FILE_OUT_PATH}
+eventfactory.depends = $$PWD/dom/make_event_factory.pl $$EVENTS_NAMES
 GENERATORS += eventfactory
 
 # GENERATOR 5-F:
diff --git a/Source/WebCore/English.lproj/Localizable.strings b/Source/WebCore/English.lproj/Localizable.strings
index 0c2378a0e..100ec3fc3 100644
--- a/Source/WebCore/English.lproj/Localizable.strings
+++ b/Source/WebCore/English.lproj/Localizable.strings
diff --git a/Source/WebCore/English.lproj/localizedStrings.js b/Source/WebCore/English.lproj/localizedStrings.js
index cadf49ee2..648eb5112 100644
--- a/Source/WebCore/English.lproj/localizedStrings.js
+++ b/Source/WebCore/English.lproj/localizedStrings.js
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ASCIICType.h b/Source/WebCore/ForwardingHeaders/wtf/ASCIICType.h
deleted file mode 100644
index 5851cc6f4..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ASCIICType.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ASCIICType_h
-#define WebCore_FWD_ASCIICType_h
-#include <JavaScriptCore/ASCIICType.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/AVLTree.h b/Source/WebCore/ForwardingHeaders/wtf/AVLTree.h
deleted file mode 100644
index 151b7f7ce..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/AVLTree.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_AVLTree_h
-#define WebCore_FWD_AVLTree_h
-#include <JavaScriptCore/AVLTree.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Alignment.h b/Source/WebCore/ForwardingHeaders/wtf/Alignment.h
deleted file mode 100644
index 3754945be..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Alignment.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Alignment_h
-#define WebCore_FWD_Alignment_h
-#include <JavaScriptCore/Alignment.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/AlwaysInline.h b/Source/WebCore/ForwardingHeaders/wtf/AlwaysInline.h
deleted file mode 100644
index e23416262..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/AlwaysInline.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_AlwaysInline_h
-#define WebCore_FWD_AlwaysInline_h
-#include <JavaScriptCore/AlwaysInline.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ArrayBuffer.h b/Source/WebCore/ForwardingHeaders/wtf/ArrayBuffer.h
deleted file mode 100644
index 687d98c8a..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ArrayBuffer.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ArrayBuffer_h
-#define WebCore_FWD_ArrayBuffer_h
-#include <JavaScriptCore/ArrayBuffer.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ArrayBufferView.h b/Source/WebCore/ForwardingHeaders/wtf/ArrayBufferView.h
deleted file mode 100644
index de3952669..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ArrayBufferView.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ArrayBufferView_h
-#define WebCore_FWD_ArrayBufferView_h
-#include <JavaScriptCore/ArrayBufferView.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Assertions.h b/Source/WebCore/ForwardingHeaders/wtf/Assertions.h
deleted file mode 100644
index 5445be411..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Assertions.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Assertions_h
-#define WebCore_FWD_Assertions_h
-#include <JavaScriptCore/Assertions.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Atomics.h b/Source/WebCore/ForwardingHeaders/wtf/Atomics.h
deleted file mode 100644
index 2fee17506..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Atomics.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Atomics_h
-#define WebCore_FWD_Atomics_h
-#include <JavaScriptCore/Atomics.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Bitmap.h b/Source/WebCore/ForwardingHeaders/wtf/Bitmap.h
deleted file mode 100644
index 25fb88593..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Bitmap.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Bitmap_h
-#define WebCore_FWD_Bitmap_h
-#include <JavaScriptCore/Bitmap.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/BloomFilter.h b/Source/WebCore/ForwardingHeaders/wtf/BloomFilter.h
deleted file mode 100644
index 98a67b9cc..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/BloomFilter.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_BloomFilter_h
-#define WebCore_FWD_BloomFilter_h
-#include <JavaScriptCore/BloomFilter.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/BumpPointerAllocator.h b/Source/WebCore/ForwardingHeaders/wtf/BumpPointerAllocator.h
deleted file mode 100644
index 25acbf4bc..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/BumpPointerAllocator.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_BumpPointerAllocator_h
-#define WebCore_FWD_BumpPointerAllocator_h
-#include <JavaScriptCore/BumpPointerAllocator.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ByteArray.h b/Source/WebCore/ForwardingHeaders/wtf/ByteArray.h
deleted file mode 100644
index 9c078c9fd..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ByteArray.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ByteArray_h
-#define WebCore_FWD_ByteArray_h
-#include <JavaScriptCore/ByteArray.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/CheckedArithmetic.h b/Source/WebCore/ForwardingHeaders/wtf/CheckedArithmetic.h
deleted file mode 100644
index bc48ae52e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/CheckedArithmetic.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_CheckedArithmetic_h
-#define WebCore_FWD_CheckedArithmetic_h
-#include <JavaScriptCore/CheckedArithmetic.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/CheckedBoolean.h b/Source/WebCore/ForwardingHeaders/wtf/CheckedBoolean.h
deleted file mode 100644
index 79e051ce3..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/CheckedBoolean.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/CheckedBoolean.h>
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Compiler.h b/Source/WebCore/ForwardingHeaders/wtf/Compiler.h
deleted file mode 100644
index 596c50a03..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Compiler.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Compiler_h
-#define WebCore_FWD_Compiler_h
-#include <JavaScriptCore/Compiler.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Complex.h b/Source/WebCore/ForwardingHeaders/wtf/Complex.h
deleted file mode 100644
index 1234f8aba..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Complex.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Complex_h
-#define WebCore_FWD_Complex_h
-#include <JavaScriptCore/Complex.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/CryptographicallyRandomNumber.h b/Source/WebCore/ForwardingHeaders/wtf/CryptographicallyRandomNumber.h
deleted file mode 100644
index 6c36f9b8d..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/CryptographicallyRandomNumber.h
+++ /dev/null
@@ -1,5 +0,0 @@
-#ifndef WebCore_FWD_CryptographicallyRandomNumber_h
-#define WebCore_FWD_CryptographicallyRandomNumber_h
-#include <JavaScriptCore/CryptographicallyRandomNumber.h>
-#endif
-
diff --git a/Source/WebCore/ForwardingHeaders/wtf/CurrentTime.h b/Source/WebCore/ForwardingHeaders/wtf/CurrentTime.h
deleted file mode 100644
index 00709150c..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/CurrentTime.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_CurrentTime_h
-#define WebCore_FWD_CurrentTime_h
-#include <JavaScriptCore/CurrentTime.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DataLog.h b/Source/WebCore/ForwardingHeaders/wtf/DataLog.h
deleted file mode 100644
index 1be170fcb..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/DataLog.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_DataLog_h
-#define WebCore_FWD_DataLog_h
-#include <JavaScriptCore/DataLog.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DateInstanceCache.h b/Source/WebCore/ForwardingHeaders/wtf/DateInstanceCache.h
deleted file mode 100644
index f39bdee4b..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/DateInstanceCache.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_DateInstanceCache_h
-#define WebCore_FWD_DateInstanceCache_h
-#include <JavaScriptCore/DateInstanceCache.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DateMath.h b/Source/WebCore/ForwardingHeaders/wtf/DateMath.h
deleted file mode 100644
index 4135742f2..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/DateMath.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_DateMath_h
-#define WebCore_FWD_DateMath_h
-#include <JavaScriptCore/DateMath.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DecimalNumber.h b/Source/WebCore/ForwardingHeaders/wtf/DecimalNumber.h
deleted file mode 100644
index 333174d58..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/DecimalNumber.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_DecimalNumber_h
-#define WebCore_FWD_DecimalNumber_h
-#include <JavaScriptCore/DecimalNumber.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Decoder.h b/Source/WebCore/ForwardingHeaders/wtf/Decoder.h
deleted file mode 100644
index e82373e26..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Decoder.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Decoder_h
-#define WebCore_FWD_Decoder_h
-#include <JavaScriptCore/Decoder.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Deque.h b/Source/WebCore/ForwardingHeaders/wtf/Deque.h
deleted file mode 100644
index a4eee78e4..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Deque.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Deque_h
-#define WebCore_FWD_Deque_h
-#include <JavaScriptCore/Deque.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DisallowCType.h b/Source/WebCore/ForwardingHeaders/wtf/DisallowCType.h
deleted file mode 100644
index c4d59aca7..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/DisallowCType.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_DisallowCType_h
-#define WebCore_FWD_DisallowCType_h
-#include <JavaScriptCore/DisallowCType.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DoublyLinkedList.h b/Source/WebCore/ForwardingHeaders/wtf/DoublyLinkedList.h
deleted file mode 100644
index 86c8f7a1c..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/DoublyLinkedList.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_DoublyLinkedList_h
-#define WebCore_FWD_DoublyLinkedList_h
-#include <JavaScriptCore/DoublyLinkedList.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/DynamicAnnotations.h b/Source/WebCore/ForwardingHeaders/wtf/DynamicAnnotations.h
deleted file mode 100644
index e5a2f2d3c..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/DynamicAnnotations.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_DynamicAnnotations_h
-#define WebCore_FWD_DynamicAnnotations_h
-#include <JavaScriptCore/DynamicAnnotations.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Encoder.h b/Source/WebCore/ForwardingHeaders/wtf/Encoder.h
deleted file mode 100644
index 773ad37b4..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Encoder.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Encoder_h
-#define WebCore_FWD_Encoder_h
-#include <JavaScriptCore/Encoder.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ExportMacros.h b/Source/WebCore/ForwardingHeaders/wtf/ExportMacros.h
deleted file mode 100644
index b0b7e44a4..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ExportMacros.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ExportMacros_h
-#define WebCore_FWD_ExportMacros_h
-#include <JavaScriptCore/ExportMacros.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/FastAllocBase.h b/Source/WebCore/ForwardingHeaders/wtf/FastAllocBase.h
deleted file mode 100644
index 6e50bd805..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/FastAllocBase.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_FastAllocBase_h
-#define WebCore_FWD_FastAllocBase_h
-#include <JavaScriptCore/FastAllocBase.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/FastMalloc.h b/Source/WebCore/ForwardingHeaders/wtf/FastMalloc.h
deleted file mode 100644
index b883c0b32..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/FastMalloc.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_FastMalloc_h
-#define WebCore_FWD_FastMalloc_h
-#include <JavaScriptCore/FastMalloc.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/FixedArray.h b/Source/WebCore/ForwardingHeaders/wtf/FixedArray.h
deleted file mode 100644
index fc8dd7e4a..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/FixedArray.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_FixedArray_h
-#define WebCore_FWD_FixedArray_h
-#include <JavaScriptCore/FixedArray.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Float32Array.h b/Source/WebCore/ForwardingHeaders/wtf/Float32Array.h
deleted file mode 100644
index b2453dd21..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Float32Array.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Float32Array_h
-#define WebCore_FWD_Float32Array_h
-#include <JavaScriptCore/Float32Array.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Float64Array.h b/Source/WebCore/ForwardingHeaders/wtf/Float64Array.h
deleted file mode 100644
index e7e35aadc..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Float64Array.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Float64Array_h
-#define WebCore_FWD_Float64Array_h
-#include <JavaScriptCore/Float64Array.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Forward.h b/Source/WebCore/ForwardingHeaders/wtf/Forward.h
deleted file mode 100644
index 3e6b8c843..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Forward.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Forward_h
-#define WebCore_FWD_Forward_h
-#include <JavaScriptCore/Forward.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Functional.h b/Source/WebCore/ForwardingHeaders/wtf/Functional.h
deleted file mode 100644
index 44313274d..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Functional.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Functional_h
-#define WebCore_FWD_Functional_h
-#include <JavaScriptCore/Functional.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/GetPtr.h b/Source/WebCore/ForwardingHeaders/wtf/GetPtr.h
deleted file mode 100644
index 5a36ce210..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/GetPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_GetPtr_h
-#define WebCore_FWD_GetPtr_h
-#include <JavaScriptCore/GetPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/HashCountedSet.h b/Source/WebCore/ForwardingHeaders/wtf/HashCountedSet.h
deleted file mode 100644
index c92e9f01d..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/HashCountedSet.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_HashCountedSet_h
-#define WebCore_FWD_HashCountedSet_h
-#include <JavaScriptCore/HashCountedSet.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/HashFunctions.h b/Source/WebCore/ForwardingHeaders/wtf/HashFunctions.h
deleted file mode 100644
index 65e110ddb..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/HashFunctions.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_HashFunctions_h
-#define WebCore_FWD_HashFunctions_h
-#include <JavaScriptCore/HashFunctions.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/HashMap.h b/Source/WebCore/ForwardingHeaders/wtf/HashMap.h
deleted file mode 100644
index 68ea68e19..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/HashMap.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_HashMap_h
-#define WebCore_FWD_HashMap_h
-#include <JavaScriptCore/HashMap.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/HashSet.h b/Source/WebCore/ForwardingHeaders/wtf/HashSet.h
deleted file mode 100644
index a4cf32bad..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/HashSet.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_HashSet_h
-#define WebCore_FWD_HashSet_h
-#include <JavaScriptCore/HashSet.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/HashTable.h b/Source/WebCore/ForwardingHeaders/wtf/HashTable.h
deleted file mode 100644
index 5975685f0..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/HashTable.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_HashTable_h
-#define WebCore_FWD_HashTable_h
-#include <JavaScriptCore/HashTable.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/HashTraits.h b/Source/WebCore/ForwardingHeaders/wtf/HashTraits.h
deleted file mode 100644
index 3cf24cb06..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/HashTraits.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_HashTraits_h
-#define WebCore_FWD_HashTraits_h
-#include <JavaScriptCore/HashTraits.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/HexNumber.h b/Source/WebCore/ForwardingHeaders/wtf/HexNumber.h
deleted file mode 100644
index d17b95e45..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/HexNumber.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_HexNumber_h
-#define WebCore_FWD_HexNumber_h
-#include <JavaScriptCore/HexNumber.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Int16Array.h b/Source/WebCore/ForwardingHeaders/wtf/Int16Array.h
deleted file mode 100644
index 45d00399d..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Int16Array.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Int16Array_h
-#define WebCore_FWD_Int16Array_h
-#include <JavaScriptCore/Int16Array.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Int32Array.h b/Source/WebCore/ForwardingHeaders/wtf/Int32Array.h
deleted file mode 100644
index 7b65741d7..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Int32Array.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Int32Array_h
-#define WebCore_FWD_Int32Array_h
-#include <JavaScriptCore/Int32Array.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Int8Array.h b/Source/WebCore/ForwardingHeaders/wtf/Int8Array.h
deleted file mode 100644
index 6b6ad5274..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Int8Array.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Int8Array_h
-#define WebCore_FWD_Int8Array_h
-#include <JavaScriptCore/Int8Array.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ListHashSet.h b/Source/WebCore/ForwardingHeaders/wtf/ListHashSet.h
deleted file mode 100644
index c528b78dc..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ListHashSet.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ListHashSet_h
-#define WebCore_FWD_ListHashSet_h
-#include <JavaScriptCore/ListHashSet.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ListRefPtr.h b/Source/WebCore/ForwardingHeaders/wtf/ListRefPtr.h
deleted file mode 100644
index 379adfb9f..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ListRefPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ListRefPtr_h
-#define WebCore_FWD_ListRefPtr_h
-#include <JavaScriptCore/ListRefPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Locker.h b/Source/WebCore/ForwardingHeaders/wtf/Locker.h
deleted file mode 100644
index 4dbe13e90..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Locker.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Locker_h
-#define WebCore_FWD_Locker_h
-#include <JavaScriptCore/Locker.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/MD5.h b/Source/WebCore/ForwardingHeaders/wtf/MD5.h
deleted file mode 100644
index 0c657860b..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/MD5.h
+++ /dev/null
@@ -1,5 +0,0 @@
-#ifndef WebCore_FWD_MD5_h
-#define WebCore_FWD_MD5_h
-#include <JavaScriptCore/MD5.h>
-#endif
-
diff --git a/Source/WebCore/ForwardingHeaders/wtf/MainThread.h b/Source/WebCore/ForwardingHeaders/wtf/MainThread.h
deleted file mode 100644
index 2d8e280fa..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/MainThread.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_MainThread_h
-#define WebCore_FWD_MainThread_h
-#include <JavaScriptCore/MainThread.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/MathExtras.h b/Source/WebCore/ForwardingHeaders/wtf/MathExtras.h
deleted file mode 100644
index 8594e644e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/MathExtras.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_MathExtras_h
-#define WebCore_FWD_MathExtras_h
-#include <JavaScriptCore/MathExtras.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/MessageQueue.h b/Source/WebCore/ForwardingHeaders/wtf/MessageQueue.h
deleted file mode 100644
index c597e0883..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/MessageQueue.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_MessageQueue_h
-#define WebCore_FWD_MessageQueue_h
-#include <JavaScriptCore/MessageQueue.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/MetaAllocator.h b/Source/WebCore/ForwardingHeaders/wtf/MetaAllocator.h
deleted file mode 100644
index 7457af54e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/MetaAllocator.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_MetaAllocator_h
-#define WebCore_FWD_MetaAllocator_h
-#include <JavaScriptCore/MetaAllocator.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/MetaAllocatorHandle.h b/Source/WebCore/ForwardingHeaders/wtf/MetaAllocatorHandle.h
deleted file mode 100644
index a17b08ee0..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/MetaAllocatorHandle.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/MetaAllocatorHandle.h>
diff --git a/Source/WebCore/ForwardingHeaders/wtf/NonCopyingSort.h b/Source/WebCore/ForwardingHeaders/wtf/NonCopyingSort.h
deleted file mode 100644
index d30e61f31..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/NonCopyingSort.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_NonCopyingSort_h
-#define WebCore_FWD_NonCopyingSort_h
-#include <JavaScriptCore/NonCopyingSort.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Noncopyable.h b/Source/WebCore/ForwardingHeaders/wtf/Noncopyable.h
deleted file mode 100644
index c5126776a..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Noncopyable.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Noncopyable_h
-#define WebCore_FWD_Noncopyable_h
-#include <JavaScriptCore/Noncopyable.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/NotFound.h b/Source/WebCore/ForwardingHeaders/wtf/NotFound.h
deleted file mode 100644
index 17576837e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/NotFound.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_NotFound_h
-#define WebCore_FWD_NotFound_h
-#include <JavaScriptCore/NotFound.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/OSAllocator.h b/Source/WebCore/ForwardingHeaders/wtf/OSAllocator.h
deleted file mode 100644
index 637611adb..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/OSAllocator.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/OSAllocator.h>
diff --git a/Source/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h b/Source/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h
deleted file mode 100644
index 7700641f6..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_OwnArrayPtr_h
-#define WebCore_FWD_OwnArrayPtr_h
-#include <JavaScriptCore/OwnArrayPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/OwnPtr.h b/Source/WebCore/ForwardingHeaders/wtf/OwnPtr.h
deleted file mode 100644
index 977382d9e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/OwnPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_OwnPtr_h
-#define WebCore_FWD_OwnPtr_h
-#include <JavaScriptCore/OwnPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/OwnPtrCommon.h b/Source/WebCore/ForwardingHeaders/wtf/OwnPtrCommon.h
deleted file mode 100644
index 58260316e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/OwnPtrCommon.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PassOwnPtr_h
-#define WebCore_FWD_PassOwnPtr_h
-#include <JavaScriptCore/PassOwnPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/PageAllocation.h b/Source/WebCore/ForwardingHeaders/wtf/PageAllocation.h
deleted file mode 100644
index 6471b7332..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/PageAllocation.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PageAllocation_h
-#define WebCore_FWD_PageAllocation_h
-#include <JavaScriptCore/PageAllocation.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/PageAllocationAligned.h b/Source/WebCore/ForwardingHeaders/wtf/PageAllocationAligned.h
deleted file mode 100644
index 26d221646..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/PageAllocationAligned.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PageAllocationAligned_h
-#define WebCore_FWD_PageAllocationAligned_h
-#include <JavaScriptCore/PageAllocationAligned.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/PageBlock.h b/Source/WebCore/ForwardingHeaders/wtf/PageBlock.h
deleted file mode 100644
index b616eddf3..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/PageBlock.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PageBlock_h
-#define WebCore_FWD_PageBlock_h
-#include <JavaScriptCore/PageBlock.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/PageReservation.h b/Source/WebCore/ForwardingHeaders/wtf/PageReservation.h
deleted file mode 100644
index 212b02c7f..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/PageReservation.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PageReservation_h
-#define WebCore_FWD_PageReservation_h
-#include <JavaScriptCore/PageReservation.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ParallelJobs.h b/Source/WebCore/ForwardingHeaders/wtf/ParallelJobs.h
deleted file mode 100644
index b064e969c..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ParallelJobs.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ParallelJobs_h
-#define WebCore_FWD_ParallelJobs_h
-#include <JavaScriptCore/ParallelJobs.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/PassOwnArrayPtr.h b/Source/WebCore/ForwardingHeaders/wtf/PassOwnArrayPtr.h
deleted file mode 100644
index 8202caecd..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/PassOwnArrayPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PassOwnArrayPtr_h
-#define WebCore_FWD_PassOwnArrayPtr_h
-#include <JavaScriptCore/PassOwnArrayPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/PassOwnPtr.h b/Source/WebCore/ForwardingHeaders/wtf/PassOwnPtr.h
deleted file mode 100644
index 58260316e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/PassOwnPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PassOwnPtr_h
-#define WebCore_FWD_PassOwnPtr_h
-#include <JavaScriptCore/PassOwnPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/PassRefPtr.h b/Source/WebCore/ForwardingHeaders/wtf/PassRefPtr.h
deleted file mode 100644
index ef57e5fe2..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/PassRefPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PassRefPtr_h
-#define WebCore_FWD_PassRefPtr_h
-#include <JavaScriptCore/PassRefPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Platform.h b/Source/WebCore/ForwardingHeaders/wtf/Platform.h
deleted file mode 100644
index 9f2bb3a4c..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Platform.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Platform_h
-#define WebCore_FWD_Platform_h
-#include <JavaScriptCore/Platform.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/PossiblyNull.h b/Source/WebCore/ForwardingHeaders/wtf/PossiblyNull.h
deleted file mode 100644
index d52a4a044..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/PossiblyNull.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_PossiblyNull_h
-#define WebCore_FWD_PossiblyNull_h
-#include <JavaScriptCore/PossiblyNull.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/RandomNumber.h b/Source/WebCore/ForwardingHeaders/wtf/RandomNumber.h
deleted file mode 100644
index cb156d22d..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/RandomNumber.h
+++ /dev/null
@@ -1,5 +0,0 @@
-#ifndef WebCore_FWD_RandomNumber_h
-#define WebCore_FWD_RandomNumber_h
-#include <JavaScriptCore/RandomNumber.h>
-#endif
-
diff --git a/Source/WebCore/ForwardingHeaders/wtf/RedBlackTree.h b/Source/WebCore/ForwardingHeaders/wtf/RedBlackTree.h
deleted file mode 100644
index bd63b03e8..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/RedBlackTree.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_RedBlackTree_h
-#define WebCore_FWD_RedBlackTree_h
-#include <JavaScriptCore/RedBlackTree.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/RefCounted.h b/Source/WebCore/ForwardingHeaders/wtf/RefCounted.h
deleted file mode 100644
index c6b2deeb3..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/RefCounted.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_RefCounted_h
-#define WebCore_FWD_RefCounted_h
-#include <JavaScriptCore/RefCounted.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h b/Source/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h
deleted file mode 100644
index 2abe37e81..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h
+++ /dev/null
@@ -1,5 +0,0 @@
-#ifndef WebCore_FWD_RefCountedLeakCounter_h
-#define WebCore_FWD_RefCountedLeakCounter_h
-#include <JavaScriptCore/RefCountedLeakCounter.h>
-#endif
-
diff --git a/Source/WebCore/ForwardingHeaders/wtf/RefPtr.h b/Source/WebCore/ForwardingHeaders/wtf/RefPtr.h
deleted file mode 100644
index 594929deb..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/RefPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_RefPtr_h
-#define WebCore_FWD_RefPtr_h
-#include <JavaScriptCore/RefPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/RetainPtr.h b/Source/WebCore/ForwardingHeaders/wtf/RetainPtr.h
deleted file mode 100644
index 1352bd893..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/RetainPtr.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_RetainPtr_h
-#define WebCore_FWD_RetainPtr_h
-#include <JavaScriptCore/RetainPtr.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/SHA1.h b/Source/WebCore/ForwardingHeaders/wtf/SHA1.h
deleted file mode 100644
index 8bb48b240..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/SHA1.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_SHA1_h
-#define WebCore_FWD_SHA1_h
-#include <JavaScriptCore/SHA1.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/SegmentedVector.h b/Source/WebCore/ForwardingHeaders/wtf/SegmentedVector.h
deleted file mode 100644
index 5aa39a4b6..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/SegmentedVector.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_SegmentedVector_h
-#define WebCore_FWD_SegmentedVector_h
-#include <JavaScriptCore/SegmentedVector.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Spectrum.h b/Source/WebCore/ForwardingHeaders/wtf/Spectrum.h
deleted file mode 100644
index ccf503206..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Spectrum.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/Spectrum.h>
diff --git a/Source/WebCore/ForwardingHeaders/wtf/StackBounds.h b/Source/WebCore/ForwardingHeaders/wtf/StackBounds.h
deleted file mode 100644
index 770265e32..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/StackBounds.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StackBounds_h
-#define WebCore_FWD_StackBounds_h
-#include <JavaScriptCore/StackBounds.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/StaticConstructors.h b/Source/WebCore/ForwardingHeaders/wtf/StaticConstructors.h
deleted file mode 100644
index c8ce157e3..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/StaticConstructors.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StaticConstructors_h
-#define WebCore_FWD_StaticConstructors_h
-#include <JavaScriptCore/StaticConstructors.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/StdLibExtras.h b/Source/WebCore/ForwardingHeaders/wtf/StdLibExtras.h
deleted file mode 100644
index 20032951b..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/StdLibExtras.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StdLibExtras_h
-#define WebCore_FWD_StdLibExtras_h
-#include <JavaScriptCore/StdLibExtras.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/StringExtras.h b/Source/WebCore/ForwardingHeaders/wtf/StringExtras.h
deleted file mode 100644
index d89f2384f..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/StringExtras.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StringExtras_h
-#define WebCore_FWD_StringExtras_h
-#include <JavaScriptCore/StringExtras.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/StringHasher.h b/Source/WebCore/ForwardingHeaders/wtf/StringHasher.h
deleted file mode 100644
index fbc0d8d72..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/StringHasher.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StringHasher_h
-#define WebCore_FWD_StringHasher_h
-#include <JavaScriptCore/StringHasher.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/TemporaryChange.h b/Source/WebCore/ForwardingHeaders/wtf/TemporaryChange.h
deleted file mode 100644
index 4e475df15..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/TemporaryChange.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_TemporaryChange_h
-#define WebCore_FWD_TemporaryChange_h
-#include <JavaScriptCore/TemporaryChange.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ThreadRestrictionVerifier.h b/Source/WebCore/ForwardingHeaders/wtf/ThreadRestrictionVerifier.h
deleted file mode 100644
index 8442d1cba..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ThreadRestrictionVerifier.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ThreadRestrictionVerifier_h
-#define WebCore_FWD_ThreadRestrictionVerifier_h
-#include <JavaScriptCore/ThreadRestrictionVerifier.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeRefCounted.h b/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeRefCounted.h
deleted file mode 100644
index d7a35f882..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ThreadSafeRefCounted.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ThreadSafeRefCounted_h
-#define WebCore_FWD_ThreadSafeRefCounted_h
-#include <JavaScriptCore/ThreadSafeRefCounted.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h b/Source/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h
deleted file mode 100644
index 1e5474ffb..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ThreadSpecific_h
-#define WebCore_FWD_ThreadSpecific_h
-#include <JavaScriptCore/ThreadSpecific.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Threading.h b/Source/WebCore/ForwardingHeaders/wtf/Threading.h
deleted file mode 100644
index ad2984721..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Threading.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Threading_h
-#define WebCore_FWD_Threading_h
-#include <JavaScriptCore/Threading.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ThreadingPrimitives.h b/Source/WebCore/ForwardingHeaders/wtf/ThreadingPrimitives.h
deleted file mode 100644
index 5dd2e0301..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ThreadingPrimitives.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ThreadingPrimitives_h
-#define WebCore_FWD_ThreadingPrimitives_h
-#include <JavaScriptCore/ThreadingPrimitives.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/TypeTraits.h b/Source/WebCore/ForwardingHeaders/wtf/TypeTraits.h
deleted file mode 100644
index a4ae09fac..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/TypeTraits.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_TypeTraits_h
-#define WebCore_FWD_TypeTraits_h
-#include <JavaScriptCore/TypeTraits.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Uint16Array.h b/Source/WebCore/ForwardingHeaders/wtf/Uint16Array.h
deleted file mode 100644
index cccea2c1b..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Uint16Array.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Uint16Array_h
-#define WebCore_FWD_Uint16Array_h
-#include <JavaScriptCore/Uint16Array.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Uint32Array.h b/Source/WebCore/ForwardingHeaders/wtf/Uint32Array.h
deleted file mode 100644
index f6026f15c..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Uint32Array.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Uint32Array_h
-#define WebCore_FWD_Uint32Array_h
-#include <JavaScriptCore/Uint32Array.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Uint8Array.h b/Source/WebCore/ForwardingHeaders/wtf/Uint8Array.h
deleted file mode 100644
index 4c8de4ea7..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Uint8Array.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Uint8Array_h
-#define WebCore_FWD_Uint8Array_h
-#include <JavaScriptCore/Uint8Array.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Uint8ClampedArray.h b/Source/WebCore/ForwardingHeaders/wtf/Uint8ClampedArray.h
deleted file mode 100644
index 27d2e01d1..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Uint8ClampedArray.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Uint8ClampedArray_h
-#define WebCore_FWD_Uint8ClampedArray_h
-#include <JavaScriptCore/Uint8ClampedArray.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/UnusedParam.h b/Source/WebCore/ForwardingHeaders/wtf/UnusedParam.h
deleted file mode 100644
index 5202740c0..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/UnusedParam.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_UnusedParam_h
-#define WebCore_FWD_UnusedParam_h
-#include <JavaScriptCore/UnusedParam.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/VMTags.h b/Source/WebCore/ForwardingHeaders/wtf/VMTags.h
deleted file mode 100644
index ffd1e128e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/VMTags.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_VMTags_h
-#define WebCore_FWD_VMTags_h
-#include <JavaScriptCore/VMTags.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/ValueCheck.h b/Source/WebCore/ForwardingHeaders/wtf/ValueCheck.h
deleted file mode 100644
index 4667674eb..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/ValueCheck.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ValueCheck_h
-#define WebCore_FWD_ValueCheck_h
-#include <JavaScriptCore/ValueCheck.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/Vector.h b/Source/WebCore/ForwardingHeaders/wtf/Vector.h
deleted file mode 100644
index 2c1cf7b97..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/Vector.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Vector_h
-#define WebCore_FWD_Vector_h
-#include <JavaScriptCore/Vector.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/VectorTraits.h b/Source/WebCore/ForwardingHeaders/wtf/VectorTraits.h
deleted file mode 100644
index 87a38229e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/VectorTraits.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_VectorTraits_h
-#define WebCore_FWD_VectorTraits_h
-#include <JavaScriptCore/VectorTraits.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/WTFThreadData.h b/Source/WebCore/ForwardingHeaders/wtf/WTFThreadData.h
deleted file mode 100644
index a08417a51..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/WTFThreadData.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_WTFThreadData_h
-#define WebCore_FWD_WTFThreadData_h
-#include <JavaScriptCore/WTFThreadData.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/dtoa.h b/Source/WebCore/ForwardingHeaders/wtf/dtoa.h
deleted file mode 100644
index 7fd92652f..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/dtoa.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_dtoa_h
-#define WebCore_FWD_dtoa_h
-#include <JavaScriptCore/dtoa.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/dtoa/double-conversion.h b/Source/WebCore/ForwardingHeaders/wtf/dtoa/double-conversion.h
deleted file mode 100644
index 86fb12789..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/dtoa/double-conversion.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_double_conversion_h
-#define WebCore_FWD_double_conversion_h
-#include <JavaScriptCore/double-conversion.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/ASCIIFastPath.h b/Source/WebCore/ForwardingHeaders/wtf/text/ASCIIFastPath.h
deleted file mode 100644
index 837357d16..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/ASCIIFastPath.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_ASCIIFastPath_h
-#define WebCore_FWD_ASCIIFastPath_h
-#include <JavaScriptCore/ASCIIFastPath.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/AtomicString.h b/Source/WebCore/ForwardingHeaders/wtf/text/AtomicString.h
deleted file mode 100644
index 83289d2a5..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/AtomicString.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_AtomicString_h
-#define WebCore_FWD_AtomicString_h
-#include <JavaScriptCore/AtomicString.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/AtomicStringHash.h b/Source/WebCore/ForwardingHeaders/wtf/text/AtomicStringHash.h
deleted file mode 100644
index 3ca1b77d5..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/AtomicStringHash.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_AtomicStringHash_h
-#define WebCore_FWD_AtomicStringHash_h
-#include <JavaScriptCore/AtomicStringHash.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/AtomicStringImpl.h b/Source/WebCore/ForwardingHeaders/wtf/text/AtomicStringImpl.h
deleted file mode 100644
index 87214a10c..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/AtomicStringImpl.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_AtomicStringImpl_h
-#define WebCore_FWD_AtomicStringImpl_h
-#include <JavaScriptCore/AtomicStringImpl.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/CString.h b/Source/WebCore/ForwardingHeaders/wtf/text/CString.h
deleted file mode 100644
index a8c2ac98a..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/CString.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_CString_h
-#define WebCore_FWD_CString_h
-#include <JavaScriptCore/CString.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/StringBuffer.h b/Source/WebCore/ForwardingHeaders/wtf/text/StringBuffer.h
deleted file mode 100644
index 0b5324049..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/StringBuffer.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StringBuffer_h
-#define WebCore_FWD_StringBuffer_h
-#include <JavaScriptCore/StringBuffer.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/StringBuilder.h b/Source/WebCore/ForwardingHeaders/wtf/text/StringBuilder.h
deleted file mode 100644
index 115db065a..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/StringBuilder.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StringBuilder_h
-#define WebCore_FWD_StringBuilder_h
-#include <JavaScriptCore/StringBuilder.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/StringConcatenate.h b/Source/WebCore/ForwardingHeaders/wtf/text/StringConcatenate.h
deleted file mode 100644
index 666ac0855..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/StringConcatenate.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StringConcatenate_h
-#define WebCore_FWD_StringConcatenate_h
-#include <JavaScriptCore/StringConcatenate.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/StringHash.h b/Source/WebCore/ForwardingHeaders/wtf/text/StringHash.h
deleted file mode 100644
index f56c7b5be..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/StringHash.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StringHash_h
-#define WebCore_FWD_StringHash_h
-#include <JavaScriptCore/StringHash.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/StringImpl.h b/Source/WebCore/ForwardingHeaders/wtf/text/StringImpl.h
deleted file mode 100644
index 3e506d44b..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/StringImpl.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StringImpl_h
-#define WebCore_FWD_StringImpl_h
-#include <JavaScriptCore/StringImpl.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/TextPosition.h b/Source/WebCore/ForwardingHeaders/wtf/text/TextPosition.h
deleted file mode 100644
index 16009846e..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/TextPosition.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_TextPosition_h
-#define WebCore_FWD_TextPosition_h
-#include <JavaScriptCore/TextPosition.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/text/WTFString.h b/Source/WebCore/ForwardingHeaders/wtf/text/WTFString.h
deleted file mode 100644
index 4b9f31d16..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/text/WTFString.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_WTFString_h
-#define WebCore_FWD_WTFString_h
-#include <JavaScriptCore/WTFString.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/unicode/CharacterNames.h b/Source/WebCore/ForwardingHeaders/wtf/unicode/CharacterNames.h
deleted file mode 100644
index 551864209..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/unicode/CharacterNames.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_CharacterNames_h
-#define WebCore_FWD_CharacterNames_h
-#include <JavaScriptCore/CharacterNames.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/unicode/Collator.h b/Source/WebCore/ForwardingHeaders/wtf/unicode/Collator.h
deleted file mode 100644
index f28a11728..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/unicode/Collator.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Collator_h
-#define WebCore_FWD_Collator_h
-#include <JavaScriptCore/Collator.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h b/Source/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h
deleted file mode 100644
index b9daa435d..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_UTF8_h
-#define WebCore_FWD_UTF8_h
-#include <JavaScriptCore/UTF8.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h b/Source/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h
deleted file mode 100644
index 9f06747f1..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_Unicode_h
-#define WebCore_FWD_Unicode_h
-#include <JavaScriptCore/Unicode.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h b/Source/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h
deleted file mode 100644
index 4819f476f..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_UnicodeIcu_h
-#define WebCore_FWD_UnicodeIcu_h
-#include <JavaScriptCore/UnicodeIcu.h>
-#endif
diff --git a/Source/WebCore/ForwardingHeaders/wtf/unicode/wince/UnicodeWince.h b/Source/WebCore/ForwardingHeaders/wtf/unicode/wince/UnicodeWince.h
deleted file mode 100644
index 6d63d31d3..000000000
--- a/Source/WebCore/ForwardingHeaders/wtf/unicode/wince/UnicodeWince.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_UnicodeWince_h
-#define WebCore_FWD_UnicodeWince_h
-#include <JavaScriptCore/UnicodeWince.h>
-#endif
diff --git a/Source/WebCore/GNUmakefile.am b/Source/WebCore/GNUmakefile.am
index 2df6a36d6..ebdcc8fcc 100644
--- a/Source/WebCore/GNUmakefile.am
+++ b/Source/WebCore/GNUmakefile.am
@@ -12,6 +12,10 @@ webcore_cppflags += \
 	-I$(srcdir)/Source/ThirdParty/ANGLE/include/GLSLANG \
 	-I$(srcdir)/Source/WebCore \
 	-I$(srcdir)/Source/WebCore/Modules/geolocation \
+	-I$(srcdir)/Source/WebCore/Modules/indexeddb \
+	-I$(srcdir)/Source/WebCore/Modules/mediastream \
+	-I$(srcdir)/Source/WebCore/Modules/webdatabase \
+	-I$(srcdir)/Source/WebCore/Modules/websockets \
 	-I$(srcdir)/Source/WebCore/accessibility \
 	-I$(srcdir)/Source/WebCore/bindings \
 	-I$(srcdir)/Source/WebCore/bindings/generic \
@@ -39,7 +43,6 @@ webcore_cppflags += \
 	-I$(srcdir)/Source/WebCore/loader/cache \
 	-I$(srcdir)/Source/WebCore/loader/icon \
 	-I$(srcdir)/Source/WebCore/mathml \
-	-I$(srcdir)/Source/WebCore/mediastream \
 	-I$(srcdir)/Source/WebCore/notifications \
 	-I$(srcdir)/Source/WebCore/page \
 	-I$(srcdir)/Source/WebCore/page/animation \
@@ -110,6 +113,12 @@ webcoregtk_cppflags += \
 	-I$(srcdir)/Source/WebCore/platform/network/soup
 
 # ---
+# Features enabled by default at compilation time
+# ---
+FEATURE_DEFINES += ENABLE_SMOOTH_SCROLLING=1
+webcore_cppflags += -DENABLE_SMOOTH_SCROLLING=1
+
+# ---
 # Channel mesaging support
 # ---
 if ENABLE_CHANNEL_MESSAGING
@@ -295,6 +304,16 @@ webcore_cppflags += -DENABLE_INPUT_SPEECH=0
 endif # END ENABLE_INPUT_SPEECH
 
 # ----
+# Scripted Speech API support
+# ----
+if ENABLE_SCRIPTED_SPEECH
+FEATURE_DEFINES += ENABLE_SCRIPTED_SPEECH=1
+webcore_cppflags += -DENABLE_SCRIPTED_SPEECH=1
+else
+webcore_cppflags += -DENABLE_SCRIPTED_SPEECH=0
+endif # END ENABLE_SCRIPTED_SPEECH
+
+# ----
 # Icon Database Support
 # ----
 if ENABLE_ICONDATABASE
@@ -464,8 +483,8 @@ DerivedSources/WebCore/MathMLElementFactory.cpp DerivedSources/WebCore/MathMLNam
 # Notifications support
 # ----
 if ENABLE_NOTIFICATIONS
-FEATURE_DEFINES += ENABLE_NOTIFICATIONS=1
-webcore_cppflags += -DENABLE_NOTIFICATIONS=1
+FEATURE_DEFINES += ENABLE_NOTIFICATIONS=1 ENABLE_LEGACY_NOTIFICATIONS=1
+webcore_cppflags += -DENABLE_NOTIFICATIONS=1 -DENABLE_LEGACY_NOTIFICATIONS=1
 endif # END ENABLE_NOTIFICATIONS
 
 # ----
@@ -686,9 +705,9 @@ SCRIPTS_FOR_GENERATE_BINDINGS = \
 	$(WebCore)/bindings/scripts/generate-bindings.pl \
 	$(WebCore)/bindings/scripts/preprocessor.pm
 
-SCRIPTS_FOR_RESOLVE_SUPPLEMENTAL = \
+SCRIPTS_FOR_PREPROCESS_IDLS = \
 	$(WebCore)/bindings/scripts/IDLParser.pm \
-	$(WebCore)/bindings/scripts/resolve-supplemental.pl
+	$(WebCore)/bindings/scripts/preprocess-idls.pl
 
 DerivedSources/WebCore/UserAgentStyleSheetsData.cpp: DerivedSources/WebCore/UserAgentStyleSheets.h
 DerivedSources/WebCore/UserAgentStyleSheets.h: $(WebCore)/css/make-css-file-arrays.pl $(WebCore)/bindings/scripts/preprocessor.pm $(USER_AGENT_STYLE_SHEETS)
@@ -719,8 +738,8 @@ DerivedSources/WebCore/XMLNSNames.cpp DerivedSources/WebCore/XMLNSNames.h: $(Web
 DerivedSources/WebCore/XMLNames.cpp DerivedSources/WebCore/XMLNames.h: $(WebCore)/dom/make_names.pl $(WebCore)/xml/xmlattrs.in
 	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/xml/xmlattrs.in --outputDir "$(GENSOURCES_WEBCORE)"
 
-DerivedSources/WebCore/EventFactory.cpp DerivedSources/WebCore/EventHeaders.h DerivedSources/WebCore/EventInterfaces.h: $(WebCore)/dom/make_event_factory.pl $(WebCore)/dom/EventFactory.in
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --input $(WebCore)/dom/EventFactory.in --outputDir "$(GENSOURCES_WEBCORE)"
+DerivedSources/WebCore/EventFactory.cpp DerivedSources/WebCore/EventHeaders.h DerivedSources/WebCore/EventInterfaces.h: $(WebCore)/dom/make_event_factory.pl $(WebCore)/dom/EventNames.in
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --input $(WebCore)/dom/EventNames.in --outputDir "$(GENSOURCES_WEBCORE)"
 
 DerivedSources/WebCore/EventTargetHeaders.h DerivedSources/WebCore/EventTargetInterfaces.h: $(WebCore)/dom/make_event_factory.pl $(WebCore)/dom/EventTargetFactory.in
 	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --input $(WebCore)/dom/EventTargetFactory.in --outputDir "$(GENSOURCES_WEBCORE)"
@@ -760,6 +779,10 @@ DerivedSources/ANGLE/glslang_tab.h: DerivedSources/ANGLE/glslang_tab.cpp
 
 IDL_PATH := \
     $(WebCore)/Modules/geolocation \
+    $(WebCore)/Modules/indexeddb \
+    $(WebCore)/Modules/mediastream \
+    $(WebCore)/Modules/webdatabase \
+    $(WebCore)/Modules/websockets \
     $(WebCore)/bindings/js \
     $(WebCore)/css \
     $(WebCore)/dom \
@@ -771,7 +794,6 @@ IDL_PATH := \
     $(WebCore)/html/track \
     $(WebCore)/inspector \
     $(WebCore)/loader/appcache \
-    $(WebCore)/mediastream \
     $(WebCore)/notifications \
     $(WebCore)/page \
     $(WebCore)/plugins \
@@ -790,11 +812,11 @@ idl_files_list = $(top_builddir)/DerivedSources/WebCore/idl_files_list
 idl_attributes_file = $(WebCore)/bindings/scripts/IDLAttributes.txt
 
 .SECONDARY:
-$(supplemental_dependency_file): $(SCRIPTS_FOR_RESOLVE_SUPPLEMENTAL) $(dom_binding_idls) $(idl_attributes_file)
+$(supplemental_dependency_file): $(SCRIPTS_FOR_PREPROCESS_IDLS) $(dom_binding_idls) $(idl_attributes_file)
 	$(AM_V_GEN)
 	$(AM_V_at)echo -n > $(idl_files_list)
 	$(AM_V_at)($(foreach idl, $(dom_binding_idls), echo $(idl) &&) echo -n) >> $(idl_files_list)
-	$(AM_V_at)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/resolve-supplemental.pl --defines "LANGUAGE_JAVASCRIPT=1 $(FEATURE_DEFINES)" --idlFilesList $(idl_files_list) --supplementalDependencyFile $@ --idlAttributesFile $(idl_attributes_file)
+	$(AM_V_at)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/preprocess-idls.pl --defines "LANGUAGE_JAVASCRIPT=1 $(FEATURE_DEFINES)" --idlFilesList $(idl_files_list) --supplementalDependencyFile $@ --idlAttributesFile $(idl_attributes_file)
 
 # This does not appear to work correctly with gnumake unless
 # it includes an empty command list (the semicolon).
@@ -899,6 +921,11 @@ libWebCoreGtk_la_CPPFLAGS = \
 	$(XT_CFLAGS)
 
 EXTRA_DIST += \
+	$(shell ls $(srcdir)/Source/WebCore/Modules/geolocation/*.idl) \
+	$(shell ls $(srcdir)/Source/WebCore/Modules/indexeddb/*.idl) \
+	$(shell ls $(srcdir)/Source/WebCore/Modules/mediastream/*.idl) \
+	$(shell ls $(srcdir)/Source/WebCore/Modules/webdatabase/*.idl) \
+	$(shell ls $(srcdir)/Source/WebCore/Modules/websockets/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/css/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/dom/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/fileapi/*.idl) \
@@ -908,7 +935,6 @@ EXTRA_DIST += \
 	$(shell ls $(srcdir)/Source/WebCore/html/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/inspector/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/loader/appcache/*.idl) \
-	$(shell ls $(srcdir)/Source/WebCore/mediastream/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/notifications/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/page/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/plugins/*.idl) \
@@ -916,7 +942,6 @@ EXTRA_DIST += \
 	$(shell ls $(srcdir)/Source/WebCore/svg/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/testing/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/webaudio/*.idl) \
-	$(shell ls $(srcdir)/Source/WebCore/websockets/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/workers/*.idl) \
 	$(shell ls $(srcdir)/Source/WebCore/xml/*.idl) \
 	Source/ThirdParty/ANGLE/src/compiler/glslang.l \
@@ -924,6 +949,7 @@ EXTRA_DIST += \
 	Source/WebCore/bindings/scripts/CodeGeneratorGObject.pm \
 	Source/WebCore/bindings/scripts/CodeGeneratorJS.pm \
 	Source/WebCore/bindings/scripts/CodeGenerator.pm \
+	Source/WebCore/bindings/scripts/IDLAttributes.txt \
 	Source/WebCore/bindings/scripts/IDLParser.pm \
 	Source/WebCore/bindings/scripts/IDLStructure.pm \
 	Source/WebCore/bindings/scripts/InFilesCompiler.pm \
@@ -931,7 +957,7 @@ EXTRA_DIST += \
 	Source/WebCore/bindings/scripts/generate-bindings.pl \
 	Source/WebCore/bindings/scripts/gobject-generate-headers.pl \
 	Source/WebCore/bindings/scripts/preprocessor.pm \
-	Source/WebCore/bindings/scripts/resolve-supplemental.pl \
+	Source/WebCore/bindings/scripts/preprocess-idls.pl \
 	Source/WebCore/ChangeLog \
 	Source/WebCore/css/CSSGrammar.y \
 	Source/WebCore/css/CSSPropertyNames.in \
@@ -954,7 +980,7 @@ EXTRA_DIST += \
 	Source/WebCore/css/SVGCSSValueKeywords.in \
 	Source/WebCore/css/view-source.css \
 	Source/WebCore/css/WebKitFontFamilyNames.in \
-	Source/WebCore/dom/EventFactory.in \
+	Source/WebCore/dom/EventNames.in \
 	Source/WebCore/dom/EventTargetFactory.in \
 	Source/WebCore/dom/make_dom_exceptions.pl \
 	Source/WebCore/dom/make_event_factory.pl \
diff --git a/Source/WebCore/GNUmakefile.list.am b/Source/WebCore/GNUmakefile.list.am
index e5a03cb53..2bd1f654c 100644
--- a/Source/WebCore/GNUmakefile.list.am
+++ b/Source/WebCore/GNUmakefile.list.am
@@ -161,6 +161,8 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSEntityReference.h \
 	DerivedSources/WebCore/JSErrorEvent.cpp \
 	DerivedSources/WebCore/JSErrorEvent.h \
+	DerivedSources/WebCore/JSEXTTextureFilterAnisotropic.cpp \
+	DerivedSources/WebCore/JSEXTTextureFilterAnisotropic.h \
 	DerivedSources/WebCore/JSEvent.cpp \
 	DerivedSources/WebCore/JSEventException.cpp \
 	DerivedSources/WebCore/JSEventException.h \
@@ -656,6 +658,19 @@ dom_binding_idls += \
 	$(WebCore)/Modules/geolocation/PositionCallback.idl \
 	$(WebCore)/Modules/geolocation/PositionError.idl \
 	$(WebCore)/Modules/geolocation/PositionErrorCallback.idl \
+	$(WebCore)/Modules/mediastream/DOMWindowMediaStream.idl \
+	$(WebCore)/Modules/mediastream/LocalMediaStream.idl \
+	$(WebCore)/Modules/mediastream/MediaStream.idl \
+	$(WebCore)/Modules/mediastream/MediaStreamEvent.idl \
+	$(WebCore)/Modules/mediastream/MediaStreamList.idl \
+	$(WebCore)/Modules/mediastream/MediaStreamTrack.idl \
+	$(WebCore)/Modules/mediastream/MediaStreamTrackList.idl \
+	$(WebCore)/Modules/mediastream/NavigatorMediaStream.idl \
+	$(WebCore)/Modules/mediastream/NavigatorUserMediaError.idl \
+	$(WebCore)/Modules/mediastream/NavigatorUserMediaErrorCallback.idl \
+	$(WebCore)/Modules/mediastream/NavigatorUserMediaSuccessCallback.idl \
+	$(WebCore)/Modules/mediastream/PeerConnection.idl \
+	$(WebCore)/Modules/mediastream/SignalingCallback.idl \
 	$(WebCore)/css/CSSCharsetRule.idl \
 	$(WebCore)/css/CSSFontFaceRule.idl \
 	$(WebCore)/css/CSSImportRule.idl \
@@ -757,7 +772,6 @@ dom_binding_idls += \
 	$(WebCore)/html/DOMSettableTokenList.idl \
 	$(WebCore)/html/DOMTokenList.idl \
 	$(WebCore)/html/DOMURL.idl \
-	$(WebCore)/html/DOMWindowHTML.idl \
 	$(WebCore)/html/HTMLAllCollection.idl \
 	$(WebCore)/html/HTMLAnchorElement.idl \
 	$(WebCore)/html/HTMLAppletElement.idl \
@@ -844,8 +858,8 @@ dom_binding_idls += \
 	$(WebCore)/html/canvas/CanvasPattern.idl \
 	$(WebCore)/html/canvas/CanvasRenderingContext.idl \
 	$(WebCore)/html/canvas/CanvasRenderingContext2D.idl \
-	$(WebCore)/html/canvas/DOMWindowWebGL.idl \
 	$(WebCore)/html/canvas/DataView.idl \
+	$(WebCore)/html/canvas/EXTTextureFilterAnisotropic.idl \
 	$(WebCore)/html/canvas/Float32Array.idl \
 	$(WebCore)/html/canvas/Float64Array.idl \
 	$(WebCore)/html/canvas/Int16Array.idl \
@@ -884,19 +898,6 @@ dom_binding_idls += \
 	$(WebCore)/inspector/ScriptProfile.idl \
 	$(WebCore)/inspector/ScriptProfileNode.idl \
 	$(WebCore)/loader/appcache/DOMApplicationCache.idl \
-	$(WebCore)/mediastream/DOMWindowMediaStream.idl \
-	$(WebCore)/mediastream/LocalMediaStream.idl \
-	$(WebCore)/mediastream/MediaStream.idl \
-	$(WebCore)/mediastream/MediaStreamEvent.idl \
-	$(WebCore)/mediastream/MediaStreamList.idl \
-	$(WebCore)/mediastream/MediaStreamTrack.idl \
-	$(WebCore)/mediastream/MediaStreamTrackList.idl \
-	$(WebCore)/mediastream/NavigatorMediaStream.idl \
-	$(WebCore)/mediastream/NavigatorUserMediaError.idl \
-	$(WebCore)/mediastream/NavigatorUserMediaErrorCallback.idl \
-	$(WebCore)/mediastream/NavigatorUserMediaSuccessCallback.idl \
-	$(WebCore)/mediastream/PeerConnection.idl \
-	$(WebCore)/mediastream/SignalingCallback.idl \
 	$(WebCore)/notifications/Notification.idl \
 	$(WebCore)/notifications/NotificationCenter.idl \
 	$(WebCore)/page/BarInfo.idl \
@@ -935,14 +936,12 @@ dom_binding_idls += \
 	$(WebCore)/webaudio/DOMWindowWebAudio.idl \
 	$(WebCore)/webaudio/WaveShaperNode.idl \
 	$(WebCore)/workers/AbstractWorker.idl \
-	$(WebCore)/workers/DOMWindowWorker.idl \
 	$(WebCore)/workers/DedicatedWorkerContext.idl \
 	$(WebCore)/workers/SharedWorker.idl \
 	$(WebCore)/workers/SharedWorkerContext.idl \
 	$(WebCore)/workers/Worker.idl \
 	$(WebCore)/workers/WorkerContext.idl \
 	$(WebCore)/workers/WorkerLocation.idl \
-	$(WebCore)/xml/DOMWindowXML.idl \
 	$(WebCore)/xml/DOMParser.idl \
 	$(WebCore)/xml/XMLHttpRequest.idl \
 	$(WebCore)/xml/XMLHttpRequestException.idl \
@@ -970,6 +969,175 @@ webcore_sources += \
 	Source/WebCore/Modules/geolocation/PositionError.h \
 	Source/WebCore/Modules/geolocation/PositionErrorCallback.h \
 	Source/WebCore/Modules/geolocation/PositionOptions.h \
+	Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.cpp \
+	Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.h \
+	Source/WebCore/Modules/indexeddb/IDBAny.cpp \
+	Source/WebCore/Modules/indexeddb/IDBAny.h \
+	Source/WebCore/Modules/indexeddb/IDBBackingStore.h \
+	Source/WebCore/Modules/indexeddb/IDBCallbacks.h \
+	Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp \
+	Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h \
+	Source/WebCore/Modules/indexeddb/IDBCursorBackendInterface.h \
+	Source/WebCore/Modules/indexeddb/IDBCursor.cpp \
+	Source/WebCore/Modules/indexeddb/IDBCursor.h \
+	Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp \
+	Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h \
+	Source/WebCore/Modules/indexeddb/IDBDatabaseBackendInterface.h \
+	Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacks.h \
+	Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacksImpl.h \
+	Source/WebCore/Modules/indexeddb/IDBDatabase.cpp \
+	Source/WebCore/Modules/indexeddb/IDBDatabaseError.h \
+	Source/WebCore/Modules/indexeddb/IDBDatabaseException.cpp \
+	Source/WebCore/Modules/indexeddb/IDBDatabaseException.h \
+	Source/WebCore/Modules/indexeddb/IDBDatabase.h \
+	Source/WebCore/Modules/indexeddb/IDBEventDispatcher.cpp \
+	Source/WebCore/Modules/indexeddb/IDBEventDispatcher.h \
+	Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp \
+	Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.h \
+	Source/WebCore/Modules/indexeddb/IDBFactoryBackendInterface.cpp \
+	Source/WebCore/Modules/indexeddb/IDBFactoryBackendInterface.h \
+	Source/WebCore/Modules/indexeddb/IDBFactory.cpp \
+	Source/WebCore/Modules/indexeddb/IDBFactory.h \
+	Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp \
+	Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h \
+	Source/WebCore/Modules/indexeddb/IDBIndexBackendInterface.h \
+	Source/WebCore/Modules/indexeddb/IDBIndexBackendInterface.h \
+	Source/WebCore/Modules/indexeddb/IDBIndex.cpp \
+	Source/WebCore/Modules/indexeddb/IDBIndex.h \
+	Source/WebCore/Modules/indexeddb/IDBKey.h \
+	Source/WebCore/Modules/indexeddb/IDBKeyPath.h \
+	Source/WebCore/Modules/indexeddb/IDBKeyPathBackendImpl.h \
+	Source/WebCore/Modules/indexeddb/IDBKeyRange.cpp \
+	Source/WebCore/Modules/indexeddb/IDBKeyRange.h \
+	Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp \
+	Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.h \
+	Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.cpp \
+	Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.h \
+	Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp \
+	Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h \
+	Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h \
+	Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h \
+	Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp \
+	Source/WebCore/Modules/indexeddb/IDBObjectStore.h \
+	Source/WebCore/Modules/indexeddb/IDBRequest.cpp \
+	Source/WebCore/Modules/indexeddb/IDBRequest.h \
+	Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h \
+	Source/WebCore/Modules/indexeddb/IDBTransactionCoordinator.h \
+	Source/WebCore/Modules/indexeddb/IDBTransaction.cpp \
+	Source/WebCore/Modules/indexeddb/IDBTransaction.h \
+	Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.h \
+	Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.h \
+	Source/WebCore/Modules/indexeddb/PageGroupIndexedDatabase.cpp \
+	Source/WebCore/Modules/indexeddb/PageGroupIndexedDatabase.h \
+	Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.cpp \
+	Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.h \
+	Source/WebCore/Modules/mediastream/LocalMediaStream.cpp \
+	Source/WebCore/Modules/mediastream/LocalMediaStream.h \
+	Source/WebCore/Modules/mediastream/MediaStream.cpp \
+	Source/WebCore/Modules/mediastream/MediaStream.h \
+	Source/WebCore/Modules/mediastream/MediaStreamEvent.cpp \
+	Source/WebCore/Modules/mediastream/MediaStreamEvent.h \
+	Source/WebCore/Modules/mediastream/MediaStreamList.cpp \
+	Source/WebCore/Modules/mediastream/MediaStreamList.h \
+	Source/WebCore/Modules/mediastream/MediaStreamRegistry.cpp \
+	Source/WebCore/Modules/mediastream/MediaStreamRegistry.h \
+	Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp \
+	Source/WebCore/Modules/mediastream/MediaStreamTrack.h \
+	Source/WebCore/Modules/mediastream/MediaStreamTrackList.cpp \
+	Source/WebCore/Modules/mediastream/MediaStreamTrackList.h \
+	Source/WebCore/Modules/mediastream/NavigatorMediaStream.cpp \
+	Source/WebCore/Modules/mediastream/NavigatorMediaStream.h \
+	Source/WebCore/Modules/mediastream/NavigatorUserMediaError.h \
+	Source/WebCore/Modules/mediastream/NavigatorUserMediaErrorCallback.h \
+	Source/WebCore/Modules/mediastream/NavigatorUserMediaSuccessCallback.h \
+	Source/WebCore/Modules/mediastream/PeerConnection.cpp \
+	Source/WebCore/Modules/mediastream/PeerConnection.h \
+	Source/WebCore/Modules/mediastream/SignalingCallback.h \
+	Source/WebCore/Modules/mediastream/UserMediaClient.h \
+	Source/WebCore/Modules/mediastream/UserMediaController.h \
+	Source/WebCore/Modules/mediastream/UserMediaController.cpp \
+	Source/WebCore/Modules/mediastream/UserMediaRequest.cpp \
+	Source/WebCore/Modules/mediastream/UserMediaRequest.h \
+	Source/WebCore/Modules/webdatabase/AbstractDatabase.cpp \
+	Source/WebCore/Modules/webdatabase/AbstractDatabase.h \
+	Source/WebCore/Modules/webdatabase/ChangeVersionWrapper.cpp \
+	Source/WebCore/Modules/webdatabase/ChangeVersionWrapper.h \
+	Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.cpp \
+	Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.h \
+	Source/WebCore/Modules/webdatabase/Database.cpp \
+	Source/WebCore/Modules/webdatabase/Database.h \
+	Source/WebCore/Modules/webdatabase/DatabaseAuthorizer.cpp \
+	Source/WebCore/Modules/webdatabase/DatabaseAuthorizer.h \
+	Source/WebCore/Modules/webdatabase/DatabaseCallback.h \
+	Source/WebCore/Modules/webdatabase/DatabaseContext.cpp \
+	Source/WebCore/Modules/webdatabase/DatabaseContext.h \
+	Source/WebCore/Modules/webdatabase/DatabaseDetails.h \
+	Source/WebCore/Modules/webdatabase/DatabaseSync.cpp \
+	Source/WebCore/Modules/webdatabase/DatabaseSync.h \
+	Source/WebCore/Modules/webdatabase/DatabaseTask.cpp \
+	Source/WebCore/Modules/webdatabase/DatabaseTask.h \
+	Source/WebCore/Modules/webdatabase/DatabaseThread.cpp \
+	Source/WebCore/Modules/webdatabase/DatabaseThread.h \
+	Source/WebCore/Modules/webdatabase/DatabaseTrackerClient.h \
+	Source/WebCore/Modules/webdatabase/DatabaseTracker.cpp \
+	Source/WebCore/Modules/webdatabase/DatabaseTracker.h \
+	Source/WebCore/Modules/webdatabase/OriginQuotaManager.cpp \
+	Source/WebCore/Modules/webdatabase/OriginQuotaManager.h \
+	Source/WebCore/Modules/webdatabase/OriginUsageRecord.cpp \
+	Source/WebCore/Modules/webdatabase/OriginUsageRecord.h \
+	Source/WebCore/Modules/webdatabase/SQLCallbackWrapper.h \
+	Source/WebCore/Modules/webdatabase/SQLError.h \
+	Source/WebCore/Modules/webdatabase/SQLException.cpp \
+	Source/WebCore/Modules/webdatabase/SQLException.h \
+	Source/WebCore/Modules/webdatabase/SQLResultSet.cpp \
+	Source/WebCore/Modules/webdatabase/SQLResultSet.h \
+	Source/WebCore/Modules/webdatabase/SQLResultSetRowList.cpp \
+	Source/WebCore/Modules/webdatabase/SQLResultSetRowList.h \
+	Source/WebCore/Modules/webdatabase/SQLStatementCallback.h \
+	Source/WebCore/Modules/webdatabase/SQLStatement.cpp \
+	Source/WebCore/Modules/webdatabase/SQLStatementErrorCallback.h \
+	Source/WebCore/Modules/webdatabase/SQLStatement.h \
+	Source/WebCore/Modules/webdatabase/SQLStatementSync.cpp \
+	Source/WebCore/Modules/webdatabase/SQLStatementSync.h \
+	Source/WebCore/Modules/webdatabase/SQLTransactionCallback.h \
+	Source/WebCore/Modules/webdatabase/SQLTransactionClient.cpp \
+	Source/WebCore/Modules/webdatabase/SQLTransactionClient.h \
+	Source/WebCore/Modules/webdatabase/SQLTransactionCoordinator.cpp \
+	Source/WebCore/Modules/webdatabase/SQLTransactionCoordinator.h \
+	Source/WebCore/Modules/webdatabase/SQLTransaction.cpp \
+	Source/WebCore/Modules/webdatabase/SQLTransactionErrorCallback.h \
+	Source/WebCore/Modules/webdatabase/SQLTransaction.h \
+	Source/WebCore/Modules/webdatabase/SQLTransactionSyncCallback.h \
+	Source/WebCore/Modules/webdatabase/SQLTransactionSync.cpp \
+	Source/WebCore/Modules/webdatabase/SQLTransactionSync.h \
+	Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.cpp \
+	Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.h \
+	Source/WebCore/Modules/websockets/CloseEvent.h \
+	Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp \
+	Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.h \
+	Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.cpp \
+	Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h \
+	Source/WebCore/Modules/websockets/WebSocketChannelClient.h \
+	Source/WebCore/Modules/websockets/WebSocketChannel.cpp \
+	Source/WebCore/Modules/websockets/WebSocketChannel.h \
+	Source/WebCore/Modules/websockets/WebSocket.cpp \
+	Source/WebCore/Modules/websockets/WebSocket.h \
+	Source/WebCore/Modules/websockets/WebSocketDeflateFramer.cpp \
+	Source/WebCore/Modules/websockets/WebSocketDeflateFramer.h \
+	Source/WebCore/Modules/websockets/WebSocketDeflater.cpp \
+	Source/WebCore/Modules/websockets/WebSocketDeflater.h \
+	Source/WebCore/Modules/websockets/WebSocketExtensionDispatcher.cpp \
+	Source/WebCore/Modules/websockets/WebSocketExtensionDispatcher.h \
+	Source/WebCore/Modules/websockets/WebSocketExtensionProcessor.h \
+	Source/WebCore/Modules/websockets/WebSocketFrame.h \
+	Source/WebCore/Modules/websockets/WebSocketHandshake.cpp \
+	Source/WebCore/Modules/websockets/WebSocketHandshake.h \
+	Source/WebCore/Modules/websockets/WebSocketHandshakeRequest.cpp \
+	Source/WebCore/Modules/websockets/WebSocketHandshakeRequest.h \
+	Source/WebCore/Modules/websockets/WebSocketHandshakeResponse.cpp \
+	Source/WebCore/Modules/websockets/WebSocketHandshakeResponse.h \
+	Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp \
+	Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h \
 	Source/WebCore/accessibility/AccessibilityARIAGridCell.cpp \
 	Source/WebCore/accessibility/AccessibilityARIAGridCell.h \
 	Source/WebCore/accessibility/AccessibilityARIAGrid.cpp \
@@ -1441,6 +1609,8 @@ webcore_sources += \
 	Source/WebCore/css/StyleMedia.h \
 	Source/WebCore/css/StylePropertySet.cpp \
 	Source/WebCore/css/StylePropertySet.h \
+	Source/WebCore/css/StyleRule.cpp \
+	Source/WebCore/css/StyleRule.h \
 	Source/WebCore/css/StyleSheet.cpp \
 	Source/WebCore/css/StyleSheet.h \
 	Source/WebCore/css/StyleSheetList.cpp \
@@ -1501,6 +1671,8 @@ webcore_sources += \
 	Source/WebCore/dom/ContainerNodeAlgorithms.h \
 	Source/WebCore/dom/ContainerNode.cpp \
 	Source/WebCore/dom/ContainerNode.h \
+	Source/WebCore/dom/ContextDestructionObserver.cpp \
+	Source/WebCore/dom/ContextDestructionObserver.h \
 	Source/WebCore/dom/CrossThreadTask.h \
 	Source/WebCore/dom/CustomEvent.cpp \
 	Source/WebCore/dom/CustomEvent.h \
@@ -1666,6 +1838,8 @@ webcore_sources += \
 	Source/WebCore/dom/RangeException.h \
 	Source/WebCore/dom/Range.h \
 	Source/WebCore/dom/RawDataDocumentParser.h \
+	Source/WebCore/dom/RegionNodeList.cpp \
+	Source/WebCore/dom/RegionNodeList.h \
 	Source/WebCore/dom/RegisteredEventListener.cpp \
 	Source/WebCore/dom/RegisteredEventListener.h \
 	Source/WebCore/dom/RenderedDocumentMarker.h \
@@ -1685,8 +1859,8 @@ webcore_sources += \
 	Source/WebCore/dom/SelectorQuery.h \
 	Source/WebCore/dom/ShadowRoot.cpp \
 	Source/WebCore/dom/ShadowRoot.h \
-	Source/WebCore/dom/ShadowRootList.cpp \
-	Source/WebCore/dom/ShadowRootList.h \
+	Source/WebCore/dom/ShadowTree.cpp \
+	Source/WebCore/dom/ShadowTree.h \
 	Source/WebCore/dom/SpaceSplitString.cpp \
 	Source/WebCore/dom/SpaceSplitString.h \
 	Source/WebCore/dom/StaticHashSetNodeList.cpp \
@@ -1857,6 +2031,8 @@ webcore_sources += \
 	Source/WebCore/editing/WrapContentsInDummySpanCommand.cpp \
 	Source/WebCore/editing/WrapContentsInDummySpanCommand.h \
 	Source/WebCore/editing/WritingDirection.h \
+	Source/WebCore/fileapi/AsyncFileStream.cpp \
+	Source/WebCore/fileapi/AsyncFileStream.h \
 	Source/WebCore/fileapi/AsyncFileWriter.h \
 	Source/WebCore/fileapi/AsyncFileWriterClient.h \
 	Source/WebCore/fileapi/Blob.cpp \
@@ -1914,8 +2090,6 @@ webcore_sources += \
 	Source/WebCore/fileapi/FileReaderLoaderClient.h \
 	Source/WebCore/fileapi/FileReaderSync.cpp \
 	Source/WebCore/fileapi/FileReaderSync.h \
-	Source/WebCore/fileapi/FileStreamProxy.cpp \
-	Source/WebCore/fileapi/FileStreamProxy.h \
 	Source/WebCore/fileapi/FileSystemCallback.h \
 	Source/WebCore/fileapi/FileSystemCallbacks.cpp \
 	Source/WebCore/fileapi/FileSystemCallbacks.h \
@@ -1941,6 +2115,8 @@ webcore_sources += \
 	Source/WebCore/fileapi/ThreadableBlobRegistry.h \
 	Source/WebCore/fileapi/WebKitBlobBuilder.cpp \
 	Source/WebCore/fileapi/WebKitBlobBuilder.h \
+	Source/WebCore/fileapi/WorkerContextFileSystem.cpp \
+	Source/WebCore/fileapi/WorkerContextFileSystem.h \
 	Source/WebCore/history/BackForwardController.cpp \
 	Source/WebCore/history/BackForwardController.h \
 	Source/WebCore/history/BackForwardList.h \
@@ -1959,6 +2135,8 @@ webcore_sources += \
 	Source/WebCore/html/BaseButtonInputType.h \
 	Source/WebCore/html/BaseCheckableInputType.cpp \
 	Source/WebCore/html/BaseCheckableInputType.h \
+	Source/WebCore/html/BaseClickableWithKeyInputType.cpp \
+	Source/WebCore/html/BaseClickableWithKeyInputType.h \
 	Source/WebCore/html/BaseDateAndTimeInputType.cpp \
 	Source/WebCore/html/BaseDateAndTimeInputType.h \
 	Source/WebCore/html/BaseTextInputType.cpp \
@@ -2199,6 +2377,8 @@ webcore_sources += \
 	Source/WebCore/html/ImageInputType.h \
 	Source/WebCore/html/InputType.cpp \
 	Source/WebCore/html/InputType.h \
+	Source/WebCore/html/LabelableElement.cpp \
+	Source/WebCore/html/LabelableElement.h \
 	Source/WebCore/html/LabelsNodeList.cpp \
 	Source/WebCore/html/LabelsNodeList.h \
 	Source/WebCore/html/LinkRelAttribute.cpp \
@@ -2640,41 +2820,14 @@ webcore_sources += \
 	Source/WebCore/mathml/MathMLMathElement.h \
 	Source/WebCore/mathml/MathMLTextElement.cpp \
 	Source/WebCore/mathml/MathMLTextElement.h \
-	Source/WebCore/mediastream/LocalMediaStream.cpp \
-	Source/WebCore/mediastream/LocalMediaStream.h \
-	Source/WebCore/mediastream/MediaStream.cpp \
-	Source/WebCore/mediastream/MediaStream.h \
-	Source/WebCore/mediastream/MediaStreamEvent.cpp \
-	Source/WebCore/mediastream/MediaStreamEvent.h \
-	Source/WebCore/mediastream/MediaStreamList.cpp \
-	Source/WebCore/mediastream/MediaStreamList.h \
-	Source/WebCore/mediastream/MediaStreamRegistry.cpp \
-	Source/WebCore/mediastream/MediaStreamRegistry.h \
-	Source/WebCore/mediastream/MediaStreamTrack.cpp \
-	Source/WebCore/mediastream/MediaStreamTrack.h \
-	Source/WebCore/mediastream/MediaStreamTrackList.cpp \
-	Source/WebCore/mediastream/MediaStreamTrackList.h \
-	Source/WebCore/mediastream/NavigatorMediaStream.cpp \
-	Source/WebCore/mediastream/NavigatorMediaStream.h \
-	Source/WebCore/mediastream/NavigatorUserMediaError.h \
-	Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.h \
-	Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.h \
-	Source/WebCore/mediastream/PeerConnection.cpp \
-	Source/WebCore/mediastream/PeerConnection.h \
-	Source/WebCore/mediastream/SignalingCallback.h \
-	Source/WebCore/mediastream/UserMediaClient.h \
-	Source/WebCore/mediastream/UserMediaController.h \
-	Source/WebCore/mediastream/UserMediaController.cpp \
-	Source/WebCore/mediastream/UserMediaRequest.cpp \
-	Source/WebCore/mediastream/UserMediaRequest.h \
 	Source/WebCore/notifications/NotificationCenter.cpp \
 	Source/WebCore/notifications/NotificationCenter.h \
+	Source/WebCore/notifications/NotificationClient.h \
 	Source/WebCore/notifications/NotificationContents.h \
 	Source/WebCore/notifications/NotificationController.cpp \
 	Source/WebCore/notifications/NotificationController.h \
 	Source/WebCore/notifications/Notification.cpp \
 	Source/WebCore/notifications/Notification.h \
-	Source/WebCore/notifications/NotificationPresenter.h \
 	Source/WebCore/page/animation/AnimationBase.cpp \
 	Source/WebCore/page/animation/AnimationBase.h \
 	Source/WebCore/page/animation/AnimationController.cpp \
@@ -2756,8 +2909,6 @@ webcore_sources += \
 	Source/WebCore/page/NavigatorBase.h \
 	Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp \
 	Source/WebCore/page/NavigatorRegisterProtocolHandler.h \
-	Source/WebCore/page/NavigatorSupplement.cpp \
-	Source/WebCore/page/NavigatorSupplement.h \
 	Source/WebCore/page/OriginAccessEntry.cpp \
 	Source/WebCore/page/OriginAccessEntry.h \
 	Source/WebCore/page/Page.cpp \
@@ -2768,8 +2919,6 @@ webcore_sources += \
 	Source/WebCore/page/PageGroupLoadDeferrer.h \
 	Source/WebCore/page/PageSerializer.cpp \
 	Source/WebCore/page/PageSerializer.h \
-	Source/WebCore/page/PageSupplement.cpp \
-	Source/WebCore/page/PageSupplement.h \
 	Source/WebCore/page/PageVisibilityState.cpp \
 	Source/WebCore/page/PageVisibilityState.h \
 	Source/WebCore/page/Performance.cpp \
@@ -2788,6 +2937,8 @@ webcore_sources += \
 	Source/WebCore/page/scrolling/ScrollingCoordinator.cpp \
 	Source/WebCore/page/scrolling/ScrollingCoordinator.h \
 	Source/WebCore/page/scrolling/ScrollingCoordinatorNone.cpp \
+	Source/WebCore/page/scrolling/ScrollingTreeState.cpp \
+	Source/WebCore/page/scrolling/ScrollingTreeState.h \
 	Source/WebCore/page/SecurityOrigin.cpp \
 	Source/WebCore/page/SecurityOrigin.h \
 	Source/WebCore/page/SecurityOriginHash.h \
@@ -2834,7 +2985,6 @@ webcore_sources += \
 	Source/WebCore/platform/animation/TimingFunction.h \
 	Source/WebCore/platform/Arena.cpp \
 	Source/WebCore/platform/Arena.h \
-	Source/WebCore/platform/AsyncFileStream.h \
 	Source/WebCore/platform/AsyncFileSystem.cpp \
 	Source/WebCore/platform/AsyncFileSystem.h \
 	Source/WebCore/platform/AutodrainedPool.h \
@@ -3129,6 +3279,8 @@ webcore_sources += \
 	Source/WebCore/platform/KURL.cpp \
 	Source/WebCore/platform/KURL.h \
 	Source/WebCore/platform/KURLHash.h \
+	Source/WebCore/platform/KURLWTFURL.cpp \
+	Source/WebCore/platform/KURLWTFURLImpl.h \
 	Source/WebCore/platform/Language.cpp \
 	Source/WebCore/platform/Language.h \
 	Source/WebCore/platform/LengthBox.h \
@@ -3269,6 +3421,7 @@ webcore_sources += \
 	Source/WebCore/platform/PlatformEvent.cpp \
 	Source/WebCore/platform/PlatformEvent.h \
 	Source/WebCore/platform/PlatformExportMacros.h \
+	Source/WebCore/platform/PlatformGestureEvent.h \
 	Source/WebCore/platform/PlatformKeyboardEvent.h \
 	Source/WebCore/platform/PlatformMenuDescription.h \
 	Source/WebCore/platform/PlatformMouseEvent.h \
@@ -3292,10 +3445,13 @@ webcore_sources += \
 	Source/WebCore/platform/SchemeRegistry.h \
 	Source/WebCore/platform/ScrollAnimator.cpp \
 	Source/WebCore/platform/ScrollAnimator.h \
+	Source/WebCore/platform/ScrollAnimatorNone.cpp \
+	Source/WebCore/platform/ScrollAnimatorNone.h \
 	Source/WebCore/platform/ScrollableArea.cpp \
 	Source/WebCore/platform/ScrollableArea.h \
 	Source/WebCore/platform/Scrollbar.cpp \
 	Source/WebCore/platform/Scrollbar.h \
+	Source/WebCore/platform/ScrollbarThemeClient.h \
 	Source/WebCore/platform/ScrollbarThemeComposite.cpp \
 	Source/WebCore/platform/ScrollbarThemeComposite.h \
 	Source/WebCore/platform/ScrollbarTheme.cpp \
@@ -3324,6 +3480,7 @@ webcore_sources += \
 	Source/WebCore/platform/sql/SQLValue.h \
 	Source/WebCore/platform/SSLKeyGenerator.h \
 	Source/WebCore/platform/SuddenTermination.h \
+	Source/WebCore/platform/Supplementable.h \
 	Source/WebCore/platform/SystemTime.h \
 	Source/WebCore/platform/text/Base64.cpp \
 	Source/WebCore/platform/text/Base64.h \
@@ -3489,8 +3646,6 @@ webcore_sources += \
 	Source/WebCore/rendering/RenderCounter.h \
 	Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp \
 	Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h \
-	Source/WebCore/rendering/RenderDetails.cpp \
-	Source/WebCore/rendering/RenderDetails.h \
 	Source/WebCore/rendering/RenderDetailsMarker.cpp \
 	Source/WebCore/rendering/RenderDetailsMarker.h \
 	Source/WebCore/rendering/RenderEmbeddedObject.cpp \
@@ -3580,8 +3735,6 @@ webcore_sources += \
 	Source/WebCore/rendering/RenderSelectionInfo.h \
 	Source/WebCore/rendering/RenderSlider.cpp \
 	Source/WebCore/rendering/RenderSlider.h \
-	Source/WebCore/rendering/RenderSummary.cpp \
-	Source/WebCore/rendering/RenderSummary.h \
 	Source/WebCore/rendering/RenderTableCaption.cpp \
 	Source/WebCore/rendering/RenderTableCaption.h \
 	Source/WebCore/rendering/RenderTableCell.cpp \
@@ -3688,6 +3841,8 @@ webcore_sources += \
 	Source/WebCore/rendering/style/StyleGeneratedImage.h \
 	Source/WebCore/rendering/style/StyleGridData.cpp \
 	Source/WebCore/rendering/style/StyleGridData.h \
+	Source/WebCore/rendering/style/StyleGridItemData.cpp \
+	Source/WebCore/rendering/style/StyleGridItemData.h \
 	Source/WebCore/rendering/style/StyleImage.h \
 	Source/WebCore/rendering/style/StyleInheritedData.cpp \
 	Source/WebCore/rendering/style/StyleInheritedData.h \
@@ -3761,8 +3916,6 @@ webcore_sources += \
 	Source/WebCore/rendering/svg/RenderSVGResourceSolidColor.h \
 	Source/WebCore/rendering/svg/RenderSVGRoot.cpp \
 	Source/WebCore/rendering/svg/RenderSVGRoot.h \
-	Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.cpp \
-	Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.h \
 	Source/WebCore/rendering/svg/RenderSVGShape.cpp \
 	Source/WebCore/rendering/svg/RenderSVGShape.h \
 	Source/WebCore/rendering/svg/RenderSVGTSpan.cpp \
@@ -3790,6 +3943,8 @@ webcore_sources += \
 	Source/WebCore/rendering/svg/SVGRenderSupport.h \
 	Source/WebCore/rendering/svg/SVGRenderTreeAsText.cpp \
 	Source/WebCore/rendering/svg/SVGRenderTreeAsText.h \
+	Source/WebCore/rendering/svg/SVGRenderingContext.cpp \
+	Source/WebCore/rendering/svg/SVGRenderingContext.h \
 	Source/WebCore/rendering/svg/SVGResourcesCache.cpp \
 	Source/WebCore/rendering/svg/SVGResourcesCache.h \
 	Source/WebCore/rendering/svg/SVGResources.cpp \
@@ -3798,8 +3953,6 @@ webcore_sources += \
 	Source/WebCore/rendering/svg/SVGResources.h \
 	Source/WebCore/rendering/svg/SVGRootInlineBox.cpp \
 	Source/WebCore/rendering/svg/SVGRootInlineBox.h \
-	Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp \
-	Source/WebCore/rendering/svg/SVGShadowTreeElements.h \
 	Source/WebCore/rendering/svg/SVGSubpathData.h \
 	Source/WebCore/rendering/svg/SVGTextChunk.cpp \
 	Source/WebCore/rendering/svg/SVGTextChunk.h \
@@ -3826,116 +3979,10 @@ webcore_sources += \
 	Source/WebCore/rendering/svg/SVGTextRunRenderingContext.h \
 	Source/WebCore/rendering/TableLayout.h \
 	Source/WebCore/rendering/TrailingFloatsRootInlineBox.h \
-	Source/WebCore/storage/AbstractDatabase.cpp \
-	Source/WebCore/storage/AbstractDatabase.h \
-	Source/WebCore/storage/ChangeVersionWrapper.cpp \
-	Source/WebCore/storage/ChangeVersionWrapper.h \
-	Source/WebCore/storage/DOMWindowSQLDatabase.cpp \
-	Source/WebCore/storage/DOMWindowSQLDatabase.h \
-	Source/WebCore/storage/DatabaseAuthorizer.cpp \
-	Source/WebCore/storage/DatabaseAuthorizer.h \
-	Source/WebCore/storage/DatabaseCallback.h \
-	Source/WebCore/storage/Database.cpp \
-	Source/WebCore/storage/DatabaseDetails.h \
-	Source/WebCore/storage/Database.h \
-	Source/WebCore/storage/DatabaseSync.cpp \
-	Source/WebCore/storage/DatabaseSync.h \
-	Source/WebCore/storage/DatabaseTask.cpp \
-	Source/WebCore/storage/DatabaseTask.h \
-	Source/WebCore/storage/DatabaseThread.cpp \
-	Source/WebCore/storage/DatabaseThread.h \
-	Source/WebCore/storage/DatabaseTrackerClient.h \
-	Source/WebCore/storage/DatabaseTracker.cpp \
-	Source/WebCore/storage/DatabaseTracker.h \
-	Source/WebCore/storage/IDBAny.cpp \
-	Source/WebCore/storage/IDBAny.h \
-	Source/WebCore/storage/IDBBackingStore.h \
-	Source/WebCore/storage/IDBCallbacks.h \
-	Source/WebCore/storage/IDBCursorBackendImpl.cpp \
-	Source/WebCore/storage/IDBCursorBackendImpl.h \
-	Source/WebCore/storage/IDBCursorBackendInterface.h \
-	Source/WebCore/storage/IDBCursor.cpp \
-	Source/WebCore/storage/IDBCursor.h \
-	Source/WebCore/storage/IDBDatabaseBackendImpl.cpp \
-	Source/WebCore/storage/IDBDatabaseBackendImpl.h \
-	Source/WebCore/storage/IDBDatabaseBackendInterface.h \
-	Source/WebCore/storage/IDBDatabaseCallbacks.h \
-	Source/WebCore/storage/IDBDatabaseCallbacksImpl.h \
-	Source/WebCore/storage/IDBDatabase.cpp \
-	Source/WebCore/storage/IDBDatabaseError.h \
-	Source/WebCore/storage/IDBDatabaseException.cpp \
-	Source/WebCore/storage/IDBDatabaseException.h \
-	Source/WebCore/storage/IDBDatabase.h \
-	Source/WebCore/storage/IDBEventDispatcher.cpp \
-	Source/WebCore/storage/IDBEventDispatcher.h \
-	Source/WebCore/storage/IDBFactoryBackendImpl.cpp \
-	Source/WebCore/storage/IDBFactoryBackendImpl.h \
-	Source/WebCore/storage/IDBFactoryBackendInterface.cpp \
-	Source/WebCore/storage/IDBFactoryBackendInterface.h \
-	Source/WebCore/storage/IDBFactory.cpp \
-	Source/WebCore/storage/IDBFactory.h \
-	Source/WebCore/storage/IDBIndexBackendImpl.cpp \
-	Source/WebCore/storage/IDBIndexBackendImpl.h \
-	Source/WebCore/storage/IDBIndexBackendInterface.h \
-	Source/WebCore/storage/IDBIndexBackendInterface.h \
-	Source/WebCore/storage/IDBIndex.cpp \
-	Source/WebCore/storage/IDBIndex.h \
-	Source/WebCore/storage/IDBKey.h \
-	Source/WebCore/storage/IDBKeyPath.h \
-	Source/WebCore/storage/IDBKeyPathBackendImpl.h \
-	Source/WebCore/storage/IDBKeyRange.cpp \
-	Source/WebCore/storage/IDBKeyRange.h \
-	Source/WebCore/storage/IDBLevelDBBackingStore.cpp \
-	Source/WebCore/storage/IDBLevelDBBackingStore.h \
-	Source/WebCore/storage/IDBLevelDBCoding.cpp \
-	Source/WebCore/storage/IDBLevelDBCoding.h \
-	Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp \
-	Source/WebCore/storage/IDBObjectStoreBackendImpl.h \
-	Source/WebCore/storage/IDBObjectStoreBackendInterface.h \
-	Source/WebCore/storage/IDBObjectStoreBackendInterface.h \
-	Source/WebCore/storage/IDBObjectStore.cpp \
-	Source/WebCore/storage/IDBObjectStore.h \
-	Source/WebCore/storage/IDBRequest.cpp \
-	Source/WebCore/storage/IDBRequest.h \
-	Source/WebCore/storage/IDBTransactionBackendInterface.h \
-	Source/WebCore/storage/IDBTransactionCoordinator.h \
-	Source/WebCore/storage/IDBTransaction.cpp \
-	Source/WebCore/storage/IDBTransaction.h \
-	Source/WebCore/storage/IDBVersionChangeEvent.h \
-	Source/WebCore/storage/IDBVersionChangeRequest.h \
 	Source/WebCore/storage/StorageTask.cpp \
 	Source/WebCore/storage/StorageTask.h \
 	Source/WebCore/storage/StorageThread.cpp \
 	Source/WebCore/storage/StorageThread.h \
-	Source/WebCore/storage/OriginQuotaManager.cpp \
-	Source/WebCore/storage/OriginQuotaManager.h \
-	Source/WebCore/storage/OriginUsageRecord.cpp \
-	Source/WebCore/storage/OriginUsageRecord.h \
-	Source/WebCore/storage/SQLCallbackWrapper.h \
-	Source/WebCore/storage/SQLError.h \
-	Source/WebCore/storage/SQLException.cpp \
-	Source/WebCore/storage/SQLException.h \
-	Source/WebCore/storage/SQLResultSet.cpp \
-	Source/WebCore/storage/SQLResultSet.h \
-	Source/WebCore/storage/SQLResultSetRowList.cpp \
-	Source/WebCore/storage/SQLResultSetRowList.h \
-	Source/WebCore/storage/SQLStatementCallback.h \
-	Source/WebCore/storage/SQLStatement.cpp \
-	Source/WebCore/storage/SQLStatementErrorCallback.h \
-	Source/WebCore/storage/SQLStatement.h \
-	Source/WebCore/storage/SQLStatementSync.cpp \
-	Source/WebCore/storage/SQLStatementSync.h \
-	Source/WebCore/storage/SQLTransactionCallback.h \
-	Source/WebCore/storage/SQLTransactionClient.cpp \
-	Source/WebCore/storage/SQLTransactionClient.h \
-	Source/WebCore/storage/SQLTransactionCoordinator.cpp \
-	Source/WebCore/storage/SQLTransactionCoordinator.h \
-	Source/WebCore/storage/SQLTransaction.cpp \
-	Source/WebCore/storage/SQLTransactionErrorCallback.h \
-	Source/WebCore/storage/SQLTransaction.h \
-	Source/WebCore/storage/SQLTransactionSyncCallback.h \
-	Source/WebCore/storage/SQLTransactionSync.cpp \
-	Source/WebCore/storage/SQLTransactionSync.h \
 	Source/WebCore/storage/StorageArea.h \
 	Source/WebCore/storage/StorageAreaImpl.cpp \
 	Source/WebCore/storage/StorageAreaImpl.h \
@@ -4339,30 +4386,6 @@ webcore_sources += \
 	Source/WebCore/svg/SVGZoomEvent.cpp \
 	Source/WebCore/svg/SVGZoomEvent.h \
 	Source/WebCore/WebCorePrefix.h \
-	Source/WebCore/websockets/CloseEvent.h \
-	Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.cpp \
-	Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h \
-	Source/WebCore/websockets/ThreadableWebSocketChannel.cpp \
-	Source/WebCore/websockets/ThreadableWebSocketChannel.h \
-	Source/WebCore/websockets/WebSocketChannelClient.h \
-	Source/WebCore/websockets/WebSocketChannel.cpp \
-	Source/WebCore/websockets/WebSocketChannel.h \
-	Source/WebCore/websockets/WebSocket.cpp \
-	Source/WebCore/websockets/WebSocket.h \
-	Source/WebCore/websockets/WebSocketDeflater.cpp \
-	Source/WebCore/websockets/WebSocketDeflater.h \
-	Source/WebCore/websockets/WebSocketExtensionDispatcher.cpp \
-	Source/WebCore/websockets/WebSocketExtensionDispatcher.h \
-	Source/WebCore/websockets/WebSocketExtensionProcessor.h \
-	Source/WebCore/websockets/WebSocketFrame.h \
-	Source/WebCore/websockets/WebSocketHandshake.cpp \
-	Source/WebCore/websockets/WebSocketHandshake.h \
-	Source/WebCore/websockets/WebSocketHandshakeRequest.cpp \
-	Source/WebCore/websockets/WebSocketHandshakeRequest.h \
-	Source/WebCore/websockets/WebSocketHandshakeResponse.cpp \
-	Source/WebCore/websockets/WebSocketHandshakeResponse.h \
-	Source/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp \
-	Source/WebCore/websockets/WorkerThreadableWebSocketChannel.h \
 	Source/WebCore/workers/AbstractWorker.cpp \
 	Source/WebCore/workers/AbstractWorker.h \
 	Source/WebCore/workers/DedicatedWorkerContext.cpp \
@@ -4521,6 +4544,8 @@ webcoregtk_sources += \
 	Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.h \
 	Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.cpp \
 	Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.h \
+	Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.cpp \
+	Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.h \
 	Source/WebCore/platform/graphics/gstreamer/ImageGStreamerCairo.cpp \
 	Source/WebCore/platform/graphics/gstreamer/ImageGStreamer.h \
 	Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp \
@@ -4609,6 +4634,9 @@ webcoregtk_sources += \
 
 if TARGET_X11
 webcoregtk_sources += \
+	Source/WebCore/platform/graphics/glx/GLContextGLX.cpp \
+	Source/WebCore/platform/graphics/gtk/GLContextGtk.cpp \
+	Source/WebCore/platform/graphics/cairo/GLContext.h \
 	Source/WebCore/platform/gtk/GtkWidgetBackingStoreX11.cpp \
 	Source/WebCore/plugins/gtk/gtk2xtbin.c \
 	Source/WebCore/plugins/gtk/gtk2xtbin.h \
@@ -4710,21 +4738,22 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSSQLTransactionSyncCallback.h
 
 dom_binding_idls += \
-	$(WebCore)/storage/DOMWindowSQLDatabase.idl \
-	$(WebCore)/storage/Database.idl \
-	$(WebCore)/storage/DatabaseCallback.idl \
-	$(WebCore)/storage/DatabaseSync.idl \
-	$(WebCore)/storage/SQLError.idl \
-	$(WebCore)/storage/SQLException.idl \
-	$(WebCore)/storage/SQLResultSet.idl \
-	$(WebCore)/storage/SQLResultSetRowList.idl \
-	$(WebCore)/storage/SQLStatementCallback.idl \
-	$(WebCore)/storage/SQLStatementErrorCallback.idl \
-	$(WebCore)/storage/SQLTransaction.idl \
-	$(WebCore)/storage/SQLTransactionCallback.idl \
-	$(WebCore)/storage/SQLTransactionErrorCallback.idl \
-	$(WebCore)/storage/SQLTransactionSync.idl \
-	$(WebCore)/storage/SQLTransactionSyncCallback.idl
+	$(WebCore)/Modules/webdatabase/DOMWindowSQLDatabase.idl \
+	$(WebCore)/Modules/webdatabase/Database.idl \
+	$(WebCore)/Modules/webdatabase/DatabaseCallback.idl \
+	$(WebCore)/Modules/webdatabase/DatabaseSync.idl \
+	$(WebCore)/Modules/webdatabase/SQLError.idl \
+	$(WebCore)/Modules/webdatabase/SQLException.idl \
+	$(WebCore)/Modules/webdatabase/SQLResultSet.idl \
+	$(WebCore)/Modules/webdatabase/SQLResultSetRowList.idl \
+	$(WebCore)/Modules/webdatabase/SQLStatementCallback.idl \
+	$(WebCore)/Modules/webdatabase/SQLStatementErrorCallback.idl \
+	$(WebCore)/Modules/webdatabase/SQLTransaction.idl \
+	$(WebCore)/Modules/webdatabase/SQLTransactionCallback.idl \
+	$(WebCore)/Modules/webdatabase/SQLTransactionErrorCallback.idl \
+	$(WebCore)/Modules/webdatabase/SQLTransactionSync.idl \
+	$(WebCore)/Modules/webdatabase/SQLTransactionSyncCallback.idl \
+	$(WebCore)/Modules/webdatabase/WorkerContextSQLDatabase.idl
 endif # END ENABLE_SQL_DATABASE
 
 # ----
@@ -4778,16 +4807,18 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSIDBTransaction.h
 
 dom_binding_idls += \
-	$(WebCore)/storage/IDBAny.idl \
-	$(WebCore)/storage/IDBDatabase.idl \
-	$(WebCore)/storage/IDBDatabaseError.idl \
-	$(WebCore)/storage/IDBDatabaseException.idl \
-	$(WebCore)/storage/IDBFactory.idl \
-	$(WebCore)/storage/IDBIndex.idl \
-	$(WebCore)/storage/IDBKeyRange.idl \
-	$(WebCore)/storage/IDBObjectStore.idl \
-	$(WebCore)/storage/IDBRequest.idl \
-	$(WebCore)/storage/IDBTransaction.idl
+	$(WebCore)/Modules/indexeddb/DOMWindowIndexedDatabase.idl \
+	$(WebCore)/Modules/indexeddb/IDBAny.idl \
+	$(WebCore)/Modules/indexeddb/IDBDatabase.idl \
+	$(WebCore)/Modules/indexeddb/IDBDatabaseError.idl \
+	$(WebCore)/Modules/indexeddb/IDBDatabaseException.idl \
+	$(WebCore)/Modules/indexeddb/IDBFactory.idl \
+	$(WebCore)/Modules/indexeddb/IDBIndex.idl \
+	$(WebCore)/Modules/indexeddb/IDBKeyRange.idl \
+	$(WebCore)/Modules/indexeddb/IDBObjectStore.idl \
+	$(WebCore)/Modules/indexeddb/IDBRequest.idl \
+	$(WebCore)/Modules/indexeddb/IDBTransaction.idl \
+	$(WebCore)/Modules/indexeddb/WorkerContextIndexedDatabase.idl
 endif # END ENABLE_INDEXED_DATABASE
 
 # ----
@@ -4863,7 +4894,8 @@ dom_binding_idls += \
 	$(WebCore)/fileapi/FileWriterCallback.idl \
 	$(WebCore)/fileapi/FileWriterSync.idl \
 	$(WebCore)/fileapi/Metadata.idl \
-	$(WebCore)/fileapi/MetadataCallback.idl
+	$(WebCore)/fileapi/MetadataCallback.idl \
+	$(WebCore)/fileapi/WorkerContextFileSystem.idl
 
 webcoregtk_sources += \
 	Source/WebCore/platform/gtk/AsyncFileSystemGtk.cpp \
@@ -5172,7 +5204,6 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSSVGZoomEvent.h
 
 dom_binding_idls += \
-	$(WebCore)/svg/DOMWindowSVG.idl \
 	$(WebCore)/svg/SVGAElement.idl \
 	$(WebCore)/svg/SVGAltGlyphDefElement.idl \
 	$(WebCore)/svg/SVGAltGlyphElement.idl \
@@ -5333,6 +5364,7 @@ webcore_sources += \
 	Source/WebCore/webaudio/AudioBasicProcessorNode.h \
 	Source/WebCore/webaudio/AudioBuffer.cpp \
 	Source/WebCore/webaudio/AudioBuffer.h \
+	Source/WebCore/webaudio/AudioBufferCallback.h \
 	Source/WebCore/webaudio/AudioBufferSourceNode.cpp \
 	Source/WebCore/webaudio/AudioBufferSourceNode.h \
 	Source/WebCore/webaudio/AudioChannelMerger.cpp \
@@ -5426,6 +5458,7 @@ webcore_sources += \
 	Source/WebCore/platform/audio/Biquad.h \
 	Source/WebCore/platform/audio/Cone.cpp \
 	Source/WebCore/platform/audio/Cone.h \
+	Source/WebCore/platform/audio/DenormalDisabler.h \
 	Source/WebCore/platform/audio/Distance.cpp \
 	Source/WebCore/platform/audio/Distance.h \
 	Source/WebCore/platform/audio/DynamicsCompressor.h \
@@ -5560,9 +5593,9 @@ webcore_built_sources += \
 	DerivedSources/WebCore/JSWebSocket.h
 
 dom_binding_idls += \
-	$(WebCore)/websockets/CloseEvent.idl \
-	$(WebCore)/websockets/DOMWindowWebSocket.idl \
-	$(WebCore)/websockets/WebSocket.idl
+	$(WebCore)/Modules/websockets/CloseEvent.idl \
+	$(WebCore)/Modules/websockets/DOMWindowWebSocket.idl \
+	$(WebCore)/Modules/websockets/WebSocket.idl
 endif  # END ENABLE_WEB_SOCKETS
 
 # ---
@@ -5710,6 +5743,8 @@ webcore_sources += \
 	Source/WebCore/html/canvas/WebGLVertexArrayObjectOES.h \
 	Source/WebCore/html/canvas/WebGLExtension.cpp \
 	Source/WebCore/html/canvas/WebGLExtension.h \
+	Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.cpp \
+	Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.h \
 	Source/WebCore/html/canvas/OESStandardDerivatives.cpp \
 	Source/WebCore/html/canvas/OESStandardDerivatives.h \
 	Source/WebCore/html/canvas/OESTextureFloat.cpp \
@@ -5720,8 +5755,8 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/ANGLEWebKitBridge.h \
 	Source/WebCore/platform/graphics/cairo/DrawingBufferCairo.cpp \
 	Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp \
-	Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.cpp \
-	Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.h \
+	Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.cpp \
+	Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.h \
 	Source/WebCore/platform/graphics/gpu/DrawingBuffer.cpp \
 	Source/WebCore/platform/graphics/gpu/DrawingBuffer.h \
 	Source/WebCore/platform/graphics/GraphicsContext3D.cpp \
@@ -5818,9 +5853,6 @@ webcore_sources += \
 	Source/WebCore/platform/graphics/texmap/TextureMapperLayer.cpp \
 	Source/WebCore/platform/graphics/texmap/TextureMapperLayer.h \
 	Source/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
-webcoregtk_sources += \
-	Source/WebCore/platform/graphics/gtk/WindowGLContextGLX.cpp \
-	Source/WebCore/platform/graphics/gtk/WindowGLContext.h
 endif  # END USE_TEXTURE_MAPPER_GL
 endif  # USE_ACCELERATED_COMPOSITING
 
diff --git a/Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp b/Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp
index 95cd602a2..9ad62ad9c 100644
--- a/Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp
+++ b/Source/WebCore/Modules/gamepad/NavigatorGamepad.cpp
@@ -46,7 +46,7 @@ NavigatorGamepad::~NavigatorGamepad()
 NavigatorGamepad* NavigatorGamepad::from(Navigator* navigator)
 {
     DEFINE_STATIC_LOCAL(AtomicString, name, ("NavigatorGamepad"));
-    NavigatorGamepad* supplement = static_cast<NavigatorGamepad*>(NavigatorSupplement::from(navigator, name));
+    NavigatorGamepad* supplement = static_cast<NavigatorGamepad*>(Supplement<Navigator>::from(navigator, name));
     if (!supplement) {
         supplement = new NavigatorGamepad();
         provideTo(navigator, name, adoptPtr(supplement));
diff --git a/Source/WebCore/Modules/gamepad/NavigatorGamepad.h b/Source/WebCore/Modules/gamepad/NavigatorGamepad.h
index 0ab51b594..87e4d8ae8 100644
--- a/Source/WebCore/Modules/gamepad/NavigatorGamepad.h
+++ b/Source/WebCore/Modules/gamepad/NavigatorGamepad.h
@@ -28,14 +28,14 @@
 
 #if ENABLE(GAMEPAD)
 
-#include "NavigatorSupplement.h"
+#include "Supplementable.h"
 
 namespace WebCore {
 
 class GamepadList;
 class Navigator;
 
-class NavigatorGamepad : public NavigatorSupplement {
+class NavigatorGamepad : public Supplement<Navigator> {
 public:
     virtual ~NavigatorGamepad();
     static NavigatorGamepad* from(Navigator*);
diff --git a/Source/WebCore/Modules/geolocation/Geolocation.cpp b/Source/WebCore/Modules/geolocation/Geolocation.cpp
index ae1f4fcbc..a689a1812 100644
--- a/Source/WebCore/Modules/geolocation/Geolocation.cpp
+++ b/Source/WebCore/Modules/geolocation/Geolocation.cpp
@@ -225,38 +225,57 @@ void Geolocation::Watchers::getNotifiersVector(GeoNotifierVector& copy) const
     copyValuesToVector(m_idToNotifierMap, copy);
 }
 
-Geolocation::Geolocation(Frame* frame)
-    : DOMWindowProperty(frame)
+PassRefPtr<Geolocation> Geolocation::create(ScriptExecutionContext* context)
+{
+    RefPtr<Geolocation> geolocation = adoptRef(new Geolocation(context));
+    geolocation->suspendIfNeeded();
+    return geolocation.release();
+}
+
+Geolocation::Geolocation(ScriptExecutionContext* context)
+    : ActiveDOMObject(context, this)
 #if !ENABLE(CLIENT_BASED_GEOLOCATION)
     , m_service(GeolocationService::create(this))
 #endif
     , m_allowGeolocation(Unknown)
 {
-    if (!m_frame)
-        return;
-    ASSERT(m_frame->document());
-    m_frame->document()->setUsingGeolocation(true);
 }
 
 Geolocation::~Geolocation()
 {
     ASSERT(m_allowGeolocation != InProgress);
-    ASSERT(!m_frame);
+}
+
+Document* Geolocation::document() const
+{
+    ASSERT(!scriptExecutionContext() || scriptExecutionContext()->isDocument());
+    return static_cast<Document*>(scriptExecutionContext());
+}
+
+Frame* Geolocation::frame() const
+{
+    return document() ? document()->frame() : 0;
 }
 
 Page* Geolocation::page() const
 {
-    return m_frame ? m_frame->page() : 0;
+    return document() ? document()->page() : 0;
 }
 
-void Geolocation::reset()
+void Geolocation::stop()
 {
+    // FIXME: We should ideally allow existing Geolocation activities to continue
+    // when the Geolocation's iframe is reparented. (Assuming we continue to
+    // support reparenting iframes.)
+    // See https://bugs.webkit.org/show_bug.cgi?id=55577
+    // and https://bugs.webkit.org/show_bug.cgi?id=52877
+
     Page* page = this->page();
     if (page && m_allowGeolocation == InProgress) {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
         page->geolocationController()->cancelPermissionRequest(this);
 #else
-        page->chrome()->client()->cancelGeolocationPermissionRequestForFrame(m_frame, this);
+        page->chrome()->client()->cancelGeolocationPermissionRequestForFrame(frame(), this);
 #endif
     }
     // The frame may be moving to a new page and we want to get the permissions from the new page's client.
@@ -268,15 +287,6 @@ void Geolocation::reset()
 #endif
 }
 
-void Geolocation::disconnectFrame()
-{
-    // Once we are disconnected from the Frame, it is no longer possible to perform any operations.
-    reset();
-    if (m_frame && m_frame->document())
-        m_frame->document()->setUsingGeolocation(false);
-    DOMWindowProperty::disconnectFrame();
-}
-
 Geoposition* Geolocation::lastPosition()
 {
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
@@ -294,7 +304,7 @@ Geoposition* Geolocation::lastPosition()
 
 void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
-    if (!m_frame)
+    if (!frame())
         return;
 
     RefPtr<GeoNotifier> notifier = startRequest(successCallback, errorCallback, options);
@@ -305,7 +315,7 @@ void Geolocation::getCurrentPosition(PassRefPtr<PositionCallback> successCallbac
 
 int Geolocation::watchPosition(PassRefPtr<PositionCallback> successCallback, PassRefPtr<PositionErrorCallback> errorCallback, PassRefPtr<PositionOptions> options)
 {
-    if (!m_frame)
+    if (!frame())
         return 0;
 
     RefPtr<GeoNotifier> notifier = startRequest(successCallback, errorCallback, options);
@@ -620,7 +630,7 @@ void Geolocation::requestPermission()
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
     page->geolocationController()->requestPermission(this);
 #else
-    page->chrome()->client()->requestGeolocationPermissionForFrame(m_frame, this);
+    page->chrome()->client()->requestGeolocationPermissionForFrame(frame(), this);
 #endif
 }
 
@@ -757,17 +767,11 @@ void Geolocation::handlePendingPermissionNotifiers()
 
 namespace WebCore {
 
-void Geolocation::clearWatch(int) {}
-
-void Geolocation::reset() {}
-
-void Geolocation::disconnectFrame() {}
-
-Geolocation::Geolocation(Frame*) : DOMWindowProperty(0) {}
-
-Geolocation::~Geolocation() {}
-
-void Geolocation::setIsAllowed(bool) {}
+void Geolocation::clearWatch(int) { }
+void Geolocation::stop() { }
+Geolocation::Geolocation(ScriptExecutionContext* context) : ActiveDOMObject(context, this) { }
+Geolocation::~Geolocation() { }
+void Geolocation::setIsAllowed(bool) { }
 
 }
                                                         
diff --git a/Source/WebCore/Modules/geolocation/Geolocation.h b/Source/WebCore/Modules/geolocation/Geolocation.h
index ea55cbf1f..2c6bab8bd 100644
--- a/Source/WebCore/Modules/geolocation/Geolocation.h
+++ b/Source/WebCore/Modules/geolocation/Geolocation.h
@@ -27,7 +27,7 @@
 #ifndef Geolocation_h
 #define Geolocation_h
 
-#include "DOMWindowProperty.h"
+#include "ActiveDOMObject.h"
 #include "Geoposition.h"
 #include "PositionCallback.h"
 #include "PositionError.h"
@@ -41,24 +41,27 @@
 
 namespace WebCore {
 
+class Document;
 class Frame;
 #if ENABLE(CLIENT_BASED_GEOLOCATION)
 class GeolocationPosition;
 class GeolocationError;
 #endif
 class Page;
+class ScriptExecutionContext;
 
-class Geolocation : public RefCounted<Geolocation>, public DOMWindowProperty
+class Geolocation : public RefCounted<Geolocation>, public ActiveDOMObject
 #if !ENABLE(CLIENT_BASED_GEOLOCATION) && ENABLE(GEOLOCATION)
     , public GeolocationServiceClient
 #endif
 {
 public:
-    static PassRefPtr<Geolocation> create(Frame* frame) { return adoptRef(new Geolocation(frame)); }
+    static PassRefPtr<Geolocation> create(ScriptExecutionContext*);
     ~Geolocation();
 
-    virtual void disconnectFrame() OVERRIDE;
-    void reset();
+    virtual void stop() OVERRIDE;
+    Document* document() const;
+    Frame* frame() const;
 
     void getCurrentPosition(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
     int watchPosition(PassRefPtr<PositionCallback>, PassRefPtr<PositionErrorCallback>, PassRefPtr<PositionOptions>);
@@ -79,7 +82,7 @@ private:
     bool isAllowed() const { return m_allowGeolocation == Yes; }
     bool isDenied() const { return m_allowGeolocation == No; }
 
-    explicit Geolocation(Frame*);
+    explicit Geolocation(ScriptExecutionContext*);
 
     Page* page() const;
 
diff --git a/Source/WebCore/Modules/geolocation/NavigatorGeolocation.cpp b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.cpp
index b8a47c1f5..da0ebf54a 100644
--- a/Source/WebCore/Modules/geolocation/NavigatorGeolocation.cpp
+++ b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.cpp
@@ -1,31 +1,33 @@
 /*
- * Copyright (C) 2012, Google Inc. All rights reserved.
+ *  Copyright (C) 2000 Harri Porten (porten@kde.org)
+ *  Copyright (c) 2000 Daniel Molkentin (molkentin@kde.org)
+ *  Copyright (c) 2000 Stefan Schimanski (schimmi@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ *  Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
  *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
- * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
- * DAMAGE.
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
 #include "config.h"
+
+#if ENABLE(GEOLOCATION)
+
 #include "NavigatorGeolocation.h"
 
+#include "Document.h"
+#include "Frame.h"
 #include "Geolocation.h"
 #include "Navigator.h"
 
@@ -40,21 +42,10 @@ NavigatorGeolocation::~NavigatorGeolocation()
 {
 }
 
-void NavigatorGeolocation::willDetachPage()
-{
-    // FIXME: We should ideally allow existing Geolocation activities to continue
-    // when the Geolocation's iframe is reparented. (Assuming we continue to
-    // support reparenting iframes.)
-    // See https://bugs.webkit.org/show_bug.cgi?id=55577
-    // and https://bugs.webkit.org/show_bug.cgi?id=52877
-    if (m_geolocation)
-        m_geolocation->reset();
-}
-
 NavigatorGeolocation* NavigatorGeolocation::from(Navigator* navigator)
 {
     DEFINE_STATIC_LOCAL(AtomicString, name, ("NavigatorGeolocation"));
-    NavigatorGeolocation* supplement = static_cast<NavigatorGeolocation*>(NavigatorSupplement::from(navigator, name));
+    NavigatorGeolocation* supplement = static_cast<NavigatorGeolocation*>(Supplement<Navigator>::from(navigator, name));
     if (!supplement) {
         supplement = new NavigatorGeolocation(navigator->frame());
         provideTo(navigator, name, adoptPtr(supplement));
@@ -69,9 +60,11 @@ Geolocation* NavigatorGeolocation::geolocation(Navigator* navigator)
 
 Geolocation* NavigatorGeolocation::geolocation() const
 {
-    if (!m_geolocation)
-        m_geolocation = Geolocation::create(frame());
+    if (!m_geolocation && frame())
+        m_geolocation = Geolocation::create(frame()->document());
     return m_geolocation.get();
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(GEOLOCATION)
diff --git a/Source/WebCore/Modules/geolocation/NavigatorGeolocation.h b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.h
index b8c92e6a3..6f9d8057f 100644
--- a/Source/WebCore/Modules/geolocation/NavigatorGeolocation.h
+++ b/Source/WebCore/Modules/geolocation/NavigatorGeolocation.h
@@ -1,33 +1,29 @@
 /*
- * Copyright (C) 2011, Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
- * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
- * DAMAGE.
- */
+    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
 
 #ifndef NavigatorGeolocation_h
 #define NavigatorGeolocation_h
 
+#if ENABLE(GEOLOCATION)
+
 #include "DOMWindowProperty.h"
-#include "NavigatorSupplement.h"
+#include "Supplementable.h"
 
 namespace WebCore {
 
@@ -35,7 +31,7 @@ class Frame;
 class Geolocation;
 class Navigator;
 
-class NavigatorGeolocation : public NavigatorSupplement, public DOMWindowProperty {
+class NavigatorGeolocation : public Supplement<Navigator>, public DOMWindowProperty {
 public:
     virtual ~NavigatorGeolocation();
     static NavigatorGeolocation* from(Navigator*);
@@ -46,11 +42,11 @@ public:
 private:
     NavigatorGeolocation(Frame*);
 
-    virtual void willDetachPage() OVERRIDE;
-
     mutable RefPtr<Geolocation> m_geolocation;
 };
 
 } // namespace WebCore
 
+#endif // ENABLE(GEOLOCATION)
+
 #endif // NavigatorGeolocation_h
diff --git a/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.cpp b/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.cpp
index 9b40c5ad3..6ec2dc001 100644
--- a/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.cpp
+++ b/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.cpp
@@ -10,7 +10,7 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
@@ -32,12 +32,14 @@
 #include "Document.h"
 #include "IDBFactory.h"
 #include "Page.h"
-#include "PageGroup.h"
+#include "PageGroupIndexedDatabase.h"
 #include "SecurityOrigin.h"
 
 namespace WebCore {
 
-DOMWindowIndexedDatabase::DOMWindowIndexedDatabase()
+DOMWindowIndexedDatabase::DOMWindowIndexedDatabase(DOMWindow* window)
+    : DOMWindowProperty(window->frame())
+    , m_window(window)
 {
 }
 
@@ -45,9 +47,31 @@ DOMWindowIndexedDatabase::~DOMWindowIndexedDatabase()
 {
 }
 
+DOMWindowIndexedDatabase* DOMWindowIndexedDatabase::from(DOMWindow* window)
+{
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("DOMWindowIndexedDatabase"));
+    DOMWindowIndexedDatabase* supplement = static_cast<DOMWindowIndexedDatabase*>(Supplement<DOMWindow>::from(window, name));
+    if (!supplement) {
+        supplement = new DOMWindowIndexedDatabase(window);
+        provideTo(window, name, adoptPtr(supplement));
+    }
+    return supplement;
+}
+
+void DOMWindowIndexedDatabase::disconnectFrame()
+{
+    m_idbFactory = 0;
+    DOMWindowProperty::disconnectFrame();
+}
+
 IDBFactory* DOMWindowIndexedDatabase::webkitIndexedDB(DOMWindow* window)
 {
-    Document* document = window->document();
+    return from(window)->webkitIndexedDB();
+}
+
+IDBFactory* DOMWindowIndexedDatabase::webkitIndexedDB()
+{
+    Document* document = m_window->document();
     if (!document)
         return 0;
 
@@ -58,9 +82,9 @@ IDBFactory* DOMWindowIndexedDatabase::webkitIndexedDB(DOMWindow* window)
     if (!document->securityOrigin()->canAccessDatabase())
         return 0;
 
-    if (!window->idbFactory() && window->isCurrentlyDisplayedInFrame())
-        window->setIDBFactory(IDBFactory::create(page->group().idbFactory()));
-    return window->idbFactory();
+    if (!m_idbFactory && m_window->isCurrentlyDisplayedInFrame())
+        m_idbFactory = IDBFactory::create(PageGroupIndexedDatabase::from(page->group())->factoryBackend());
+    return m_idbFactory.get();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.h b/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.h
index 960c144f7..d71f82dd3 100644
--- a/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.h
+++ b/Source/WebCore/Modules/indexeddb/DOMWindowIndexedDatabase.h
@@ -10,7 +10,7 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
@@ -28,18 +28,30 @@
 
 #if ENABLE(INDEXED_DATABASE)
 
+#include "DOMWindowProperty.h"
+#include "Supplementable.h"
+
 namespace WebCore {
 
 class IDBFactory;
 class DOMWindow;
 
-class DOMWindowIndexedDatabase {
+class DOMWindowIndexedDatabase : public DOMWindowProperty, public Supplement<DOMWindow> {
 public:
+    virtual ~DOMWindowIndexedDatabase();
+    static DOMWindowIndexedDatabase* from(DOMWindow*);
+
     static IDBFactory* webkitIndexedDB(DOMWindow*);
 
+    virtual void disconnectFrame() OVERRIDE;
+
 private:
-    DOMWindowIndexedDatabase();
-    ~DOMWindowIndexedDatabase();
+    explicit DOMWindowIndexedDatabase(DOMWindow*);
+
+    IDBFactory* webkitIndexedDB();
+
+    DOMWindow* m_window;
+    RefPtr<IDBFactory> m_idbFactory;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBAny.cpp b/Source/WebCore/Modules/indexeddb/IDBAny.cpp
index 57a406e2b..57a406e2b 100644
--- a/Source/WebCore/storage/IDBAny.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBAny.cpp
diff --git a/Source/WebCore/storage/IDBAny.h b/Source/WebCore/Modules/indexeddb/IDBAny.h
index 6beda5888..6beda5888 100644
--- a/Source/WebCore/storage/IDBAny.h
+++ b/Source/WebCore/Modules/indexeddb/IDBAny.h
diff --git a/Source/WebCore/storage/IDBAny.idl b/Source/WebCore/Modules/indexeddb/IDBAny.idl
index dd51c4daa..dd51c4daa 100644
--- a/Source/WebCore/storage/IDBAny.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBAny.idl
diff --git a/Source/WebCore/storage/IDBBackingStore.h b/Source/WebCore/Modules/indexeddb/IDBBackingStore.h
index b5fcb3ad7..b5fcb3ad7 100644
--- a/Source/WebCore/storage/IDBBackingStore.h
+++ b/Source/WebCore/Modules/indexeddb/IDBBackingStore.h
diff --git a/Source/WebCore/storage/IDBCallbacks.h b/Source/WebCore/Modules/indexeddb/IDBCallbacks.h
index 7dee5500f..7dee5500f 100644
--- a/Source/WebCore/storage/IDBCallbacks.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCallbacks.h
diff --git a/Source/WebCore/storage/IDBCursor.cpp b/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
index 1dd1e9ebe..e7a01ecb7 100644
--- a/Source/WebCore/storage/IDBCursor.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBCursor.cpp
@@ -50,6 +50,7 @@ IDBCursor::IDBCursor(PassRefPtr<IDBCursorBackendInterface> backend, IDBRequest*
     , m_request(request)
     , m_source(source)
     , m_transaction(transaction)
+    , m_transactionNotifier(transaction, this)
 {
     ASSERT(m_backend);
     ASSERT(m_request);
@@ -110,6 +111,10 @@ void IDBCursor::continueFunction(PassRefPtr<IDBKey> key, ExceptionCode& ec)
         return;
     }
 
+    if (!m_request) {
+        ec = IDBDatabaseException::TRANSACTION_INACTIVE_ERR;
+        return;
+    }
     // FIXME: We're not using the context from when continue was called, which means the callback
     //        will be on the original context openCursor was called on. Is this right?
     if (m_request->resetReadyState(m_transaction.get())) {
@@ -136,6 +141,13 @@ void IDBCursor::postSuccessHandlerCallback()
     m_backend->postSuccessHandlerCallback();
 }
 
+void IDBCursor::close()
+{
+    ASSERT(m_request);
+    m_request->finishCursor();
+    m_request.clear();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/storage/IDBCursor.h b/Source/WebCore/Modules/indexeddb/IDBCursor.h
index ba49d827c..eb7670643 100644
--- a/Source/WebCore/storage/IDBCursor.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCursor.h
@@ -29,6 +29,7 @@
 #if ENABLE(INDEXED_DATABASE)
 
 #include "IDBKey.h"
+#include "IDBTransaction.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -39,7 +40,6 @@ class IDBAny;
 class IDBCallbacks;
 class IDBCursorBackendInterface;
 class IDBRequest;
-class IDBTransaction;
 class ScriptExecutionContext;
 class SerializedScriptValue;
 
@@ -71,6 +71,7 @@ public:
     PassRefPtr<IDBRequest> deleteFunction(ScriptExecutionContext*, ExceptionCode&);
 
     void postSuccessHandlerCallback();
+    void close();
 
 protected:
     IDBCursor(PassRefPtr<IDBCursorBackendInterface>, IDBRequest*, IDBAny* source, IDBTransaction*);
@@ -80,6 +81,7 @@ private:
     RefPtr<IDBRequest> m_request;
     RefPtr<IDBAny> m_source;
     RefPtr<IDBTransaction> m_transaction;
+    IDBTransaction::OpenCursorNotifier m_transactionNotifier;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/storage/IDBCursor.idl b/Source/WebCore/Modules/indexeddb/IDBCursor.idl
index 41540e2f2..41540e2f2 100644
--- a/Source/WebCore/storage/IDBCursor.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBCursor.idl
diff --git a/Source/WebCore/storage/IDBCursorBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp
index cdbe707fc..cdbe707fc 100644
--- a/Source/WebCore/storage/IDBCursorBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.cpp
diff --git a/Source/WebCore/storage/IDBCursorBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h
index 4ee5ac40a..4ee5ac40a 100644
--- a/Source/WebCore/storage/IDBCursorBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorBackendImpl.h
diff --git a/Source/WebCore/storage/IDBCursorBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBCursorBackendInterface.h
index b57bb5868..b57bb5868 100644
--- a/Source/WebCore/storage/IDBCursorBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorBackendInterface.h
diff --git a/Source/WebCore/storage/IDBCursorWithValue.cpp b/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.cpp
index 30d242c98..30d242c98 100644
--- a/Source/WebCore/storage/IDBCursorWithValue.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.cpp
diff --git a/Source/WebCore/storage/IDBCursorWithValue.h b/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.h
index a1ba14f96..a1ba14f96 100644
--- a/Source/WebCore/storage/IDBCursorWithValue.h
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.h
diff --git a/Source/WebCore/storage/IDBCursorWithValue.idl b/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.idl
index 6ffc5b554..6ffc5b554 100644
--- a/Source/WebCore/storage/IDBCursorWithValue.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBCursorWithValue.idl
diff --git a/Source/WebCore/storage/IDBDatabase.cpp b/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp
index cc53a882a..cc53a882a 100644
--- a/Source/WebCore/storage/IDBDatabase.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabase.cpp
diff --git a/Source/WebCore/storage/IDBDatabase.h b/Source/WebCore/Modules/indexeddb/IDBDatabase.h
index ffe21d826..ffe21d826 100644
--- a/Source/WebCore/storage/IDBDatabase.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabase.h
diff --git a/Source/WebCore/storage/IDBDatabase.idl b/Source/WebCore/Modules/indexeddb/IDBDatabase.idl
index 9abb38d89..9abb38d89 100644
--- a/Source/WebCore/storage/IDBDatabase.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabase.idl
diff --git a/Source/WebCore/storage/IDBDatabaseBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp
index 6720fe2f9..b05b32863 100644
--- a/Source/WebCore/storage/IDBDatabaseBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.cpp
@@ -133,6 +133,7 @@ PassRefPtr<DOMStringList> IDBDatabaseBackendImpl::objectStoreNames() const
     RefPtr<DOMStringList> objectStoreNames = DOMStringList::create();
     for (ObjectStoreMap::const_iterator it = m_objectStores.begin(); it != m_objectStores.end(); ++it)
         objectStoreNames->append(it->first);
+    objectStoreNames->sort();
     return objectStoreNames.release();
 }
 
diff --git a/Source/WebCore/storage/IDBDatabaseBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h
index 7a5ce1da8..7a5ce1da8 100644
--- a/Source/WebCore/storage/IDBDatabaseBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendImpl.h
diff --git a/Source/WebCore/storage/IDBDatabaseBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendInterface.h
index 56e8f2dbb..56e8f2dbb 100644
--- a/Source/WebCore/storage/IDBDatabaseBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseBackendInterface.h
diff --git a/Source/WebCore/storage/IDBDatabaseCallbacks.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacks.h
index b3f244f51..b3f244f51 100644
--- a/Source/WebCore/storage/IDBDatabaseCallbacks.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacks.h
diff --git a/Source/WebCore/storage/IDBDatabaseCallbacksImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacksImpl.cpp
index 39c440909..39c440909 100644
--- a/Source/WebCore/storage/IDBDatabaseCallbacksImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacksImpl.cpp
diff --git a/Source/WebCore/storage/IDBDatabaseCallbacksImpl.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacksImpl.h
index e8b1f99b8..e8b1f99b8 100644
--- a/Source/WebCore/storage/IDBDatabaseCallbacksImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseCallbacksImpl.h
diff --git a/Source/WebCore/storage/IDBDatabaseError.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseError.h
index 8b42f1707..8b42f1707 100644
--- a/Source/WebCore/storage/IDBDatabaseError.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseError.h
diff --git a/Source/WebCore/storage/IDBDatabaseError.idl b/Source/WebCore/Modules/indexeddb/IDBDatabaseError.idl
index 2912a1d72..2912a1d72 100644
--- a/Source/WebCore/storage/IDBDatabaseError.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseError.idl
diff --git a/Source/WebCore/storage/IDBDatabaseException.cpp b/Source/WebCore/Modules/indexeddb/IDBDatabaseException.cpp
index 4fc681e0c..4fc681e0c 100644
--- a/Source/WebCore/storage/IDBDatabaseException.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseException.cpp
diff --git a/Source/WebCore/storage/IDBDatabaseException.h b/Source/WebCore/Modules/indexeddb/IDBDatabaseException.h
index 570a2fcd6..570a2fcd6 100644
--- a/Source/WebCore/storage/IDBDatabaseException.h
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseException.h
diff --git a/Source/WebCore/storage/IDBDatabaseException.idl b/Source/WebCore/Modules/indexeddb/IDBDatabaseException.idl
index c8e1b3536..c8e1b3536 100644
--- a/Source/WebCore/storage/IDBDatabaseException.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBDatabaseException.idl
diff --git a/Source/WebCore/storage/IDBEventDispatcher.cpp b/Source/WebCore/Modules/indexeddb/IDBEventDispatcher.cpp
index 726346754..726346754 100644
--- a/Source/WebCore/storage/IDBEventDispatcher.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBEventDispatcher.cpp
diff --git a/Source/WebCore/storage/IDBEventDispatcher.h b/Source/WebCore/Modules/indexeddb/IDBEventDispatcher.h
index 00bf15463..00bf15463 100644
--- a/Source/WebCore/storage/IDBEventDispatcher.h
+++ b/Source/WebCore/Modules/indexeddb/IDBEventDispatcher.h
diff --git a/Source/WebCore/storage/IDBFactory.cpp b/Source/WebCore/Modules/indexeddb/IDBFactory.cpp
index 42b4fee9b..42b4fee9b 100644
--- a/Source/WebCore/storage/IDBFactory.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBFactory.cpp
diff --git a/Source/WebCore/storage/IDBFactory.h b/Source/WebCore/Modules/indexeddb/IDBFactory.h
index 4611cb6c4..4611cb6c4 100644
--- a/Source/WebCore/storage/IDBFactory.h
+++ b/Source/WebCore/Modules/indexeddb/IDBFactory.h
diff --git a/Source/WebCore/storage/IDBFactory.idl b/Source/WebCore/Modules/indexeddb/IDBFactory.idl
index c44996ba0..c44996ba0 100644
--- a/Source/WebCore/storage/IDBFactory.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBFactory.idl
diff --git a/Source/WebCore/storage/IDBFactoryBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp
index dd242eab5..dd242eab5 100644
--- a/Source/WebCore/storage/IDBFactoryBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.cpp
diff --git a/Source/WebCore/storage/IDBFactoryBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.h
index 7982168be..7982168be 100644
--- a/Source/WebCore/storage/IDBFactoryBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendImpl.h
diff --git a/Source/WebCore/storage/IDBFactoryBackendInterface.cpp b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendInterface.cpp
index ac136521f..ac136521f 100644
--- a/Source/WebCore/storage/IDBFactoryBackendInterface.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendInterface.cpp
diff --git a/Source/WebCore/storage/IDBFactoryBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendInterface.h
index 19a1c9784..19a1c9784 100644
--- a/Source/WebCore/storage/IDBFactoryBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBFactoryBackendInterface.h
diff --git a/Source/WebCore/storage/IDBIndex.cpp b/Source/WebCore/Modules/indexeddb/IDBIndex.cpp
index a7c8dd3bb..b2a31f62a 100644
--- a/Source/WebCore/storage/IDBIndex.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBIndex.cpp
@@ -87,6 +87,15 @@ PassRefPtr<IDBRequest> IDBIndex::count(ScriptExecutionContext* context, PassRefP
     return request;
 }
 
+PassRefPtr<IDBRequest> IDBIndex::count(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
+{
+    IDB_TRACE("IDBIndex::count");
+    RefPtr<IDBKeyRange> keyRange = IDBKeyRange::only(key, ec);
+    if (ec)
+        return 0;
+    return count(context, keyRange.release(), ec);
+}
+
 PassRefPtr<IDBRequest> IDBIndex::openKeyCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, ExceptionCode& ec)
 {
     IDB_TRACE("IDBIndex::openKeyCursor");
diff --git a/Source/WebCore/storage/IDBIndex.h b/Source/WebCore/Modules/indexeddb/IDBIndex.h
index 96b380bc9..4057eed5d 100644
--- a/Source/WebCore/storage/IDBIndex.h
+++ b/Source/WebCore/Modules/indexeddb/IDBIndex.h
@@ -58,8 +58,9 @@ public:
     PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openCursor(context, 0, ec); }
     PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec) { return openCursor(context, keyRange, IDBCursor::NEXT, ec); }
     PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, unsigned short direction, ExceptionCode&);
-    PassRefPtr<IDBRequest> count(ScriptExecutionContext* context, ExceptionCode& ec) { return count(context, 0, ec); }
+    PassRefPtr<IDBRequest> count(ScriptExecutionContext* context, ExceptionCode& ec) { return count(context, static_cast<IDBKeyRange*>(0), ec); }
     PassRefPtr<IDBRequest> count(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, ExceptionCode&);
+    PassRefPtr<IDBRequest> count(ScriptExecutionContext*, PassRefPtr<IDBKey>, ExceptionCode&);
 
     PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openKeyCursor(context, 0, ec); } 
     PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec) { return openKeyCursor(context, keyRange, IDBCursor::NEXT, ec); }
diff --git a/Source/WebCore/storage/IDBIndex.idl b/Source/WebCore/Modules/indexeddb/IDBIndex.idl
index 4c8f655e3..1e49a4f13 100644
--- a/Source/WebCore/storage/IDBIndex.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBIndex.idl
@@ -44,6 +44,8 @@ module storage {
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest count(in [Optional] IDBKeyRange range)
             raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext] IDBRequest count(in IDBKey key)
+            raises (IDBDatabaseException);
     };
 
 }
diff --git a/Source/WebCore/storage/IDBIndexBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp
index cec43b98e..cec43b98e 100644
--- a/Source/WebCore/storage/IDBIndexBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.cpp
diff --git a/Source/WebCore/storage/IDBIndexBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h
index 9ef51d5a9..9ef51d5a9 100644
--- a/Source/WebCore/storage/IDBIndexBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBIndexBackendImpl.h
diff --git a/Source/WebCore/storage/IDBIndexBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBIndexBackendInterface.h
index a0f1ba81b..a0f1ba81b 100644
--- a/Source/WebCore/storage/IDBIndexBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBIndexBackendInterface.h
diff --git a/Source/WebCore/storage/IDBKey.cpp b/Source/WebCore/Modules/indexeddb/IDBKey.cpp
index 598686e1a..598686e1a 100644
--- a/Source/WebCore/storage/IDBKey.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBKey.cpp
diff --git a/Source/WebCore/storage/IDBKey.h b/Source/WebCore/Modules/indexeddb/IDBKey.h
index 17c4eaea5..17c4eaea5 100644
--- a/Source/WebCore/storage/IDBKey.h
+++ b/Source/WebCore/Modules/indexeddb/IDBKey.h
diff --git a/Source/WebCore/storage/IDBKey.idl b/Source/WebCore/Modules/indexeddb/IDBKey.idl
index 1464d9f73..1464d9f73 100644
--- a/Source/WebCore/storage/IDBKey.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBKey.idl
diff --git a/Source/WebCore/storage/IDBKeyPath.cpp b/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp
index cd5e96634..cd5e96634 100644
--- a/Source/WebCore/storage/IDBKeyPath.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyPath.cpp
diff --git a/Source/WebCore/storage/IDBKeyPath.h b/Source/WebCore/Modules/indexeddb/IDBKeyPath.h
index c52a63ba8..c52a63ba8 100644
--- a/Source/WebCore/storage/IDBKeyPath.h
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyPath.h
diff --git a/Source/WebCore/storage/IDBKeyPathBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBKeyPathBackendImpl.cpp
index 4f0fcee64..4f0fcee64 100644
--- a/Source/WebCore/storage/IDBKeyPathBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyPathBackendImpl.cpp
diff --git a/Source/WebCore/storage/IDBKeyPathBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBKeyPathBackendImpl.h
index 1c7623221..1c7623221 100644
--- a/Source/WebCore/storage/IDBKeyPathBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyPathBackendImpl.h
diff --git a/Source/WebCore/storage/IDBKeyRange.cpp b/Source/WebCore/Modules/indexeddb/IDBKeyRange.cpp
index 0c2326e5d..0c2326e5d 100644
--- a/Source/WebCore/storage/IDBKeyRange.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyRange.cpp
diff --git a/Source/WebCore/storage/IDBKeyRange.h b/Source/WebCore/Modules/indexeddb/IDBKeyRange.h
index b9a98daeb..b9a98daeb 100644
--- a/Source/WebCore/storage/IDBKeyRange.h
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyRange.h
diff --git a/Source/WebCore/storage/IDBKeyRange.idl b/Source/WebCore/Modules/indexeddb/IDBKeyRange.idl
index 161cb9c47..161cb9c47 100644
--- a/Source/WebCore/storage/IDBKeyRange.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBKeyRange.idl
diff --git a/Source/WebCore/storage/IDBLevelDBBackingStore.cpp b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp
index f423bb007..f423bb007 100644
--- a/Source/WebCore/storage/IDBLevelDBBackingStore.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.cpp
diff --git a/Source/WebCore/storage/IDBLevelDBBackingStore.h b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.h
index 24d439d76..24d439d76 100644
--- a/Source/WebCore/storage/IDBLevelDBBackingStore.h
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBBackingStore.h
diff --git a/Source/WebCore/storage/IDBLevelDBCoding.cpp b/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.cpp
index f0263f89f..f0263f89f 100644
--- a/Source/WebCore/storage/IDBLevelDBCoding.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.cpp
diff --git a/Source/WebCore/storage/IDBLevelDBCoding.h b/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.h
index 14c42ea73..14c42ea73 100644
--- a/Source/WebCore/storage/IDBLevelDBCoding.h
+++ b/Source/WebCore/Modules/indexeddb/IDBLevelDBCoding.h
diff --git a/Source/WebCore/storage/IDBObjectStore.cpp b/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
index 6d4ffab7d..5c34666d3 100644
--- a/Source/WebCore/storage/IDBObjectStore.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStore.cpp
@@ -131,6 +131,7 @@ PassRefPtr<IDBRequest> IDBObjectStore::put(ScriptExecutionContext* context, Pass
 
 PassRefPtr<IDBRequest> IDBObjectStore::deleteFunction(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec)
 {
+    IDB_TRACE("IDBObjectStore::delete");
     if (!keyRange) {
         ec = IDBDatabaseException::DATA_ERR;
         return 0;
@@ -257,6 +258,15 @@ PassRefPtr<IDBRequest> IDBObjectStore::count(ScriptExecutionContext* context, Pa
     return request.release();
 }
 
+PassRefPtr<IDBRequest> IDBObjectStore::count(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
+{
+    IDB_TRACE("IDBObjectStore::count");
+    RefPtr<IDBKeyRange> keyRange = IDBKeyRange::only(key, ec);
+    if (ec)
+        return 0;
+    return count(context, keyRange.release(), ec);
+}
+
 void IDBObjectStore::transactionFinished()
 {
     ASSERT(m_transaction->finished());
diff --git a/Source/WebCore/storage/IDBObjectStore.h b/Source/WebCore/Modules/indexeddb/IDBObjectStore.h
index 60a9b1d3f..509090ed8 100644
--- a/Source/WebCore/storage/IDBObjectStore.h
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStore.h
@@ -79,8 +79,9 @@ public:
     void deleteIndex(const String& name, ExceptionCode&);
 
     PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, unsigned short direction, ExceptionCode&); 
-    PassRefPtr<IDBRequest> count(ScriptExecutionContext* context, ExceptionCode& ec) { return count(context, 0, ec); }
+    PassRefPtr<IDBRequest> count(ScriptExecutionContext* context, ExceptionCode& ec) { return count(context, static_cast<IDBKeyRange*>(0), ec); }
     PassRefPtr<IDBRequest> count(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, ExceptionCode&);
+    PassRefPtr<IDBRequest> count(ScriptExecutionContext*, PassRefPtr<IDBKey>, ExceptionCode&);
 
     void transactionFinished();
 
diff --git a/Source/WebCore/storage/IDBObjectStore.idl b/Source/WebCore/Modules/indexeddb/IDBObjectStore.idl
index 5bcaf8ec4..ab1200cf4 100644
--- a/Source/WebCore/storage/IDBObjectStore.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStore.idl
@@ -55,5 +55,7 @@ module storage {
             raises (IDBDatabaseException);
         [CallWith=ScriptExecutionContext] IDBRequest count(in [Optional] IDBKeyRange range)
             raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext] IDBRequest count(in IDBKey key)
+            raises (IDBDatabaseException);
     };
 }
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
index b9ecce329..548f1a293 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.cpp
@@ -79,6 +79,7 @@ PassRefPtr<DOMStringList> IDBObjectStoreBackendImpl::indexNames() const
     RefPtr<DOMStringList> indexNames = DOMStringList::create();
     for (IndexMap::const_iterator it = m_indexes.begin(); it != m_indexes.end(); ++it)
         indexNames->append(it->first);
+    indexNames->sort();
     return indexNames.release();
 }
 
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h
index cdf360cdf..cdf360cdf 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendImpl.h
diff --git a/Source/WebCore/storage/IDBObjectStoreBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h
index 5e6bf49c5..5e6bf49c5 100644
--- a/Source/WebCore/storage/IDBObjectStoreBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBObjectStoreBackendInterface.h
diff --git a/Source/WebCore/storage/IDBPendingTransactionMonitor.cpp b/Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.cpp
index f2de3e7a9..f2de3e7a9 100644
--- a/Source/WebCore/storage/IDBPendingTransactionMonitor.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.cpp
diff --git a/Source/WebCore/storage/IDBPendingTransactionMonitor.h b/Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.h
index 128b55133..128b55133 100644
--- a/Source/WebCore/storage/IDBPendingTransactionMonitor.h
+++ b/Source/WebCore/Modules/indexeddb/IDBPendingTransactionMonitor.h
diff --git a/Source/WebCore/storage/IDBRequest.cpp b/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
index a04c0c668..90c188cbf 100644
--- a/Source/WebCore/storage/IDBRequest.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBRequest.cpp
@@ -58,6 +58,7 @@ IDBRequest::IDBRequest(ScriptExecutionContext* context, PassRefPtr<IDBAny> sourc
     , m_transaction(transaction)
     , m_readyState(LOADING)
     , m_requestFinished(false)
+    , m_cursorFinished(false)
     , m_contextStopped(false)
     , m_cursorType(IDBCursorBackendInterface::InvalidCursorType)
     , m_cursor(0)
@@ -182,6 +183,13 @@ void IDBRequest::setCursor(PassRefPtr<IDBCursor> cursor)
     m_cursor = cursor;
 }
 
+void IDBRequest::finishCursor()
+{
+    m_cursorFinished = true;
+    if (m_readyState != LOADING)
+        m_requestFinished = true;
+}
+
 void IDBRequest::onError(PassRefPtr<IDBDatabaseError> error)
 {
     ASSERT(!m_errorCode && m_errorMessage.isNull() && !m_result);
@@ -364,7 +372,7 @@ bool IDBRequest::dispatchEvent(PassRefPtr<Event> event)
     bool dontPreventDefault = IDBEventDispatcher::dispatch(event.get(), targets);
 
     // If the result was of type IDBCursor, or a onBlocked event, then we'll fire again.
-    if (event->type() != eventNames().blockedEvent && m_result && m_result->type() != IDBAny::IDBCursorType && m_result->type() != IDBAny::IDBCursorWithValueType)
+    if (event->type() != eventNames().blockedEvent && (!cursorToNotify || m_cursorFinished))
         m_requestFinished = true;
 
     if (cursorToNotify)
diff --git a/Source/WebCore/storage/IDBRequest.h b/Source/WebCore/Modules/indexeddb/IDBRequest.h
index 8bc7865ac..a6b573d87 100644
--- a/Source/WebCore/storage/IDBRequest.h
+++ b/Source/WebCore/Modules/indexeddb/IDBRequest.h
@@ -72,6 +72,7 @@ public:
     bool resetReadyState(IDBTransaction*);
     void setCursorType(IDBCursorBackendInterface::CursorType);
     void setCursor(PassRefPtr<IDBCursor>);
+    void finishCursor();
     IDBAny* source();
     void abort();
 
@@ -122,6 +123,7 @@ private:
 
     ReadyState m_readyState;
     bool m_requestFinished; // Is it possible that we'll fire any more events? If not, we're finished.
+    bool m_cursorFinished;
     bool m_contextStopped;
     Vector<RefPtr<Event> > m_enqueuedEvents;
 
diff --git a/Source/WebCore/storage/IDBRequest.idl b/Source/WebCore/Modules/indexeddb/IDBRequest.idl
index 8c3e38529..8c3e38529 100644
--- a/Source/WebCore/storage/IDBRequest.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBRequest.idl
diff --git a/Source/WebCore/storage/IDBTracing.h b/Source/WebCore/Modules/indexeddb/IDBTracing.h
index e1b3ef60f..e1b3ef60f 100644
--- a/Source/WebCore/storage/IDBTracing.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTracing.h
diff --git a/Source/WebCore/storage/IDBTransaction.cpp b/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
index ccdfb2b9e..9e0b3a8f7 100644
--- a/Source/WebCore/storage/IDBTransaction.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBTransaction.cpp
@@ -126,6 +126,36 @@ void IDBTransaction::abort()
         m_backend->abort();
 }
 
+IDBTransaction::OpenCursorNotifier::OpenCursorNotifier(PassRefPtr<IDBTransaction> transaction, IDBCursor* cursor)
+    : m_transaction(transaction),
+      m_cursor(cursor)
+{
+    m_transaction->registerOpenCursor(m_cursor);
+}
+
+IDBTransaction::OpenCursorNotifier::~OpenCursorNotifier()
+{
+    m_transaction->unregisterOpenCursor(m_cursor);
+}
+
+void IDBTransaction::registerOpenCursor(IDBCursor* cursor)
+{
+    m_openCursors.add(cursor);
+}
+
+void IDBTransaction::unregisterOpenCursor(IDBCursor* cursor)
+{
+    m_openCursors.remove(cursor);
+}
+
+void IDBTransaction::closeOpenCursors()
+{
+    HashSet<IDBCursor*> cursors;
+    cursors.swap(m_openCursors);
+    for (HashSet<IDBCursor*>::iterator i = cursors.begin(); i != cursors.end(); ++i)
+        (*i)->close();
+}
+
 void IDBTransaction::registerRequest(IDBRequest* request)
 {
     m_childRequests.add(request);
@@ -148,6 +178,7 @@ void IDBTransaction::onAbort()
 
     if (m_mode == IDBTransaction::VERSION_CHANGE)
         m_database->clearVersionChangeTransaction(this);
+    closeOpenCursors();
 
     if (m_contextStopped || !scriptExecutionContext())
         return;
@@ -160,6 +191,7 @@ void IDBTransaction::onComplete()
     ASSERT(!m_transactionFinished);
     if (m_mode == IDBTransaction::VERSION_CHANGE)
         m_database->clearVersionChangeTransaction(this);
+    closeOpenCursors();
 
     if (m_contextStopped || !scriptExecutionContext())
         return;
diff --git a/Source/WebCore/storage/IDBTransaction.h b/Source/WebCore/Modules/indexeddb/IDBTransaction.h
index 1d34cc3bd..3c60350d6 100644
--- a/Source/WebCore/storage/IDBTransaction.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransaction.h
@@ -36,10 +36,12 @@
 #include "EventTarget.h"
 #include "IDBTransactionBackendInterface.h"
 #include "IDBTransactionCallbacks.h"
+#include <wtf/HashSet.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
 
+class IDBCursor;
 class IDBDatabase;
 class IDBObjectStore;
 
@@ -62,6 +64,15 @@ public:
     PassRefPtr<IDBObjectStore> objectStore(const String& name, ExceptionCode&);
     void abort();
 
+    class OpenCursorNotifier {
+    public:
+        OpenCursorNotifier(PassRefPtr<IDBTransaction>, IDBCursor*);
+        ~OpenCursorNotifier();
+    private:
+        RefPtr<IDBTransaction> m_transaction;
+        IDBCursor* m_cursor;
+    };
+
     void registerRequest(IDBRequest*);
     void unregisterRequest(IDBRequest*);
     void objectStoreCreated(const String&, PassRefPtr<IDBObjectStore>);
@@ -93,6 +104,10 @@ private:
     IDBTransaction(ScriptExecutionContext*, PassRefPtr<IDBTransactionBackendInterface>, IDBDatabase*);
 
     void enqueueEvent(PassRefPtr<Event>);
+    void closeOpenCursors();
+
+    void registerOpenCursor(IDBCursor*);
+    void unregisterOpenCursor(IDBCursor*);
 
     // EventTarget
     virtual void refEventTarget() { ref(); }
@@ -111,6 +126,8 @@ private:
     typedef HashMap<String, RefPtr<IDBObjectStore> > IDBObjectStoreMap;
     IDBObjectStoreMap m_objectStoreMap;
 
+    HashSet<IDBCursor*> m_openCursors;
+
     EventTargetData m_eventTargetData;
 };
 
diff --git a/Source/WebCore/storage/IDBTransaction.idl b/Source/WebCore/Modules/indexeddb/IDBTransaction.idl
index 9e3b0e920..9e3b0e920 100644
--- a/Source/WebCore/storage/IDBTransaction.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBTransaction.idl
diff --git a/Source/WebCore/storage/IDBTransactionBackendImpl.cpp b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.cpp
index 012e6b6dd..012e6b6dd 100644
--- a/Source/WebCore/storage/IDBTransactionBackendImpl.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.cpp
diff --git a/Source/WebCore/storage/IDBTransactionBackendImpl.h b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.h
index 2f9c2ba84..2f9c2ba84 100644
--- a/Source/WebCore/storage/IDBTransactionBackendImpl.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendImpl.h
diff --git a/Source/WebCore/storage/IDBTransactionBackendInterface.h b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h
index 003dbfdcc..003dbfdcc 100644
--- a/Source/WebCore/storage/IDBTransactionBackendInterface.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionBackendInterface.h
diff --git a/Source/WebCore/storage/IDBTransactionCallbacks.h b/Source/WebCore/Modules/indexeddb/IDBTransactionCallbacks.h
index 8d906a6eb..8d906a6eb 100644
--- a/Source/WebCore/storage/IDBTransactionCallbacks.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionCallbacks.h
diff --git a/Source/WebCore/storage/IDBTransactionCoordinator.cpp b/Source/WebCore/Modules/indexeddb/IDBTransactionCoordinator.cpp
index edaff2c50..edaff2c50 100644
--- a/Source/WebCore/storage/IDBTransactionCoordinator.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionCoordinator.cpp
diff --git a/Source/WebCore/storage/IDBTransactionCoordinator.h b/Source/WebCore/Modules/indexeddb/IDBTransactionCoordinator.h
index ef99e737a..ef99e737a 100644
--- a/Source/WebCore/storage/IDBTransactionCoordinator.h
+++ b/Source/WebCore/Modules/indexeddb/IDBTransactionCoordinator.h
diff --git a/Source/WebCore/storage/IDBVersionChangeEvent.cpp b/Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.cpp
index a299d7485..a299d7485 100644
--- a/Source/WebCore/storage/IDBVersionChangeEvent.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.cpp
diff --git a/Source/WebCore/storage/IDBVersionChangeEvent.h b/Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.h
index dae9f236c..dae9f236c 100644
--- a/Source/WebCore/storage/IDBVersionChangeEvent.h
+++ b/Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.h
diff --git a/Source/WebCore/storage/IDBVersionChangeEvent.idl b/Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.idl
index c6a41718f..c6a41718f 100644
--- a/Source/WebCore/storage/IDBVersionChangeEvent.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBVersionChangeEvent.idl
diff --git a/Source/WebCore/storage/IDBVersionChangeRequest.cpp b/Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.cpp
index f13ca9d3c..f13ca9d3c 100644
--- a/Source/WebCore/storage/IDBVersionChangeRequest.cpp
+++ b/Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.cpp
diff --git a/Source/WebCore/storage/IDBVersionChangeRequest.h b/Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.h
index ce284e933..ce284e933 100644
--- a/Source/WebCore/storage/IDBVersionChangeRequest.h
+++ b/Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.h
diff --git a/Source/WebCore/storage/IDBVersionChangeRequest.idl b/Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.idl
index 2aa238a8b..2aa238a8b 100644
--- a/Source/WebCore/storage/IDBVersionChangeRequest.idl
+++ b/Source/WebCore/Modules/indexeddb/IDBVersionChangeRequest.idl
diff --git a/Source/WebCore/mediastream/NavigatorMediaStream.cpp b/Source/WebCore/Modules/indexeddb/PageGroupIndexedDatabase.cpp
index 204d6e3b7..5803fc0c5 100644
--- a/Source/WebCore/mediastream/NavigatorMediaStream.cpp
+++ b/Source/WebCore/Modules/indexeddb/PageGroupIndexedDatabase.cpp
@@ -10,7 +10,7 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
@@ -24,50 +24,43 @@
  */
 
 #include "config.h"
-#include "NavigatorMediaStream.h"
+#include "PageGroupIndexedDatabase.h"
 
-#if ENABLE(MEDIA_STREAM)
+#if ENABLE(INDEXED_DATABASE)
 
-#include "Document.h"
-#include "ExceptionCode.h"
-#include "Frame.h"
-#include "Navigator.h"
-#include "NavigatorUserMediaErrorCallback.h"
-#include "NavigatorUserMediaSuccessCallback.h"
-#include "Page.h"
-#include "UserMediaController.h"
-#include "UserMediaRequest.h"
+#include "IDBFactoryBackendInterface.h"
+#include "PageGroup.h"
 
 namespace WebCore {
 
-NavigatorMediaStream::NavigatorMediaStream()
+PageGroupIndexedDatabase::PageGroupIndexedDatabase()
 {
 }
 
-NavigatorMediaStream::~NavigatorMediaStream()
+PageGroupIndexedDatabase::~PageGroupIndexedDatabase()
 {
 }
 
-void NavigatorMediaStream::webkitGetUserMedia(Navigator* navigator, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback, PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback, ExceptionCode& ec)
+PageGroupIndexedDatabase* PageGroupIndexedDatabase::from(PageGroup& group)
 {
-    if (!successCallback)
-        return;
-
-    UserMediaController* userMedia = UserMediaController::from(navigator->frame());
-    if (!userMedia) {
-        ec = NOT_SUPPORTED_ERR;
-        return;
-    }
-
-    RefPtr<UserMediaRequest> request = UserMediaRequest::create(navigator->frame()->document(), userMedia, options, successCallback, errorCallback);
-    if (!request) {
-        ec = NOT_SUPPORTED_ERR;
-        return;
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("PageGroupIndexedDatabase"));
+    PageGroupIndexedDatabase* supplement = static_cast<PageGroupIndexedDatabase*>(Supplement<PageGroup>::from(&group, name));
+    if (!supplement) {
+        supplement = new PageGroupIndexedDatabase();
+        provideTo(&group, name, adoptPtr(supplement));
     }
+    return supplement;
+}
 
-    request->start();
+IDBFactoryBackendInterface* PageGroupIndexedDatabase::factoryBackend()
+{
+    // Do not add page setting based access control here since this object is shared by all pages in
+    // the group and having per-page controls is misleading.
+    if (!m_factoryBackend)
+        m_factoryBackend = IDBFactoryBackendInterface::create();
+    return m_factoryBackend.get();
 }
 
 } // namespace WebCore
 
-#endif // ENABLE(MEDIA_STREAM)
+#endif // ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/mediastream/NavigatorMediaStream.h b/Source/WebCore/Modules/indexeddb/PageGroupIndexedDatabase.h
index b7b01fa52..187c78a5c 100644
--- a/Source/WebCore/mediastream/NavigatorMediaStream.h
+++ b/Source/WebCore/Modules/indexeddb/PageGroupIndexedDatabase.h
@@ -10,7 +10,7 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE
@@ -23,33 +23,33 @@
  * DAMAGE.
  */
 
-#ifndef NavigatorMediaStream_h
-#define NavigatorMediaStream_h
+#ifndef PageGroupIndexedDatabase_h
+#define PageGroupIndexedDatabase_h
 
-#if ENABLE(MEDIA_STREAM)
+#if ENABLE(INDEXED_DATABASE)
 
-#include <wtf/PassRefPtr.h>
-#include <wtf/text/WTFString.h>
+#include "Supplementable.h"
 
 namespace WebCore {
 
-class Navigator;
-class NavigatorUserMediaErrorCallback;
-class NavigatorUserMediaSuccessCallback;
+class IDBFactoryBackendInterface;
+class PageGroup;
 
-typedef int ExceptionCode;
-
-class NavigatorMediaStream {
+class PageGroupIndexedDatabase : public Supplement<PageGroup> {
 public:
-    static void webkitGetUserMedia(Navigator*, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>, PassRefPtr<NavigatorUserMediaErrorCallback>, ExceptionCode&);
+    virtual ~PageGroupIndexedDatabase();
+    static PageGroupIndexedDatabase* from(PageGroup&);
+
+    IDBFactoryBackendInterface* factoryBackend();
 
 private:
-    NavigatorMediaStream();
-    ~NavigatorMediaStream();
+    PageGroupIndexedDatabase();
+
+    RefPtr<IDBFactoryBackendInterface> m_factoryBackend;
 };
 
 } // namespace WebCore
 
-#endif // ENABLE(MEDIA_STREAM)
+#endif // ENABLE(INDEXED_DATABASE)
 
-#endif // NavigatorMediaStream_h
+#endif // PageGroupIndexedDatabase_h
diff --git a/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.cpp b/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.cpp
new file mode 100644
index 000000000..b3d209992
--- /dev/null
+++ b/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009, 2011 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+
+#if ENABLE(WORKERS) && ENABLE(INDEXED_DATABASE)
+
+#include "WorkerContextIndexedDatabase.h"
+
+#include "IDBFactory.h"
+#include "IDBFactoryBackendInterface.h"
+#include "ScriptExecutionContext.h"
+#include "SecurityOrigin.h"
+
+namespace WebCore {
+
+WorkerContextIndexedDatabase::WorkerContextIndexedDatabase(ScriptExecutionContext* context)
+    : m_context(context)
+{
+}
+
+WorkerContextIndexedDatabase::~WorkerContextIndexedDatabase()
+{
+}
+
+WorkerContextIndexedDatabase* WorkerContextIndexedDatabase::from(ScriptExecutionContext* context)
+{
+    AtomicString name = "WorkderContextIndexedDatabase";
+    WorkerContextIndexedDatabase* supplement = static_cast<WorkerContextIndexedDatabase*>(Supplement<ScriptExecutionContext>::from(context, name));
+    if (!supplement) {
+        supplement = new WorkerContextIndexedDatabase(context);
+        provideTo(context, name, adoptPtr(supplement));
+    }
+    return supplement;
+}
+
+IDBFactory* WorkerContextIndexedDatabase::webkitIndexedDB(ScriptExecutionContext* context)
+{
+    return from(context)->webkitIndexedDB();
+}
+
+IDBFactory* WorkerContextIndexedDatabase::webkitIndexedDB()
+{
+    if (!m_context->securityOrigin()->canAccessDatabase())
+        return 0;
+    if (!m_factoryBackend)
+        m_factoryBackend = IDBFactoryBackendInterface::create();
+    if (!m_idbFactory)
+        m_idbFactory = IDBFactory::create(m_factoryBackend.get());
+    return m_idbFactory.get();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS) && ENABLE(INDEXED_DATABASE)
diff --git a/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.h b/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.h
new file mode 100644
index 000000000..836caa8c6
--- /dev/null
+++ b/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef WorkerContextIndexedDatabase_h
+#define WorkerContextIndexedDatabase_h
+
+#if ENABLE(WORKERS) && ENABLE(INDEXED_DATABASE)
+
+#include "Supplementable.h"
+
+namespace WebCore {
+
+class IDBFactory;
+class IDBFactoryBackendInterface;
+class ScriptExecutionContext;
+
+class WorkerContextIndexedDatabase : public Supplement<ScriptExecutionContext> {
+public:
+    virtual ~WorkerContextIndexedDatabase();
+    static WorkerContextIndexedDatabase* from(ScriptExecutionContext*);
+
+    static IDBFactory* webkitIndexedDB(ScriptExecutionContext*);
+
+private:
+    explicit WorkerContextIndexedDatabase(ScriptExecutionContext*);
+
+    IDBFactory* webkitIndexedDB();
+
+    ScriptExecutionContext* m_context;
+    RefPtr<IDBFactoryBackendInterface> m_factoryBackend;
+    RefPtr<IDBFactory> m_idbFactory;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS) && ENABLE(INDEXED_DATABASE)
+
+#endif // WorkerContextIndexedDatabase_h
diff --git a/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.idl b/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.idl
new file mode 100644
index 000000000..f9795a89d
--- /dev/null
+++ b/Source/WebCore/Modules/indexeddb/WorkerContextIndexedDatabase.idl
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module threads {
+
+    interface [
+        Conditional=INDEXED_DATABASE,
+        Supplemental=WorkerContext
+    ] WorkerContextIndexedDatabase {
+        readonly attribute [V8EnabledAtRuntime] IDBFactory webkitIndexedDB;
+
+        attribute [V8EnabledAtRuntime] IDBCursorConstructor webkitIDBCursor;
+        attribute [V8EnabledAtRuntime] IDBDatabaseConstructor webkitIDBDatabase;
+        attribute [V8EnabledAtRuntime] IDBDatabaseErrorConstructor webkitIDBDatabaseError;
+        attribute [V8EnabledAtRuntime] IDBDatabaseExceptionConstructor webkitIDBDatabaseException;
+        attribute [V8EnabledAtRuntime] IDBFactoryConstructor webkitIDBFactory;
+        attribute [V8EnabledAtRuntime] IDBIndexConstructor webkitIDBIndex;
+        attribute [V8EnabledAtRuntime] IDBKeyRangeConstructor webkitIDBKeyRange;
+        attribute [V8EnabledAtRuntime] IDBObjectStoreConstructor webkitIDBObjectStore;
+        attribute [V8EnabledAtRuntime] IDBRequestConstructor webkitIDBRequest;
+        attribute [V8EnabledAtRuntime] IDBTransactionConstructor webkitIDBTransaction;
+    };
+
+}
diff --git a/Source/WebCore/Modules/intents/DOMWindowIntents.idl b/Source/WebCore/Modules/intents/DOMWindowIntents.idl
index b8a089d34..638dbe034 100644
--- a/Source/WebCore/Modules/intents/DOMWindowIntents.idl
+++ b/Source/WebCore/Modules/intents/DOMWindowIntents.idl
@@ -1,20 +1,27 @@
 /*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 module window {
diff --git a/Source/WebCore/Modules/mediastream/DOMWindowMediaStream.idl b/Source/WebCore/Modules/mediastream/DOMWindowMediaStream.idl
new file mode 100644
index 000000000..85011ae96
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/DOMWindowMediaStream.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+
+    interface [
+        Conditional=MEDIA_STREAM,
+        Supplemental=DOMWindow
+    ] DOMWindowMediaStream {
+        attribute [V8EnabledAtRuntime] PeerConnectionConstructor webkitPeerConnection;
+        attribute MediaStreamEventConstructor MediaStreamEvent;
+    };
+
+}
diff --git a/Source/WebCore/mediastream/LocalMediaStream.cpp b/Source/WebCore/Modules/mediastream/LocalMediaStream.cpp
index 31ba25bfc..31ba25bfc 100644
--- a/Source/WebCore/mediastream/LocalMediaStream.cpp
+++ b/Source/WebCore/Modules/mediastream/LocalMediaStream.cpp
diff --git a/Source/WebCore/mediastream/LocalMediaStream.h b/Source/WebCore/Modules/mediastream/LocalMediaStream.h
index 8c958085a..8c958085a 100644
--- a/Source/WebCore/mediastream/LocalMediaStream.h
+++ b/Source/WebCore/Modules/mediastream/LocalMediaStream.h
diff --git a/Source/WebCore/mediastream/LocalMediaStream.idl b/Source/WebCore/Modules/mediastream/LocalMediaStream.idl
index 49360fff2..49360fff2 100644
--- a/Source/WebCore/mediastream/LocalMediaStream.idl
+++ b/Source/WebCore/Modules/mediastream/LocalMediaStream.idl
diff --git a/Source/WebCore/mediastream/MediaStream.cpp b/Source/WebCore/Modules/mediastream/MediaStream.cpp
index 01f1e04e6..01f1e04e6 100644
--- a/Source/WebCore/mediastream/MediaStream.cpp
+++ b/Source/WebCore/Modules/mediastream/MediaStream.cpp
diff --git a/Source/WebCore/mediastream/MediaStream.h b/Source/WebCore/Modules/mediastream/MediaStream.h
index 0db47879f..0db47879f 100644
--- a/Source/WebCore/mediastream/MediaStream.h
+++ b/Source/WebCore/Modules/mediastream/MediaStream.h
diff --git a/Source/WebCore/mediastream/MediaStream.idl b/Source/WebCore/Modules/mediastream/MediaStream.idl
index 65a183312..65a183312 100644
--- a/Source/WebCore/mediastream/MediaStream.idl
+++ b/Source/WebCore/Modules/mediastream/MediaStream.idl
diff --git a/Source/WebCore/mediastream/MediaStreamEvent.cpp b/Source/WebCore/Modules/mediastream/MediaStreamEvent.cpp
index be0e5cbc5..be0e5cbc5 100644
--- a/Source/WebCore/mediastream/MediaStreamEvent.cpp
+++ b/Source/WebCore/Modules/mediastream/MediaStreamEvent.cpp
diff --git a/Source/WebCore/mediastream/MediaStreamEvent.h b/Source/WebCore/Modules/mediastream/MediaStreamEvent.h
index 01b06565b..01b06565b 100644
--- a/Source/WebCore/mediastream/MediaStreamEvent.h
+++ b/Source/WebCore/Modules/mediastream/MediaStreamEvent.h
diff --git a/Source/WebCore/mediastream/MediaStreamEvent.idl b/Source/WebCore/Modules/mediastream/MediaStreamEvent.idl
index a1930a4b6..a1930a4b6 100644
--- a/Source/WebCore/mediastream/MediaStreamEvent.idl
+++ b/Source/WebCore/Modules/mediastream/MediaStreamEvent.idl
diff --git a/Source/WebCore/mediastream/MediaStreamList.cpp b/Source/WebCore/Modules/mediastream/MediaStreamList.cpp
index 50921300e..ba7407419 100644
--- a/Source/WebCore/mediastream/MediaStreamList.cpp
+++ b/Source/WebCore/Modules/mediastream/MediaStreamList.cpp
@@ -50,6 +50,8 @@ unsigned MediaStreamList::length() const
 
 MediaStream* MediaStreamList::item(unsigned index) const
 {
+    if (index >= m_streams.size())
+        return 0;
     return m_streams[index].get();
 }
 
diff --git a/Source/WebCore/mediastream/MediaStreamList.h b/Source/WebCore/Modules/mediastream/MediaStreamList.h
index a056ade51..a056ade51 100644
--- a/Source/WebCore/mediastream/MediaStreamList.h
+++ b/Source/WebCore/Modules/mediastream/MediaStreamList.h
diff --git a/Source/WebCore/mediastream/MediaStreamList.idl b/Source/WebCore/Modules/mediastream/MediaStreamList.idl
index d182e6f82..d182e6f82 100644
--- a/Source/WebCore/mediastream/MediaStreamList.idl
+++ b/Source/WebCore/Modules/mediastream/MediaStreamList.idl
diff --git a/Source/WebCore/mediastream/MediaStreamRegistry.cpp b/Source/WebCore/Modules/mediastream/MediaStreamRegistry.cpp
index eb9fdbbb3..eb9fdbbb3 100644
--- a/Source/WebCore/mediastream/MediaStreamRegistry.cpp
+++ b/Source/WebCore/Modules/mediastream/MediaStreamRegistry.cpp
diff --git a/Source/WebCore/mediastream/MediaStreamRegistry.h b/Source/WebCore/Modules/mediastream/MediaStreamRegistry.h
index 1f9274509..1f9274509 100644
--- a/Source/WebCore/mediastream/MediaStreamRegistry.h
+++ b/Source/WebCore/Modules/mediastream/MediaStreamRegistry.h
diff --git a/Source/WebCore/mediastream/MediaStreamTrack.cpp b/Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp
index c34efa5f2..c34efa5f2 100644
--- a/Source/WebCore/mediastream/MediaStreamTrack.cpp
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrack.cpp
diff --git a/Source/WebCore/mediastream/MediaStreamTrack.h b/Source/WebCore/Modules/mediastream/MediaStreamTrack.h
index c45be18c7..c45be18c7 100644
--- a/Source/WebCore/mediastream/MediaStreamTrack.h
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrack.h
diff --git a/Source/WebCore/mediastream/MediaStreamTrack.idl b/Source/WebCore/Modules/mediastream/MediaStreamTrack.idl
index 79875975e..79875975e 100644
--- a/Source/WebCore/mediastream/MediaStreamTrack.idl
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrack.idl
diff --git a/Source/WebCore/mediastream/MediaStreamTrackList.cpp b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.cpp
index 92bf0f786..b63bcef61 100644
--- a/Source/WebCore/mediastream/MediaStreamTrackList.cpp
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.cpp
@@ -51,7 +51,8 @@ unsigned MediaStreamTrackList::length() const
 
 MediaStreamTrack* MediaStreamTrackList::item(unsigned index) const
 {
-    ASSERT(index < length());
+    if (index >= m_trackVector.size())
+        return 0;
     return m_trackVector[index].get();
 }
 
diff --git a/Source/WebCore/mediastream/MediaStreamTrackList.h b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.h
index 4d61f85e6..4d61f85e6 100644
--- a/Source/WebCore/mediastream/MediaStreamTrackList.h
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.h
diff --git a/Source/WebCore/mediastream/MediaStreamTrackList.idl b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.idl
index 4dd9c2972..4dd9c2972 100644
--- a/Source/WebCore/mediastream/MediaStreamTrackList.idl
+++ b/Source/WebCore/Modules/mediastream/MediaStreamTrackList.idl
diff --git a/Source/WebCore/Modules/mediastream/NavigatorMediaStream.cpp b/Source/WebCore/Modules/mediastream/NavigatorMediaStream.cpp
new file mode 100644
index 000000000..0b21d8ca2
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/NavigatorMediaStream.cpp
@@ -0,0 +1,70 @@
+/*
+ *  Copyright (C) 2000 Harri Porten (porten@kde.org)
+ *  Copyright (c) 2000 Daniel Molkentin (molkentin@kde.org)
+ *  Copyright (c) 2000 Stefan Schimanski (schimmi@kde.org)
+ *  Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ *  Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "NavigatorMediaStream.h"
+
+#if ENABLE(MEDIA_STREAM)
+
+#include "Document.h"
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "Navigator.h"
+#include "NavigatorUserMediaErrorCallback.h"
+#include "NavigatorUserMediaSuccessCallback.h"
+#include "Page.h"
+#include "UserMediaController.h"
+#include "UserMediaRequest.h"
+
+namespace WebCore {
+
+NavigatorMediaStream::NavigatorMediaStream()
+{
+}
+
+NavigatorMediaStream::~NavigatorMediaStream()
+{
+}
+
+void NavigatorMediaStream::webkitGetUserMedia(Navigator* navigator, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback> successCallback, PassRefPtr<NavigatorUserMediaErrorCallback> errorCallback, ExceptionCode& ec)
+{
+    if (!successCallback)
+        return;
+
+    UserMediaController* userMedia = UserMediaController::from(navigator->frame() ? navigator->frame()->page() : 0);
+    if (!userMedia) {
+        ec = NOT_SUPPORTED_ERR;
+        return;
+    }
+
+    RefPtr<UserMediaRequest> request = UserMediaRequest::create(navigator->frame()->document(), userMedia, options, successCallback, errorCallback);
+    if (!request) {
+        ec = NOT_SUPPORTED_ERR;
+        return;
+    }
+
+    request->start();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
diff --git a/Source/WebCore/Modules/mediastream/NavigatorMediaStream.h b/Source/WebCore/Modules/mediastream/NavigatorMediaStream.h
new file mode 100644
index 000000000..6ea5da4c0
--- /dev/null
+++ b/Source/WebCore/Modules/mediastream/NavigatorMediaStream.h
@@ -0,0 +1,49 @@
+/*
+    Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef NavigatorMediaStream_h
+#define NavigatorMediaStream_h
+
+#if ENABLE(MEDIA_STREAM)
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class Navigator;
+class NavigatorUserMediaErrorCallback;
+class NavigatorUserMediaSuccessCallback;
+
+typedef int ExceptionCode;
+
+class NavigatorMediaStream {
+public:
+    static void webkitGetUserMedia(Navigator*, const String& options, PassRefPtr<NavigatorUserMediaSuccessCallback>, PassRefPtr<NavigatorUserMediaErrorCallback>, ExceptionCode&);
+
+private:
+    NavigatorMediaStream();
+    ~NavigatorMediaStream();
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(MEDIA_STREAM)
+
+#endif // NavigatorMediaStream_h
diff --git a/Source/WebCore/mediastream/NavigatorMediaStream.idl b/Source/WebCore/Modules/mediastream/NavigatorMediaStream.idl
index 84e062e64..84e062e64 100644
--- a/Source/WebCore/mediastream/NavigatorMediaStream.idl
+++ b/Source/WebCore/Modules/mediastream/NavigatorMediaStream.idl
diff --git a/Source/WebCore/mediastream/NavigatorUserMediaError.h b/Source/WebCore/Modules/mediastream/NavigatorUserMediaError.h
index 5edd97d90..5edd97d90 100644
--- a/Source/WebCore/mediastream/NavigatorUserMediaError.h
+++ b/Source/WebCore/Modules/mediastream/NavigatorUserMediaError.h
diff --git a/Source/WebCore/mediastream/NavigatorUserMediaError.idl b/Source/WebCore/Modules/mediastream/NavigatorUserMediaError.idl
index 293450b22..293450b22 100644
--- a/Source/WebCore/mediastream/NavigatorUserMediaError.idl
+++ b/Source/WebCore/Modules/mediastream/NavigatorUserMediaError.idl
diff --git a/Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.h b/Source/WebCore/Modules/mediastream/NavigatorUserMediaErrorCallback.h
index dd3c8b32b..dd3c8b32b 100644
--- a/Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.h
+++ b/Source/WebCore/Modules/mediastream/NavigatorUserMediaErrorCallback.h
diff --git a/Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.idl b/Source/WebCore/Modules/mediastream/NavigatorUserMediaErrorCallback.idl
index 44928f81f..44928f81f 100644
--- a/Source/WebCore/mediastream/NavigatorUserMediaErrorCallback.idl
+++ b/Source/WebCore/Modules/mediastream/NavigatorUserMediaErrorCallback.idl
diff --git a/Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.h b/Source/WebCore/Modules/mediastream/NavigatorUserMediaSuccessCallback.h
index 2b6aae5df..2b6aae5df 100644
--- a/Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.h
+++ b/Source/WebCore/Modules/mediastream/NavigatorUserMediaSuccessCallback.h
diff --git a/Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.idl b/Source/WebCore/Modules/mediastream/NavigatorUserMediaSuccessCallback.idl
index 0a661807b..0a661807b 100644
--- a/Source/WebCore/mediastream/NavigatorUserMediaSuccessCallback.idl
+++ b/Source/WebCore/Modules/mediastream/NavigatorUserMediaSuccessCallback.idl
diff --git a/Source/WebCore/mediastream/PeerConnection.cpp b/Source/WebCore/Modules/mediastream/PeerConnection.cpp
index 4dd3bf0da..4dd3bf0da 100644
--- a/Source/WebCore/mediastream/PeerConnection.cpp
+++ b/Source/WebCore/Modules/mediastream/PeerConnection.cpp
diff --git a/Source/WebCore/mediastream/PeerConnection.h b/Source/WebCore/Modules/mediastream/PeerConnection.h
index fd2f2fb2d..fd2f2fb2d 100644
--- a/Source/WebCore/mediastream/PeerConnection.h
+++ b/Source/WebCore/Modules/mediastream/PeerConnection.h
diff --git a/Source/WebCore/mediastream/PeerConnection.idl b/Source/WebCore/Modules/mediastream/PeerConnection.idl
index 7760d10ce..7543a0dbc 100644
--- a/Source/WebCore/mediastream/PeerConnection.idl
+++ b/Source/WebCore/Modules/mediastream/PeerConnection.idl
@@ -27,7 +27,6 @@ module p2p {
     interface [
         Conditional=MEDIA_STREAM,
         ActiveDOMObject,
-        ConstructorParameters=2,
         Constructor(in DOMString serverConfiguration, in [Callback] SignalingCallback signalingCallback),
         CallWith=ScriptExecutionContext,
         JSCustomConstructor,
diff --git a/Source/WebCore/mediastream/SignalingCallback.h b/Source/WebCore/Modules/mediastream/SignalingCallback.h
index a4a30e712..a4a30e712 100644
--- a/Source/WebCore/mediastream/SignalingCallback.h
+++ b/Source/WebCore/Modules/mediastream/SignalingCallback.h
diff --git a/Source/WebCore/mediastream/SignalingCallback.idl b/Source/WebCore/Modules/mediastream/SignalingCallback.idl
index e2e0cebd2..e2e0cebd2 100644
--- a/Source/WebCore/mediastream/SignalingCallback.idl
+++ b/Source/WebCore/Modules/mediastream/SignalingCallback.idl
diff --git a/Source/WebCore/mediastream/UserMediaClient.h b/Source/WebCore/Modules/mediastream/UserMediaClient.h
index 744711e42..744711e42 100644
--- a/Source/WebCore/mediastream/UserMediaClient.h
+++ b/Source/WebCore/Modules/mediastream/UserMediaClient.h
diff --git a/Source/WebCore/mediastream/UserMediaController.cpp b/Source/WebCore/Modules/mediastream/UserMediaController.cpp
index 3b4dd14e9..3077d411b 100644
--- a/Source/WebCore/mediastream/UserMediaController.cpp
+++ b/Source/WebCore/Modules/mediastream/UserMediaController.cpp
@@ -52,7 +52,7 @@ PassOwnPtr<UserMediaController> UserMediaController::create(UserMediaClient* cli
 
 void provideUserMediaTo(Page* page, UserMediaClient* client)
 {
-    PageSupplement::provideTo(page, UserMediaController::supplementName(), UserMediaController::create(client));
+    UserMediaController::provideTo(page, UserMediaController::supplementName(), UserMediaController::create(client));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/mediastream/UserMediaController.h b/Source/WebCore/Modules/mediastream/UserMediaController.h
index 6b0590ecf..dd85c0341 100644
--- a/Source/WebCore/mediastream/UserMediaController.h
+++ b/Source/WebCore/Modules/mediastream/UserMediaController.h
@@ -27,16 +27,13 @@
 
 #if ENABLE(MEDIA_STREAM)
 
-#include "PageSupplement.h"
+#include "Page.h"
 #include "UserMediaClient.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
-class Frame;
-class Page;
-
-class UserMediaController : public PageSupplement {
+class UserMediaController : public Supplement<Page> {
 public:
     ~UserMediaController();
 
@@ -46,8 +43,7 @@ public:
 
     static PassOwnPtr<UserMediaController> create(UserMediaClient*);
     static const AtomicString& supplementName();
-    static UserMediaController* from(Frame* frame) { return static_cast<UserMediaController*>(PageSupplement::from(frame, supplementName())); }
-    static UserMediaController* from(Page* page) { return static_cast<UserMediaController*>(PageSupplement::from(page, supplementName())); }
+    static UserMediaController* from(Page* page) { return static_cast<UserMediaController*>(Supplement<Page>::from(page, supplementName())); }
 
 protected:
     UserMediaController(UserMediaClient*);
diff --git a/Source/WebCore/mediastream/UserMediaRequest.cpp b/Source/WebCore/Modules/mediastream/UserMediaRequest.cpp
index 3f3c9efe1..3f3c9efe1 100644
--- a/Source/WebCore/mediastream/UserMediaRequest.cpp
+++ b/Source/WebCore/Modules/mediastream/UserMediaRequest.cpp
diff --git a/Source/WebCore/mediastream/UserMediaRequest.h b/Source/WebCore/Modules/mediastream/UserMediaRequest.h
index 6af31f30b..6af31f30b 100644
--- a/Source/WebCore/mediastream/UserMediaRequest.h
+++ b/Source/WebCore/Modules/mediastream/UserMediaRequest.h
diff --git a/Source/WebCore/Modules/speech/DOMWindowSpeech.idl b/Source/WebCore/Modules/speech/DOMWindowSpeech.idl
new file mode 100644
index 000000000..70200b1be
--- /dev/null
+++ b/Source/WebCore/Modules/speech/DOMWindowSpeech.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+    interface [
+        Conditional=SCRIPTED_SPEECH,
+        Supplemental=DOMWindow
+    ] DOMWindowSpeech {
+        attribute [V8EnabledAtRuntime] SpeechRecognitionErrorConstructor webkitSpeechRecognitionError;
+        attribute [V8EnabledAtRuntime] SpeechRecognitionEventConstructor webkitSpeechRecognitionEvent;
+        attribute [V8EnabledAtRuntime] SpeechGrammarConstructor webkitSpeechGrammar;
+        attribute [V8EnabledAtRuntime] SpeechGrammarListConstructor webkitSpeechGrammarList;
+    };
+}
diff --git a/Source/WebCore/Modules/speech/SpeechGrammar.cpp b/Source/WebCore/Modules/speech/SpeechGrammar.cpp
new file mode 100644
index 000000000..1736e1e4a
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechGrammar.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "SpeechGrammar.h"
+
+#include "Document.h"
+
+namespace WebCore {
+
+PassRefPtr<SpeechGrammar> SpeechGrammar::create()
+{
+    return adoptRef(new SpeechGrammar);
+}
+
+PassRefPtr<SpeechGrammar> SpeechGrammar::create(const KURL& src, double weight)
+{
+    return adoptRef(new SpeechGrammar(src, weight));
+}
+
+void SpeechGrammar::setSrc(ScriptExecutionContext* scriptExecutionContext, const String& src)
+{
+    ASSERT(scriptExecutionContext->isDocument());
+    Document* document = static_cast<Document*>(scriptExecutionContext);
+    m_src = document->completeURL(src);
+}
+
+SpeechGrammar::SpeechGrammar()
+    : m_weight(1.0)
+{
+}
+
+SpeechGrammar::SpeechGrammar(const KURL& src, double weight)
+    : m_src(src)
+    , m_weight(weight)
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
diff --git a/Source/WebCore/Modules/speech/SpeechGrammar.h b/Source/WebCore/Modules/speech/SpeechGrammar.h
new file mode 100644
index 000000000..62088c18b
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechGrammar.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SpeechGrammar_h
+#define SpeechGrammar_h
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "KURL.h"
+#include "PlatformString.h"
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class ScriptExecutionContext;
+
+class SpeechGrammar : public RefCounted<SpeechGrammar> {
+public:
+    static PassRefPtr<SpeechGrammar> create(); // FIXME: The spec is not clear on what the constructor should look like.
+    static PassRefPtr<SpeechGrammar> create(const KURL& src, double weight);
+
+    const KURL& src(ScriptExecutionContext*) const { return m_src; }
+    void setSrc(ScriptExecutionContext*, const String& src);
+
+    double weight() const { return m_weight; }
+    void setWeight(double weight) { m_weight = weight; }
+
+private:
+    SpeechGrammar();
+    SpeechGrammar(const KURL& src, double weight);
+
+    KURL m_src;
+    double m_weight;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
+
+#endif // SpeechGrammar_h
diff --git a/Source/WebCore/Modules/speech/SpeechGrammar.idl b/Source/WebCore/Modules/speech/SpeechGrammar.idl
new file mode 100644
index 000000000..b793ac3ab
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechGrammar.idl
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        Conditional=SCRIPTED_SPEECH,
+        Constructor
+    ] SpeechGrammar {
+        attribute [URL,CallWith=ScriptExecutionContext] DOMString src;
+        attribute float weight;
+    };
+}
diff --git a/Source/WebCore/Modules/speech/SpeechGrammarList.cpp b/Source/WebCore/Modules/speech/SpeechGrammarList.cpp
new file mode 100644
index 000000000..841df2948
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechGrammarList.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "SpeechGrammarList.h"
+
+#include "Document.h"
+
+namespace WebCore {
+
+PassRefPtr<SpeechGrammarList> SpeechGrammarList::create()
+{
+    return adoptRef(new SpeechGrammarList);
+}
+
+SpeechGrammar* SpeechGrammarList::item(unsigned long index) const
+{
+    if (index >= m_grammars.size())
+        return 0;
+
+    return m_grammars[index].get();
+}
+
+void SpeechGrammarList::addFromUri(ScriptExecutionContext* scriptExecutionContext, const String& src, double weight)
+{
+    ASSERT(scriptExecutionContext->isDocument());
+    Document* document = static_cast<Document*>(scriptExecutionContext);
+    m_grammars.append(SpeechGrammar::create(document->completeURL(src), weight));
+}
+
+void SpeechGrammarList::addFromString(const String& string, double weight)
+{
+    String urlString = String("data:application/xml,") + encodeWithURLEscapeSequences(string);
+    m_grammars.append(SpeechGrammar::create(KURL(KURL(), urlString), weight));
+}
+
+SpeechGrammarList::SpeechGrammarList()
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
diff --git a/Source/WebCore/Modules/speech/SpeechGrammarList.h b/Source/WebCore/Modules/speech/SpeechGrammarList.h
new file mode 100644
index 000000000..d7b53d757
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechGrammarList.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SpeechGrammarList_h
+#define SpeechGrammarList_h
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "SpeechGrammar.h"
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class ScriptExecutionContext;
+
+class SpeechGrammarList : public RefCounted<SpeechGrammarList> {
+public:
+    static PassRefPtr<SpeechGrammarList> create();
+
+    unsigned long length() const { return m_grammars.size(); }
+    SpeechGrammar* item(unsigned long) const;
+
+    void addFromUri(ScriptExecutionContext*, const String& src, double weight = 1.0);
+    void addFromString(const String&, double weight = 1.0);
+
+private:
+    SpeechGrammarList();
+
+    Vector<RefPtr<SpeechGrammar> > m_grammars;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
+
+#endif // SpeechGrammarList_h
diff --git a/Source/WebCore/Modules/speech/SpeechGrammarList.idl b/Source/WebCore/Modules/speech/SpeechGrammarList.idl
new file mode 100644
index 000000000..bf4d7c69f
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechGrammarList.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        Conditional=SCRIPTED_SPEECH,
+        IndexedGetter,
+        Constructor,
+    ] SpeechGrammarList {
+        readonly attribute unsigned long length;
+        SpeechGrammar item(in [IsIndex] unsigned long index);
+        [CallWith=ScriptExecutionContext] void addFromUri(in DOMString src, in [Optional] float weight);
+        void addFromString(in DOMString string, in [Optional] float weight);
+    };
+}
diff --git a/Source/WebCore/page/NavigatorSupplement.cpp b/Source/WebCore/Modules/speech/SpeechRecognitionAlternative.cpp
index bb424d4d6..c58c1e78e 100644
--- a/Source/WebCore/page/NavigatorSupplement.cpp
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionAlternative.cpp
@@ -24,27 +24,24 @@
  */
 
 #include "config.h"
-#include "NavigatorSupplement.h"
 
-#include "Navigator.h"
-#include <wtf/PassOwnPtr.h>
+#if ENABLE(SCRIPTED_SPEECH)
 
-namespace WebCore {
+#include "SpeechRecognitionAlternative.h"
 
-NavigatorSupplement::~NavigatorSupplement()
-{
-}
+namespace WebCore {
 
-void NavigatorSupplement::provideTo(Navigator* navigator, const AtomicString& key, PassOwnPtr<NavigatorSupplement> supplement)
+PassRefPtr<SpeechRecognitionAlternative> SpeechRecognitionAlternative::create(const String& transcript, double confidence)
 {
-    navigator->provideSupplement(key, supplement);
+    return adoptRef(new SpeechRecognitionAlternative(transcript, confidence));
 }
 
-NavigatorSupplement* NavigatorSupplement::from(Navigator* navigator, const AtomicString& name)
+SpeechRecognitionAlternative::SpeechRecognitionAlternative(const String& transcript, double confidence)
+    : m_transcript(transcript)
+    , m_confidence(confidence)
 {
-    if (!navigator)
-        return 0;
-    return navigator->requireSupplement(name);
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionAlternative.h b/Source/WebCore/Modules/speech/SpeechRecognitionAlternative.h
new file mode 100644
index 000000000..c577ea7ce
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionAlternative.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SpeechRecognitionAlternative_h
+#define SpeechRecognitionAlternative_h
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "PlatformString.h"
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class ScriptExecutionContext;
+
+class SpeechRecognitionAlternative : public RefCounted<SpeechRecognitionAlternative> {
+public:
+    static PassRefPtr<SpeechRecognitionAlternative> create(const String&, double);
+
+    const String& transcript() const { return m_transcript; }
+    double confidence() const { return m_confidence; }
+
+private:
+    SpeechRecognitionAlternative(const String&, double);
+
+    String m_transcript;
+    double m_confidence;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
+
+#endif // SpeechRecognitionAlternative_h
diff --git a/Source/WebCore/page/PageSupplement.h b/Source/WebCore/Modules/speech/SpeechRecognitionAlternative.idl
index e1b48aa90..a9d4dec3d 100644
--- a/Source/WebCore/page/PageSupplement.h
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionAlternative.idl
@@ -23,28 +23,12 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef PageSupplement_h
-#define PageSupplement_h
+module core {
+    interface [
+        Conditional=SCRIPTED_SPEECH
+    ] SpeechRecognitionAlternative {
+        readonly attribute DOMString transcript;
+        readonly attribute float confidence;
+    };
+}
 
-#include <wtf/Forward.h>
-#include <wtf/Noncopyable.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/text/AtomicString.h>
-
-namespace WebCore {
-
-class Page;
-class Frame;
-
-class PageSupplement {
-public:
-    virtual ~PageSupplement();
-
-    static void provideTo(Page*, const AtomicString&, PassOwnPtr<PageSupplement>);
-    static PageSupplement* from(Page*, const AtomicString&);
-    static PageSupplement* from(Frame*, const AtomicString&);
-};
-
-} // namespace WebCore
-
-#endif // PageSupplement_h
diff --git a/Source/WebCore/page/NavigatorSupplement.h b/Source/WebCore/Modules/speech/SpeechRecognitionError.cpp
index fc958fd96..b7b507237 100644
--- a/Source/WebCore/page/NavigatorSupplement.h
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionError.cpp
@@ -23,26 +23,25 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef NavigatorSupplement_h
-#define NavigatorSupplement_h
+#include "config.h"
 
-#include <wtf/Forward.h>
-#include <wtf/Noncopyable.h>
-#include <wtf/OwnPtr.h>
-#include <wtf/text/AtomicString.h>
+#if ENABLE(SCRIPTED_SPEECH)
 
-namespace WebCore {
+#include "SpeechRecognitionError.h"
 
-class Navigator;
+namespace WebCore {
 
-class NavigatorSupplement {
-public:
-    virtual ~NavigatorSupplement();
+PassRefPtr<SpeechRecognitionError> SpeechRecognitionError::create(Code code, const String& message)
+{
+    return adoptRef(new SpeechRecognitionError(code, message));
+}
 
-    static void provideTo(Navigator*, const AtomicString&, PassOwnPtr<NavigatorSupplement>);
-    static NavigatorSupplement* from(Navigator*, const AtomicString&);
-};
+SpeechRecognitionError::SpeechRecognitionError(Code code, const String& message)
+    : m_code(code)
+    , m_message(message)
+{
+}
 
 } // namespace WebCore
 
-#endif // NavigatorSupplement_h
+#endif // ENABLE(SCRIPTED_SPEECH)
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionError.h b/Source/WebCore/Modules/speech/SpeechRecognitionError.h
new file mode 100644
index 000000000..daf945c58
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionError.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SpeechRecognitionError_h
+#define SpeechRecognitionError_h
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "PlatformString.h"
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class SpeechRecognitionError : public RefCounted<SpeechRecognitionError> {
+public:
+    enum Code {
+        OTHER = 0,
+        NO_SPEECH = 1,
+        ABORTED = 2,
+        AUDIO_CAPTURE = 3,
+        NETWORK = 4,
+        NOT_ALLOWED = 5,
+        SERVICE_NOT_ALLOWED = 6,
+        BAD_GRAMMAR = 7,
+        LANGUAGE_NOT_SUPPORTED = 8
+    };
+
+    static PassRefPtr<SpeechRecognitionError> create(Code, const String&);
+
+    Code code() { return m_code; }
+    const String& message() { return m_message; }
+
+private:
+    SpeechRecognitionError(Code, const String&);
+
+    Code m_code;
+    String m_message;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
+
+#endif // SpeechRecognitionError_h
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionError.idl b/Source/WebCore/Modules/speech/SpeechRecognitionError.idl
new file mode 100644
index 000000000..39ecb1d0a
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionError.idl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        Conditional=SCRIPTED_SPEECH
+    ] SpeechRecognitionError {
+        const unsigned short OTHER = 0;
+        const unsigned short NO_SPEECH = 1;
+        const unsigned short ABORTED = 2;
+        const unsigned short AUDIO_CAPTURE = 3;
+        const unsigned short NETWORK = 4;
+        const unsigned short NOT_ALLOWED = 5;
+        const unsigned short SERVICE_NOT_ALLOWED = 6;
+        const unsigned short BAD_GRAMMAR = 7;
+        const unsigned short LANGUAGE_NOT_SUPPORTED = 8;
+
+        readonly attribute unsigned short code;
+        readonly attribute DOMString message;
+    };
+}
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionEvent.cpp b/Source/WebCore/Modules/speech/SpeechRecognitionEvent.cpp
new file mode 100644
index 000000000..c9f88e3a9
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionEvent.cpp
@@ -0,0 +1,106 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "SpeechRecognitionEvent.h"
+
+namespace WebCore {
+
+SpeechRecognitionEventInit::SpeechRecognitionEventInit()
+    : resultIndex(0)
+{
+}
+
+PassRefPtr<SpeechRecognitionEvent> SpeechRecognitionEvent::create()
+{
+    return adoptRef(new SpeechRecognitionEvent());
+}
+
+PassRefPtr<SpeechRecognitionEvent> SpeechRecognitionEvent::create(const AtomicString& eventName, const SpeechRecognitionEventInit& initializer)
+{
+    return adoptRef(new SpeechRecognitionEvent(eventName, initializer));
+}
+
+PassRefPtr<SpeechRecognitionEvent> SpeechRecognitionEvent::createResult(PassRefPtr<SpeechRecognitionResult> result, short resultIndex, PassRefPtr<SpeechRecognitionResultList> resultHistory)
+{
+    return adoptRef(new SpeechRecognitionEvent(eventNames().resultEvent, result, resultIndex, resultHistory));
+}
+
+PassRefPtr<SpeechRecognitionEvent> SpeechRecognitionEvent::createNoMatch(PassRefPtr<SpeechRecognitionResult> result)
+{
+    return adoptRef(new SpeechRecognitionEvent(eventNames().nomatchEvent, result, 0, 0));
+}
+
+PassRefPtr<SpeechRecognitionEvent> SpeechRecognitionEvent::createResultDeleted(short resultIndex, PassRefPtr<SpeechRecognitionResultList> resultHistory)
+{
+    return adoptRef(new SpeechRecognitionEvent(eventNames().resultdeletedEvent, 0, resultIndex, resultHistory));
+}
+
+PassRefPtr<SpeechRecognitionEvent> SpeechRecognitionEvent::createError(PassRefPtr<SpeechRecognitionError> error)
+{
+    return adoptRef(new SpeechRecognitionEvent(error));
+}
+
+const AtomicString& SpeechRecognitionEvent::interfaceName() const
+{
+    return eventNames().interfaceForSpeechRecognitionEvent;
+}
+
+SpeechRecognitionEvent::SpeechRecognitionEvent()
+    : m_resultIndex(0)
+{
+}
+
+SpeechRecognitionEvent::SpeechRecognitionEvent(const AtomicString& eventName, const SpeechRecognitionEventInit& initializer)
+    : Event(eventName, initializer)
+    , m_result(initializer.result)
+    , m_error(initializer.error)
+    , m_resultIndex(initializer.resultIndex)
+    , m_resultHistory(initializer.resultHistory)
+{
+}
+
+SpeechRecognitionEvent::SpeechRecognitionEvent(const AtomicString& eventName, PassRefPtr<SpeechRecognitionResult> result, short resultIndex, PassRefPtr<SpeechRecognitionResultList> resultHistory)
+    : Event(eventName, /*canBubble=*/false, /*cancelable=*/false)
+    , m_result(result)
+    , m_error(0)
+    , m_resultIndex(resultIndex)
+    , m_resultHistory(resultHistory)
+{
+}
+
+SpeechRecognitionEvent::SpeechRecognitionEvent(PassRefPtr<SpeechRecognitionError> error)
+    : Event(eventNames().errorEvent, /*canBubble=*/false, /*cancelable=*/false) // FIXME: The spec should say whether these bubble or not.
+    , m_error(error)
+    , m_resultIndex(0)
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionEvent.h b/Source/WebCore/Modules/speech/SpeechRecognitionEvent.h
new file mode 100644
index 000000000..443906e88
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionEvent.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SpeechRecognitionEvent_h
+#define SpeechRecognitionEvent_h
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "Event.h"
+#include "SpeechRecognitionError.h"
+#include "SpeechRecognitionResult.h"
+#include "SpeechRecognitionResultList.h"
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class SpeechRecognitionError;
+class SpeechRecognitionResult;
+class SpeechRecognitionResultList;
+
+struct SpeechRecognitionEventInit : public EventInit {
+    SpeechRecognitionEventInit();
+
+    RefPtr<SpeechRecognitionResult> result;
+    RefPtr<SpeechRecognitionError> error;
+    short resultIndex;
+    RefPtr<SpeechRecognitionResultList> resultHistory;
+};
+
+class SpeechRecognitionEvent : public Event {
+public:
+    static PassRefPtr<SpeechRecognitionEvent> create();
+    static PassRefPtr<SpeechRecognitionEvent> create(const AtomicString&, const SpeechRecognitionEventInit&);
+
+    static PassRefPtr<SpeechRecognitionEvent> createResult(PassRefPtr<SpeechRecognitionResult>, short resultIndex, PassRefPtr<SpeechRecognitionResultList> resultHistory);
+    static PassRefPtr<SpeechRecognitionEvent> createNoMatch(PassRefPtr<SpeechRecognitionResult>);
+    static PassRefPtr<SpeechRecognitionEvent> createResultDeleted(short resultIndex, PassRefPtr<SpeechRecognitionResultList> resultHistory);
+    static PassRefPtr<SpeechRecognitionEvent> createError(PassRefPtr<SpeechRecognitionError>);
+
+    SpeechRecognitionResult* result() const { return m_result.get(); }
+    SpeechRecognitionError* error() const { return m_error.get(); }
+    short resultIndex() const { return m_resultIndex; } // FIXME: Spec says this should be short, but other indices are unsigned ints.
+    SpeechRecognitionResultList* resultHistory() const { return m_resultHistory.get(); }
+
+    // Event
+    virtual const AtomicString& interfaceName() const OVERRIDE;
+
+private:
+    SpeechRecognitionEvent();
+    SpeechRecognitionEvent(const AtomicString&, const SpeechRecognitionEventInit&);
+    SpeechRecognitionEvent(const AtomicString& eventName, PassRefPtr<SpeechRecognitionResult>, short resultIndex, PassRefPtr<SpeechRecognitionResultList> resultHistory);
+    SpeechRecognitionEvent(PassRefPtr<SpeechRecognitionError>);
+
+    RefPtr<SpeechRecognitionResult> m_result;
+    RefPtr<SpeechRecognitionError> m_error;
+    short m_resultIndex;
+    RefPtr<SpeechRecognitionResultList> m_resultHistory;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
+
+#endif // SpeechRecognitionEvent_h
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionEvent.idl b/Source/WebCore/Modules/speech/SpeechRecognitionEvent.idl
new file mode 100644
index 000000000..49000810c
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionEvent.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module events {
+    interface [
+        Conditional=SCRIPTED_SPEECH,
+        ConstructorTemplate=Event
+    ] SpeechRecognitionEvent : Event {
+        readonly attribute [InitializedByEventConstructor] SpeechRecognitionResult result;
+        readonly attribute [InitializedByEventConstructor] SpeechRecognitionError error;
+        readonly attribute [InitializedByEventConstructor] short resultIndex;
+        readonly attribute [InitializedByEventConstructor] SpeechRecognitionResultList resultHistory;
+    };
+}
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionResult.cpp b/Source/WebCore/Modules/speech/SpeechRecognitionResult.cpp
new file mode 100644
index 000000000..1dff24c19
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionResult.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "SpeechRecognitionResult.h"
+
+namespace WebCore {
+
+PassRefPtr<SpeechRecognitionResult> SpeechRecognitionResult::create(const Vector<RefPtr<SpeechRecognitionAlternative> >& alternatives, bool final)
+{
+    return adoptRef(new SpeechRecognitionResult(alternatives, final));
+}
+
+SpeechRecognitionAlternative* SpeechRecognitionResult::item(unsigned long index)
+{
+    if (index >= m_alternatives.size())
+        return 0;
+
+    return m_alternatives[index].get();
+}
+
+SpeechRecognitionResult::SpeechRecognitionResult(const Vector<RefPtr<SpeechRecognitionAlternative> >& alternatives, bool final)
+    : m_alternatives(alternatives)
+    , m_final(final)
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionResult.h b/Source/WebCore/Modules/speech/SpeechRecognitionResult.h
new file mode 100644
index 000000000..38645cb04
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionResult.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SpeechRecognitionResult_h
+#define SpeechRecognitionResult_h
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "SpeechRecognitionAlternative.h"
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class SpeechRecognitionResult : public RefCounted<SpeechRecognitionResult> {
+public:
+    static PassRefPtr<SpeechRecognitionResult> create(const Vector<RefPtr<SpeechRecognitionAlternative> >&, bool final);
+
+    unsigned long length() { return m_alternatives.size(); }
+    SpeechRecognitionAlternative* item(unsigned long index);
+    bool final() { return m_final; }
+
+private:
+    SpeechRecognitionResult(const Vector<RefPtr<SpeechRecognitionAlternative> >&, bool final);
+
+    Vector<RefPtr<SpeechRecognitionAlternative> > m_alternatives;
+    bool m_final;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
+
+#endif // SpeechRecognitionResult_h
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionResult.idl b/Source/WebCore/Modules/speech/SpeechRecognitionResult.idl
new file mode 100644
index 000000000..3f912621c
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionResult.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        Conditional=SCRIPTED_SPEECH,
+        IndexedGetter
+    ] SpeechRecognitionResult {
+        readonly attribute unsigned long length;
+        SpeechRecognitionAlternative item(in [IsIndex] unsigned long index);
+        readonly attribute boolean final;
+    };
+}
+
diff --git a/Source/WebCore/page/PageSupplement.cpp b/Source/WebCore/Modules/speech/SpeechRecognitionResultList.cpp
index fb8c1e77e..e8b2419c3 100644
--- a/Source/WebCore/page/PageSupplement.cpp
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionResultList.cpp
@@ -24,34 +24,31 @@
  */
 
 #include "config.h"
-#include "PageSupplement.h"
 
-#include "Frame.h"
-#include "Page.h"
+#if ENABLE(SCRIPTED_SPEECH)
 
-namespace WebCore {
+#include "SpeechRecognitionResultList.h"
 
-PageSupplement::~PageSupplement()
-{
-}
+namespace WebCore {
 
-void PageSupplement::provideTo(Page* page, const AtomicString& key, PassOwnPtr<PageSupplement> supplement)
+PassRefPtr<SpeechRecognitionResultList> SpeechRecognitionResultList::create(const Vector<RefPtr<SpeechRecognitionResult> >& results)
 {
-    page->provideSupplement(key, supplement);
+    return adoptRef(new SpeechRecognitionResultList(results));
 }
 
-PageSupplement* PageSupplement::from(Page* page, const AtomicString& name)
+SpeechRecognitionResult* SpeechRecognitionResultList::item(unsigned long index)
 {
-    if (!page)
+    if (index >= m_results.size())
         return 0;
-    return page->requireSupplement(name);
+
+    return m_results[index].get();
 }
 
-PageSupplement* PageSupplement::from(Frame* frame, const AtomicString& name)
+SpeechRecognitionResultList::SpeechRecognitionResultList(const Vector<RefPtr<SpeechRecognitionResult> >& results)
+    : m_results(results)
 {
-    if (!frame || !frame->page())
-        return 0;
-    return frame->page()->requireSupplement(name);
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionResultList.h b/Source/WebCore/Modules/speech/SpeechRecognitionResultList.h
new file mode 100644
index 000000000..22e3d4f19
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionResultList.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SpeechRecognitionResultList_h
+#define SpeechRecognitionResultList_h
+
+#if ENABLE(SCRIPTED_SPEECH)
+
+#include "SpeechRecognitionResult.h"
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class SpeechRecognitionResultList : public RefCounted<SpeechRecognitionResultList> {
+public:
+    static PassRefPtr<SpeechRecognitionResultList> create(const Vector<RefPtr<SpeechRecognitionResult> >&);
+
+    unsigned long length() { return m_results.size(); }
+    SpeechRecognitionResult* item(unsigned long index);
+
+private:
+    SpeechRecognitionResultList(const Vector<RefPtr<SpeechRecognitionResult> >&);
+
+    Vector<RefPtr<SpeechRecognitionResult> > m_results;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SCRIPTED_SPEECH)
+
+#endif // SpeechRecognitionResultList_h
diff --git a/Source/WebCore/Modules/speech/SpeechRecognitionResultList.idl b/Source/WebCore/Modules/speech/SpeechRecognitionResultList.idl
new file mode 100644
index 000000000..fd7be4f1c
--- /dev/null
+++ b/Source/WebCore/Modules/speech/SpeechRecognitionResultList.idl
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        Conditional=SCRIPTED_SPEECH,
+        IndexedGetter
+    ] SpeechRecognitionResultList {
+        readonly attribute unsigned long length;
+        SpeechRecognitionResult item(in [IsIndex] unsigned long index);
+    };
+}
diff --git a/Source/WebCore/Modules/vibration/Vibration.cpp b/Source/WebCore/Modules/vibration/Vibration.cpp
index 9e52c3dfb..a1da4b047 100644
--- a/Source/WebCore/Modules/vibration/Vibration.cpp
+++ b/Source/WebCore/Modules/vibration/Vibration.cpp
@@ -124,7 +124,7 @@ void Vibration::timerStopFired(Timer<Vibration>* timer)
 
 const AtomicString& Vibration::supplementName()
 {
-    DEFINE_STATIC_LOCAL(AtomicString, name, ("vibration"));
+    DEFINE_STATIC_LOCAL(AtomicString, name, ("Vibration"));
     return name;
 }
 
@@ -135,7 +135,7 @@ bool Vibration::isActive(Page* page)
 
 void provideVibrationTo(Page* page, VibrationClient* client)
 {
-    PageSupplement::provideTo(page, Vibration::supplementName(), Vibration::create(client));
+    Vibration::provideTo(page, Vibration::supplementName(), Vibration::create(client));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/Modules/vibration/Vibration.h b/Source/WebCore/Modules/vibration/Vibration.h
index 27e0736be..9b01086a6 100644
--- a/Source/WebCore/Modules/vibration/Vibration.h
+++ b/Source/WebCore/Modules/vibration/Vibration.h
@@ -22,7 +22,7 @@
 
 #if ENABLE(VIBRATION)
 
-#include "PageSupplement.h"
+#include "Page.h"
 #include "Timer.h"
 #include <wtf/PassOwnPtr.h>
 
@@ -32,7 +32,7 @@ class Navigator;
 class Page;
 class VibrationClient;
 
-class Vibration : public PageSupplement {
+class Vibration : public Supplement<Page> {
 public:
     typedef Vector<unsigned long> VibrationPattern;
 
@@ -52,7 +52,7 @@ public:
     void timerStopFired(Timer<Vibration>*);
 
     static const AtomicString& supplementName();
-    static Vibration* from(Page* page) { return static_cast<Vibration*>(PageSupplement::from(page, supplementName())); }
+    static Vibration* from(Page* page) { return static_cast<Vibration*>(Supplement<Page>::from(page, supplementName())); }
     static bool isActive(Page*);
 
 private:
diff --git a/Source/WebCore/storage/AbstractDatabase.cpp b/Source/WebCore/Modules/webdatabase/AbstractDatabase.cpp
index 27051138d..e51c24448 100644
--- a/Source/WebCore/storage/AbstractDatabase.cpp
+++ b/Source/WebCore/Modules/webdatabase/AbstractDatabase.cpp
@@ -32,6 +32,7 @@
 #if ENABLE(SQL_DATABASE)
 
 #include "DatabaseAuthorizer.h"
+#include "DatabaseContext.h"
 #include "DatabaseTracker.h"
 #include "ExceptionCode.h"
 #include "Logging.h"
@@ -188,6 +189,7 @@ const char* AbstractDatabase::databaseInfoTableName()
 AbstractDatabase::AbstractDatabase(ScriptExecutionContext* context, const String& name, const String& expectedVersion,
                                    const String& displayName, unsigned long estimatedSize, DatabaseType databaseType)
     : m_scriptExecutionContext(context)
+    , m_databaseContext(DatabaseContext::from(context))
     , m_name(name.isolatedCopy())
     , m_expectedVersion(expectedVersion.isolatedCopy())
     , m_displayName(displayName.isolatedCopy())
diff --git a/Source/WebCore/storage/AbstractDatabase.h b/Source/WebCore/Modules/webdatabase/AbstractDatabase.h
index 3286a87b2..12b8985d1 100644
--- a/Source/WebCore/storage/AbstractDatabase.h
+++ b/Source/WebCore/Modules/webdatabase/AbstractDatabase.h
@@ -42,6 +42,7 @@
 namespace WebCore {
 
 class DatabaseAuthorizer;
+class DatabaseContext;
 class ScriptExecutionContext;
 class SecurityOrigin;
 
@@ -86,6 +87,8 @@ public:
     virtual void markAsDeletedAndClose() = 0;
     virtual void closeImmediately() = 0;
 
+    DatabaseContext* databaseContext() const { return m_databaseContext; }
+
 protected:
     friend class ChangeVersionWrapper;
     friend class SQLStatement;
@@ -124,8 +127,9 @@ protected:
 
     static const char* databaseInfoTableName();
 
-    RefPtr<ScriptExecutionContext> m_scriptExecutionContext;
     RefPtr<SecurityOrigin> m_contextThreadSecurityOrigin;
+    RefPtr<ScriptExecutionContext> m_scriptExecutionContext;
+    DatabaseContext* m_databaseContext; // Owned by m_scriptExecutionContext.
 
     String m_name;
     String m_expectedVersion;
diff --git a/Source/WebCore/storage/ChangeVersionWrapper.cpp b/Source/WebCore/Modules/webdatabase/ChangeVersionWrapper.cpp
index c46ee2e83..c46ee2e83 100644
--- a/Source/WebCore/storage/ChangeVersionWrapper.cpp
+++ b/Source/WebCore/Modules/webdatabase/ChangeVersionWrapper.cpp
diff --git a/Source/WebCore/storage/ChangeVersionWrapper.h b/Source/WebCore/Modules/webdatabase/ChangeVersionWrapper.h
index 785fe2892..785fe2892 100644
--- a/Source/WebCore/storage/ChangeVersionWrapper.h
+++ b/Source/WebCore/Modules/webdatabase/ChangeVersionWrapper.h
diff --git a/Source/WebCore/storage/DOMWindowSQLDatabase.cpp b/Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.cpp
index e4b609080..996357c65 100644
--- a/Source/WebCore/storage/DOMWindowSQLDatabase.cpp
+++ b/Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.cpp
@@ -1,34 +1,33 @@
 /*
- * Copyright (C) 2012 Google Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
 #include "config.h"
+
+#if ENABLE(SQL_DATABASE)
+
 #include "DOMWindowSQLDatabase.h"
 
 #include "AbstractDatabase.h"
@@ -39,8 +38,6 @@
 #include "Frame.h"
 #include "SecurityOrigin.h"
 
-#if ENABLE(SQL_DATABASE)
-
 namespace WebCore {
 
 PassRefPtr<Database> DOMWindowSQLDatabase::openDatabase(DOMWindow* window, const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode& ec)
diff --git a/Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.h b/Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.h
new file mode 100644
index 000000000..c362b9f11
--- /dev/null
+++ b/Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DOMWindowSQLDatabase_h
+#define DOMWindowSQLDatabase_h
+
+#if ENABLE(SQL_DATABASE)
+#include "ExceptionCode.h"
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class DOMWindow;
+class Database;
+class DatabaseCallback;
+class Frame;
+
+class DOMWindowSQLDatabase {
+public:
+    static PassRefPtr<Database> openDatabase(DOMWindow*, const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode&);
+
+private:
+    DOMWindowSQLDatabase() { };
+    ~DOMWindowSQLDatabase() { };
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SQL_DATABASE)
+
+#endif // DOMWindowSQLDatabase_h
diff --git a/Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.idl b/Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.idl
new file mode 100644
index 000000000..f2aea7751
--- /dev/null
+++ b/Source/WebCore/Modules/webdatabase/DOMWindowSQLDatabase.idl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+
+    interface [
+        Conditional=SQL_DATABASE,
+        Supplemental=DOMWindow
+    ] DOMWindowSQLDatabase {
+        [V8EnabledAtRuntime] Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize, in [Callback, Optional] DatabaseCallback creationCallback)
+            raises(DOMException);
+#if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
+        attribute SQLExceptionConstructor SQLException;
+#endif
+    };
+
+}
diff --git a/Source/WebCore/storage/Database.cpp b/Source/WebCore/Modules/webdatabase/Database.cpp
index d9911c919..d0c3a7a1e 100644
--- a/Source/WebCore/storage/Database.cpp
+++ b/Source/WebCore/Modules/webdatabase/Database.cpp
@@ -34,6 +34,7 @@
 #include "ChangeVersionWrapper.h"
 #include "CrossThreadTask.h"
 #include "DatabaseCallback.h"
+#include "DatabaseContext.h"
 #include "DatabaseTask.h"
 #include "DatabaseThread.h"
 #include "DatabaseTracker.h"
@@ -109,7 +110,7 @@ PassRefPtr<Database> Database::openDatabase(ScriptExecutionContext* context, con
 
     DatabaseTracker::tracker().setDatabaseDetails(context->securityOrigin(), name, displayName, estimatedSize);
 
-    context->setHasOpenDatabases();
+    DatabaseContext::from(context)->setHasOpenDatabases();
 
     InspectorInstrumentation::didOpenDatabase(context, database, context->securityOrigin()->host(), name, expectedVersion);
 
@@ -130,7 +131,7 @@ Database::Database(ScriptExecutionContext* context, const String& name, const St
     m_databaseThreadSecurityOrigin = m_contextThreadSecurityOrigin->isolatedCopy();
 
     ScriptController::initializeThreading();
-    ASSERT(m_scriptExecutionContext->databaseThread());
+    ASSERT(databaseContext()->databaseThread());
 }
 
 class DerefContextTask : public ScriptExecutionContext::Task {
@@ -179,12 +180,12 @@ String Database::version() const
 bool Database::openAndVerifyVersion(bool setVersionInNewDatabase, ExceptionCode& e, String& errorMessage)
 {
     DatabaseTaskSynchronizer synchronizer;
-    if (!m_scriptExecutionContext->databaseThread() || m_scriptExecutionContext->databaseThread()->terminationRequested(&synchronizer))
+    if (!databaseContext()->databaseThread() || databaseContext()->databaseThread()->terminationRequested(&synchronizer))
         return false;
 
     bool success = false;
     OwnPtr<DatabaseOpenTask> task = DatabaseOpenTask::create(this, setVersionInNewDatabase, &synchronizer, e, errorMessage, success);
-    m_scriptExecutionContext->databaseThread()->scheduleImmediateTask(task.release());
+    databaseContext()->databaseThread()->scheduleImmediateTask(task.release());
     synchronizer.waitForTaskCompletion();
 
     return success;
@@ -192,27 +193,27 @@ bool Database::openAndVerifyVersion(bool setVersionInNewDatabase, ExceptionCode&
 
 void Database::markAsDeletedAndClose()
 {
-    if (m_deleted || !m_scriptExecutionContext->databaseThread())
+    if (m_deleted || !databaseContext()->databaseThread())
         return;
 
     LOG(StorageAPI, "Marking %s (%p) as deleted", stringIdentifier().ascii().data(), this);
     m_deleted = true;
 
     DatabaseTaskSynchronizer synchronizer;
-    if (m_scriptExecutionContext->databaseThread()->terminationRequested(&synchronizer)) {
+    if (databaseContext()->databaseThread()->terminationRequested(&synchronizer)) {
         LOG(StorageAPI, "Database handle %p is on a terminated DatabaseThread, cannot be marked for normal closure\n", this);
         return;
     }
 
     OwnPtr<DatabaseCloseTask> task = DatabaseCloseTask::create(this, &synchronizer);
-    m_scriptExecutionContext->databaseThread()->scheduleImmediateTask(task.release());
+    databaseContext()->databaseThread()->scheduleImmediateTask(task.release());
     synchronizer.waitForTaskCompletion();
 }
 
 void Database::close()
 {
-    ASSERT(m_scriptExecutionContext->databaseThread());
-    ASSERT(currentThread() == m_scriptExecutionContext->databaseThread()->getThreadID());
+    ASSERT(databaseContext()->databaseThread());
+    ASSERT(currentThread() == databaseContext()->databaseThread()->getThreadID());
 
     {
         MutexLocker locker(m_transactionInProgressMutex);
@@ -225,15 +226,15 @@ void Database::close()
 
     // Must ref() before calling databaseThread()->recordDatabaseClosed().
     RefPtr<Database> protect = this;
-    m_scriptExecutionContext->databaseThread()->recordDatabaseClosed(this);
-    m_scriptExecutionContext->databaseThread()->unscheduleDatabaseTasks(this);
+    databaseContext()->databaseThread()->recordDatabaseClosed(this);
+    databaseContext()->databaseThread()->unscheduleDatabaseTasks(this);
     DatabaseTracker::tracker().removeOpenDatabase(this);
 }
 
 void Database::closeImmediately()
 {
     ASSERT(m_scriptExecutionContext->isContextThread());
-    DatabaseThread* databaseThread = scriptExecutionContext()->databaseThread();
+    DatabaseThread* databaseThread = databaseContext()->databaseThread();
     if (databaseThread && !databaseThread->terminationRequested() && opened()) {
         logErrorMessage("forcibly closing database");
         databaseThread->scheduleImmediateTask(DatabaseCloseTask::create(this, 0));
@@ -248,8 +249,8 @@ unsigned long long Database::maximumSize() const
 bool Database::performOpenAndVerify(bool setVersionInNewDatabase, ExceptionCode& e, String& errorMessage)
 {
     if (AbstractDatabase::performOpenAndVerify(setVersionInNewDatabase, e, errorMessage)) {
-        if (m_scriptExecutionContext->databaseThread())
-            m_scriptExecutionContext->databaseThread()->recordDatabaseOpen(this);
+        if (databaseContext()->databaseThread())
+            databaseContext()->databaseThread()->recordDatabaseOpen(this);
 
         return true;
     }
@@ -311,26 +312,26 @@ void Database::scheduleTransaction()
     if (m_isTransactionQueueEnabled && !m_transactionQueue.isEmpty())
         transaction = m_transactionQueue.takeFirst();
 
-    if (transaction && m_scriptExecutionContext->databaseThread()) {
+    if (transaction && databaseContext()->databaseThread()) {
         OwnPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
         LOG(StorageAPI, "Scheduling DatabaseTransactionTask %p for transaction %p\n", task.get(), task->transaction());
         m_transactionInProgress = true;
-        m_scriptExecutionContext->databaseThread()->scheduleTask(task.release());
+        databaseContext()->databaseThread()->scheduleTask(task.release());
     } else
         m_transactionInProgress = false;
 }
 
 void Database::scheduleTransactionStep(SQLTransaction* transaction, bool immediately)
 {
-    if (!m_scriptExecutionContext->databaseThread())
+    if (!databaseContext()->databaseThread())
         return;
 
     OwnPtr<DatabaseTransactionTask> task = DatabaseTransactionTask::create(transaction);
     LOG(StorageAPI, "Scheduling DatabaseTransactionTask %p for the transaction step\n", task.get());
     if (immediately)
-        m_scriptExecutionContext->databaseThread()->scheduleImmediateTask(task.release());
+        databaseContext()->databaseThread()->scheduleImmediateTask(task.release());
     else
-        m_scriptExecutionContext->databaseThread()->scheduleTask(task.release());
+        databaseContext()->databaseThread()->scheduleTask(task.release());
 }
 
 class DeliverPendingCallbackTask : public ScriptExecutionContext::Task {
@@ -390,12 +391,12 @@ Vector<String> Database::performGetTableNames()
 
 SQLTransactionClient* Database::transactionClient() const
 {
-    return m_scriptExecutionContext->databaseThread()->transactionClient();
+    return databaseContext()->databaseThread()->transactionClient();
 }
 
 SQLTransactionCoordinator* Database::transactionCoordinator() const
 {
-    return m_scriptExecutionContext->databaseThread()->transactionCoordinator();
+    return databaseContext()->databaseThread()->transactionCoordinator();
 }
 
 Vector<String> Database::tableNames()
@@ -404,11 +405,11 @@ Vector<String> Database::tableNames()
     // in dealing with them. However, if the code changes, this may not be true anymore.
     Vector<String> result;
     DatabaseTaskSynchronizer synchronizer;
-    if (!m_scriptExecutionContext->databaseThread() || m_scriptExecutionContext->databaseThread()->terminationRequested(&synchronizer))
+    if (!databaseContext()->databaseThread() || databaseContext()->databaseThread()->terminationRequested(&synchronizer))
         return result;
 
     OwnPtr<DatabaseTableNamesTask> task = DatabaseTableNamesTask::create(this, &synchronizer, result);
-    m_scriptExecutionContext->databaseThread()->scheduleImmediateTask(task.release());
+    databaseContext()->databaseThread()->scheduleImmediateTask(task.release());
     synchronizer.waitForTaskCompletion();
 
     return result;
@@ -418,7 +419,7 @@ SecurityOrigin* Database::securityOrigin() const
 {
     if (m_scriptExecutionContext->isContextThread())
         return m_contextThreadSecurityOrigin.get();
-    if (currentThread() == m_scriptExecutionContext->databaseThread()->getThreadID())
+    if (currentThread() == databaseContext()->databaseThread()->getThreadID())
         return m_databaseThreadSecurityOrigin.get();
     return 0;
 }
diff --git a/Source/WebCore/storage/Database.h b/Source/WebCore/Modules/webdatabase/Database.h
index 12b430e33..12b430e33 100644
--- a/Source/WebCore/storage/Database.h
+++ b/Source/WebCore/Modules/webdatabase/Database.h
diff --git a/Source/WebCore/storage/Database.idl b/Source/WebCore/Modules/webdatabase/Database.idl
index ddc544a86..ddc544a86 100644
--- a/Source/WebCore/storage/Database.idl
+++ b/Source/WebCore/Modules/webdatabase/Database.idl
diff --git a/Source/WebCore/storage/DatabaseAuthorizer.cpp b/Source/WebCore/Modules/webdatabase/DatabaseAuthorizer.cpp
index 72dba4cbf..72dba4cbf 100644
--- a/Source/WebCore/storage/DatabaseAuthorizer.cpp
+++ b/Source/WebCore/Modules/webdatabase/DatabaseAuthorizer.cpp
diff --git a/Source/WebCore/storage/DatabaseAuthorizer.h b/Source/WebCore/Modules/webdatabase/DatabaseAuthorizer.h
index 939b409eb..939b409eb 100644
--- a/Source/WebCore/storage/DatabaseAuthorizer.h
+++ b/Source/WebCore/Modules/webdatabase/DatabaseAuthorizer.h
diff --git a/Source/WebCore/storage/DatabaseCallback.h b/Source/WebCore/Modules/webdatabase/DatabaseCallback.h
index bfa7bc627..bfa7bc627 100644
--- a/Source/WebCore/storage/DatabaseCallback.h
+++ b/Source/WebCore/Modules/webdatabase/DatabaseCallback.h
diff --git a/Source/WebCore/storage/DatabaseCallback.idl b/Source/WebCore/Modules/webdatabase/DatabaseCallback.idl
index 8d316484b..8d316484b 100644
--- a/Source/WebCore/storage/DatabaseCallback.idl
+++ b/Source/WebCore/Modules/webdatabase/DatabaseCallback.idl
diff --git a/Source/WebCore/Modules/webdatabase/DatabaseContext.cpp b/Source/WebCore/Modules/webdatabase/DatabaseContext.cpp
new file mode 100644
index 000000000..0b662a890
--- /dev/null
+++ b/Source/WebCore/Modules/webdatabase/DatabaseContext.cpp
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2011 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#include "config.h"
+#include "DatabaseContext.h"
+
+#if ENABLE(SQL_DATABASE)
+
+#include "Chrome.h"
+#include "ChromeClient.h"
+#include "Database.h"
+#include "DatabaseTask.h"
+#include "DatabaseThread.h"
+#include "DatabaseTracker.h"
+#include "Document.h"
+#include "Page.h"
+#include "SchemeRegistry.h"
+#include "SecurityOrigin.h"
+#include "Settings.h"
+
+namespace WebCore {
+
+static DatabaseContext* existingDatabaseContextFrom(ScriptExecutionContext* context)
+{
+    return static_cast<DatabaseContext*>(Supplement<ScriptExecutionContext>::from(context, "DatabaseContext"));
+}
+
+DatabaseContext::DatabaseContext(ScriptExecutionContext* context)
+    : m_scriptExecutionContext(context)
+    , m_hasOpenDatabases(false)
+{
+}
+
+DatabaseContext::~DatabaseContext()
+{
+    if (m_databaseThread) {
+        ASSERT(m_databaseThread->terminationRequested());
+        m_databaseThread = 0;
+    }
+}
+
+DatabaseContext* DatabaseContext::from(ScriptExecutionContext* context)
+{
+    DatabaseContext* supplement = existingDatabaseContextFrom(context);
+    if (!supplement) {
+        supplement = new DatabaseContext(context);
+        provideTo(context, "DatabaseContext", adoptPtr(supplement));
+        ASSERT(supplement == existingDatabaseContextFrom(context));
+    }
+    return supplement;
+}
+
+DatabaseThread* DatabaseContext::databaseThread()
+{
+    if (!m_databaseThread && !m_hasOpenDatabases) {
+        // Create the database thread on first request - but not if at least one database was already opened,
+        // because in that case we already had a database thread and terminated it and should not create another.
+        m_databaseThread = DatabaseThread::create();
+        if (!m_databaseThread->start())
+            m_databaseThread = 0;
+    }
+
+    return m_databaseThread.get();
+}
+
+bool DatabaseContext::hasOpenDatabases(ScriptExecutionContext* context)
+{
+    // We don't use DatabaseContext::from because we don't want to cause
+    // DatabaseContext to be allocated if we don't have one already.
+    DatabaseContext* databaseContext = existingDatabaseContextFrom(context);
+    if (!databaseContext)
+        return false;
+    return databaseContext->m_hasOpenDatabases;
+}
+
+void DatabaseContext::stopDatabases(ScriptExecutionContext* context, DatabaseTaskSynchronizer* cleanupSync)
+{
+    // We don't use DatabaseContext::from because we don't want to cause
+    // DatabaseContext to be allocated if we don't have one already.
+    DatabaseContext* databaseContext = existingDatabaseContextFrom(context);
+
+    if (databaseContext && databaseContext->m_databaseThread)
+        databaseContext->m_databaseThread->requestTermination(cleanupSync);
+    else if (cleanupSync)
+        cleanupSync->taskCompleted();
+}
+
+bool DatabaseContext::allowDatabaseAccess() const
+{
+    if (m_scriptExecutionContext->isDocument()) {
+        Document* document = static_cast<Document*>(m_scriptExecutionContext);
+        if (!document->page() || (document->page()->settings()->privateBrowsingEnabled() && !SchemeRegistry::allowsDatabaseAccessInPrivateBrowsing(document->securityOrigin()->protocol())))
+            return false;
+        return true;
+    }
+    ASSERT(m_scriptExecutionContext->isWorkerContext());
+    // allowDatabaseAccess is not yet implemented for workers.
+    return true;
+}
+
+void DatabaseContext::databaseExceededQuota(const String& name)
+{
+    if (m_scriptExecutionContext->isDocument()) {
+        Document* document = static_cast<Document*>(m_scriptExecutionContext);
+        if (Page* page = document->page())
+            page->chrome()->client()->exceededDatabaseQuota(document->frame(), name);
+        return;
+    }
+    ASSERT(m_scriptExecutionContext->isWorkerContext());
+#if !PLATFORM(CHROMIUM)
+    // FIXME: This needs a real implementation; this is a temporary solution for testing.
+    const unsigned long long defaultQuota = 5 * 1024 * 1024;
+    DatabaseTracker::tracker().setQuota(m_scriptExecutionContext->securityOrigin(), defaultQuota);
+#endif
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SQL_DATABASE)
diff --git a/Source/WebCore/Modules/webdatabase/DatabaseContext.h b/Source/WebCore/Modules/webdatabase/DatabaseContext.h
new file mode 100644
index 000000000..fced47dd5
--- /dev/null
+++ b/Source/WebCore/Modules/webdatabase/DatabaseContext.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2011 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef DatabaseContext_h
+#define DatabaseContext_h
+
+#if ENABLE(SQL_DATABASE)
+
+#include "Supplementable.h"
+
+namespace WebCore {
+
+class Database;
+class DatabaseTaskSynchronizer;
+class DatabaseThread;
+class ScriptExecutionContext;
+
+class DatabaseContext : public Supplement<ScriptExecutionContext> {
+public:
+    virtual ~DatabaseContext();
+    static DatabaseContext* from(ScriptExecutionContext*);
+
+    DatabaseThread* databaseThread();
+
+    void setHasOpenDatabases() { m_hasOpenDatabases = true; }
+
+    static bool hasOpenDatabases(ScriptExecutionContext*);
+
+    // When the database cleanup is done, cleanupSync will be signalled.
+    static void stopDatabases(ScriptExecutionContext*, DatabaseTaskSynchronizer*);
+
+    bool allowDatabaseAccess() const;
+    void databaseExceededQuota(const String& name);
+
+private:
+    explicit DatabaseContext(ScriptExecutionContext*);
+
+    ScriptExecutionContext* m_scriptExecutionContext;
+    RefPtr<DatabaseThread> m_databaseThread;
+    bool m_hasOpenDatabases; // This never changes back to false, even after the database thread is closed.
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SQL_DATABASE)
+
+#endif // DatabaseContext_h
diff --git a/Source/WebCore/storage/DatabaseDetails.h b/Source/WebCore/Modules/webdatabase/DatabaseDetails.h
index d2bc71b7e..d2bc71b7e 100644
--- a/Source/WebCore/storage/DatabaseDetails.h
+++ b/Source/WebCore/Modules/webdatabase/DatabaseDetails.h
diff --git a/Source/WebCore/storage/DatabaseSync.cpp b/Source/WebCore/Modules/webdatabase/DatabaseSync.cpp
index 8b744b8c6..8b744b8c6 100644
--- a/Source/WebCore/storage/DatabaseSync.cpp
+++ b/Source/WebCore/Modules/webdatabase/DatabaseSync.cpp
diff --git a/Source/WebCore/storage/DatabaseSync.h b/Source/WebCore/Modules/webdatabase/DatabaseSync.h
index bfc124b17..bfc124b17 100644
--- a/Source/WebCore/storage/DatabaseSync.h
+++ b/Source/WebCore/Modules/webdatabase/DatabaseSync.h
diff --git a/Source/WebCore/storage/DatabaseSync.idl b/Source/WebCore/Modules/webdatabase/DatabaseSync.idl
index cfb0b590c..cfb0b590c 100644
--- a/Source/WebCore/storage/DatabaseSync.idl
+++ b/Source/WebCore/Modules/webdatabase/DatabaseSync.idl
diff --git a/Source/WebCore/storage/DatabaseTask.cpp b/Source/WebCore/Modules/webdatabase/DatabaseTask.cpp
index 066725fe3..066725fe3 100644
--- a/Source/WebCore/storage/DatabaseTask.cpp
+++ b/Source/WebCore/Modules/webdatabase/DatabaseTask.cpp
diff --git a/Source/WebCore/storage/DatabaseTask.h b/Source/WebCore/Modules/webdatabase/DatabaseTask.h
index 82d51f03f..82d51f03f 100644
--- a/Source/WebCore/storage/DatabaseTask.h
+++ b/Source/WebCore/Modules/webdatabase/DatabaseTask.h
diff --git a/Source/WebCore/storage/DatabaseThread.cpp b/Source/WebCore/Modules/webdatabase/DatabaseThread.cpp
index d771b1ca1..d771b1ca1 100644
--- a/Source/WebCore/storage/DatabaseThread.cpp
+++ b/Source/WebCore/Modules/webdatabase/DatabaseThread.cpp
diff --git a/Source/WebCore/storage/DatabaseThread.h b/Source/WebCore/Modules/webdatabase/DatabaseThread.h
index fa4fd088f..fa4fd088f 100644
--- a/Source/WebCore/storage/DatabaseThread.h
+++ b/Source/WebCore/Modules/webdatabase/DatabaseThread.h
diff --git a/Source/WebCore/storage/DatabaseTracker.cpp b/Source/WebCore/Modules/webdatabase/DatabaseTracker.cpp
index f11cc599e..233b3721b 100644
--- a/Source/WebCore/storage/DatabaseTracker.cpp
+++ b/Source/WebCore/Modules/webdatabase/DatabaseTracker.cpp
@@ -34,6 +34,7 @@
 #include "AbstractDatabase.h"
 #include "Chrome.h"
 #include "ChromeClient.h"
+#include "DatabaseContext.h"
 #include "DatabaseThread.h"
 #include "DatabaseTrackerClient.h"
 #include "Logging.h"
@@ -175,7 +176,7 @@ bool DatabaseTracker::canEstablishDatabase(ScriptExecutionContext* context, cons
         m_proposedDatabases.add(&details);
     }
     // Drop all locks before calling out; we don't know what they'll do.
-    context->databaseExceededQuota(name);
+    DatabaseContext::from(context)->databaseExceededQuota(name);
 
     MutexLocker lockDatabase(m_databaseGuard);
 
diff --git a/Source/WebCore/storage/DatabaseTracker.h b/Source/WebCore/Modules/webdatabase/DatabaseTracker.h
index d94a41578..d94a41578 100644
--- a/Source/WebCore/storage/DatabaseTracker.h
+++ b/Source/WebCore/Modules/webdatabase/DatabaseTracker.h
diff --git a/Source/WebCore/storage/DatabaseTrackerClient.h b/Source/WebCore/Modules/webdatabase/DatabaseTrackerClient.h
index 9c08bcd31..9c08bcd31 100644
--- a/Source/WebCore/storage/DatabaseTrackerClient.h
+++ b/Source/WebCore/Modules/webdatabase/DatabaseTrackerClient.h
diff --git a/Source/WebCore/storage/OriginQuotaManager.cpp b/Source/WebCore/Modules/webdatabase/OriginQuotaManager.cpp
index b6cbef15b..b6cbef15b 100644
--- a/Source/WebCore/storage/OriginQuotaManager.cpp
+++ b/Source/WebCore/Modules/webdatabase/OriginQuotaManager.cpp
diff --git a/Source/WebCore/storage/OriginQuotaManager.h b/Source/WebCore/Modules/webdatabase/OriginQuotaManager.h
index 974de7216..974de7216 100644
--- a/Source/WebCore/storage/OriginQuotaManager.h
+++ b/Source/WebCore/Modules/webdatabase/OriginQuotaManager.h
diff --git a/Source/WebCore/storage/OriginUsageRecord.cpp b/Source/WebCore/Modules/webdatabase/OriginUsageRecord.cpp
index 443550a57..443550a57 100644
--- a/Source/WebCore/storage/OriginUsageRecord.cpp
+++ b/Source/WebCore/Modules/webdatabase/OriginUsageRecord.cpp
diff --git a/Source/WebCore/storage/OriginUsageRecord.h b/Source/WebCore/Modules/webdatabase/OriginUsageRecord.h
index 61d9c9019..61d9c9019 100644
--- a/Source/WebCore/storage/OriginUsageRecord.h
+++ b/Source/WebCore/Modules/webdatabase/OriginUsageRecord.h
diff --git a/Source/WebCore/storage/SQLCallbackWrapper.h b/Source/WebCore/Modules/webdatabase/SQLCallbackWrapper.h
index 3cb0e2dbc..3cb0e2dbc 100644
--- a/Source/WebCore/storage/SQLCallbackWrapper.h
+++ b/Source/WebCore/Modules/webdatabase/SQLCallbackWrapper.h
diff --git a/Source/WebCore/storage/SQLError.h b/Source/WebCore/Modules/webdatabase/SQLError.h
index e51db8b12..e51db8b12 100644
--- a/Source/WebCore/storage/SQLError.h
+++ b/Source/WebCore/Modules/webdatabase/SQLError.h
diff --git a/Source/WebCore/storage/SQLError.idl b/Source/WebCore/Modules/webdatabase/SQLError.idl
index ad847598a..ad847598a 100644
--- a/Source/WebCore/storage/SQLError.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLError.idl
diff --git a/Source/WebCore/storage/SQLException.cpp b/Source/WebCore/Modules/webdatabase/SQLException.cpp
index 0e7be829f..0e7be829f 100644
--- a/Source/WebCore/storage/SQLException.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLException.cpp
diff --git a/Source/WebCore/storage/SQLException.h b/Source/WebCore/Modules/webdatabase/SQLException.h
index be968cf05..be968cf05 100644
--- a/Source/WebCore/storage/SQLException.h
+++ b/Source/WebCore/Modules/webdatabase/SQLException.h
diff --git a/Source/WebCore/storage/SQLException.idl b/Source/WebCore/Modules/webdatabase/SQLException.idl
index 39e58d68e..39e58d68e 100644
--- a/Source/WebCore/storage/SQLException.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLException.idl
diff --git a/Source/WebCore/storage/SQLResultSet.cpp b/Source/WebCore/Modules/webdatabase/SQLResultSet.cpp
index 73cb430e5..73cb430e5 100644
--- a/Source/WebCore/storage/SQLResultSet.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLResultSet.cpp
diff --git a/Source/WebCore/storage/SQLResultSet.h b/Source/WebCore/Modules/webdatabase/SQLResultSet.h
index e30be595d..e30be595d 100644
--- a/Source/WebCore/storage/SQLResultSet.h
+++ b/Source/WebCore/Modules/webdatabase/SQLResultSet.h
diff --git a/Source/WebCore/storage/SQLResultSet.idl b/Source/WebCore/Modules/webdatabase/SQLResultSet.idl
index 60692cbea..60692cbea 100644
--- a/Source/WebCore/storage/SQLResultSet.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLResultSet.idl
diff --git a/Source/WebCore/storage/SQLResultSetRowList.cpp b/Source/WebCore/Modules/webdatabase/SQLResultSetRowList.cpp
index c99b40a56..c99b40a56 100644
--- a/Source/WebCore/storage/SQLResultSetRowList.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLResultSetRowList.cpp
diff --git a/Source/WebCore/storage/SQLResultSetRowList.h b/Source/WebCore/Modules/webdatabase/SQLResultSetRowList.h
index 45d88b6ef..45d88b6ef 100644
--- a/Source/WebCore/storage/SQLResultSetRowList.h
+++ b/Source/WebCore/Modules/webdatabase/SQLResultSetRowList.h
diff --git a/Source/WebCore/storage/SQLResultSetRowList.idl b/Source/WebCore/Modules/webdatabase/SQLResultSetRowList.idl
index ba0cb4cf7..ba0cb4cf7 100644
--- a/Source/WebCore/storage/SQLResultSetRowList.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLResultSetRowList.idl
diff --git a/Source/WebCore/storage/SQLStatement.cpp b/Source/WebCore/Modules/webdatabase/SQLStatement.cpp
index 79ec135a5..79ec135a5 100644
--- a/Source/WebCore/storage/SQLStatement.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLStatement.cpp
diff --git a/Source/WebCore/storage/SQLStatement.h b/Source/WebCore/Modules/webdatabase/SQLStatement.h
index b636b068b..b636b068b 100644
--- a/Source/WebCore/storage/SQLStatement.h
+++ b/Source/WebCore/Modules/webdatabase/SQLStatement.h
diff --git a/Source/WebCore/storage/SQLStatementCallback.h b/Source/WebCore/Modules/webdatabase/SQLStatementCallback.h
index 83201d2b8..83201d2b8 100644
--- a/Source/WebCore/storage/SQLStatementCallback.h
+++ b/Source/WebCore/Modules/webdatabase/SQLStatementCallback.h
diff --git a/Source/WebCore/storage/SQLStatementCallback.idl b/Source/WebCore/Modules/webdatabase/SQLStatementCallback.idl
index c3053c0ee..c3053c0ee 100644
--- a/Source/WebCore/storage/SQLStatementCallback.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLStatementCallback.idl
diff --git a/Source/WebCore/storage/SQLStatementErrorCallback.h b/Source/WebCore/Modules/webdatabase/SQLStatementErrorCallback.h
index c7c9f5450..c7c9f5450 100644
--- a/Source/WebCore/storage/SQLStatementErrorCallback.h
+++ b/Source/WebCore/Modules/webdatabase/SQLStatementErrorCallback.h
diff --git a/Source/WebCore/storage/SQLStatementErrorCallback.idl b/Source/WebCore/Modules/webdatabase/SQLStatementErrorCallback.idl
index 1fc96cb0a..1fc96cb0a 100644
--- a/Source/WebCore/storage/SQLStatementErrorCallback.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLStatementErrorCallback.idl
diff --git a/Source/WebCore/storage/SQLStatementSync.cpp b/Source/WebCore/Modules/webdatabase/SQLStatementSync.cpp
index 4a934ec00..4a934ec00 100644
--- a/Source/WebCore/storage/SQLStatementSync.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLStatementSync.cpp
diff --git a/Source/WebCore/storage/SQLStatementSync.h b/Source/WebCore/Modules/webdatabase/SQLStatementSync.h
index 6dfcc748e..6dfcc748e 100644
--- a/Source/WebCore/storage/SQLStatementSync.h
+++ b/Source/WebCore/Modules/webdatabase/SQLStatementSync.h
diff --git a/Source/WebCore/storage/SQLTransaction.cpp b/Source/WebCore/Modules/webdatabase/SQLTransaction.cpp
index 97c34cd5f..e9f38a976 100644
--- a/Source/WebCore/storage/SQLTransaction.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLTransaction.cpp
@@ -33,6 +33,7 @@
 
 #include "Database.h"
 #include "DatabaseAuthorizer.h"
+#include "DatabaseContext.h"
 #include "DatabaseThread.h"
 #include "ExceptionCode.h"
 #include "Logging.h"
@@ -97,7 +98,7 @@ void SQLTransaction::executeSQL(const String& sqlStatement, const Vector<SQLValu
     }
 
     int permissions = DatabaseAuthorizer::ReadWriteMask;
-    if (!m_database->scriptExecutionContext()->allowDatabaseAccess())
+    if (!m_database->databaseContext()->allowDatabaseAccess())
         permissions |= DatabaseAuthorizer::NoAccessMask;
     else if (m_readOnly)
         permissions |= DatabaseAuthorizer::ReadOnlyMask;
@@ -163,7 +164,7 @@ void SQLTransaction::checkAndHandleClosedOrInterruptedDatabase()
     m_errorCallbackWrapper.clear();
 
     // The next steps should be executed only if we're on the DB thread.
-    if (currentThread() != database()->scriptExecutionContext()->databaseThread()->getThreadID())
+    if (currentThread() != database()->databaseContext()->databaseThread()->getThreadID())
         return;
 
     // The current SQLite transaction should be stopped, as well
@@ -215,7 +216,7 @@ void SQLTransaction::performPendingCallback()
 
 void SQLTransaction::notifyDatabaseThreadIsShuttingDown()
 {
-    ASSERT(currentThread() == database()->scriptExecutionContext()->databaseThread()->getThreadID());
+    ASSERT(currentThread() == database()->databaseContext()->databaseThread()->getThreadID());
 
     // If the transaction is in progress, we should roll it back here, since this is our last
     // oportunity to do something related to this transaction on the DB thread.
diff --git a/Source/WebCore/storage/SQLTransaction.h b/Source/WebCore/Modules/webdatabase/SQLTransaction.h
index 11438e22a..11438e22a 100644
--- a/Source/WebCore/storage/SQLTransaction.h
+++ b/Source/WebCore/Modules/webdatabase/SQLTransaction.h
diff --git a/Source/WebCore/storage/SQLTransaction.idl b/Source/WebCore/Modules/webdatabase/SQLTransaction.idl
index f0994a1f8..f0994a1f8 100644
--- a/Source/WebCore/storage/SQLTransaction.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLTransaction.idl
diff --git a/Source/WebCore/storage/SQLTransactionCallback.h b/Source/WebCore/Modules/webdatabase/SQLTransactionCallback.h
index 208ce111b..208ce111b 100644
--- a/Source/WebCore/storage/SQLTransactionCallback.h
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionCallback.h
diff --git a/Source/WebCore/storage/SQLTransactionCallback.idl b/Source/WebCore/Modules/webdatabase/SQLTransactionCallback.idl
index 1b50bee2f..1b50bee2f 100644
--- a/Source/WebCore/storage/SQLTransactionCallback.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionCallback.idl
diff --git a/Source/WebCore/storage/SQLTransactionClient.cpp b/Source/WebCore/Modules/webdatabase/SQLTransactionClient.cpp
index 5dba32ed1..07c83d2c9 100644
--- a/Source/WebCore/storage/SQLTransactionClient.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionClient.cpp
@@ -34,6 +34,7 @@
 #if ENABLE(SQL_DATABASE)
 
 #include "AbstractDatabase.h"
+#include "DatabaseContext.h"
 #include "DatabaseTracker.h"
 #include "ScriptExecutionContext.h"
 #include "SecurityOrigin.h"
@@ -55,7 +56,7 @@ bool SQLTransactionClient::didExceedQuota(AbstractDatabase* database)
 {
     ASSERT(database->scriptExecutionContext()->isContextThread());
     unsigned long long currentQuota = DatabaseTracker::tracker().quotaForOrigin(database->securityOrigin());
-    database->scriptExecutionContext()->databaseExceededQuota(database->stringIdentifier());
+    database->databaseContext()->databaseExceededQuota(database->stringIdentifier());
     unsigned long long newQuota = DatabaseTracker::tracker().quotaForOrigin(database->securityOrigin());
     return (newQuota > currentQuota);
 }
diff --git a/Source/WebCore/storage/SQLTransactionClient.h b/Source/WebCore/Modules/webdatabase/SQLTransactionClient.h
index 28559ed49..28559ed49 100644
--- a/Source/WebCore/storage/SQLTransactionClient.h
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionClient.h
diff --git a/Source/WebCore/storage/SQLTransactionCoordinator.cpp b/Source/WebCore/Modules/webdatabase/SQLTransactionCoordinator.cpp
index 4158c98d7..4158c98d7 100644
--- a/Source/WebCore/storage/SQLTransactionCoordinator.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionCoordinator.cpp
diff --git a/Source/WebCore/storage/SQLTransactionCoordinator.h b/Source/WebCore/Modules/webdatabase/SQLTransactionCoordinator.h
index d586de4b7..d586de4b7 100644
--- a/Source/WebCore/storage/SQLTransactionCoordinator.h
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionCoordinator.h
diff --git a/Source/WebCore/storage/SQLTransactionErrorCallback.h b/Source/WebCore/Modules/webdatabase/SQLTransactionErrorCallback.h
index 56727cc05..56727cc05 100644
--- a/Source/WebCore/storage/SQLTransactionErrorCallback.h
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionErrorCallback.h
diff --git a/Source/WebCore/storage/SQLTransactionErrorCallback.idl b/Source/WebCore/Modules/webdatabase/SQLTransactionErrorCallback.idl
index f6ec15641..f6ec15641 100644
--- a/Source/WebCore/storage/SQLTransactionErrorCallback.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionErrorCallback.idl
diff --git a/Source/WebCore/storage/SQLTransactionSync.cpp b/Source/WebCore/Modules/webdatabase/SQLTransactionSync.cpp
index d1da05ee7..7aae7d4ae 100644
--- a/Source/WebCore/storage/SQLTransactionSync.cpp
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionSync.cpp
@@ -34,6 +34,7 @@
 #if ENABLE(SQL_DATABASE)
 
 #include "DatabaseAuthorizer.h"
+#include "DatabaseContext.h"
 #include "DatabaseSync.h"
 #include "PlatformString.h"
 #include "SQLException.h"
@@ -94,7 +95,7 @@ PassRefPtr<SQLResultSet> SQLTransactionSync::executeSQL(const String& sqlStateme
         return 0;
 
     int permissions = DatabaseAuthorizer::ReadWriteMask;
-    if (!m_database->scriptExecutionContext()->allowDatabaseAccess())
+    if (!m_database->databaseContext()->allowDatabaseAccess())
       permissions |= DatabaseAuthorizer::NoAccessMask;
     else if (m_readOnly)
       permissions |= DatabaseAuthorizer::ReadOnlyMask;
diff --git a/Source/WebCore/storage/SQLTransactionSync.h b/Source/WebCore/Modules/webdatabase/SQLTransactionSync.h
index 309acfbe8..309acfbe8 100644
--- a/Source/WebCore/storage/SQLTransactionSync.h
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionSync.h
diff --git a/Source/WebCore/storage/SQLTransactionSync.idl b/Source/WebCore/Modules/webdatabase/SQLTransactionSync.idl
index e5bdedf01..e5bdedf01 100644
--- a/Source/WebCore/storage/SQLTransactionSync.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionSync.idl
diff --git a/Source/WebCore/storage/SQLTransactionSyncCallback.h b/Source/WebCore/Modules/webdatabase/SQLTransactionSyncCallback.h
index 0c5f8fd63..0c5f8fd63 100644
--- a/Source/WebCore/storage/SQLTransactionSyncCallback.h
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionSyncCallback.h
diff --git a/Source/WebCore/storage/SQLTransactionSyncCallback.idl b/Source/WebCore/Modules/webdatabase/SQLTransactionSyncCallback.idl
index ea22e5f29..ea22e5f29 100644
--- a/Source/WebCore/storage/SQLTransactionSyncCallback.idl
+++ b/Source/WebCore/Modules/webdatabase/SQLTransactionSyncCallback.idl
diff --git a/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.cpp b/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.cpp
new file mode 100644
index 000000000..8a2935571
--- /dev/null
+++ b/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.cpp
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009, 2011 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+
+#if ENABLE(SQL_DATABASE)
+
+#include "WorkerContextSQLDatabase.h"
+
+#include "AbstractDatabase.h"
+#include "Database.h"
+#include "DatabaseCallback.h"
+#include "DatabaseSync.h"
+#include "DatabaseTracker.h"
+#include "SecurityOrigin.h"
+#include "WorkerContext.h"
+
+namespace WebCore {
+
+PassRefPtr<Database> WorkerContextSQLDatabase::openDatabase(WorkerContext* context, const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode& ec)
+{
+    if (!context->securityOrigin()->canAccessDatabase() || !AbstractDatabase::isAvailable()) {
+        ec = SECURITY_ERR;
+        return 0;
+    }
+
+    return Database::openDatabase(context, name, version, displayName, estimatedSize, creationCallback, ec);
+}
+
+PassRefPtr<DatabaseSync> WorkerContextSQLDatabase::openDatabaseSync(WorkerContext* context, const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode& ec)
+{
+    if (!context->securityOrigin()->canAccessDatabase() || !AbstractDatabase::isAvailable()) {
+        ec = SECURITY_ERR;
+        return 0;
+    }
+
+    return DatabaseSync::openDatabaseSync(context, name, version, displayName, estimatedSize, creationCallback, ec);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SQL_DATABASE)
diff --git a/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.h b/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.h
new file mode 100644
index 000000000..257d9efe2
--- /dev/null
+++ b/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+#ifndef WorkerContextSQLDatabase_h
+#define WorkerContextSQLDatabase_h
+
+#if ENABLE(SQL_DATABASE)
+
+#include "ExceptionCode.h"
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class Database;
+class DatabaseCallback;
+class DatabaseSync;
+class WorkerContext;
+
+class WorkerContextSQLDatabase {
+public:
+    static PassRefPtr<Database> openDatabase(WorkerContext*, const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode&);
+    static PassRefPtr<DatabaseSync> openDatabaseSync(WorkerContext*, const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode&);
+
+private:
+    WorkerContextSQLDatabase() { };
+    ~WorkerContextSQLDatabase() { };
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SQL_DATABASE)
+
+#endif // WorkerContextSQLDatabase_h
diff --git a/Source/WebCore/platform/qt/ScrollbarThemeQt.h b/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.idl
index cf4882da2..d3e6df47a 100644
--- a/Source/WebCore/platform/qt/ScrollbarThemeQt.h
+++ b/Source/WebCore/Modules/webdatabase/WorkerContextSQLDatabase.idl
@@ -10,10 +10,10 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
@@ -21,43 +21,20 @@
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
  */
 
-#ifndef ScrollbarThemeQt_h
-#define ScrollbarThemeQt_h
-
-#include "ScrollbarTheme.h"
-
-#include <QtCore/qglobal.h>
-
-QT_BEGIN_NAMESPACE
-class QStyle;
-QT_END_NAMESPACE
-
-namespace WebCore {
-
-class ScrollbarThemeQt : public ScrollbarTheme {
-public:
-    virtual ~ScrollbarThemeQt();
-
-    virtual bool paint(Scrollbar*, GraphicsContext*, const IntRect& damageRect);
-    virtual void paintScrollCorner(ScrollView*, GraphicsContext*, const IntRect& cornerRect);
-
-    virtual ScrollbarPart hitTest(Scrollbar*, const PlatformMouseEvent&);
-
-    virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
-
-    virtual void invalidatePart(Scrollbar*, ScrollbarPart);
-
-    virtual int thumbPosition(Scrollbar*);
-    virtual int thumbLength(Scrollbar*);
-    virtual int trackPosition(Scrollbar*);
-    virtual int trackLength(Scrollbar*);
+module window {
 
-    virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
+    interface [
+        Conditional=SQL_DATABASE,
+        Supplemental=WorkerContext
+    ] WorkerContextSQLDatabase {
+        [V8EnabledAtRuntime] Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize, in [Callback, Optional] DatabaseCallback creationCallback)
+            raises(DOMException);
 
-    QStyle* style() const;
-};
+        [V8EnabledAtRuntime] DatabaseSync openDatabaseSync(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize, in [Callback, Optional] DatabaseCallback creationCallback)
+            raises(DOMException);
+    };
 
 }
-#endif
diff --git a/Source/WebCore/storage/chromium/DatabaseObserver.h b/Source/WebCore/Modules/webdatabase/chromium/DatabaseObserver.h
index 657c78e9e..657c78e9e 100644
--- a/Source/WebCore/storage/chromium/DatabaseObserver.h
+++ b/Source/WebCore/Modules/webdatabase/chromium/DatabaseObserver.h
diff --git a/Source/WebCore/storage/chromium/DatabaseTrackerChromium.cpp b/Source/WebCore/Modules/webdatabase/chromium/DatabaseTrackerChromium.cpp
index 117fdbeed..117fdbeed 100644
--- a/Source/WebCore/storage/chromium/DatabaseTrackerChromium.cpp
+++ b/Source/WebCore/Modules/webdatabase/chromium/DatabaseTrackerChromium.cpp
diff --git a/Source/WebCore/storage/chromium/QuotaTracker.cpp b/Source/WebCore/Modules/webdatabase/chromium/QuotaTracker.cpp
index 2a0962798..2a0962798 100644
--- a/Source/WebCore/storage/chromium/QuotaTracker.cpp
+++ b/Source/WebCore/Modules/webdatabase/chromium/QuotaTracker.cpp
diff --git a/Source/WebCore/storage/chromium/QuotaTracker.h b/Source/WebCore/Modules/webdatabase/chromium/QuotaTracker.h
index def731ed4..def731ed4 100644
--- a/Source/WebCore/storage/chromium/QuotaTracker.h
+++ b/Source/WebCore/Modules/webdatabase/chromium/QuotaTracker.h
diff --git a/Source/WebCore/storage/chromium/SQLTransactionClientChromium.cpp b/Source/WebCore/Modules/webdatabase/chromium/SQLTransactionClientChromium.cpp
index d12f47193..d12f47193 100644
--- a/Source/WebCore/storage/chromium/SQLTransactionClientChromium.cpp
+++ b/Source/WebCore/Modules/webdatabase/chromium/SQLTransactionClientChromium.cpp
diff --git a/Source/WebCore/websockets/CloseEvent.h b/Source/WebCore/Modules/websockets/CloseEvent.h
index 75a775042..75a775042 100644
--- a/Source/WebCore/websockets/CloseEvent.h
+++ b/Source/WebCore/Modules/websockets/CloseEvent.h
diff --git a/Source/WebCore/websockets/CloseEvent.idl b/Source/WebCore/Modules/websockets/CloseEvent.idl
index ea75111ac..ea75111ac 100644
--- a/Source/WebCore/websockets/CloseEvent.idl
+++ b/Source/WebCore/Modules/websockets/CloseEvent.idl
diff --git a/Source/WebCore/Modules/websockets/DOMWindowWebSocket.idl b/Source/WebCore/Modules/websockets/DOMWindowWebSocket.idl
new file mode 100644
index 000000000..2b5fca8bb
--- /dev/null
+++ b/Source/WebCore/Modules/websockets/DOMWindowWebSocket.idl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+
+    interface [
+        Conditional=WEB_SOCKETS,
+        Supplemental=DOMWindow
+    ] DOMWindowWebSocket {
+#if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
+        attribute CloseEventConstructor CloseEvent;
+        attribute [JSCustomGetter, V8EnabledAtRuntime] WebSocketConstructor WebSocket; // Usable with the new operator
+#endif
+    };
+
+}
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannel.cpp b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.cpp
index 029e4ffd7..029e4ffd7 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannel.cpp
+++ b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.cpp
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannel.h b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h
index a14582a8f..32ea8aae1 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannel.h
+++ b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannel.h
@@ -50,13 +50,19 @@ public:
     ThreadableWebSocketChannel() { }
     static PassRefPtr<ThreadableWebSocketChannel> create(ScriptExecutionContext*, WebSocketChannelClient*);
 
+    enum SendResult {
+        SendSuccess,
+        SendFail,
+        InvalidMessage
+    };
+
     virtual bool useHixie76Protocol() = 0;
     virtual void connect(const KURL&, const String& protocol) = 0;
     virtual String subprotocol() = 0; // Will be available after didConnect() callback is invoked.
     virtual String extensions() = 0; // Will be available after didConnect() callback is invoked.
-    virtual bool send(const String& message) = 0;
-    virtual bool send(const ArrayBuffer&) = 0;
-    virtual bool send(const Blob&) = 0;
+    virtual SendResult send(const String& message) = 0;
+    virtual SendResult send(const ArrayBuffer&) = 0;
+    virtual SendResult send(const Blob&) = 0;
     virtual unsigned long bufferedAmount() const = 0;
     virtual void close(int code, const String& reason) = 0;
     // Log the reason text and close the connection. Will call didClose().
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.cpp b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp
index dcb1802a2..9a4f3fa23 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.cpp
+++ b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp
@@ -46,7 +46,7 @@ ThreadableWebSocketChannelClientWrapper::ThreadableWebSocketChannelClientWrapper
     , m_client(client)
     , m_syncMethodDone(true)
     , m_useHixie76Protocol(true)
-    , m_sendRequestResult(false)
+    , m_sendRequestResult(ThreadableWebSocketChannel::SendFail)
     , m_bufferedAmount(0)
     , m_suspended(false)
 {
@@ -112,12 +112,12 @@ void ThreadableWebSocketChannelClientWrapper::setExtensions(const String& extens
         memcpy(m_extensions.data(), extensions.characters(), sizeof(UChar) * length);
 }
 
-bool ThreadableWebSocketChannelClientWrapper::sendRequestResult() const
+ThreadableWebSocketChannel::SendResult ThreadableWebSocketChannelClientWrapper::sendRequestResult() const
 {
     return m_sendRequestResult;
 }
 
-void ThreadableWebSocketChannelClientWrapper::setSendRequestResult(bool sendRequestResult)
+void ThreadableWebSocketChannelClientWrapper::setSendRequestResult(ThreadableWebSocketChannel::SendResult sendRequestResult)
 {
     m_sendRequestResult = sendRequestResult;
     m_syncMethodDone = true;
diff --git a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.h
index 4b9b7fde7..bfd106381 100644
--- a/Source/WebCore/websockets/ThreadableWebSocketChannelClientWrapper.h
+++ b/Source/WebCore/Modules/websockets/ThreadableWebSocketChannelClientWrapper.h
@@ -35,6 +35,7 @@
 
 #include "PlatformString.h"
 #include "ScriptExecutionContext.h"
+#include "ThreadableWebSocketChannel.h"
 #include "WebSocketChannelClient.h"
 #include <wtf/Forward.h>
 #include <wtf/OwnPtr.h>
@@ -66,8 +67,8 @@ public:
     String extensions() const;
     void setExtensions(const String&);
 
-    bool sendRequestResult() const;
-    void setSendRequestResult(bool);
+    ThreadableWebSocketChannel::SendResult sendRequestResult() const;
+    void setSendRequestResult(ThreadableWebSocketChannel::SendResult);
 
     unsigned long bufferedAmount() const;
     void setBufferedAmount(unsigned long);
@@ -104,7 +105,7 @@ private:
     // ThreadSafeRefCounted must not have String member variables.
     Vector<UChar> m_subprotocol;
     Vector<UChar> m_extensions;
-    bool m_sendRequestResult;
+    ThreadableWebSocketChannel::SendResult m_sendRequestResult;
     unsigned long m_bufferedAmount;
     bool m_suspended;
     Vector<OwnPtr<ScriptExecutionContext::Task> > m_pendingTasks;
diff --git a/Source/WebCore/websockets/WebSocket.cpp b/Source/WebCore/Modules/websockets/WebSocket.cpp
index 36dbb6f32..78183f1fb 100644
--- a/Source/WebCore/websockets/WebSocket.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocket.cpp
@@ -288,9 +288,14 @@ bool WebSocket::send(const String& message, ExceptionCode& ec)
         m_bufferedAmountAfterClose = saturateAdd(m_bufferedAmountAfterClose, getFramingOverhead(payloadSize));
         return false;
     }
-    // FIXME: check message is valid utf8.
     ASSERT(m_channel);
-    return m_channel->send(message);
+    ThreadableWebSocketChannel::SendResult result = m_channel->send(message);
+    if (result == ThreadableWebSocketChannel::InvalidMessage) {
+        scriptExecutionContext()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "Websocket message contains invalid character(s).");
+        ec = SYNTAX_ERR;
+        return false;
+    }
+    return result == ThreadableWebSocketChannel::SendSuccess;
 }
 
 bool WebSocket::send(ArrayBuffer* binaryData, ExceptionCode& ec)
@@ -310,7 +315,7 @@ bool WebSocket::send(ArrayBuffer* binaryData, ExceptionCode& ec)
         return false;
     }
     ASSERT(m_channel);
-    return m_channel->send(*binaryData);
+    return m_channel->send(*binaryData) == ThreadableWebSocketChannel::SendSuccess;
 }
 
 bool WebSocket::send(Blob* binaryData, ExceptionCode& ec)
@@ -330,7 +335,7 @@ bool WebSocket::send(Blob* binaryData, ExceptionCode& ec)
         return false;
     }
     ASSERT(m_channel);
-    return m_channel->send(*binaryData);
+    return m_channel->send(*binaryData) == ThreadableWebSocketChannel::SendSuccess;
 }
 
 void WebSocket::close(int code, const String& reason, ExceptionCode& ec)
@@ -343,8 +348,15 @@ void WebSocket::close(int code, const String& reason, ExceptionCode& ec)
             ec = INVALID_ACCESS_ERR;
             return;
         }
-        // FIXME: if reason contains any unpaired surrogates, raise SYNTAX_ERR.
-        if (reason.utf8().length() > maxReasonSizeInBytes) {
+        CString utf8 = reason.utf8(true);
+        if (utf8.length() > maxReasonSizeInBytes) {
+            scriptExecutionContext()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "WebSocket close message is too long.");
+            ec = SYNTAX_ERR;
+            return;
+        }
+        // Checks whether reason is valid utf8.
+        if (utf8.isNull() && reason.length()) {
+            scriptExecutionContext()->addConsoleMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "WebSocket close message contains invalid character(s).");
             ec = SYNTAX_ERR;
             return;
         }
@@ -478,6 +490,7 @@ void WebSocket::didConnect()
     ASSERT(scriptExecutionContext());
     m_state = OPEN;
     m_subprotocol = m_channel->subprotocol();
+    m_extensions = m_channel->extensions();
     dispatchEvent(Event::create(eventNames().openEvent, false, false));
 }
 
diff --git a/Source/WebCore/websockets/WebSocket.h b/Source/WebCore/Modules/websockets/WebSocket.h
index 1e44245e8..1e44245e8 100644
--- a/Source/WebCore/websockets/WebSocket.h
+++ b/Source/WebCore/Modules/websockets/WebSocket.h
diff --git a/Source/WebCore/websockets/WebSocket.idl b/Source/WebCore/Modules/websockets/WebSocket.idl
index 92835ae43..92835ae43 100644
--- a/Source/WebCore/websockets/WebSocket.idl
+++ b/Source/WebCore/Modules/websockets/WebSocket.idl
diff --git a/Source/WebCore/websockets/WebSocketChannel.cpp b/Source/WebCore/Modules/websockets/WebSocketChannel.cpp
index ec0706db4..6c976aac9 100644
--- a/Source/WebCore/websockets/WebSocketChannel.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocketChannel.cpp
@@ -127,6 +127,8 @@ void WebSocketChannel::connect(const KURL& url, const String& protocol)
     ASSERT(!m_suspended);
     m_handshake = adoptPtr(new WebSocketHandshake(url, protocol, m_document, m_useHixie76Protocol));
     m_handshake->reset();
+    if (!m_useHixie76Protocol && m_deflateFramer.canDeflate())
+        m_handshake->addExtensionProcessor(m_deflateFramer.createExtensionProcessor());
     if (m_identifier)
         InspectorInstrumentation::didCreateWebSocket(m_document, m_identifier, url, m_document->url());
     ref();
@@ -155,37 +157,39 @@ String WebSocketChannel::extensions()
     return extensions;
 }
 
-bool WebSocketChannel::send(const String& message)
+ThreadableWebSocketChannel::SendResult WebSocketChannel::send(const String& message)
 {
     LOG(Network, "WebSocketChannel %p send %s", this, message.utf8().data());
+    CString utf8 = message.utf8(true);
+    if (utf8.isNull() && message.length())
+        return InvalidMessage;
     if (m_useHixie76Protocol) {
-        CString utf8 = message.utf8();
-        return sendFrameHixie76(utf8.data(), utf8.length());
+        return sendFrameHixie76(utf8.data(), utf8.length()) ? ThreadableWebSocketChannel::SendSuccess : ThreadableWebSocketChannel::SendFail;
     }
-    enqueueTextFrame(message);
+    enqueueTextFrame(utf8);
     // According to WebSocket API specification, WebSocket.send() should return void instead
     // of boolean. However, our implementation still returns boolean due to compatibility
     // concern (see bug 65850).
     // m_channel->send() may happen later, thus it's not always possible to know whether
     // the message has been sent to the socket successfully. In this case, we have no choice
     // but to return true.
-    return true;
+    return ThreadableWebSocketChannel::SendSuccess;
 }
 
-bool WebSocketChannel::send(const ArrayBuffer& binaryData)
+ThreadableWebSocketChannel::SendResult WebSocketChannel::send(const ArrayBuffer& binaryData)
 {
     LOG(Network, "WebSocketChannel %p send arraybuffer %p", this, &binaryData);
     ASSERT(!m_useHixie76Protocol);
     enqueueRawFrame(WebSocketFrame::OpCodeBinary, static_cast<const char*>(binaryData.data()), binaryData.byteLength());
-    return true;
+    return ThreadableWebSocketChannel::SendSuccess;
 }
 
-bool WebSocketChannel::send(const Blob& binaryData)
+ThreadableWebSocketChannel::SendResult WebSocketChannel::send(const Blob& binaryData)
 {
     LOG(Network, "WebSocketChannel %p send blob %s", this, binaryData.url().string().utf8().data());
     ASSERT(!m_useHixie76Protocol);
     enqueueBlobFrame(WebSocketFrame::OpCodeBinary, binaryData);
-    return true;
+    return ThreadableWebSocketChannel::SendSuccess;
 }
 
 bool WebSocketChannel::send(const char* data, int length)
@@ -228,6 +232,7 @@ void WebSocketChannel::fail(const String& reason)
         m_shouldDiscardReceivedData = true;
         if (m_buffer)
             skipBuffer(m_bufferSize); // Save memory.
+        m_deflateFramer.didFail();
         m_hasContinuousFrame = false;
         m_continuousFrameData.clear();
     }
@@ -618,6 +623,12 @@ bool WebSocketChannel::processFrame()
     ASSERT(m_buffer < frameEnd);
     ASSERT(frameEnd <= m_buffer + m_bufferSize);
 
+    OwnPtr<InflateResultHolder> inflateResult = m_deflateFramer.inflate(frame);
+    if (!inflateResult->succeeded()) {
+        fail(inflateResult->failureReason());
+        return false;
+    }
+
     // Validate the frame data.
     if (WebSocketFrame::isReservedOpCode(frame.opCode)) {
         fail("Unrecognized frame opcode: " + String::number(frame.opCode));
@@ -847,7 +858,7 @@ bool WebSocketChannel::processFrameHixie76()
     return false;
 }
 
-void WebSocketChannel::enqueueTextFrame(const String& string)
+void WebSocketChannel::enqueueTextFrame(const CString& string)
 {
     ASSERT(!m_useHixie76Protocol);
     ASSERT(m_outgoingFrameQueueStatus == OutgoingFrameQueueOpen);
@@ -895,8 +906,7 @@ void WebSocketChannel::processOutgoingFrameQueue()
         OwnPtr<QueuedFrame> frame = m_outgoingFrameQueue.takeFirst();
         switch (frame->frameType) {
         case QueuedFrameTypeString: {
-            CString utf8 = frame->stringData.utf8();
-            if (!sendFrame(frame->opCode, utf8.data(), utf8.length()))
+            if (!sendFrame(frame->opCode, frame->stringData.data(), frame->stringData.length()))
                 fail("Failed to send WebSocket frame.");
             break;
         }
@@ -1011,6 +1021,13 @@ bool WebSocketChannel::sendFrame(WebSocketFrame::OpCode opCode, const char* data
 
     ASSERT(!(opCode & ~opCodeMask)); // Checks whether "opCode" fits in the range of opCodes.
     WebSocketFrame frame(opCode, true, false, true, data, dataLength);
+
+    OwnPtr<DeflateResultHolder> deflateResult = m_deflateFramer.deflate(frame);
+    if (!deflateResult->succeeded()) {
+        fail(deflateResult->failureReason());
+        return false;
+    }
+
     Vector<char> frameData;
     makeFrameData(frame, frameData);
 
diff --git a/Source/WebCore/websockets/WebSocketChannel.h b/Source/WebCore/Modules/websockets/WebSocketChannel.h
index 4bb28c9f2..62b4fd35f 100644
--- a/Source/WebCore/websockets/WebSocketChannel.h
+++ b/Source/WebCore/Modules/websockets/WebSocketChannel.h
@@ -37,12 +37,14 @@
 #include "SocketStreamHandleClient.h"
 #include "ThreadableWebSocketChannel.h"
 #include "Timer.h"
+#include "WebSocketDeflateFramer.h"
 #include "WebSocketFrame.h"
 #include "WebSocketHandshake.h"
 #include <wtf/Deque.h>
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
+#include <wtf/text/CString.h>
 
 namespace WebCore {
 
@@ -70,9 +72,9 @@ public:
     virtual void connect(const KURL&, const String& protocol) OVERRIDE;
     virtual String subprotocol() OVERRIDE;
     virtual String extensions() OVERRIDE;
-    virtual bool send(const String& message) OVERRIDE;
-    virtual bool send(const ArrayBuffer&) OVERRIDE;
-    virtual bool send(const Blob&) OVERRIDE;
+    virtual ThreadableWebSocketChannel::SendResult send(const String& message) OVERRIDE;
+    virtual ThreadableWebSocketChannel::SendResult send(const ArrayBuffer&) OVERRIDE;
+    virtual ThreadableWebSocketChannel::SendResult send(const Blob&) OVERRIDE;
     virtual unsigned long bufferedAmount() const OVERRIDE;
     virtual void close(int code, const String& reason) OVERRIDE; // Start closing handshake.
     virtual void fail(const String& reason) OVERRIDE;
@@ -159,11 +161,11 @@ private:
         WebSocketFrame::OpCode opCode;
         QueuedFrameType frameType;
         // Only one of the following items is used, according to the value of frameType.
-        String stringData;
+        CString stringData;
         Vector<char> vectorData;
         RefPtr<Blob> blobData;
     };
-    void enqueueTextFrame(const String&);
+    void enqueueTextFrame(const CString&);
     void enqueueRawFrame(WebSocketFrame::OpCode, const char* data, size_t dataLength);
     void enqueueBlobFrame(WebSocketFrame::OpCode, const Blob&);
 
@@ -231,6 +233,8 @@ private:
     OwnPtr<FileReaderLoader> m_blobLoader;
     BlobLoaderStatus m_blobLoaderStatus;
 #endif
+
+    WebSocketDeflateFramer m_deflateFramer;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/websockets/WebSocketChannelClient.h b/Source/WebCore/Modules/websockets/WebSocketChannelClient.h
index 31d189217..31d189217 100644
--- a/Source/WebCore/websockets/WebSocketChannelClient.h
+++ b/Source/WebCore/Modules/websockets/WebSocketChannelClient.h
diff --git a/Source/WebCore/Modules/websockets/WebSocketDeflateFramer.cpp b/Source/WebCore/Modules/websockets/WebSocketDeflateFramer.cpp
new file mode 100644
index 000000000..67f9533ab
--- /dev/null
+++ b/Source/WebCore/Modules/websockets/WebSocketDeflateFramer.cpp
@@ -0,0 +1,257 @@
+/*
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_SOCKETS)
+
+#include "WebSocketDeflateFramer.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/text/StringHash.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class WebSocketExtensionDeflateFrame : public WebSocketExtensionProcessor {
+public:
+    static PassOwnPtr<WebSocketExtensionDeflateFrame> create(WebSocketDeflateFramer* framer)
+    {
+        return adoptPtr(new WebSocketExtensionDeflateFrame(framer));
+    }
+    virtual ~WebSocketExtensionDeflateFrame() { }
+
+    virtual String handshakeString() OVERRIDE;
+    virtual bool processResponse(const HashMap<String, String>&) OVERRIDE;
+    virtual String failureReason() OVERRIDE { return m_failureReason; }
+
+private:
+    WebSocketExtensionDeflateFrame(WebSocketDeflateFramer*);
+
+    WebSocketDeflateFramer* m_framer;
+    bool m_responseProcessed;
+    String m_failureReason;
+};
+
+// FXIME: Remove vendor prefix after the specification matured.
+WebSocketExtensionDeflateFrame::WebSocketExtensionDeflateFrame(WebSocketDeflateFramer* framer)
+    : WebSocketExtensionProcessor("x-webkit-deflate-frame")
+    , m_framer(framer)
+    , m_responseProcessed(false)
+{
+    ASSERT(m_framer);
+}
+
+String WebSocketExtensionDeflateFrame::handshakeString()
+{
+    return extensionToken(); // No parameter
+}
+
+bool WebSocketExtensionDeflateFrame::processResponse(const HashMap<String, String>& serverParameters)
+{
+#if USE(ZLIB)
+    if (m_responseProcessed) {
+        m_failureReason = "Received duplicate deflate-frame response";
+        return false;
+    }
+    m_responseProcessed = true;
+
+    int expectedNumParameters = 0;
+    int windowBits = 15;
+    HashMap<String, String>::const_iterator parameter = serverParameters.find("max_window_bits");
+    if (parameter != serverParameters.end()) {
+        windowBits = parameter->second.toInt();
+        if (windowBits < 8 || windowBits > 15) {
+            m_failureReason = "Received invalid max_window_bits parameter";
+            return false;
+        }
+        expectedNumParameters++;
+    }
+
+    WebSocketDeflater::ContextTakeOverMode mode = WebSocketDeflater::TakeOverContext;
+    parameter = serverParameters.find("no_context_takeover");
+    if (parameter != serverParameters.end()) {
+        if (!parameter->second.isNull()) {
+            m_failureReason = "Received invalid no_context_takeover parameter";
+            return false;
+        }
+        mode = WebSocketDeflater::DoNotTakeOverContext;
+        expectedNumParameters++;
+    }
+
+    if (expectedNumParameters != serverParameters.size()) {
+        m_failureReason = "Received unexpected deflate-frame parameter";
+        return false;
+    }
+
+    m_framer->enableDeflate(windowBits, mode);
+    return true;
+#else
+    ASSERT_NOT_REACHED();
+    return false;
+#endif
+}
+
+DeflateResultHolder::DeflateResultHolder(WebSocketDeflateFramer* framer)
+    : m_framer(framer)
+    , m_succeeded(true)
+{
+    ASSERT(m_framer);
+}
+
+DeflateResultHolder::~DeflateResultHolder()
+{
+    m_framer->resetDeflateContext();
+}
+
+void DeflateResultHolder::fail(const String& failureReason)
+{
+    m_succeeded = false;
+    m_failureReason = failureReason;
+}
+
+InflateResultHolder::InflateResultHolder(WebSocketDeflateFramer* framer)
+    : m_framer(framer)
+    , m_succeeded(true)
+{
+    ASSERT(m_framer);
+}
+
+InflateResultHolder::~InflateResultHolder()
+{
+    m_framer->resetInflateContext();
+}
+
+void InflateResultHolder::fail(const String& failureReason)
+{
+    m_succeeded = false;
+    m_failureReason = failureReason;
+}
+
+WebSocketDeflateFramer::WebSocketDeflateFramer()
+    : m_enabled(false)
+{
+}
+
+PassOwnPtr<WebSocketExtensionProcessor> WebSocketDeflateFramer::createExtensionProcessor()
+{
+    return WebSocketExtensionDeflateFrame::create(this);
+}
+
+bool WebSocketDeflateFramer::canDeflate() const
+{
+#if USE(ZLIB)
+    return true;
+#else
+    return false;
+#endif
+}
+
+#if USE(ZLIB)
+void WebSocketDeflateFramer::enableDeflate(int windowBits, WebSocketDeflater::ContextTakeOverMode mode)
+{
+    m_deflater = WebSocketDeflater::create(windowBits, mode);
+    m_inflater = WebSocketInflater::create();
+    if (!m_deflater->initialize() || !m_inflater->initialize()) {
+        m_deflater.clear();
+        m_inflater.clear();
+        return;
+    }
+    m_enabled = true;
+}
+#endif
+
+PassOwnPtr<DeflateResultHolder> WebSocketDeflateFramer::deflate(WebSocketFrame& frame)
+{
+#if USE(ZLIB)
+    OwnPtr<DeflateResultHolder> result = DeflateResultHolder::create(this);
+    if (!enabled() || !WebSocketFrame::isNonControlOpCode(frame.opCode) || !frame.payloadLength)
+        return result.release();
+    if (!m_deflater->addBytes(frame.payload, frame.payloadLength) || !m_deflater->finish()) {
+        result->fail("Failed to compress frame");
+        return result.release();
+    }
+    frame.compress = true;
+    frame.payload = m_deflater->data();
+    frame.payloadLength = m_deflater->size();
+    return result.release();
+#else
+    return DeflateResultHolder::create(this);
+#endif
+}
+
+void WebSocketDeflateFramer::resetDeflateContext()
+{
+#if USE(ZLIB)
+    if (m_deflater)
+        m_deflater->reset();
+#endif
+}
+
+PassOwnPtr<InflateResultHolder> WebSocketDeflateFramer::inflate(WebSocketFrame& frame)
+{
+#if USE(ZLIB)
+    OwnPtr<InflateResultHolder> result = InflateResultHolder::create(this);
+    if (!frame.compress)
+        return result.release();
+    if (!enabled() || !WebSocketFrame::isNonControlOpCode(frame.opCode)) {
+        result->fail("Received unexpected compressed frame");
+        return result.release();
+    }
+    if (!m_inflater->addBytes(frame.payload, frame.payloadLength) || !m_inflater->finish()) {
+        result->fail("Failed to decompress frame");
+        return result.release();
+    }
+    frame.compress = false;
+    frame.payload = m_inflater->data();
+    frame.payloadLength = m_inflater->size();
+    return result.release();
+#else
+    return InflateResultHolder::create(this);
+#endif
+}
+
+void WebSocketDeflateFramer::resetInflateContext()
+{
+#if USE(ZLIB)
+    if (m_inflater)
+        m_inflater->reset();
+#endif
+}
+
+void WebSocketDeflateFramer::didFail()
+{
+    resetDeflateContext();
+    resetInflateContext();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_SOCKETS)
diff --git a/Source/WebCore/Modules/websockets/WebSocketDeflateFramer.h b/Source/WebCore/Modules/websockets/WebSocketDeflateFramer.h
new file mode 100644
index 000000000..a35526821
--- /dev/null
+++ b/Source/WebCore/Modules/websockets/WebSocketDeflateFramer.h
@@ -0,0 +1,124 @@
+/*
+ * Copyright (C) 2012 Google Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebSocketDeflateFramer_h
+#define WebSocketDeflateFramer_h
+
+#if ENABLE(WEB_SOCKETS)
+
+#if USE(ZLIB)
+#include "WebSocketDeflater.h"
+#endif
+#include "WebSocketExtensionProcessor.h"
+#include "WebSocketFrame.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class WebSocketDeflateFramer;
+
+class DeflateResultHolder {
+public:
+    static PassOwnPtr<DeflateResultHolder> create(WebSocketDeflateFramer* framer)
+    {
+        return adoptPtr(new DeflateResultHolder(framer));
+    }
+
+    ~DeflateResultHolder();
+
+    bool succeeded() const { return m_succeeded; }
+    String failureReason() const { return m_failureReason; }
+
+    void fail(const String& failureReason);
+
+private:
+    explicit DeflateResultHolder(WebSocketDeflateFramer*);
+
+    WebSocketDeflateFramer* m_framer;
+    bool m_succeeded;
+    String m_failureReason;
+};
+
+class InflateResultHolder {
+public:
+    static PassOwnPtr<InflateResultHolder> create(WebSocketDeflateFramer* framer)
+    {
+        return adoptPtr(new InflateResultHolder(framer));
+    }
+
+    ~InflateResultHolder();
+
+    bool succeeded() const { return m_succeeded; }
+    String failureReason() const { return m_failureReason; }
+
+    void fail(const String& failureReason);
+
+private:
+    explicit InflateResultHolder(WebSocketDeflateFramer*);
+
+    WebSocketDeflateFramer* m_framer;
+    bool m_succeeded;
+    String m_failureReason;
+};
+
+class WebSocketDeflateFramer {
+public:
+    WebSocketDeflateFramer();
+
+    PassOwnPtr<WebSocketExtensionProcessor> createExtensionProcessor();
+
+    bool canDeflate() const;
+    bool enabled() const { return m_enabled; }
+
+    PassOwnPtr<DeflateResultHolder> deflate(WebSocketFrame&);
+    void resetDeflateContext();
+    PassOwnPtr<InflateResultHolder> inflate(WebSocketFrame&);
+    void resetInflateContext();
+
+    void didFail();
+
+#if USE(ZLIB)
+    void enableDeflate(int windowBits, WebSocketDeflater::ContextTakeOverMode);
+#endif
+
+private:
+    bool m_enabled;
+#if USE(ZLIB)
+    OwnPtr<WebSocketDeflater> m_deflater;
+    OwnPtr<WebSocketInflater> m_inflater;
+#endif
+};
+
+}
+
+#endif // ENABLE(WEB_SOCKETS)
+
+#endif // WebSocketDeflateFramer_h
diff --git a/Source/WebCore/websockets/WebSocketDeflater.cpp b/Source/WebCore/Modules/websockets/WebSocketDeflater.cpp
index 47ea94055..ca4960129 100644
--- a/Source/WebCore/websockets/WebSocketDeflater.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocketDeflater.cpp
@@ -29,11 +29,10 @@
  */
 
 #include "config.h"
-
-#if ENABLE(WEB_SOCKETS)
-
 #include "WebSocketDeflater.h"
 
+#if ENABLE(WEB_SOCKETS) && USE(ZLIB)
+
 #include "Logging.h"
 #include <wtf/FastMalloc.h>
 #include <wtf/HashMap.h>
@@ -209,4 +208,4 @@ void WebSocketInflater::reset()
 
 } // namespace WebCore
 
-#endif // ENABLE(WEB_SOCKETS)
+#endif // ENABLE(WEB_SOCKETS) && USE(ZLIB)
diff --git a/Source/WebCore/websockets/WebSocketDeflater.h b/Source/WebCore/Modules/websockets/WebSocketDeflater.h
index 9c630dcfb..9c630dcfb 100644
--- a/Source/WebCore/websockets/WebSocketDeflater.h
+++ b/Source/WebCore/Modules/websockets/WebSocketDeflater.h
diff --git a/Source/WebCore/websockets/WebSocketExtensionDispatcher.cpp b/Source/WebCore/Modules/websockets/WebSocketExtensionDispatcher.cpp
index 7c592ad1b..7c592ad1b 100644
--- a/Source/WebCore/websockets/WebSocketExtensionDispatcher.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocketExtensionDispatcher.cpp
diff --git a/Source/WebCore/websockets/WebSocketExtensionDispatcher.h b/Source/WebCore/Modules/websockets/WebSocketExtensionDispatcher.h
index 35cd769ea..35cd769ea 100644
--- a/Source/WebCore/websockets/WebSocketExtensionDispatcher.h
+++ b/Source/WebCore/Modules/websockets/WebSocketExtensionDispatcher.h
diff --git a/Source/WebCore/websockets/WebSocketExtensionProcessor.h b/Source/WebCore/Modules/websockets/WebSocketExtensionProcessor.h
index ee3d53d41..ee3d53d41 100644
--- a/Source/WebCore/websockets/WebSocketExtensionProcessor.h
+++ b/Source/WebCore/Modules/websockets/WebSocketExtensionProcessor.h
diff --git a/Source/WebCore/websockets/WebSocketFrame.h b/Source/WebCore/Modules/websockets/WebSocketFrame.h
index 7efea78db..7efea78db 100644
--- a/Source/WebCore/websockets/WebSocketFrame.h
+++ b/Source/WebCore/Modules/websockets/WebSocketFrame.h
diff --git a/Source/WebCore/websockets/WebSocketHandshake.cpp b/Source/WebCore/Modules/websockets/WebSocketHandshake.cpp
index 8cc509e59..8cc509e59 100644
--- a/Source/WebCore/websockets/WebSocketHandshake.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocketHandshake.cpp
diff --git a/Source/WebCore/websockets/WebSocketHandshake.h b/Source/WebCore/Modules/websockets/WebSocketHandshake.h
index b025f0c27..b025f0c27 100644
--- a/Source/WebCore/websockets/WebSocketHandshake.h
+++ b/Source/WebCore/Modules/websockets/WebSocketHandshake.h
diff --git a/Source/WebCore/websockets/WebSocketHandshakeRequest.cpp b/Source/WebCore/Modules/websockets/WebSocketHandshakeRequest.cpp
index 1132a4478..1132a4478 100644
--- a/Source/WebCore/websockets/WebSocketHandshakeRequest.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocketHandshakeRequest.cpp
diff --git a/Source/WebCore/websockets/WebSocketHandshakeRequest.h b/Source/WebCore/Modules/websockets/WebSocketHandshakeRequest.h
index 792f67e52..792f67e52 100644
--- a/Source/WebCore/websockets/WebSocketHandshakeRequest.h
+++ b/Source/WebCore/Modules/websockets/WebSocketHandshakeRequest.h
diff --git a/Source/WebCore/websockets/WebSocketHandshakeResponse.cpp b/Source/WebCore/Modules/websockets/WebSocketHandshakeResponse.cpp
index 2e0dad7f0..2e0dad7f0 100644
--- a/Source/WebCore/websockets/WebSocketHandshakeResponse.cpp
+++ b/Source/WebCore/Modules/websockets/WebSocketHandshakeResponse.cpp
diff --git a/Source/WebCore/websockets/WebSocketHandshakeResponse.h b/Source/WebCore/Modules/websockets/WebSocketHandshakeResponse.h
index fe435ee14..fe435ee14 100644
--- a/Source/WebCore/websockets/WebSocketHandshakeResponse.h
+++ b/Source/WebCore/Modules/websockets/WebSocketHandshakeResponse.h
diff --git a/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp b/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp
index c7486557a..762dc4369 100644
--- a/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.cpp
+++ b/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.cpp
@@ -89,24 +89,24 @@ String WorkerThreadableWebSocketChannel::extensions()
     return m_workerClientWrapper->extensions();
 }
 
-bool WorkerThreadableWebSocketChannel::send(const String& message)
+ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::send(const String& message)
 {
     if (!m_bridge)
-        return false;
+        return ThreadableWebSocketChannel::SendFail;
     return m_bridge->send(message);
 }
 
-bool WorkerThreadableWebSocketChannel::send(const ArrayBuffer& binaryData)
+ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::send(const ArrayBuffer& binaryData)
 {
     if (!m_bridge)
-        return false;
+        return ThreadableWebSocketChannel::SendFail;
     return m_bridge->send(binaryData);
 }
 
-bool WorkerThreadableWebSocketChannel::send(const Blob& binaryData)
+ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::send(const Blob& binaryData)
 {
     if (!m_bridge)
-        return false;
+        return ThreadableWebSocketChannel::SendFail;
     return m_bridge->send(binaryData);
 }
 
@@ -180,7 +180,7 @@ void WorkerThreadableWebSocketChannel::Peer::connect(const KURL& url, const Stri
     m_mainWebSocketChannel->connect(url, protocol);
 }
 
-static void workerContextDidSend(ScriptExecutionContext* context, PassRefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper, bool sendRequestResult)
+static void workerContextDidSend(ScriptExecutionContext* context, PassRefPtr<ThreadableWebSocketChannelClientWrapper> workerClientWrapper, ThreadableWebSocketChannel::SendResult sendRequestResult)
 {
     ASSERT_UNUSED(context, context->isWorkerContext());
     workerClientWrapper->setSendRequestResult(sendRequestResult);
@@ -191,7 +191,7 @@ void WorkerThreadableWebSocketChannel::Peer::send(const String& message)
     ASSERT(isMainThread());
     if (!m_mainWebSocketChannel || !m_workerClientWrapper)
         return;
-    bool sendRequestResult = m_mainWebSocketChannel->send(message);
+    ThreadableWebSocketChannel::SendResult sendRequestResult = m_mainWebSocketChannel->send(message);
     m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidSend, m_workerClientWrapper, sendRequestResult), m_taskMode);
 }
 
@@ -200,7 +200,7 @@ void WorkerThreadableWebSocketChannel::Peer::send(const ArrayBuffer& binaryData)
     ASSERT(isMainThread());
     if (!m_mainWebSocketChannel || !m_workerClientWrapper)
         return;
-    bool sendRequestResult = m_mainWebSocketChannel->send(binaryData);
+    ThreadableWebSocketChannel::SendResult sendRequestResult = m_mainWebSocketChannel->send(binaryData);
     m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidSend, m_workerClientWrapper, sendRequestResult), m_taskMode);
 }
 
@@ -209,7 +209,7 @@ void WorkerThreadableWebSocketChannel::Peer::send(const Blob& binaryData)
     ASSERT(isMainThread());
     if (!m_mainWebSocketChannel || !m_workerClientWrapper)
         return;
-    bool sendRequestResult = m_mainWebSocketChannel->send(binaryData);
+    ThreadableWebSocketChannel::SendResult sendRequestResult = m_mainWebSocketChannel->send(binaryData);
     m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidSend, m_workerClientWrapper, sendRequestResult), m_taskMode);
 }
 
@@ -432,23 +432,25 @@ void WorkerThreadableWebSocketChannel::mainThreadSendBlob(ScriptExecutionContext
     peer->send(*blob);
 }
 
-bool WorkerThreadableWebSocketChannel::Bridge::send(const String& message)
+ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::Bridge::send(const String& message)
 {
     if (!m_workerClientWrapper)
-        return false;
+        return ThreadableWebSocketChannel::SendFail;
     ASSERT(m_peer);
     setMethodNotCompleted();
     m_loaderProxy.postTaskToLoader(createCallbackTask(&WorkerThreadableWebSocketChannel::mainThreadSend, AllowCrossThreadAccess(m_peer), message));
     RefPtr<Bridge> protect(this);
     waitForMethodCompletion();
     ThreadableWebSocketChannelClientWrapper* clientWrapper = m_workerClientWrapper.get();
-    return clientWrapper && clientWrapper->sendRequestResult();
+    if (!clientWrapper)
+        return ThreadableWebSocketChannel::SendFail;
+    return clientWrapper->sendRequestResult();
 }
 
-bool WorkerThreadableWebSocketChannel::Bridge::send(const ArrayBuffer& binaryData)
+ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::Bridge::send(const ArrayBuffer& binaryData)
 {
     if (!m_workerClientWrapper)
-        return false;
+        return ThreadableWebSocketChannel::SendFail;
     ASSERT(m_peer);
     // ArrayBuffer isn't thread-safe, hence the content of ArrayBuffer is copied into Vector<char>.
     OwnPtr<Vector<char> > data = adoptPtr(new Vector<char>(binaryData.byteLength()));
@@ -459,20 +461,24 @@ bool WorkerThreadableWebSocketChannel::Bridge::send(const ArrayBuffer& binaryDat
     RefPtr<Bridge> protect(this);
     waitForMethodCompletion();
     ThreadableWebSocketChannelClientWrapper* clientWrapper = m_workerClientWrapper.get();
-    return clientWrapper && clientWrapper->sendRequestResult();
+    if (!clientWrapper)
+        return ThreadableWebSocketChannel::SendFail;
+    return clientWrapper->sendRequestResult();
 }
 
-bool WorkerThreadableWebSocketChannel::Bridge::send(const Blob& binaryData)
+ThreadableWebSocketChannel::SendResult WorkerThreadableWebSocketChannel::Bridge::send(const Blob& binaryData)
 {
     if (!m_workerClientWrapper)
-        return false;
+        return ThreadableWebSocketChannel::SendFail;
     ASSERT(m_peer);
     setMethodNotCompleted();
     m_loaderProxy.postTaskToLoader(createCallbackTask(&WorkerThreadableWebSocketChannel::mainThreadSendBlob, AllowCrossThreadAccess(m_peer), binaryData.url(), binaryData.type(), binaryData.size()));
     RefPtr<Bridge> protect(this);
     waitForMethodCompletion();
     ThreadableWebSocketChannelClientWrapper* clientWrapper = m_workerClientWrapper.get();
-    return clientWrapper && clientWrapper->sendRequestResult();
+    if (!clientWrapper)
+        return ThreadableWebSocketChannel::SendFail;
+    return clientWrapper->sendRequestResult();
 }
 
 void WorkerThreadableWebSocketChannel::mainThreadBufferedAmount(ScriptExecutionContext* context, Peer* peer)
diff --git a/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.h b/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h
index 317fce93c..fa816da76 100644
--- a/Source/WebCore/websockets/WorkerThreadableWebSocketChannel.h
+++ b/Source/WebCore/Modules/websockets/WorkerThreadableWebSocketChannel.h
@@ -65,9 +65,9 @@ public:
     virtual void connect(const KURL&, const String& protocol) OVERRIDE;
     virtual String subprotocol() OVERRIDE;
     virtual String extensions() OVERRIDE;
-    virtual bool send(const String& message) OVERRIDE;
-    virtual bool send(const ArrayBuffer&) OVERRIDE;
-    virtual bool send(const Blob&) OVERRIDE;
+    virtual ThreadableWebSocketChannel::SendResult send(const String& message) OVERRIDE;
+    virtual ThreadableWebSocketChannel::SendResult send(const ArrayBuffer&) OVERRIDE;
+    virtual ThreadableWebSocketChannel::SendResult send(const Blob&) OVERRIDE;
     virtual unsigned long bufferedAmount() const OVERRIDE;
     virtual void close(int code, const String& reason) OVERRIDE;
     virtual void fail(const String& reason) OVERRIDE;
@@ -132,9 +132,9 @@ private:
         }
         ~Bridge();
         void connect(const KURL&, const String& protocol);
-        bool send(const String& message);
-        bool send(const ArrayBuffer&);
-        bool send(const Blob&);
+        ThreadableWebSocketChannel::SendResult send(const String& message);
+        ThreadableWebSocketChannel::SendResult send(const ArrayBuffer&);
+        ThreadableWebSocketChannel::SendResult send(const Blob&);
         unsigned long bufferedAmount();
         void close(int code, const String& reason);
         void fail(const String& reason);
diff --git a/Source/WebCore/PlatformBlackBerry.cmake b/Source/WebCore/PlatformBlackBerry.cmake
index 32524d084..42f4ccd97 100644
--- a/Source/WebCore/PlatformBlackBerry.cmake
+++ b/Source/WebCore/PlatformBlackBerry.cmake
@@ -77,6 +77,7 @@ LIST(APPEND WebCore_SOURCES
     platform/image-decoders/png/PNGImageDecoder.cpp
     platform/image-decoders/webp/WEBPImageDecoder.cpp
     platform/image-encoders/JPEGImageEncoder.cpp
+    platform/image-encoders/skia/JPEGImageEncoder.cpp
     platform/posix/FileSystemPOSIX.cpp
     platform/posix/SharedBufferPOSIX.cpp
     platform/text/TextBreakIteratorICU.cpp
@@ -87,6 +88,7 @@ LIST(APPEND WebCore_SOURCES
 
 # Networking sources
 LIST(APPEND WebCore_SOURCES
+    platform/network/MIMESniffing.cpp
     platform/network/ProxyServer.cpp
     platform/network/blackberry/DeferredData.cpp
     platform/network/blackberry/NetworkJob.cpp
@@ -132,7 +134,6 @@ LIST(APPEND WebCore_SOURCES
     page/blackberry/AccessibilityObjectBlackBerry.cpp
     page/blackberry/DragControllerBlackBerry.cpp
     page/blackberry/EventHandlerBlackBerry.cpp
-    page/blackberry/FrameBlackBerry.cpp
     platform/blackberry/ClipboardBlackBerry.cpp
     platform/blackberry/ContextMenuBlackBerry.cpp
     platform/blackberry/ContextMenuItemBlackBerry.cpp
@@ -153,6 +154,7 @@ LIST(APPEND WebCore_SOURCES
     platform/blackberry/PlatformTouchPointBlackBerry.cpp
     platform/blackberry/PopupMenuBlackBerry.cpp
     platform/blackberry/RenderThemeBlackBerry.cpp
+    platform/blackberry/RunLoopBlackBerry.cpp
     platform/blackberry/SSLKeyGeneratorBlackBerry.cpp
     platform/blackberry/ScrollbarThemeBlackBerry.cpp
     platform/blackberry/SearchPopupMenuBlackBerry.cpp
@@ -169,8 +171,7 @@ LIST(APPEND WebCore_SOURCES
     platform/graphics/blackberry/IntPointBlackBerry.cpp
     platform/graphics/blackberry/IntRectBlackBerry.cpp
     platform/graphics/blackberry/IntSizeBlackBerry.cpp
-    platform/graphics/blackberry/MMrenderer.cpp
-    platform/graphics/blackberry/MediaPlayerPrivateMMrenderer.cpp
+    platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
     platform/text/blackberry/StringBlackBerry.cpp
 )
 
@@ -238,6 +239,7 @@ IF (WTF_USE_ACCELERATED_COMPOSITING)
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerAnimation.cpp
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerCompositingThread.cpp
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerRenderer.cpp
+        ${WEBCORE_DIR}/platform/graphics/blackberry/LayerRendererSurface.cpp
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerTile.cpp
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerTiler.cpp
         ${WEBCORE_DIR}/platform/graphics/blackberry/LayerWebKitThread.cpp
diff --git a/Source/WebCore/PlatformEfl.cmake b/Source/WebCore/PlatformEfl.cmake
index 5d98c8904..e461e0f59 100644
--- a/Source/WebCore/PlatformEfl.cmake
+++ b/Source/WebCore/PlatformEfl.cmake
@@ -47,6 +47,7 @@ LIST(APPEND WebCore_SOURCES
   platform/efl/PopupMenuEfl.cpp
   platform/efl/RefPtrEfl.cpp
   platform/efl/RenderThemeEfl.cpp
+  platform/efl/RunLoopEfl.cpp
   platform/efl/ScrollViewEfl.cpp
   platform/efl/ScrollbarEfl.cpp
   platform/efl/ScrollbarThemeEfl.cpp
@@ -188,6 +189,7 @@ IF (ENABLE_VIDEO)
   LIST(APPEND WebCore_SOURCES
     platform/graphics/gstreamer/GRefPtrGStreamer.cpp
     platform/graphics/gstreamer/GStreamerGWorld.cpp
+    platform/graphics/gstreamer/GStreamerVersioning.cpp
     platform/graphics/gstreamer/ImageGStreamerCairo.cpp
     platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
     platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp
@@ -203,8 +205,10 @@ LIST(APPEND WebCore_LIBRARIES
   ${EVAS_LIBRARIES}
   ${FREETYPE_LIBRARIES}
   ${ICU_LIBRARIES}
+  ${JPEG_LIBRARY}
   ${LIBXML2_LIBRARIES}
   ${LIBXSLT_LIBRARIES}
+  ${PNG_LIBRARY}
   ${SQLITE_LIBRARIES}
   ${Glib_LIBRARIES}
   ${LIBSOUP24_LIBRARIES}
diff --git a/Source/WebCore/PlatformWinCE.cmake b/Source/WebCore/PlatformWinCE.cmake
index 11bb4b1ec..63457119f 100644
--- a/Source/WebCore/PlatformWinCE.cmake
+++ b/Source/WebCore/PlatformWinCE.cmake
@@ -32,7 +32,6 @@ LIST(APPEND WebCore_SOURCES
     platform/Cursor.cpp
     platform/LocalizedStrings.cpp
     platform/PlatformStrategies.cpp
-    platform/RunLoop.cpp
     platform/ScrollAnimatorWin.cpp
 
     platform/graphics/ImageSource.cpp
diff --git a/Source/WebCore/Resources/linearSRGB.icc b/Source/WebCore/Resources/linearSRGB.icc
new file mode 100644
index 000000000..5cc437106
--- /dev/null
+++ b/Source/WebCore/Resources/linearSRGB.icc
diff --git a/Source/WebCore/Target.pri b/Source/WebCore/Target.pri
index 9f5ce3817..56c17f3fc 100644
--- a/Source/WebCore/Target.pri
+++ b/Source/WebCore/Target.pri
@@ -19,7 +19,7 @@ DEFINES += QT_MAKEDLL
 haveQt(5) {
     # Add a QtScript dependency for the time being, in order to pull in the include
     # path for QtScript when it's built as a standalone module
-    QT += script widgets
+    QT += script
 } else {
     INCLUDEPATH += $$PWD/../JavaScriptCore/wtf/qt/compat
 }
@@ -38,6 +38,14 @@ SOURCES += \
     Modules/geolocation/GeolocationController.cpp \
     Modules/geolocation/NavigatorGeolocation.cpp \
     \
+    Modules/webdatabase/AbstractDatabase.cpp \
+    Modules/webdatabase/DOMWindowSQLDatabase.cpp \
+    Modules/webdatabase/Database.cpp \
+    Modules/webdatabase/DatabaseAuthorizer.cpp \
+    Modules/webdatabase/DatabaseContext.cpp \
+    Modules/webdatabase/DatabaseSync.cpp \
+    Modules/webdatabase/WorkerContextSQLDatabase.cpp \
+    \
     accessibility/AccessibilityImageMapLink.cpp \
     accessibility/AccessibilityMediaControls.cpp \
     accessibility/AccessibilityMenuList.cpp \
@@ -173,7 +181,6 @@ v8 {
         bindings/v8/custom/V8DedicatedWorkerContextCustom.cpp \
         bindings/v8/custom/V8DocumentCustom.cpp \
         bindings/v8/custom/V8DocumentLocationCustom.cpp \
-        bindings/v8/custom/V8ElementCustom.cpp \
         bindings/v8/custom/V8EventCustom.cpp \
         bindings/v8/custom/V8FileReaderCustom.cpp \
         bindings/v8/custom/V8HTMLAllCollectionCustom.cpp
@@ -461,6 +468,7 @@ SOURCES += \
     css/ShadowValue.cpp \
     css/StyleMedia.cpp \
     css/StylePropertySet.cpp \
+    css/StyleRule.cpp \
     css/StyleSheet.cpp \
     css/StyleSheetList.cpp \
     css/WebKitCSSFilterValue.cpp \
@@ -488,6 +496,7 @@ SOURCES += \
     dom/Comment.cpp \
     dom/CompositionEvent.cpp \
     dom/ContainerNode.cpp \
+    dom/ContextDestructionObserver.cpp \
     dom/CustomEvent.cpp \
     dom/DecodedDataDocumentParser.cpp \
     dom/DeviceMotionController.cpp \
@@ -560,6 +569,7 @@ SOURCES += \
     dom/Range.cpp \
     dom/RangeException.cpp \
     dom/RawDataDocumentParser.h \
+    dom/RegionNodeList.cpp \
     dom/RegisteredEventListener.cpp \
     dom/ScopedEventQueue.cpp \
     dom/ScriptedAnimationController.cpp \
@@ -570,7 +580,7 @@ SOURCES += \
     dom/SecurityContext.cpp \
     dom/SelectorQuery.cpp \
     dom/ShadowRoot.cpp \
-    dom/ShadowRootList.cpp \
+    dom/ShadowTree.cpp \
     dom/SpaceSplitString.cpp \
     dom/StaticNodeList.cpp \
     dom/StyledElement.cpp \
@@ -650,6 +660,8 @@ SOURCES += \
     editing/VisibleSelection.cpp \
     editing/visible_units.cpp \
     editing/WrapContentsInDummySpanCommand.cpp \
+    fileapi/AsyncFileStream.cpp \
+    fileapi/AsyncFileStream.cpp \
     fileapi/Blob.cpp \
     fileapi/BlobURL.cpp \
     fileapi/DOMFilePath.cpp \
@@ -674,8 +686,6 @@ SOURCES += \
     fileapi/FileReader.cpp \
     fileapi/FileReaderLoader.cpp \
     fileapi/FileReaderSync.cpp \
-    fileapi/FileStreamProxy.cpp \
-    fileapi/FileSystemCallbacks.cpp \
     fileapi/FileThread.cpp \
     fileapi/FileWriter.cpp \
     fileapi/FileWriterBase.cpp \
@@ -684,6 +694,7 @@ SOURCES += \
     fileapi/OperationNotAllowedException.cpp \
     fileapi/ThreadableBlobRegistry.cpp \
     fileapi/WebKitBlobBuilder.cpp \
+    fileapi/WorkerContextFileSystem.cpp \
     history/BackForwardController.cpp \
     history/BackForwardListImpl.cpp \
     history/CachedFrame.cpp \
@@ -693,6 +704,7 @@ SOURCES += \
     history/PageCache.cpp \
     html/BaseButtonInputType.cpp \
     html/BaseCheckableInputType.cpp \
+    html/BaseClickableWithKeyInputType.cpp \
     html/BaseDateAndTimeInputType.cpp \
     html/BaseTextInputType.cpp \
     html/ButtonInputType.cpp \
@@ -798,6 +810,7 @@ SOURCES += \
     html/ImageDocument.cpp \
     html/ImageInputType.cpp \
     html/InputType.cpp \
+    html/LabelableElement.cpp \
     html/LabelsNodeList.cpp \
     html/LinkRelAttribute.cpp \
     html/MediaDocument.cpp \
@@ -1005,12 +1018,10 @@ SOURCES += \
     page/Navigator.cpp \
     page/NavigatorBase.cpp \
     page/NavigatorRegisterProtocolHandler.cpp \
-    page/NavigatorSupplement.cpp \
     page/OriginAccessEntry.cpp \
     page/Page.cpp \
     page/PageGroup.cpp \
     page/PageGroupLoadDeferrer.cpp \
-    page/PageSupplement.cpp \
     page/PageVisibilityState.cpp \
     page/Performance.cpp \
     page/PerformanceNavigation.cpp \
@@ -1072,6 +1083,8 @@ SOURCES += \
     platform/graphics/FontData.cpp \
     platform/graphics/Font.cpp \
     platform/graphics/FontCache.cpp \
+    platform/graphics/FractionalLayoutRect.cpp \
+    platform/graphics/FractionalLayoutSize.cpp \
     platform/graphics/GeneratorGeneratedImage.cpp \
     platform/graphics/Gradient.cpp \
     platform/graphics/GraphicsContext.cpp \
@@ -1212,7 +1225,6 @@ SOURCES += \
     rendering/RenderCombineText.cpp \
     rendering/RenderCounter.cpp \
     rendering/RenderDeprecatedFlexibleBox.cpp \
-    rendering/RenderDetails.cpp \
     rendering/RenderDetailsMarker.cpp \
     rendering/RenderEmbeddedObject.cpp \
     rendering/RenderFieldset.cpp \
@@ -1254,7 +1266,6 @@ SOURCES += \
     rendering/RenderScrollbarPart.cpp \
     rendering/RenderScrollbarTheme.cpp \
     rendering/RenderSlider.cpp \
-    rendering/RenderSummary.cpp \
     rendering/RenderTable.cpp \
     rendering/RenderTableCaption.cpp \
     rendering/RenderTableCell.cpp \
@@ -1290,6 +1301,7 @@ SOURCES += \
     rendering/style/StyleFlexibleBoxData.cpp \
     rendering/style/StyleGeneratedImage.cpp \
     rendering/style/StyleGridData.cpp \
+    rendering/style/StyleGridItemData.cpp \
     rendering/style/StyleInheritedData.cpp \
     rendering/style/StyleMarqueeData.cpp \
     rendering/style/StyleMultiColData.cpp \
@@ -1298,11 +1310,6 @@ SOURCES += \
     rendering/style/StyleSurroundData.cpp \
     rendering/style/StyleTransformData.cpp \
     rendering/style/StyleVisualData.cpp \
-    storage/AbstractDatabase.cpp \
-    storage/DOMWindowSQLDatabase.cpp \
-    storage/Database.cpp \
-    storage/DatabaseAuthorizer.cpp \
-    storage/DatabaseSync.cpp \
     storage/StorageTask.cpp \
     storage/StorageThread.cpp \
     storage/Storage.cpp \
@@ -1528,6 +1535,30 @@ HEADERS += \
     Modules/geolocation/PositionErrorCallback.h \
     Modules/geolocation/PositionOptions.h \
     \
+    Modules/webdatabase/AbstractDatabase.h \
+    Modules/webdatabase/ChangeVersionWrapper.h \
+    Modules/webdatabase/DOMWindowSQLDatabase.h \
+    Modules/webdatabase/DatabaseAuthorizer.h \
+    Modules/webdatabase/Database.h \
+    Modules/webdatabase/DatabaseCallback.h \
+    Modules/webdatabase/DatabaseSync.h \
+    Modules/webdatabase/DatabaseTask.h \
+    Modules/webdatabase/DatabaseThread.h \
+    Modules/webdatabase/DatabaseTracker.h \
+    Modules/webdatabase/OriginQuotaManager.h \
+    Modules/webdatabase/OriginUsageRecord.h \
+    Modules/webdatabase/SQLCallbackWrapper.h \
+    Modules/webdatabase/SQLResultSet.h \
+    Modules/webdatabase/SQLResultSetRowList.h \
+    Modules/webdatabase/SQLStatement.h \
+    Modules/webdatabase/SQLStatementSync.h \
+    Modules/webdatabase/SQLTransaction.h \
+    Modules/webdatabase/SQLTransactionClient.h \
+    Modules/webdatabase/SQLTransactionCoordinator.h \
+    Modules/webdatabase/SQLTransactionSync.h \
+    Modules/webdatabase/SQLTransactionSyncCallback.h \
+    Modules/webdatabase/WorkerContextSQLDatabase.h \
+    \
     css/CSSAspectRatioValue.h \
     css/CSSBorderImageSliceValue.h \
     css/CSSBorderImage.h \
@@ -1592,6 +1623,7 @@ HEADERS += \
     css/ShadowValue.h \
     css/StyleMedia.h \
     css/StylePropertySet.h \
+    css/StyleRule.h \
     css/StyleSheet.h \
     css/StyleSheetList.h \
     css/WebKitCSSFilterValue.h \
@@ -1690,7 +1722,7 @@ HEADERS += \
     dom/ScriptExecutionContext.h \
     dom/SelectorQuery.h \
     dom/ShadowRoot.h \
-    dom/ShadowRootList.h \
+    dom/ShadowTree.h \
     dom/SpaceSplitString.h \
     dom/StaticNodeList.h \
     dom/StyledElement.h \
@@ -1780,7 +1812,6 @@ HEADERS += \
     fileapi/FileReaderLoader.h \
     fileapi/FileReaderLoaderClient.h \
     fileapi/FileReaderSync.h \
-    fileapi/FileStreamProxy.h \
     fileapi/FileThread.h \
     fileapi/FileThreadTask.h \
     fileapi/OperationNotAllowedException.h \
@@ -1895,6 +1926,7 @@ HEADERS += \
     html/HTMLViewSourceDocument.h \
     html/ImageData.h \
     html/ImageDocument.h \
+    html/LabelableElement.h \
     html/LabelsNodeList.h \
     html/LinkRelAttribute.h \
     html/MediaController.h \
@@ -2046,7 +2078,7 @@ HEADERS += \
     mathml/MathMLTextElement.h \
     notifications/Notification.h \
     notifications/NotificationCenter.h \
-    notifications/NotificationPresenter.h \
+    notifications/NotificationClient.h \
     notifications/NotificationContents.h \
     notifications/NotificationController.h \
     page/animation/AnimationBase.h \
@@ -2084,7 +2116,6 @@ HEADERS += \
     page/PageGroup.h \
     page/PageGroupLoadDeferrer.h \
     page/Page.h \
-    page/PageSupplement.h \
     page/PageVisibilityState.h \
     page/PrintContext.h \
     page/Screen.h \
@@ -2105,7 +2136,6 @@ HEADERS += \
     platform/animation/AnimationList.h \
     platform/animation/AnimationUtilities.h \
     platform/Arena.h \
-    platform/AsyncFileStream.h \
     platform/CalculationValue.h \
     platform/Clock.h \
     platform/ClockGeneric.h \
@@ -2194,7 +2224,6 @@ HEADERS += \
     platform/graphics/Region.h \
     platform/graphics/RoundedRect.h \
     platform/graphics/qt/FontCustomPlatformData.h \
-    platform/graphics/qt/ImageDecoderQt.h \
     platform/graphics/qt/StillImageQt.h \
     platform/graphics/qt/TransparencyLayer.h \
     platform/graphics/SegmentedFontData.h \
@@ -2277,6 +2306,7 @@ HEADERS += \
     platform/ScrollableArea.h \
     platform/ScrollAnimator.h \
     platform/Scrollbar.h \
+    platform/ScrollbarThemeClient.h \
     platform/ScrollbarThemeComposite.h \
     platform/ScrollView.h \
     platform/SearchPopupMenu.h \
@@ -2363,7 +2393,6 @@ HEADERS += \
     rendering/RenderCombineText.h \
     rendering/RenderCounter.h \
     rendering/RenderDeprecatedFlexibleBox.h \
-    rendering/RenderDetails.h \
     rendering/RenderDetailsMarker.h \
     rendering/RenderEmbeddedObject.h \
     rendering/RenderFieldset.h \
@@ -2405,7 +2434,6 @@ HEADERS += \
     rendering/RenderScrollbarPart.h \
     rendering/RenderScrollbarTheme.h \
     rendering/RenderSlider.h \
-    rendering/RenderSummary.h \
     rendering/RenderTableCaption.h \
     rendering/RenderTableCell.h \
     rendering/RenderTableCol.h \
@@ -2481,7 +2509,6 @@ HEADERS += \
     rendering/svg/RenderSVGResourceRadialGradient.h \
     rendering/svg/RenderSVGResourceSolidColor.h \
     rendering/svg/RenderSVGRoot.h \
-    rendering/svg/RenderSVGShadowTreeRootContainer.h \
     rendering/svg/RenderSVGShape.h \
     rendering/svg/RenderSVGTSpan.h \
     rendering/svg/RenderSVGText.h \
@@ -2496,11 +2523,11 @@ HEADERS += \
     rendering/svg/SVGPathData.h \
     rendering/svg/SVGRenderSupport.h \
     rendering/svg/SVGRenderTreeAsText.h \
+    rendering/svg/SVGRenderingContext.h \
     rendering/svg/SVGResources.h \
     rendering/svg/SVGResourcesCache.h \
     rendering/svg/SVGResourcesCycleSolver.h \
     rendering/svg/SVGRootInlineBox.h \
-    rendering/svg/SVGShadowTreeElements.h \
     rendering/svg/SVGTextChunk.h \
     rendering/svg/SVGTextChunkBuilder.h \
     rendering/svg/SVGTextFragment.h \
@@ -2513,40 +2540,18 @@ HEADERS += \
     rendering/svg/SVGTextMetricsBuilder.h \
     rendering/svg/SVGTextQuery.h \
     rendering/svg/SVGTextRunRenderingContext.h \
-    storage/AbstractDatabase.h \
-    storage/ChangeVersionWrapper.h \
-    storage/DOMWindowSQLDatabase.h \
-    storage/DatabaseAuthorizer.h \
-    storage/Database.h \
-    storage/DatabaseCallback.h \
-    storage/DatabaseSync.h \
-    storage/DatabaseTask.h \
-    storage/DatabaseThread.h \
-    storage/DatabaseTracker.h \
-    storage/StorageTask.h \
-    storage/StorageThread.h \
-    storage/OriginQuotaManager.h \
-    storage/OriginUsageRecord.h \
-    storage/SQLCallbackWrapper.h \
-    storage/SQLResultSet.h \
-    storage/SQLResultSetRowList.h \
-    storage/SQLStatement.h \
-    storage/SQLStatementSync.h \
-    storage/SQLTransaction.h \
-    storage/SQLTransactionClient.h \
-    storage/SQLTransactionCoordinator.h \
-    storage/SQLTransactionSync.h \
-    storage/SQLTransactionSyncCallback.h \
+    storage/Storage.h \
     storage/StorageArea.h \
     storage/StorageAreaImpl.h \
     storage/StorageAreaSync.h \
     storage/StorageEvent.h \
     storage/StorageEventDispatcher.h \
-    storage/Storage.h \
     storage/StorageMap.h \
     storage/StorageNamespace.h \
     storage/StorageNamespaceImpl.h \
     storage/StorageSyncManager.h \
+    storage/StorageTask.h \
+    storage/StorageThread.h \
     storage/StorageTracker.h \
     storage/StorageTrackerClient.h \
     svg/animation/SMILTimeContainer.h \
@@ -2805,7 +2810,6 @@ SOURCES += \
     platform/graphics/qt/GraphicsContextQt.cpp \
     platform/graphics/qt/IconQt.cpp \
     platform/graphics/qt/ImageBufferQt.cpp \
-    platform/graphics/qt/ImageDecoderQt.cpp \
     platform/graphics/qt/ImageQt.cpp \
     platform/graphics/qt/IntPointQt.cpp \
     platform/graphics/qt/IntRectQt.cpp \
@@ -2867,13 +2871,6 @@ SOURCES += \
     SOURCES += xml/parser/XMLDocumentParserQt.cpp
 }
 
-contains(DEFINES, HAVE_QSTYLE=1) {
-    HEADERS += platform/qt/QtStyleOptionWebComboBox.h \
-               platform/qt/RenderThemeQStyle.h \
-               platform/qt/ScrollbarThemeQt.h
-    SOURCES += platform/qt/RenderThemeQStyle.cpp
-}
-
 contains(DEFINES, ENABLE_SMOOTH_SCROLLING=1) {
     win32-*|wince* {
         HEADERS += platform/ScrollAnimatorWin.h
@@ -2957,21 +2954,21 @@ plugin_backend_xlib {
 
 contains(DEFINES, ENABLE_SQL_DATABASE=1) {
     SOURCES += \
-        storage/ChangeVersionWrapper.cpp \
-        storage/DatabaseTask.cpp \
-        storage/DatabaseThread.cpp \
-        storage/DatabaseTracker.cpp \
-        storage/OriginQuotaManager.cpp \
-        storage/OriginUsageRecord.cpp \
-        storage/SQLException.cpp \
-        storage/SQLResultSet.cpp \
-        storage/SQLResultSetRowList.cpp \
-        storage/SQLStatement.cpp \
-        storage/SQLStatementSync.cpp \
-        storage/SQLTransaction.cpp \
-        storage/SQLTransactionClient.cpp \
-        storage/SQLTransactionCoordinator.cpp \
-        storage/SQLTransactionSync.cpp
+        Modules/webdatabase/ChangeVersionWrapper.cpp \
+        Modules/webdatabase/DatabaseTask.cpp \
+        Modules/webdatabase/DatabaseThread.cpp \
+        Modules/webdatabase/DatabaseTracker.cpp \
+        Modules/webdatabase/OriginQuotaManager.cpp \
+        Modules/webdatabase/OriginUsageRecord.cpp \
+        Modules/webdatabase/SQLException.cpp \
+        Modules/webdatabase/SQLResultSet.cpp \
+        Modules/webdatabase/SQLResultSetRowList.cpp \
+        Modules/webdatabase/SQLStatement.cpp \
+        Modules/webdatabase/SQLStatementSync.cpp \
+        Modules/webdatabase/SQLTransaction.cpp \
+        Modules/webdatabase/SQLTransactionClient.cpp \
+        Modules/webdatabase/SQLTransactionCoordinator.cpp \
+        Modules/webdatabase/SQLTransactionSync.cpp \
 
     !v8 {
         SOURCES += \
@@ -2989,31 +2986,31 @@ contains(DEFINES, ENABLE_INDEXED_DATABASE=1) {
     }
 
     HEADERS += \
-        storage/IDBAny.h \
-        storage/IDBCallbacks.h \
-        storage/IDBCursor.h \
-        storage/IDBCursorBackendImpl.h \
-        storage/IDBCursorBackendInterface.h \
-        storage/IDBDatabase.h \
-        storage/IDBDatabaseBackendImpl.h \
-        storage/IDBDatabaseBackendInterface.h \
-        storage/IDBDatabaseError.h \
-        storage/IDBDatabaseException.h \
-        storage/IDBEventDispatcher.h \
-        storage/IDBFactory.h \
-        storage/IDBFactoryBackendInterface.h \
-        storage/IDBFactoryBackendImpl.h \
-        storage/IDBIndex.h \
-        storage/IDBIndexBackendInterface.h \
-        storage/IDBIndexBackendImpl.h \
-        storage/IDBKey.h \
-        storage/IDBKeyRange.h \
-        storage/IDBObjectStore.h \
-        storage/IDBObjectStoreBackendImpl.h \
-        storage/IDBObjectStoreBackendInterface.h \
-        storage/IDBRequest.h \
-        storage/IDBTransaction.h \
-        storage/IDBTransactionBackendInterface.h
+        Modules/indexeddb/IDBAny.h \
+        Modules/indexeddb/IDBCallbacks.h \
+        Modules/indexeddb/IDBCursor.h \
+        Modules/indexeddb/IDBCursorBackendImpl.h \
+        Modules/indexeddb/IDBCursorBackendInterface.h \
+        Modules/indexeddb/IDBDatabase.h \
+        Modules/indexeddb/IDBDatabaseBackendImpl.h \
+        Modules/indexeddb/IDBDatabaseBackendInterface.h \
+        Modules/indexeddb/IDBDatabaseError.h \
+        Modules/indexeddb/IDBDatabaseException.h \
+        Modules/indexeddb/IDBEventDispatcher.h \
+        Modules/indexeddb/IDBFactory.h \
+        Modules/indexeddb/IDBFactoryBackendInterface.h \
+        Modules/indexeddb/IDBFactoryBackendImpl.h \
+        Modules/indexeddb/IDBIndex.h \
+        Modules/indexeddb/IDBIndexBackendInterface.h \
+        Modules/indexeddb/IDBIndexBackendImpl.h \
+        Modules/indexeddb/IDBKey.h \
+        Modules/indexeddb/IDBKeyRange.h \
+        Modules/indexeddb/IDBObjectStore.h \
+        Modules/indexeddb/IDBObjectStoreBackendImpl.h \
+        Modules/indexeddb/IDBObjectStoreBackendInterface.h \
+        Modules/indexeddb/IDBRequest.h \
+        Modules/indexeddb/IDBTransaction.h \
+        Modules/indexeddb/IDBTransactionBackendInterface.h
 
     !v8 {
         SOURCES += \
@@ -3023,24 +3020,27 @@ contains(DEFINES, ENABLE_INDEXED_DATABASE=1) {
     }
 
     SOURCES += \
-        storage/IDBAny.cpp \
-        storage/IDBCursor.cpp \
-        storage/IDBCursorBackendImpl.cpp \
-        storage/IDBDatabase.cpp \
-        storage/IDBDatabaseBackendImpl.cpp \
-        storage/IDBDatabaseException.cpp \
-        storage/IDBEventDispatcher.cpp \
-        storage/IDBFactory.cpp \
-        storage/IDBFactoryBackendInterface.cpp \
-        storage/IDBFactoryBackendImpl.cpp \
-        storage/IDBIndex.cpp \
-        storage/IDBIndexBackendImpl.cpp \
-        storage/IDBKey.cpp \
-        storage/IDBKeyRange.cpp \
-        storage/IDBObjectStore.cpp \
-        storage/IDBObjectStoreBackendImpl.cpp \
-        storage/IDBRequest.cpp \
-        storage/IDBTransaction.cpp
+        Modules/indexeddb/DOMWindowIndexedDatabase.cpp \
+        Modules/indexeddb/IDBAny.cpp \
+        Modules/indexeddb/IDBCursor.cpp \
+        Modules/indexeddb/IDBCursorBackendImpl.cpp \
+        Modules/indexeddb/IDBDatabase.cpp \
+        Modules/indexeddb/IDBDatabaseBackendImpl.cpp \
+        Modules/indexeddb/IDBDatabaseException.cpp \
+        Modules/indexeddb/IDBEventDispatcher.cpp \
+        Modules/indexeddb/IDBFactory.cpp \
+        Modules/indexeddb/IDBFactoryBackendInterface.cpp \
+        Modules/indexeddb/IDBFactoryBackendImpl.cpp \
+        Modules/indexeddb/IDBIndex.cpp \
+        Modules/indexeddb/IDBIndexBackendImpl.cpp \
+        Modules/indexeddb/IDBKey.cpp \
+        Modules/indexeddb/IDBKeyRange.cpp \
+        Modules/indexeddb/IDBObjectStore.cpp \
+        Modules/indexeddb/IDBObjectStoreBackendImpl.cpp \
+        Modules/indexeddb/IDBRequest.cpp \
+        Modules/indexeddb/IDBTransaction.cpp \
+        Modules/indexeddb/PageGroupIndexedDatabase.cpp \
+        Modules/indexeddb/WorkerContextIndexedDatabase.cpp
 }
 
 contains(DEFINES, ENABLE_DATA_TRANSFER_ITEMS=1) {
@@ -3158,6 +3158,10 @@ contains(DEFINES, ENABLE_INPUT_SPEECH=1) {
         rendering/RenderInputSpeech.cpp
 }
 
+contains(DEFINES, ENABLE_SCRIPTED_SPEECH=1) {
+    SOURCES += # FIXME!
+}
+
 contains(DEFINES, ENABLE_QUOTA=1) {
     HEADERS += \
         storage/StorageInfo.h \
@@ -3232,6 +3236,7 @@ contains(DEFINES, ENABLE_VIDEO=1) {
         HEADERS += \
             platform/graphics/gstreamer/GRefPtrGStreamer.h \
             platform/graphics/gstreamer/GStreamerGWorld.h \
+            platform/graphics/gstreamer/GStreamerVersioning.h \
             platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h \
             platform/graphics/gstreamer/VideoSinkGStreamer.h \
             platform/graphics/gstreamer/WebKitWebSourceGStreamer.h \
@@ -3241,6 +3246,7 @@ contains(DEFINES, ENABLE_VIDEO=1) {
         SOURCES += \
             platform/graphics/gstreamer/GRefPtrGStreamer.cpp \
             platform/graphics/gstreamer/GStreamerGWorld.cpp \
+            platform/graphics/gstreamer/GStreamerVersioning.cpp \
             platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp \
             platform/graphics/gstreamer/VideoSinkGStreamer.cpp \
             platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp \
@@ -3449,7 +3455,6 @@ contains(DEFINES, ENABLE_SVG=1) {
               rendering/svg/RenderSVGResourceRadialGradient.cpp \
               rendering/svg/RenderSVGResourceSolidColor.cpp \
               rendering/svg/RenderSVGRoot.cpp \
-              rendering/svg/RenderSVGShadowTreeRootContainer.cpp \
               rendering/svg/RenderSVGTSpan.cpp \
               rendering/svg/RenderSVGText.cpp \
               rendering/svg/RenderSVGTextPath.cpp \
@@ -3462,11 +3467,11 @@ contains(DEFINES, ENABLE_SVG=1) {
               rendering/svg/SVGPathData.cpp \
               rendering/svg/SVGRenderSupport.cpp \
               rendering/svg/SVGRenderTreeAsText.cpp \
+              rendering/svg/SVGRenderingContext.cpp \
               rendering/svg/SVGResources.cpp \
               rendering/svg/SVGResourcesCache.cpp \
               rendering/svg/SVGResourcesCycleSolver.cpp \
               rendering/svg/SVGRootInlineBox.cpp \
-              rendering/svg/SVGShadowTreeElements.cpp \
               rendering/svg/SVGTextChunk.cpp \
               rendering/svg/SVGTextChunkBuilder.cpp \
               rendering/svg/SVGTextLayoutAttributes.cpp \
@@ -3672,29 +3677,35 @@ contains(DEFINES, ENABLE_VIDEO_TRACK=1) {
 
 contains(DEFINES, ENABLE_WEB_SOCKETS=1) {
     HEADERS += \
-        websockets/CloseEvent.h \
-        websockets/ThreadableWebSocketChannel.h \
-        websockets/ThreadableWebSocketChannelClientWrapper.h \
-        websockets/WebSocket.h \
-        websockets/WebSocketChannel.h \
-        websockets/WebSocketChannelClient.h \
-        websockets/WebSocketExtensionDispatcher.h \
-        websockets/WebSocketExtensionProcessor.h \
-        websockets/WebSocketFrame.h \
-        websockets/WebSocketHandshake.h \
-        websockets/WebSocketHandshakeRequest.h \
-        websockets/WebSocketHandshakeResponse.h \
+        Modules/websockets/CloseEvent.h \
+        Modules/websockets/ThreadableWebSocketChannel.h \
+        Modules/websockets/ThreadableWebSocketChannelClientWrapper.h \
+        Modules/websockets/WebSocket.h \
+        Modules/websockets/WebSocketChannel.h \
+        Modules/websockets/WebSocketChannelClient.h \
+        Modules/websockets/WebSocketDeflateFramer.h \
+        Modules/websockets/WebSocketDeflater.h \
+        Modules/websockets/WebSocketExtensionDispatcher.h \
+        Modules/websockets/WebSocketExtensionProcessor.h \
+        Modules/websockets/WebSocketFrame.h \
+        Modules/websockets/WebSocketHandshake.h \
+        Modules/websockets/WebSocketHandshakeRequest.h \
+        Modules/websockets/WebSocketHandshakeResponse.h \
+        Modules/websockets/WorkerThreadableWebSocketChannel.h \
         platform/network/qt/SocketStreamHandlePrivate.h
 
     SOURCES += \
-        websockets/WebSocket.cpp \
-        websockets/WebSocketChannel.cpp \
-        websockets/WebSocketExtensionDispatcher.cpp \
-        websockets/WebSocketHandshake.cpp \
-        websockets/WebSocketHandshakeRequest.cpp \
-        websockets/WebSocketHandshakeResponse.cpp \
-        websockets/ThreadableWebSocketChannel.cpp \
-        websockets/ThreadableWebSocketChannelClientWrapper.cpp \
+        Modules/websockets/WebSocket.cpp \
+        Modules/websockets/WebSocketChannel.cpp \
+        Modules/websockets/WebSocketDeflateFramer.cpp \
+        Modules/websockets/WebSocketDeflater.cpp \
+        Modules/websockets/WebSocketExtensionDispatcher.cpp \
+        Modules/websockets/WebSocketHandshake.cpp \
+        Modules/websockets/WebSocketHandshakeRequest.cpp \
+        Modules/websockets/WebSocketHandshakeResponse.cpp \
+        Modules/websockets/WorkerThreadableWebSocketChannel.cpp \
+        Modules/websockets/ThreadableWebSocketChannel.cpp \
+        Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp \
         platform/network/SocketStreamErrorBase.cpp \
         platform/network/SocketStreamHandleBase.cpp \
         platform/network/qt/SocketStreamHandleQt.cpp
@@ -3706,10 +3717,10 @@ contains(DEFINES, ENABLE_WEB_SOCKETS=1) {
 
     contains(DEFINES, ENABLE_WORKERS=1) {
         HEADERS += \
-            websockets/WorkerThreadableWebSocketChannel.h
+            Modules/websockets/WorkerThreadableWebSocketChannel.h
 
         SOURCES += \
-            websockets/WorkerThreadableWebSocketChannel.cpp
+            Modules/websockets/WorkerThreadableWebSocketChannel.cpp
     }
 }
 
@@ -3735,6 +3746,7 @@ contains(DEFINES, ENABLE_WEBGL=1) {
         html/canvas/WebGLRenderingContext.h \
         html/canvas/WebGLShader.h \
         html/canvas/WebGLSharedObject.h \
+        html/canvas/EXTTextureFilterAnisotropic.h \
         html/canvas/OESStandardDerivatives.h \
         html/canvas/OESTextureFloat.h \
         html/canvas/OESVertexArrayObject.h \
@@ -3775,6 +3787,7 @@ contains(DEFINES, ENABLE_WEBGL=1) {
         html/canvas/WebGLRenderingContext.cpp \
         html/canvas/WebGLShader.cpp \
         html/canvas/WebGLSharedObject.cpp \
+        html/canvas/EXTTextureFilterAnisotropic.cpp \
         html/canvas/OESStandardDerivatives.cpp \
         html/canvas/OESTextureFloat.cpp \
         html/canvas/OESVertexArrayObject.cpp \
@@ -3941,6 +3954,35 @@ contains(DEFINES, ENABLE_MHTML=1) {
         page/PageSerializer.cpp
 }
 
+contains(DEFINES, WTF_USE_QT_IMAGE_DECODER=1) {
+    HEADERS += platform/graphics/qt/ImageDecoderQt.h
+    SOURCES += platform/graphics/qt/ImageDecoderQt.cpp
+} else {
+    HEADERS += \
+        platform/image-decoders/bmp/BMPImageDecoder.h \
+        platform/image-decoders/bmp/BMPImageReader.h \
+        platform/image-decoders/gif/GIFImageDecoder.h \
+        platform/image-decoders/gif/GIFImageReader.h\
+        platform/image-decoders/ico/ICOImageDecoder.h \
+        platform/image-decoders/jpeg/JPEGImageDecoder.h \
+        platform/image-decoders/png/PNGImageDecoder.h
+
+    SOURCES += \
+        platform/image-decoders/ImageDecoder.cpp \
+        platform/image-decoders/bmp/BMPImageDecoder.cpp \
+        platform/image-decoders/bmp/BMPImageReader.cpp \
+        platform/image-decoders/gif/GIFImageDecoder.cpp \
+        platform/image-decoders/gif/GIFImageReader.cpp\
+        platform/image-decoders/ico/ICOImageDecoder.cpp \
+        platform/image-decoders/jpeg/JPEGImageDecoder.cpp \
+        platform/image-decoders/png/PNGImageDecoder.cpp
+
+    contains(DEFINES, WTF_USE_WEBP=1) {
+        HEADERS += platform/image-decoders/webp/WEBPImageDecoder.h
+        SOURCES += platform/image-decoders/webp/WEBPImageDecoder.cpp
+    }
+}
+
 !system-sqlite:exists( $${SQLITE3SRCDIR}/sqlite3.c ) {
     # Build sqlite3 into WebCore from source
     # somewhat copied from $$QT_SOURCE_TREE/src/plugins/sqldrivers/sqlite/sqlite.pro
diff --git a/Source/WebCore/UseJSC.cmake b/Source/WebCore/UseJSC.cmake
index e8a35d1ff..09038dd68 100644
--- a/Source/WebCore/UseJSC.cmake
+++ b/Source/WebCore/UseJSC.cmake
@@ -3,6 +3,10 @@ LIST(APPEND WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/bridge/jsc"
 )
 
+LIST(APPEND WebCoreTestSupport_INCLUDE_DIRECTORIES
+    "${WEBCORE_DIR}/testing/js"
+)
+
 LIST(APPEND WebCore_IDL_INCLUDES
     bindings/js
 )
@@ -164,6 +168,11 @@ LIST(APPEND WebCore_SOURCES
     bridge/jsc/BridgeJSC.cpp
 )
 
+LIST(APPEND WebCoreTestSupport_SOURCES
+    testing/js/JSInternalsCustom.cpp
+    testing/js/WebCoreTestSupport.cpp
+)
+
 IF (ENABLE_BLOB)
     LIST(APPEND WebCore_SOURCES
         bindings/js/JSFileReaderCustom.cpp
@@ -254,6 +263,10 @@ FOREACH (_include ${WebCore_IDL_INCLUDES})
     LIST(APPEND IDL_INCLUDES --include=${WEBCORE_DIR}/${_include})
 ENDFOREACH ()
 
+FOREACH (_include ${WebCoreTestSupport_IDL_INCLUDES})
+    LIST(APPEND IDL_INCLUDES --include=${WEBCORE_DIR}/${_include})
+ENDFOREACH ()
+
 SET(FEATURE_DEFINES_JAVASCRIPT "LANGUAGE_JAVASCRIPT=1")
 FOREACH (_feature ${FEATURE_DEFINES})
     SET(FEATURE_DEFINES_JAVASCRIPT "${FEATURE_DEFINES_JAVASCRIPT} ${_feature}")
@@ -263,12 +276,17 @@ ENDFOREACH ()
 FOREACH (_idl ${WebCore_IDL_FILES})
     SET(IDL_FILES_LIST "${IDL_FILES_LIST}${WEBCORE_DIR}/${_idl}\n")
 ENDFOREACH ()
+
+FOREACH (_idl ${WebCoreTestSupport_IDL_FILES})
+    SET(IDL_FILES_LIST "${IDL_FILES_LIST}${WEBCORE_DIR}/${_idl}\n")
+ENDFOREACH ()
+
 FILE(WRITE ${IDL_FILES_TMP} ${IDL_FILES_LIST})
 
 ADD_CUSTOM_COMMAND(
     OUTPUT ${SUPPLEMENTAL_DEPENDENCY_FILE}
-    DEPENDS ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl ${SCRIPTS_RESOLVE_SUPPLEMENTAL} ${WebCore_IDL_FILES} ${IDL_ATTRIBUTES_FILE}
-    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} --idlAttributesFile ${IDL_ATTRIBUTES_FILE}
+    DEPENDS ${WEBCORE_DIR}/bindings/scripts/preprocess-idls.pl ${SCRIPTS_PREPROCESS_IDLS} ${WebCore_IDL_FILES} ${WebCoreTestSupport_IDL_FILES} ${IDL_ATTRIBUTES_FILE}
+    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/preprocess-idls.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} --idlAttributesFile ${IDL_ATTRIBUTES_FILE}
     VERBATIM)
 
 FOREACH (_file ${WebCore_IDL_FILES})
@@ -281,3 +299,14 @@ FOREACH (_file ${WebCore_IDL_FILES})
         VERBATIM)
     LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.cpp)
 ENDFOREACH ()
+
+FOREACH (_file ${WebCoreTestSupport_IDL_FILES})
+    GET_FILENAME_COMPONENT (_name ${_file} NAME_WE)
+    ADD_CUSTOM_COMMAND(
+        OUTPUT  ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.h
+        MAIN_DEPENDENCY ${_file}
+        DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorJS.pm ${SUPPLEMENTAL_DEPENDENCY_FILE}
+        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator JS ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_WEBCORE_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} ${WEBCORE_DIR}/${_file}
+        VERBATIM)
+    LIST(APPEND WebCoreTestSupport_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/JS${_name}.cpp)
+ENDFOREACH ()
diff --git a/Source/WebCore/UseV8.cmake b/Source/WebCore/UseV8.cmake
index befe1c76f..b8f5fd267 100755
--- a/Source/WebCore/UseV8.cmake
+++ b/Source/WebCore/UseV8.cmake
@@ -8,6 +8,10 @@ LIST(APPEND WebCore_INCLUDE_DIRECTORIES
     "${JAVASCRIPTCORE_DIR}/runtime"
 )
 
+LIST(APPEND WebCoreTestSupport_INCLUDE_DIRECTORIES
+    "${WEBCORE_DIR}/testing/v8"
+)
+
 LIST(APPEND WebCore_IDL_INCLUDES
     bindings/v8
 )
@@ -91,7 +95,6 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp
     bindings/v8/custom/V8DocumentCustom.cpp
     bindings/v8/custom/V8DocumentLocationCustom.cpp
-    bindings/v8/custom/V8ElementCustom.cpp
     bindings/v8/custom/V8EntrySyncCustom.cpp
     bindings/v8/custom/V8EventConstructors.cpp
     bindings/v8/custom/V8EventCustom.cpp
@@ -160,6 +163,11 @@ LIST(APPEND WebCore_SOURCES
     bindings/v8/specialization/V8BindingState.cpp
 )
 
+LIST(APPEND WebCoreTestSupport_SOURCES
+    testing/v8/V8InternalsCustom.cpp
+    testing/v8/WebCoreTestSupport.cpp
+)
+
 LIST(APPEND WebCore_SOURCES
     ${JAVASCRIPTCORE_DIR}/yarr/YarrInterpreter.cpp
     ${JAVASCRIPTCORE_DIR}/yarr/YarrJIT.cpp
@@ -214,6 +222,10 @@ FOREACH (_include ${WebCore_IDL_INCLUDES})
     LIST(APPEND IDL_INCLUDES --include=${WEBCORE_DIR}/${_include})
 ENDFOREACH ()
 
+FOREACH (_include ${WebCoreTestSupport_IDL_INCLUDES})
+    LIST(APPEND IDL_INCLUDES --include=${WEBCORE_DIR}/${_include})
+ENDFOREACH ()
+
 SET(FEATURE_DEFINES_JAVASCRIPT "LANGUAGE_JAVASCRIPT=1 V8_BINDING=1")
 FOREACH (_feature ${FEATURE_DEFINES})
     SET(FEATURE_DEFINES_JAVASCRIPT "${FEATURE_DEFINES_JAVASCRIPT} ${_feature}")
@@ -249,12 +261,17 @@ LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/V8ArrayBufferViewCust
 FOREACH (_idl ${WebCore_IDL_FILES})
     SET(IDL_FILES_LIST "${IDL_FILES_LIST}${WEBCORE_DIR}/${_idl}\n")
 ENDFOREACH ()
+
+FOREACH (_idl ${WebCoreTestSupport_IDL_FILES})
+    SET(IDL_FILES_LIST "${IDL_FILES_LIST}${WEBCORE_DIR}/${_idl}\n")
+ENDFOREACH ()
+
 FILE(WRITE ${IDL_FILES_TMP} ${IDL_FILES_LIST})
 
 ADD_CUSTOM_COMMAND(
     OUTPUT ${SUPPLEMENTAL_DEPENDENCY_FILE}
-    DEPENDS ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl ${SCRIPTS_RESOLVE_SUPPLEMENTAL} ${WebCore_IDL_FILES} ${IDL_ATTRIBUTES_FILE}
-    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/resolve-supplemental.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} --idlAttributesFile ${IDL_ATTRIBUTES_FILE}
+    DEPENDS ${WEBCORE_DIR}/bindings/scripts/preprocess-idls.pl ${SCRIPTS_PREPROCESS_IDLS} ${WebCore_IDL_FILES} ${WebCoreTestSupport_IDL_FILES} ${IDL_ATTRIBUTES_FILE}
+    COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/preprocess-idls.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --idlFilesList ${IDL_FILES_TMP} --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} --idlAttributesFile ${IDL_ATTRIBUTES_FILE}
     VERBATIM)
 
 FOREACH (_file ${WebCore_IDL_FILES})
@@ -267,3 +284,14 @@ FOREACH (_file ${WebCore_IDL_FILES})
         VERBATIM)
     LIST(APPEND WebCore_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/V8${_name}.cpp)
 ENDFOREACH ()
+
+FOREACH (_file ${WebCoreTestSupport_IDL_FILES})
+    GET_FILENAME_COMPONENT (_name ${_file} NAME_WE)
+    ADD_CUSTOM_COMMAND(
+        OUTPUT  ${DERIVED_SOURCES_WEBCORE_DIR}/V8${_name}.cpp ${DERIVED_SOURCES_WEBCORE_DIR}/V8${_name}.h
+        MAIN_DEPENDENCY ${_file}
+        DEPENDS ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl ${SCRIPTS_BINDINGS} ${WEBCORE_DIR}/bindings/scripts/CodeGeneratorV8.pm ${SUPPLEMENTAL_DEPENDENCY_FILE}
+        COMMAND ${PERL_EXECUTABLE} -I${WEBCORE_DIR}/bindings/scripts ${WEBCORE_DIR}/bindings/scripts/generate-bindings.pl --defines "${FEATURE_DEFINES_JAVASCRIPT}" --generator V8 ${IDL_INCLUDES} --outputDir "${DERIVED_SOURCES_WEBCORE_DIR}" --preprocessor "${CODE_GENERATOR_PREPROCESSOR}" --supplementalDependencyFile ${SUPPLEMENTAL_DEPENDENCY_FILE} ${WEBCORE_DIR}/${_file}
+        VERBATIM)
+    LIST(APPEND WebCoreTestSupport_SOURCES ${DERIVED_SOURCES_WEBCORE_DIR}/V8${_name}.cpp)
+ENDFOREACH ()
diff --git a/Source/WebCore/WebCore.exp.in b/Source/WebCore/WebCore.exp.in
index e812ffff6..590b7c50f 100644
--- a/Source/WebCore/WebCore.exp.in
+++ b/Source/WebCore/WebCore.exp.in
@@ -104,11 +104,14 @@
 .objc_class_name_DOMTreeWalker
 .objc_class_name_DOMUIEvent
 .objc_class_name_DOMWheelEvent
+.objc_class_name_WebCoreFullScreenWindow
 .objc_class_name_WebFontCache
 .objc_class_name_WebHTMLConverter
 .objc_class_name_WebScriptObject
 .objc_class_name_WebScriptObjectPrivate
 .objc_class_name_WebUndefined
+.objc_class_name_WebWindowFadeAnimation
+.objc_class_name_WebWindowScaleAnimation
 _DOMEventException
 _DOMException
 _DOMRangeException
@@ -143,6 +146,8 @@ __ZN7WebCore10FloatPointC1ERKNS_8IntPointE
 __ZN7WebCore10JSDocument6s_infoE
 __ZN7WebCore10MouseEvent6createERKN3WTF12AtomicStringENS1_10PassRefPtrINS_9DOMWindowEEERKNS_18PlatformMouseEventEiNS5_INS_4NodeEEE
 __ZN7WebCore10MouseEventC1ERKN3WTF12AtomicStringEbbNS1_10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_11EventTargetEEENS5_INS_9ClipboardEEEb
+__ZN7WebCore10RenderView10compositorEv
+__ZN7WebCore10ShadowTree20removeAllShadowRootsEv
 __ZN7WebCore10ScrollView17setUseFixedLayoutEb
 __ZN7WebCore10ScrollView18setFixedLayoutSizeERKNS_7IntSizeE
 __ZN7WebCore10ScrollView20setCanHaveScrollbarsEb
@@ -217,6 +222,7 @@ __ZN7WebCore11MemoryCache14evictResourcesEv
 __ZN7WebCore11MemoryCache19getOriginsWithCacheERN3WTF7HashSetINS1_6RefPtrINS_14SecurityOriginEEENS_18SecurityOriginHashENS1_10HashTraitsIS5_EEEE
 __ZN7WebCore11MemoryCache25removeResourcesWithOriginEPNS_14SecurityOriginE
 __ZN7WebCore11RenderLayer19scrollRectToVisibleERKNS_7IntRectERKNS_15ScrollAlignmentES6_
+__ZN7WebCore11URLWithDataEP6NSDataP5NSURL
 __ZN7WebCore11globalPointERK8_NSPointP8NSWindow
 __ZN7WebCore11memoryCacheEv
 __ZN7WebCore11startOfWordERKNS_15VisiblePositionENS_9EWordSideE
@@ -246,25 +252,6 @@ __ZN7WebCore12EventHandler8keyEventERKNS_21PlatformKeyboardEventE
 __ZN7WebCore12EventHandler9mouseDownEP7NSEvent
 __ZN7WebCore12GCController17garbageCollectNowEv
 __ZN7WebCore12GCController43garbageCollectOnAlternateThreadForDebuggingEb
-__ZN7WebCore12IconDatabase10setEnabledEb
-__ZN7WebCore12IconDatabase11defaultIconERKNS_7IntSizeE
-__ZN7WebCore12IconDatabase14removeAllIconsEv
-__ZN7WebCore12IconDatabase15iconRecordCountEv
-__ZN7WebCore12IconDatabase19pageURLMappingCountEv
-__ZN7WebCore12IconDatabase20allowDatabaseCleanupEv
-__ZN7WebCore12IconDatabase20delayDatabaseCleanupEv   
-__ZN7WebCore12IconDatabase20retainIconForPageURLERKN3WTF6StringE
-__ZN7WebCore12IconDatabase20retainedPageURLCountEv
-__ZN7WebCore12IconDatabase21releaseIconForPageURLERKN3WTF6StringE
-__ZN7WebCore12IconDatabase23defaultDatabaseFilenameEv
-__ZN7WebCore12IconDatabase23iconRecordCountWithDataEv
-__ZN7WebCore12IconDatabase23importIconURLForPageURLERKN3WTF6StringES4_
-__ZN7WebCore12IconDatabase24importIconDataForIconURLEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS1_6StringE
-__ZN7WebCore12IconDatabase25setPrivateBrowsingEnabledEb
-__ZN7WebCore12IconDatabase27checkIntegrityBeforeOpeningEv
-__ZN7WebCore12IconDatabase5closeEv
-__ZN7WebCore12IconDatabase9setClientEPNS_18IconDatabaseClientE
-__ZN7WebCore12IconDatabaseC1Ev
 __ZN7WebCore12PopupMenuMacC1EPNS_15PopupMenuClientE
 __ZN7WebCore12PrintContext12pagePropertyEPNS_5FrameEPKci
 __ZN7WebCore12PrintContext13numberOfPagesEPNS_5FrameERKNS_9FloatSizeE
@@ -408,6 +395,8 @@ __ZN7WebCore14StorageTracker32syncFileSystemAndTrackerDatabaseEv
 __ZN7WebCore14StorageTracker7originsERN3WTF6VectorINS1_6RefPtrINS_14SecurityOriginEEELm0EEE
 __ZN7WebCore14StorageTracker7trackerEv
 __ZN7WebCore14StorageTracker9setClientEPNS_20StorageTrackerClientE
+__ZN7WebCore14decodeHostNameEP8NSString
+__ZN7WebCore14encodeHostNameEP8NSString
 __ZN7WebCore14endOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
 __ZN7WebCore15AffineTransform5flipYEv
 __ZN7WebCore15AffineTransform5scaleEd
@@ -418,6 +407,7 @@ __ZN7WebCore15AffineTransformC1Ev
 __ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS1_6StringESA_SA_RKNS_16ResourceResponseE
 __ZN7WebCore15DOMWrapperWorld13clearWrappersEv
 __ZN7WebCore15DOMWrapperWorldD1Ev
+__ZN7WebCore15DatabaseContext16hasOpenDatabasesEPNS_22ScriptExecutionContextE
 __ZN7WebCore15DatabaseTracker12deleteOriginEPNS_14SecurityOriginE
 __ZN7WebCore15DatabaseTracker14deleteDatabaseEPNS_14SecurityOriginERKN3WTF6StringE
 __ZN7WebCore15DatabaseTracker14quotaForOriginEPNS_14SecurityOriginE
@@ -475,6 +465,7 @@ __ZN7WebCore15StringTruncator5widthERKN3WTF6StringERKNS_4FontENS0_24EnableRoundi
 __ZN7WebCore15VisiblePositionC1ERKNS_8PositionENS_9EAffinityE
 __ZN7WebCore15defaultLanguageEv
 __ZN7WebCore15localizedStringEPKc
+__ZN7WebCore15originalURLDataEP5NSURL
 __ZN7WebCore15pathGetFileNameERKN3WTF6StringE
 __ZN7WebCore15reportExceptionEPN3JSC9ExecStateENS0_7JSValueE
 __ZN7WebCore15setDOMExceptionEPN3JSC9ExecStateEi
@@ -534,6 +525,7 @@ __ZN7WebCore16deleteAllCookiesEv
 __ZN7WebCore16enclosingIntRectERK7_NSRect
 __ZN7WebCore16enclosingIntRectERKNS_9FloatRectE
 __ZN7WebCore16isEndOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
+__ZN7WebCore16isUserVisibleURLEP8NSString
 __ZN7WebCore16startOfParagraphERKNS_15VisiblePositionENS_27EditingBoundaryCrossingRuleE
 __ZN7WebCore17CredentialStorage24getFromPersistentStorageERKNS_15ProtectionSpaceE
 __ZN7WebCore17CredentialStorage3getERKNS_15ProtectionSpaceE
@@ -547,6 +539,7 @@ __ZN7WebCore17RegularExpressionC1ERKN3WTF6StringENS1_19TextCaseSensitivityE
 __ZN7WebCore17RegularExpressionD1Ev
 __ZN7WebCore17cacheDOMStructureEPNS_17JSDOMGlobalObjectEPN3JSC9StructureEPKNS2_9ClassInfoE
 __ZN7WebCore17openTemporaryFileERKN3WTF6StringERi
+__ZN7WebCore17userVisibleStringEP5NSURL
 __ZN7WebCore18HTMLContentElement6createEPNS_8DocumentE
 __ZN7WebCore18PlatformPasteboard13bufferForTypeERKN3WTF6StringE
 __ZN7WebCore18PlatformPasteboard13stringForTypeERKN3WTF6StringE
@@ -604,11 +597,6 @@ __ZN7WebCore19TextResourceDecoder6decodeEPKcm
 __ZN7WebCore19TextResourceDecoderC1ERKN3WTF6StringERKNS_12TextEncodingEb
 __ZN7WebCore19TextResourceDecoderD1Ev
 __ZN7WebCore19applicationIsSafariEv
-
-#if ENABLE(NOTIFICATIONS)
-__ZN7WebCore19provideNotificationEPNS_4PageEPNS_21NotificationPresenterE
-#endif
-
 __ZN7WebCore20DisplaySleepDisablerC1EPKc
 __ZN7WebCore20DisplaySleepDisablerD1Ev
 __ZN7WebCore20NodeRenderingContextC1EPNS_4NodeE
@@ -638,6 +626,8 @@ __ZN7WebCore21SerializedScriptValue11deserializeEPK15OpaqueJSContextPPK13OpaqueJ
 __ZN7WebCore21SerializedScriptValue6createEPK15OpaqueJSContextPK13OpaqueJSValuePS6_
 __ZN7WebCore21SerializedScriptValueC1ERN3WTF6VectorIhLm0EEE
 __ZN7WebCore21SerializedScriptValueD1Ev
+__ZN7WebCore21URLByRemovingUserInfoEP5NSURL
+__ZN7WebCore22URLWithUserTypedStringEP8NSStringP5NSURL
 __ZN7WebCore21UserContentURLPattern5parseERKN3WTF6StringE
 __ZN7WebCore21WindowsLatin1EncodingEv
 __ZN7WebCore21applicationIsApertureEv
@@ -661,6 +651,9 @@ __ZN7WebCore22externalRepresentationEPNS_7ElementEj
 __ZN7WebCore22userPreferredLanguagesEv
 __ZN7WebCore23AuthenticationChallengeC1ERKNS_15ProtectionSpaceERKNS_10CredentialEjRKNS_16ResourceResponseERKNS_13ResourceErrorE
 __ZN7WebCore23createFragmentFromNodesEPNS_8DocumentERKN3WTF6VectorIPNS_4NodeELm0EEE
+__ZN7WebCore23dataForURLComponentTypeEP5NSURLl
+__ZN7WebCore23decodeHostNameWithRangeEP8NSString8_NSRange
+__ZN7WebCore23encodeHostNameWithRangeEP8NSString8_NSRange
 __ZN7WebCore23getHostnamesWithCookiesERN3WTF7HashSetINS0_6StringENS0_10StringHashENS0_10HashTraitsIS2_EEEE
 __ZN7WebCore24BinaryPropertyListWriter17writePropertyListEv
 __ZN7WebCore24CachedResourceHandleBase11setResourceEPNS_14CachedResourceE
@@ -724,6 +717,8 @@ __ZN7WebCore29isCharacterSmartReplaceExemptEib
 __ZN7WebCore29setUsesTestModeFocusRingColorEb
 __ZN7WebCore30contextMenuItemTagSpellingMenuEv
 __ZN7WebCore30contextMenuItemTagStopSpeakingEv
+__ZN7WebCore30hostNameNeedsDecodingWithRangeEP8NSString8_NSRange
+__ZN7WebCore30hostNameNeedsEncodingWithRangeEP8NSString8_NSRange
 __ZN7WebCore30overrideUserPreferredLanguagesERKN3WTF6VectorINS0_6StringELm0EEE
 __ZN7WebCore31CrossOriginPreflightResultCache5emptyEv
 __ZN7WebCore31CrossOriginPreflightResultCache6sharedEv
@@ -750,6 +745,7 @@ __ZN7WebCore38contextMenuItemTagWritingDirectionMenuEv
 __ZN7WebCore3macERKNS_10CredentialE
 __ZN7WebCore3macERKNS_23AuthenticationChallengeE
 __ZN7WebCore40restrictMinimumScaleFactorToViewportSizeERNS_18ViewportAttributesENS_7IntSizeE
+__ZN7WebCore42URLByTruncatingOneCharacterBeforeComponentEP5NSURLl
 __ZN7WebCore42contextMenuItemTagCheckGrammarWithSpellingEv
 __ZN7WebCore42contextMenuItemTagCheckSpellingWhileTypingEv
 __ZN7WebCore46contextMenuItemTagCorrectSpellingAutomaticallyEv
@@ -798,6 +794,8 @@ __ZN7WebCore4Page27setJavaScriptURLsAreAllowedEb
 __ZN7WebCore4Page31setCustomHTMLTokenizerChunkSizeEi
 __ZN7WebCore4Page31setCustomHTMLTokenizerTimeDelayEd
 __ZN7WebCore4Page32setMemoryCacheClientCallsEnabledEb
+__ZN7WebCore4Page35resumeActiveDOMObjectsAndAnimationsEv
+__ZN7WebCore4Page36suspendActiveDOMObjectsAndAnimationsEv
 __ZN7WebCore4Page37setInLowQualityImageInterpolationModeEb
 __ZN7WebCore4Page43setRelevantRepaintedObjectsCounterThresholdEy
 __ZN7WebCore4Page6goBackEv
@@ -915,7 +913,6 @@ __ZN7WebCore6WidgetD2Ev
 __ZN7WebCore6toNodeEN3JSC7JSValueE
 __ZN7WebCore7Console21shouldPrintExceptionsEv
 __ZN7WebCore7Console24setShouldPrintExceptionsEb
-__ZN7WebCore7Element16removeShadowRootEv
 __ZN7WebCore7Element21boundsInRootViewSpaceEv
 __ZN7WebCore7Element9innerTextEv
 __ZN7WebCore7IntRect5scaleEf
@@ -1180,6 +1177,7 @@ __ZNK7WebCore10ScrollView16windowToContentsERKNS_7IntRectE
 __ZNK7WebCore10ScrollView16windowToContentsERKNS_8IntPointE
 __ZNK7WebCore10ScrollView18contentsToRootViewERKNS_7IntRectE
 __ZNK7WebCore10ScrollView18contentsToRootViewERKNS_8IntPointE
+__ZNK7WebCore10ScrollView16contentsToScreenERKNS_7IntRectE
 __ZNK7WebCore10ScrollView18visibleContentRectEb
 __ZNK7WebCore11FrameLoader10isCompleteEv
 __ZNK7WebCore11FrameLoader14cancelledErrorERKNS_15ResourceRequestE
@@ -1189,6 +1187,7 @@ __ZNK7WebCore11FrameLoader17networkingContextEv
 __ZNK7WebCore11FrameLoader20activeDocumentLoaderEv
 __ZNK7WebCore11FrameLoader27numPendingOrLoadingRequestsEb
 __ZNK7WebCore11FrameLoader8loadTypeEv
+__ZNK7WebCore11Geolocation5frameEv
 __ZNK7WebCore11HistoryItem10visitCountEv
 __ZNK7WebCore11HistoryItem11hasChildrenEv
 __ZNK7WebCore11HistoryItem11originalURLEv
@@ -1212,11 +1211,9 @@ __ZNK7WebCore11HistoryItem9viewStateEv
 __ZNK7WebCore11RenderLayer19absoluteBoundingBoxEv
 __ZNK7WebCore11RenderStyle21visitedDependentColorEi
 __ZNK7WebCore11ScriptValue9getStringEPN3JSC9ExecStateERN3WTF6StringE
-__ZNK7WebCore12IconDatabase12databasePathEv
-__ZNK7WebCore12IconDatabase24shouldStopThreadActivityEv
-__ZNK7WebCore12IconDatabase9isEnabledEv
 __ZNK7WebCore12RenderObject14enclosingLayerEv
 __ZNK7WebCore12RenderObject15localToAbsoluteERKNS_10FloatPointEbb
+__ZNK7WebCore12RenderObject20localToContainerQuadERKNS_9FloatQuadEPNS_20RenderBoxModelObjectEbPb
 __ZNK7WebCore12RenderObject23absoluteBoundingBoxRectEb
 __ZNK7WebCore12RenderObject7childAtEj
 __ZNK7WebCore12RenderWidget14windowClipRectEv
@@ -1347,6 +1344,8 @@ __ZNK7WebCore20ResourceResponseBase8mimeTypeEv
 __ZNK7WebCore21BackForwardController12forwardCountEv
 __ZNK7WebCore21BackForwardController9backCountEv
 __ZNK7WebCore21UserContentURLPattern7matchesERKNS_4KURLE
+__ZNK7WebCore21RenderLayerCompositor11scrollLayerEv
+__ZNK7WebCore21RenderLayerCompositor15rootRenderLayerEv
 __ZNK7WebCore23AuthenticationChallenge20authenticationClientEv
 __ZNK7WebCore23FrameLoaderStateMachine15firstLayoutDoneEv
 __ZNK7WebCore23FrameLoaderStateMachine23committingFirstRealLoadEv
@@ -1374,6 +1373,12 @@ __ZNK7WebCore4KURL4pathEv
 __ZNK7WebCore4KURL4portEv
 __ZNK7WebCore4KURL4userEv
 __ZNK7WebCore4KURL5queryEv
+#if USE(WTFURL)
+__ZNK7WebCore4KURL6stringEv
+__ZNK7WebCore4KURL7isEmptyEv
+__ZNK7WebCore4KURL7isValidEv
+__ZNK7WebCore4KURL22protocolIsInHTTPFamilyEv
+#endif
 __ZNK7WebCore4KURL8protocolEv
 __ZNK7WebCore4KURLcvP5NSURLEv
 __ZNK7WebCore4Node14isDescendantOfEPKS0_
@@ -1431,6 +1436,7 @@ __ZNK7WebCore6Editor7canEditEv
 __ZNK7WebCore6Editor8canPasteEv
 __ZNK7WebCore6Editor9canDeleteEv
 __ZNK7WebCore6JSNode21pushEventHandlerScopeEPN3JSC9ExecStateEPNS1_14ScopeChainNodeE
+__ZNK7WebCore6Length22decrementCalculatedRefEv
 __ZNK7WebCore6Region5rectsEv
 __ZNK7WebCore6Widget14platformWidgetEv
 __ZNK7WebCore6Widget23convertToContainingViewERKNS_7IntRectE
@@ -1441,9 +1447,9 @@ __ZNK7WebCore6Widget25convertToContainingWindowERKNS_7IntRectE
 __ZNK7WebCore6Widget25convertToContainingWindowERKNS_8IntPointE
 __ZNK7WebCore6Widget9frameRectEv
 __ZNK7WebCore7Element10screenRectEv
+__ZNK7WebCore7Element10shadowTreeEv
 __ZNK7WebCore7Element12getAttributeERKNS_13QualifiedNameE
 __ZNK7WebCore7Element13hasShadowRootEv
-__ZNK7WebCore7Element14shadowRootListEv
 __ZNK7WebCore7IntRect10intersectsERKS0_
 __ZNK7WebCore7IntRect8containsERKS0_
 __ZNK7WebCore7IntRectcv6CGRectEv
@@ -1494,17 +1500,22 @@ __ZNK7WebCore9PageCache10frameCountEv
 __ZNK7WebCore9PageCache21autoreleasedPageCountEv
 __ZNK7WebCore9TreeScope14getElementByIdERKN3WTF12AtomicStringE
 __ZTVN7WebCore12ChromeClientE
+__ZN7WebCore14setMetadataURLERN3WTF6StringERKS1_S4_
 __ZTVN7WebCore16IconDatabaseBaseE
 __ZTVN7WebCore17FrameLoaderClientE
 __ZTVN7WebCore25HistoryPropertyListWriterE
 __ZTVN7WebCore28InspectorFrontendClientLocal8SettingsE
 _filenameByFixingIllegalCharacters
 _hasCaseInsensitiveSubstring
+_hasCaseInsensitivePrefix
 _hasCaseInsensitiveSuffix
 _stringEncodingForResource
 _stringIsCaseInsensitiveEqualToString
 _suggestedFilenameWithMIMEType
 _wkAdvanceDefaultButtonPulseAnimation
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+_wkCALayerEnumerateRectsBeingDrawnWithBlock
+#endif
 _wkCGContextGetShouldSmoothFonts
 _wkCGContextResetClip
 _wkCGPatternCreateWithImageAndTransform
@@ -1583,6 +1594,7 @@ _wkSetHTTPCookiesForURL
 _wkSetHTTPPipeliningMaximumPriority
 _wkSetHTTPPipeliningMinimumFastLanePriority
 _wkSetHTTPPipeliningPriority
+_wkSetMetadataURL
 _wkSetNSURLConnectionDefersCallbacks
 _wkSetNSURLRequestShouldContentSniff
 _wkSetPatternPhaseInUserSpace
@@ -1663,7 +1675,6 @@ __ZNK7WebCore21ContextMenuController21checkOrEnableIfNeededERNS_15ContextMenuIte
 __ZN7WebCore21ContextMenuController23contextMenuItemSelectedEPNS_15ContextMenuItemE
 __ZN7WebCore21contextMenuItemVectorEP14NSMutableArray
 __ZN7WebCore23platformMenuDescriptionERN3WTF6VectorINS_15ContextMenuItemELm0EEE
-__ZN7WebCore6Chrome15showContextMenuEv
 __ZNK7WebCore11ContextMenu19platformDescriptionEv
 __ZNK7WebCore15ContextMenuItem15platformSubMenuEv
 __ZNK7WebCore15ContextMenuItem4typeEv
@@ -1700,6 +1711,31 @@ __ZN7WebCore22GeolocationServiceMock8setErrorEN3WTF10PassRefPtrINS_13PositionErr
 #endif
 #endif
 
+#if ENABLE(ICONDATABASE)
+__ZN7WebCore12IconDatabase10setEnabledEb
+__ZN7WebCore12IconDatabase11defaultIconERKNS_7IntSizeE
+__ZN7WebCore12IconDatabase14removeAllIconsEv
+__ZN7WebCore12IconDatabase15iconRecordCountEv
+__ZN7WebCore12IconDatabase19pageURLMappingCountEv
+__ZN7WebCore12IconDatabase20allowDatabaseCleanupEv
+__ZN7WebCore12IconDatabase20delayDatabaseCleanupEv   
+__ZN7WebCore12IconDatabase20retainIconForPageURLERKN3WTF6StringE
+__ZN7WebCore12IconDatabase20retainedPageURLCountEv
+__ZN7WebCore12IconDatabase21releaseIconForPageURLERKN3WTF6StringE
+__ZN7WebCore12IconDatabase23defaultDatabaseFilenameEv
+__ZN7WebCore12IconDatabase23iconRecordCountWithDataEv
+__ZN7WebCore12IconDatabase23importIconURLForPageURLERKN3WTF6StringES4_
+__ZN7WebCore12IconDatabase24importIconDataForIconURLEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS1_6StringE
+__ZN7WebCore12IconDatabase25setPrivateBrowsingEnabledEb
+__ZN7WebCore12IconDatabase27checkIntegrityBeforeOpeningEv
+__ZN7WebCore12IconDatabase5closeEv
+__ZN7WebCore12IconDatabase9setClientEPNS_18IconDatabaseClientE
+__ZN7WebCore12IconDatabaseC1Ev
+__ZNK7WebCore12IconDatabase12databasePathEv
+__ZNK7WebCore12IconDatabase24shouldStopThreadActivityEv
+__ZNK7WebCore12IconDatabase9isEnabledEv
+#endif // ENABLE(ICONDATABASE)
+
 #if ENABLE(INSPECTOR)
 __ZN7WebCore15InspectorClient31doDispatchMessageOnFrontendPageEPNS_4PageERKN3WTF6StringE
 __ZN7WebCore19InspectorController14enableProfilerEv
@@ -1725,6 +1761,7 @@ __ZN7WebCore28InspectorFrontendClientLocal19requestDetachWindowEv
 __ZN7WebCore28InspectorFrontendClientLocal19windowObjectClearedEv
 __ZN7WebCore28InspectorFrontendClientLocal20sendMessageToBackendERKN3WTF6StringE
 __ZN7WebCore28InspectorFrontendClientLocal21isProfilingJavaScriptEv
+__ZN7WebCore28InspectorFrontendClientLocal21setDockingUnavailableEb
 __ZN7WebCore28InspectorFrontendClientLocal23stopProfilingJavaScriptEv
 __ZN7WebCore28InspectorFrontendClientLocal24showMainResourceForFrameEPNS_5FrameE
 __ZN7WebCore28InspectorFrontendClientLocal24startProfilingJavaScriptEv
@@ -1999,6 +2036,7 @@ __ZN7WebCore8Document34webkitWillExitFullScreenForElementEPNS_7ElementE
 __ZN7WebCore8Document35webkitWillEnterFullScreenForElementEPNS_7ElementE
 __ZN7WebCore8Document25setFullScreenRendererSizeERKNS_7IntSizeE
 __ZN7WebCore8Document36setFullScreenRendererBackgroundColorENS_5ColorE
+__ZN7WebCore8Document22setAnimatingFullScreenEb
 __ZNK7WebCore8Document9domWindowEv
 __ZNK7WebCore4Node16traverseNextNodeEPKS0_
 #endif
@@ -2085,6 +2123,7 @@ __ZN7WebCore12Notification17dispatchShowEventEv
 __ZN7WebCore12Notification18dispatchClickEventEv
 __ZN7WebCore12Notification18dispatchCloseEventEv
 __ZN7WebCore12Notification18dispatchErrorEventEv
+__ZN7WebCore19provideNotificationEPNS_4PageEPNS_18NotificationClientE
 #endif
 
 #if ENABLE(THREADED_SCROLLING)
@@ -2092,6 +2131,7 @@ __ZN7WebCore13ScrollingTree21tryToHandleWheelEventERKNS_18PlatformWheelEventE
 __ZN7WebCore13ScrollingTree22updateBackForwardStateEbb
 __ZN7WebCore13ScrollingTreeD1Ev
 __ZN7WebCore15ScrollingThread8dispatchERKN3WTF8FunctionIFvvEEE
+__ZN7WebCore20ScrollingCoordinator44setForceMainThreadScrollLayerPositionUpdatesEb
 __ZN7WebCore4Page20scrollingCoordinatorEv
 __ZNK7WebCore20ScrollingCoordinator13scrollingTreeEv
 #endif
@@ -2100,4 +2140,5 @@ __ZNK7WebCore4Node31numberOfScopedHTMLStyleChildrenEv
 
 #if ENABLE(SHADOW_DOM)
 __ZN7WebCore22RuntimeEnabledFeatures32setMultipleShadowSubtreesEnabledEb
+__ZN7WebCore22RuntimeEnabledFeatures18isShadowDOMEnabledE
 #endif
diff --git a/Source/WebCore/WebCore.gyp/WebCore.gyp b/Source/WebCore/WebCore.gyp/WebCore.gyp
index 25c541336..aeb715427 100644
--- a/Source/WebCore/WebCore.gyp/WebCore.gyp
+++ b/Source/WebCore/WebCore.gyp/WebCore.gyp
@@ -55,6 +55,11 @@
       '../Modules/geolocation',
       '../Modules/intents',
       '../Modules/indexeddb',
+      '../Modules/mediastream',
+      '../Modules/speech',
+      '../Modules/webdatabase',
+      '../Modules/webdatabase/chromium',
+      '../Modules/websockets',
       '../accessibility',
       '../accessibility/chromium',
       '../bindings',
@@ -85,7 +90,6 @@
       '../loader/cache',
       '../loader/icon',
       '../mathml',
-      '../mediastream',
       '../notifications',
       '../page',
       '../page/animation',
@@ -136,7 +140,6 @@
       '../svg/properties',
       '../../ThirdParty/glu',
       '../webaudio',
-      '../websockets',
       '../workers',
       '../xml',
       '../xml/parser',
@@ -190,18 +193,6 @@
           '<@(webcore_svg_bindings_idl_files)',
         ],
       }],
-      ['OS=="mac" and use_skia==0', {
-        'webcore_include_dirs+': [
-          # platform/graphics/cg and cocoa need to come before
-          # platform/graphics/chromium so that the Mac build picks up the
-          # version of ImageBufferData.h in the cg directory and
-          # FontPlatformData.h in the cocoa directory.  The + prepends this
-          # directory to the list.
-          # FIXME: This shouldn't need to be prepended.
-          '../platform/graphics/cocoa',
-          '../platform/graphics/cg',
-        ],
-      }],
       ['OS=="mac"', {
         'webcore_include_dirs': [
           # FIXME: Eliminate dependency on platform/mac and related
@@ -211,17 +202,13 @@
           # platform/graphics/cg may need to stick around, though.
           '../platform/audio/mac',
           '../platform/cocoa',
+          '../platform/graphics/cg',
+          '../platform/graphics/cocoa',
           '../platform/graphics/mac',
           '../platform/mac',
           '../platform/text/mac',
         ],
       }],
-      ['OS=="mac" and use_skia==1', {
-        'webcore_include_dirs': [
-              '../platform/graphics/cocoa',
-              '../platform/graphics/cg',
-        ],
-      }],
       ['OS=="win"', {
         'webcore_include_dirs': [
           '../page/win',
@@ -477,7 +464,7 @@
             'idl_files_list': '<|(idl_files_list.tmp <@(bindings_idl_files))',
           },
           'inputs': [
-            '../bindings/scripts/resolve-supplemental.pl',
+            '../bindings/scripts/preprocess-idls.pl',
             '../bindings/scripts/IDLParser.pm',
             '../bindings/scripts/IDLAttributes.txt',
             '<(idl_files_list)',
@@ -490,7 +477,7 @@
             'perl',
             '-w',
             '-I../bindings/scripts',
-            '../bindings/scripts/resolve-supplemental.pl',
+            '../bindings/scripts/preprocess-idls.pl',
             '--defines',
             '<(feature_defines) LANGUAGE_JAVASCRIPT V8_BINDING',
             '--idlFilesList',
@@ -728,7 +715,7 @@
           'action_name': 'EventFactory',
           'inputs': [
             '../dom/make_event_factory.pl',
-            '../dom/EventFactory.in',
+            '../dom/EventNames.in',
           ],
           'outputs': [
             '<(SHARED_INTERMEDIATE_DIR)/webkit/EventFactory.cpp',
@@ -827,6 +814,7 @@
               '../css/mathml.css',
               '../css/mediaControls.css',
               '../css/mediaControlsChromium.css',
+              '../css/mediaControlsChromiumAndroid.css',
               '../css/fullscreen.css',
               # Skip fullscreenQuickTime.
             ],
@@ -987,11 +975,13 @@
           ],
           'variables': {
             'generator_include_dirs': [
+              '--include', '../Modules/indexeddb',
+              '--include', '../Modules/mediastream',
+              '--include', '../Modules/webdatabase',
               '--include', '../css',
               '--include', '../dom',
               '--include', '../fileapi',
               '--include', '../html',
-              '--include', '../mediastream',
               '--include', '../notifications',
               '--include', '../page',
               '--include', '../plugins',
@@ -999,7 +989,6 @@
               '--include', '../svg',
               '--include', '../testing',
               '--include', '../webaudio',
-              '--include', '../websockets',
               '--include', '../workers',
               '--include', '../xml',
             ],
@@ -1195,6 +1184,7 @@
         '<(chromium_src_dir)/third_party/ots/ots.gyp:ots',
         '<(chromium_src_dir)/third_party/sqlite/sqlite.gyp:sqlite',
         '<(chromium_src_dir)/third_party/angle/src/build_angle.gyp:translator_glsl',
+        '<(chromium_src_dir)/third_party/zlib/zlib.gyp:zlib',
         '<(chromium_src_dir)/v8/tools/gyp/v8.gyp:v8',
         '<(libjpeg_gyp_path):libjpeg',
       ],
@@ -1363,7 +1353,6 @@
           # This directory needs to be on the include path for multiple sub-targets of webcore.
           'direct_dependent_settings': {
             'include_dirs': [
-              '<(chromium_src_dir)/third_party/ffmpeg/patched-ffmpeg',
               '<(chromium_src_dir)/third_party/ffmpeg',
             ],
           },
@@ -1513,15 +1502,6 @@
             ['include', 'platform/graphics/opentype/OpenTypeSanitizer\\.cpp$'],
           ],
         }],
-        ['OS=="mac" and use_skia==0', {
-          'sources/': [
-            # The Mac build is PLATFORM_CG too.  platform/graphics/cg is the
-            # only place that CG files we want to build are located, and not
-            # all of them even have a CG suffix, so just add them by a
-            # regexp matching their directory.
-            ['include', 'platform/graphics/cg/[^/]*(?<!Win)?\\.(cpp|mm?)$'],
-          ],
-        }],
         ['OS=="mac"', {
           # Necessary for Mac .mm stuff.
           'include_dirs': [
@@ -1618,29 +1598,7 @@
             ['exclude', 'platform/graphics/FontPlatformData\\.cpp$'],
           ],
         }],
-        ['OS=="mac" and use_skia==0', {
-          'sources/': [
-            # Cherry-pick some files that can't be included by broader regexps.
-            # Some of these are used instead of Chromium platform files, see
-            # the specific exclusions in the "exclude" list below.
-            ['include', 'platform/graphics/mac/GraphicsContextMac\\.mm$'],
-
-            # Chromium Mac does not use skia.
-            ['exclude', 'platform/graphics/skia/[^/]*Skia\\.(cpp|h)$'],
-
-            # The Mac currently uses ImageChromiumMac.mm from
-            # platform/graphics/chromium, included by regex above, instead.
-            ['exclude', 'platform/graphics/chromium/ImageChromium\\.cpp$'],
-
-            # ImageDecoderSkia is not used on mac.  ImageDecoderCG is used instead.
-            ['exclude', 'platform/image-decoders/skia/ImageDecoderSkia\\.cpp$'],
-            ['include', 'platform/image-decoders/cg/ImageDecoderCG\\.cpp$'],
-
-            # Again, Skia is not used on Mac.
-            ['exclude', 'platform/chromium/DragImageChromiumSkia\\.cpp$'],
-          ],
-        }],
-        ['OS=="mac" and use_skia==1', {
+        ['OS=="mac"', {
           'sources/': [
             ['include', 'platform/graphics/cg/FloatPointCG\\.cpp$'],
             ['include', 'platform/graphics/cg/FloatRectCG\\.cpp$'],
@@ -1656,7 +1614,7 @@
             ['exclude', 'platform/chromium/DragImageChromiumMac\\.cpp$'],
           ],
         }],
-        ['use_x11 == 0 and (OS!="mac" or use_skia==0)', {
+        ['use_x11 == 0 and OS != "mac"', {
           'sources/': [
             ['exclude', 'VDMX[^/]+\\.(cpp|h)$'],
           ],
@@ -1701,6 +1659,7 @@
             ['include', 'platform/graphics/harfbuzz/FontHarfBuzz\\.cpp$'],
             ['include', 'platform/graphics/harfbuzz/FontPlatformDataHarfBuzz\\.cpp$'],
             ['include', 'platform/graphics/harfbuzz/HarfBuzzSkia\\.cpp$'],
+            ['include', 'platform/graphics/harfbuzz/HarfBuzzShaperBase\\.cpp$'],
             ['include', 'platform/graphics/skia/SimpleFontDataSkia\\.cpp$'],
           ],
         }, { # OS!="android"
@@ -1715,25 +1674,28 @@
     # See https://bugs.webkit.org/show_bug.cgi?id=62916.
     {
       'target_name': 'webcore_arm_neon',
-      'type': 'static_library',
-      'dependencies': [
-        'webcore_prerequisites',
-      ],
-      'hard_dependency': 1,
-      'sources': [
-        '<@(webcore_files)',
-      ],
-      'sources/': [
-        ['exclude', '.*'],
-        ['include', 'platform/graphics/filters/arm/.*NEON\\.(cpp|h)'],
-      ],
       'conditions': [
-        ['OS=="android"', {
-          'cflags!': ['-mthumb'],
-          'cflags': ['-marm'],
-        }],
-        ['OS=="linux" and target_arch=="arm"', {
+        ['target_arch=="arm"', {
+          'type': 'static_library',
+          'dependencies': [
+            'webcore_prerequisites',
+          ],
+          'hard_dependency': 1,
+          'sources': [
+            '<@(webcore_files)',
+          ],
+          'sources/': [
+            ['exclude', '.*'],
+            ['include', 'platform/graphics/filters/arm/.*NEON\\.(cpp|h)'],
+          ],
           'cflags': ['-marm'],
+          'conditions': [
+            ['OS=="android"', {
+              'cflags!': ['-mthumb'],
+            }],
+          ],
+        },{  # target_arch!="arm"
+          'type': 'none',
         }],
       ],
     },
@@ -1840,6 +1802,13 @@
 
         ['exclude', 'AllInOne\\.cpp$'],
 
+        ['exclude', 'Modules/indexeddb/IDBFactoryBackendInterface\\.cpp$'],
+        ['exclude', 'Modules/indexeddb/IDBKeyPathBackendImpl\\.cpp$'],
+        ['exclude', 'Modules/webdatabase/DatabaseTrackerClient\\.h$'],
+        ['exclude', 'Modules/webdatabase/DatabaseTracker\\.cpp$'],
+        ['exclude', 'Modules/webdatabase/OriginQuotaManager\\.(cpp|h)$'],
+        ['exclude', 'Modules/webdatabase/OriginUsageRecord\\.(cpp|h)$'],
+        ['exclude', 'Modules/webdatabase/SQLTransactionClient\\.cpp$'],
         ['exclude', 'fileapi/LocalFileSystem\\.cpp$'],
         ['exclude', 'inspector/InspectorFrontendClientLocal\\.cpp$'],
         ['exclude', 'inspector/JavaScript[^/]*\\.cpp$'],
@@ -1856,13 +1825,6 @@
         ['exclude', 'plugins/PluginStream\\.cpp$'],
         ['exclude', 'plugins/PluginView\\.cpp$'],
         ['exclude', 'plugins/npapi\\.cpp$'],
-        ['exclude', 'storage/DatabaseTrackerClient\\.h$'],
-        ['exclude', 'storage/DatabaseTracker\\.cpp$'],
-        ['exclude', 'storage/IDBFactoryBackendInterface\\.cpp$'],
-        ['exclude', 'storage/IDBKeyPathBackendImpl\\.cpp$'],
-        ['exclude', 'storage/OriginQuotaManager\\.(cpp|h)$'],
-        ['exclude', 'storage/OriginUsageRecord\\.(cpp|h)$'],
-        ['exclude', 'storage/SQLTransactionClient\\.cpp$'],
         ['exclude', 'storage/StorageEventDispatcher\\.cpp$'],
         ['exclude', 'storage/StorageNamespace\\.cpp$'],
         ['exclude', 'workers/DefaultSharedWorkerRepository\\.(cpp|h)$'],
diff --git a/Source/WebCore/WebCore.gyp/scripts/action_makenames.py b/Source/WebCore/WebCore.gyp/scripts/action_makenames.py
index a5dae1204..9afd8e885 100644
--- a/Source/WebCore/WebCore.gyp/scripts/action_makenames.py
+++ b/Source/WebCore/WebCore.gyp/scripts/action_makenames.py
@@ -130,8 +130,8 @@ def main(args):
              or inputBasename.endswith('attrs.in'):
             assert attrInput == None
             attrInput = inputAbsPosix
-        elif inputBasename.endswith('EventFactory.in') \
-            or inputBasename.endswith('EventTargetFactory.in') \
+        elif inputBasename.endswith('EventTargetFactory.in') \
+            or inputBasename.endswith('EventNames.in') \
             or inputBasename.endswith('DOMExceptions.in'):
             eventsInput = inputAbsPosix
         elif inputBasename.endswith('Names.in'):
diff --git a/Source/WebCore/WebCore.gypi b/Source/WebCore/WebCore.gypi
index bf1e89651..b8171ec68 100644
--- a/Source/WebCore/WebCore.gypi
+++ b/Source/WebCore/WebCore.gypi
@@ -193,9 +193,24 @@
             'loader/icon/IconDatabaseBase.h',
             'loader/icon/IconDatabaseClient.h',
             'loader/mac/LoaderNSURLExtras.h',
+            'Modules/webdatabase/AbstractDatabase.h',
+            'Modules/webdatabase/Database.h',
+            'Modules/webdatabase/DatabaseDetails.h',
+            'Modules/webdatabase/DatabaseTracker.h',
+            'Modules/webdatabase/DatabaseTrackerClient.h',
+            'Modules/webdatabase/SQLError.h',
+            'Modules/webdatabase/SQLResultSet.h',
+            'Modules/webdatabase/SQLResultSetRowList.h',
+            'Modules/webdatabase/SQLStatementCallback.h',
+            'Modules/webdatabase/SQLStatementErrorCallback.h',
+            'Modules/webdatabase/SQLTransaction.h',
+            'Modules/webdatabase/SQLTransactionCallback.h',
+            'Modules/webdatabase/SQLTransactionErrorCallback.h',
+            'Modules/webdatabase/StorageTracker.h',
+            'Modules/webdatabase/StorageTrackerClient.h',
+            'notifications/NotificationClient.h',
             'notifications/NotificationContents.h',
             'notifications/NotificationController.h',
-            'notifications/NotificationPresenter.h',
             'page/Chrome.h',
             'page/ChromeClient.h',
             'page/Console.h',
@@ -223,7 +238,6 @@
             'page/Page.h',
             'page/PageGroup.h',
             'page/PageSerializer.h',
-            'page/PageSupplement.h',
             'page/PageVisibilityState.h',
             'page/PrintContext.h',
             'page/SecurityOrigin.h',
@@ -241,7 +255,6 @@
             'page/WindowFeatures.h',
             'page/animation/AnimationController.h',
             'page/mac/WebCoreFrameView.h',
-            'platform/AsyncFileStream.h',
             'platform/Clock.h',
             'platform/ColorChooser.h',
             'platform/ColorChooserClient.h',
@@ -292,9 +305,11 @@
             'platform/ScrollableArea.h',
             'platform/Scrollbar.h',
             'platform/ScrollbarTheme.h',
+            'platform/ScrollbarThemeClient.h',
             'platform/SearchPopupMenu.h',
             'platform/SharedBuffer.h',
             'platform/SharedBufferChunkReader.h',
+            'platform/Supplementable.h',
             'platform/SystemTime.h',
             'platform/Theme.h',
             'platform/ThemeTypes.h',
@@ -335,6 +350,8 @@
             'platform/graphics/FontSmoothingMode.h',
             'platform/graphics/FontTraitsMask.h',
             'platform/graphics/FontWidthVariant.h',
+            'platform/graphics/FractionalLayoutRect.h',
+            'platform/graphics/FractionalLayoutSize.h',
             'platform/graphics/Generator.h',
             'platform/graphics/Glyph.h',
             'platform/graphics/GlyphBuffer.h',
@@ -538,6 +555,7 @@
             'rendering/style/StyleFlexibleBoxData.h',
             'rendering/style/StyleGeneratedImage.h',
             'rendering/style/StyleGridData.h',
+            'rendering/style/StyleGridItemData.h',
             'rendering/style/StyleImage.h',
             'rendering/style/StyleInheritedData.h',
             'rendering/style/StyleMarqueeData.h',
@@ -549,22 +567,6 @@
             'rendering/style/StyleTransformData.h',
             'rendering/style/StyleVisualData.h',
             'rendering/svg/SVGResourcesCache.h',
-            'storage/AbstractDatabase.h',
-            'storage/Database.h',
-            'storage/DatabaseDetails.h',
-            'storage/DatabaseTracker.h',
-            'storage/DatabaseTrackerClient.h',
-            'storage/SQLError.h',
-            'storage/SQLResultSet.h',
-            'storage/SQLResultSetRowList.h',
-            'storage/SQLStatement.h',
-            'storage/SQLStatementCallback.h',
-            'storage/SQLStatementErrorCallback.h',
-            'storage/SQLTransaction.h',
-            'storage/SQLTransactionCallback.h',
-            'storage/SQLTransactionErrorCallback.h',
-            'storage/StorageTracker.h',
-            'storage/StorageTrackerClient.h',
             'workers/WorkerRunLoop.h',
             'workers/WorkerThread.h',
         ],
@@ -577,6 +579,7 @@
             'dom/Clipboard.h',
             'dom/ClipboardAccessPolicy.h',
             'dom/ContainerNode.h',
+            'dom/ContextDestructionObserver.h',
             'dom/DOMImplementation.h',
             'dom/DOMTimeStamp.h',
             'dom/DeviceOrientation.h',
@@ -617,7 +620,7 @@
             'dom/ScriptExecutionContext.h',
             'dom/ScriptRunner.h',
             'dom/ShadowRoot.h',
-            'dom/ShadowRootList.h',
+            'dom/ShadowTree.h',
             'dom/SpaceSplitString.h',
             'dom/StyledElement.h',
             'dom/Text.h',
@@ -653,6 +656,7 @@
             'html/HTMLTextAreaElement.h',
             'html/HTMLTextFormControlElement.h',
             'html/InputType.h',
+            'html/LabelableElement.h',
             'html/VoidCallback.h',
             'html/parser/HTMLParserIdioms.h',
         ],
@@ -727,10 +731,66 @@
             'Modules/geolocation/PositionError.idl',
             'Modules/geolocation/PositionErrorCallback.idl',
             'Modules/indexeddb/DOMWindowIndexedDatabase.idl',
+            'Modules/indexeddb/IDBAny.idl',
+            'Modules/indexeddb/IDBCursor.idl',
+            'Modules/indexeddb/IDBCursorWithValue.idl',
+            'Modules/indexeddb/IDBDatabaseError.idl',
+            'Modules/indexeddb/IDBDatabaseException.idl',
+            'Modules/indexeddb/IDBDatabase.idl',
+            'Modules/indexeddb/IDBFactory.idl',
+            'Modules/indexeddb/IDBIndex.idl',
+            'Modules/indexeddb/IDBKey.idl',
+            'Modules/indexeddb/IDBKeyRange.idl',
+            'Modules/indexeddb/IDBObjectStore.idl',
+            'Modules/indexeddb/IDBRequest.idl',
+            'Modules/indexeddb/IDBTransaction.idl',
+            'Modules/indexeddb/IDBVersionChangeEvent.idl',
+            'Modules/indexeddb/IDBVersionChangeRequest.idl',
+            'Modules/indexeddb/WorkerContextIndexedDatabase.idl',
             'Modules/intents/DOMWindowIntents.idl',
             'Modules/intents/Intent.idl',
             'Modules/intents/IntentResultCallback.idl',
             'Modules/intents/NavigatorIntents.idl',
+            'Modules/mediastream/DOMWindowMediaStream.idl',
+            'Modules/mediastream/LocalMediaStream.idl',
+            'Modules/mediastream/MediaStream.idl',
+            'Modules/mediastream/MediaStreamEvent.idl',
+            'Modules/mediastream/MediaStreamList.idl',
+            'Modules/mediastream/MediaStreamTrack.idl',
+            'Modules/mediastream/MediaStreamTrackList.idl',
+            'Modules/mediastream/NavigatorMediaStream.idl',
+            'Modules/mediastream/NavigatorUserMediaError.idl',
+            'Modules/mediastream/NavigatorUserMediaErrorCallback.idl',
+            'Modules/mediastream/NavigatorUserMediaSuccessCallback.idl',
+            'Modules/mediastream/PeerConnection.idl',
+            'Modules/mediastream/SignalingCallback.idl',
+            'Modules/speech/DOMWindowSpeech.idl',
+            'Modules/speech/SpeechGrammar.idl',
+            'Modules/speech/SpeechGrammarList.idl',
+            'Modules/speech/SpeechRecognitionAlternative.idl',
+            'Modules/speech/SpeechRecognitionError.idl',
+            'Modules/speech/SpeechRecognitionEvent.idl',
+            'Modules/speech/SpeechRecognitionResult.idl',
+            'Modules/speech/SpeechRecognitionResultList.idl',
+            'Modules/webdatabase/DOMWindowSQLDatabase.idl',
+            'Modules/webdatabase/Database.idl',
+            'Modules/webdatabase/DatabaseCallback.idl',
+            'Modules/webdatabase/DatabaseSync.idl',
+            'Modules/webdatabase/SQLError.idl',
+            'Modules/webdatabase/SQLException.idl',
+            'Modules/webdatabase/SQLResultSet.idl',
+            'Modules/webdatabase/SQLResultSetRowList.idl',
+            'Modules/webdatabase/SQLStatementCallback.idl',
+            'Modules/webdatabase/SQLStatementErrorCallback.idl',
+            'Modules/webdatabase/SQLTransaction.idl',
+            'Modules/webdatabase/SQLTransactionCallback.idl',
+            'Modules/webdatabase/SQLTransactionErrorCallback.idl',
+            'Modules/webdatabase/SQLTransactionSync.idl',
+            'Modules/webdatabase/SQLTransactionSyncCallback.idl',
+            'Modules/webdatabase/WorkerContextSQLDatabase.idl',
+            'Modules/websockets/CloseEvent.idl',
+            'Modules/websockets/DOMWindowWebSocket.idl',
+            'Modules/websockets/WebSocket.idl',
             'css/CSSCharsetRule.idl',
             'css/CSSFontFaceRule.idl',
             'css/CSSImportRule.idl',
@@ -857,11 +917,11 @@
             'fileapi/Metadata.idl',
             'fileapi/MetadataCallback.idl',
             'fileapi/WebKitBlobBuilder.idl',
+            'fileapi/WorkerContextFileSystem.idl',
             'html/DOMFormData.idl',
             'html/DOMSettableTokenList.idl',
             'html/DOMTokenList.idl',
             'html/DOMURL.idl',
-            'html/DOMWindowHTML.idl',
             'html/HTMLAllCollection.idl',
             'html/HTMLAnchorElement.idl',
             'html/HTMLAppletElement.idl',
@@ -949,8 +1009,8 @@
             'html/canvas/CanvasPixelArray.idl',
             'html/canvas/CanvasRenderingContext.idl',
             'html/canvas/CanvasRenderingContext2D.idl',
-            'html/canvas/DOMWindowWebGL.idl',
             'html/canvas/DataView.idl',
+            'html/canvas/EXTTextureFilterAnisotropic.idl',
             'html/canvas/Float32Array.idl',
             'html/canvas/Float64Array.idl',
             'html/canvas/Int16Array.idl',
@@ -992,19 +1052,6 @@
             'inspector/ScriptProfile.idl',
             'inspector/ScriptProfileNode.idl',
             'loader/appcache/DOMApplicationCache.idl',
-            'mediastream/DOMWindowMediaStream.idl',
-            'mediastream/LocalMediaStream.idl',
-            'mediastream/MediaStream.idl',
-            'mediastream/MediaStreamEvent.idl',
-            'mediastream/MediaStreamList.idl',
-            'mediastream/MediaStreamTrack.idl',
-            'mediastream/MediaStreamTrackList.idl',
-            'mediastream/NavigatorMediaStream.idl',
-            'mediastream/NavigatorUserMediaError.idl',
-            'mediastream/NavigatorUserMediaErrorCallback.idl',
-            'mediastream/NavigatorUserMediaSuccessCallback.idl',
-            'mediastream/PeerConnection.idl',
-            'mediastream/SignalingCallback.idl',
             'notifications/Notification.idl',
             'notifications/NotificationCenter.idl',
             'page/AbstractView.idl',
@@ -1036,36 +1083,6 @@
             'plugins/DOMMimeTypeArray.idl',
             'plugins/DOMPlugin.idl',
             'plugins/DOMPluginArray.idl',
-            'storage/DOMWindowSQLDatabase.idl',
-            'storage/Database.idl',
-            'storage/DatabaseCallback.idl',
-            'storage/DatabaseSync.idl',
-            'storage/IDBAny.idl',
-            'storage/IDBCursor.idl',
-            'storage/IDBCursorWithValue.idl',
-            'storage/IDBDatabaseError.idl',
-            'storage/IDBDatabaseException.idl',
-            'storage/IDBDatabase.idl',
-            'storage/IDBFactory.idl',
-            'storage/IDBIndex.idl',
-            'storage/IDBKey.idl',
-            'storage/IDBKeyRange.idl',
-            'storage/IDBObjectStore.idl',
-            'storage/IDBRequest.idl',
-            'storage/IDBTransaction.idl',
-            'storage/IDBVersionChangeEvent.idl',
-            'storage/IDBVersionChangeRequest.idl',
-            'storage/SQLError.idl',
-            'storage/SQLException.idl',
-            'storage/SQLResultSet.idl',
-            'storage/SQLResultSetRowList.idl',
-            'storage/SQLStatementCallback.idl',
-            'storage/SQLStatementErrorCallback.idl',
-            'storage/SQLTransaction.idl',
-            'storage/SQLTransactionCallback.idl',
-            'storage/SQLTransactionErrorCallback.idl',
-            'storage/SQLTransactionSync.idl',
-            'storage/SQLTransactionSyncCallback.idl',
             'storage/Storage.idl',
             'storage/StorageEvent.idl',
             'storage/StorageInfo.idl',
@@ -1099,18 +1116,13 @@
             'webaudio/OfflineAudioCompletionEvent.idl',
             'webaudio/RealtimeAnalyserNode.idl',
             'webaudio/WaveShaperNode.idl',
-            'websockets/CloseEvent.idl',
-            'websockets/DOMWindowWebSocket.idl',
-            'websockets/WebSocket.idl',
             'workers/AbstractWorker.idl',
-            'workers/DOMWindowWorker.idl',
             'workers/DedicatedWorkerContext.idl',
             'workers/SharedWorker.idl',
             'workers/SharedWorkerContext.idl',
             'workers/Worker.idl',
             'workers/WorkerContext.idl',
             'workers/WorkerLocation.idl',
-            'xml/DOMWindowXML.idl',
             'xml/DOMParser.idl',
             'xml/XMLHttpRequest.idl',
             'xml/XMLHttpRequestException.idl',
@@ -1125,7 +1137,6 @@
             'xml/XSLTProcessor.idl',
         ],
         'webcore_svg_bindings_idl_files': [
-            'svg/DOMWindowSVG.idl',
             'svg/ElementTimeControl.idl',
             'svg/SVGAElement.idl',
             'svg/SVGAltGlyphElement.idl',
@@ -1292,6 +1303,80 @@
             'Modules/geolocation/NavigatorGeolocation.h',
             'Modules/indexeddb/DOMWindowIndexedDatabase.cpp',
             'Modules/indexeddb/DOMWindowIndexedDatabase.h',
+            'Modules/indexeddb/IDBAny.cpp',
+            'Modules/indexeddb/IDBAny.h',
+            'Modules/indexeddb/IDBBackingStore.h',
+            'Modules/indexeddb/IDBCallbacks.h',
+            'Modules/indexeddb/IDBCursor.cpp',
+            'Modules/indexeddb/IDBCursor.h',
+            'Modules/indexeddb/IDBCursorBackendImpl.cpp',
+            'Modules/indexeddb/IDBCursorBackendImpl.h',
+            'Modules/indexeddb/IDBCursorBackendInterface.h',
+            'Modules/indexeddb/IDBCursorWithValue.cpp',
+            'Modules/indexeddb/IDBCursorWithValue.h',
+            'Modules/indexeddb/IDBDatabase.cpp',
+            'Modules/indexeddb/IDBDatabase.h',
+            'Modules/indexeddb/IDBDatabaseBackendImpl.cpp',
+            'Modules/indexeddb/IDBDatabaseBackendImpl.h',
+            'Modules/indexeddb/IDBDatabaseBackendInterface.h',
+            'Modules/indexeddb/IDBDatabaseCallbacks.h',
+            'Modules/indexeddb/IDBDatabaseCallbacks.h',
+            'Modules/indexeddb/IDBDatabaseCallbacksImpl.cpp',
+            'Modules/indexeddb/IDBDatabaseCallbacksImpl.h',
+            'Modules/indexeddb/IDBDatabaseError.h',
+            'Modules/indexeddb/IDBDatabaseException.cpp',
+            'Modules/indexeddb/IDBDatabaseException.h',
+            'Modules/indexeddb/IDBEventDispatcher.cpp',
+            'Modules/indexeddb/IDBEventDispatcher.h',
+            'Modules/indexeddb/IDBFactory.cpp',
+            'Modules/indexeddb/IDBFactory.h',
+            'Modules/indexeddb/IDBFactoryBackendImpl.cpp',
+            'Modules/indexeddb/IDBFactoryBackendImpl.h',
+            'Modules/indexeddb/IDBFactoryBackendInterface.cpp',
+            'Modules/indexeddb/IDBFactoryBackendInterface.h',
+            'Modules/indexeddb/IDBIndex.cpp',
+            'Modules/indexeddb/IDBIndex.h',
+            'Modules/indexeddb/IDBIndexBackendImpl.cpp',
+            'Modules/indexeddb/IDBIndexBackendImpl.h',
+            'Modules/indexeddb/IDBIndexBackendInterface.h',
+            'Modules/indexeddb/IDBKey.cpp',
+            'Modules/indexeddb/IDBKey.h',
+            'Modules/indexeddb/IDBKeyPath.cpp',
+            'Modules/indexeddb/IDBKeyPath.h',
+            'Modules/indexeddb/IDBKeyPathBackendImpl.cpp',
+            'Modules/indexeddb/IDBKeyPathBackendImpl.h',
+            'Modules/indexeddb/IDBKeyRange.cpp',
+            'Modules/indexeddb/IDBKeyRange.h',
+            'Modules/indexeddb/IDBLevelDBCoding.cpp',
+            'Modules/indexeddb/IDBLevelDBCoding.h',
+            'Modules/indexeddb/IDBLevelDBBackingStore.cpp',
+            'Modules/indexeddb/IDBLevelDBBackingStore.h',
+            'Modules/indexeddb/IDBObjectStore.cpp',
+            'Modules/indexeddb/IDBObjectStore.h',
+            'Modules/indexeddb/IDBObjectStoreBackendImpl.cpp',
+            'Modules/indexeddb/IDBObjectStoreBackendImpl.h',
+            'Modules/indexeddb/IDBObjectStoreBackendInterface.h',
+            'Modules/indexeddb/IDBPendingTransactionMonitor.cpp',
+            'Modules/indexeddb/IDBPendingTransactionMonitor.h',
+            'Modules/indexeddb/IDBRequest.cpp',
+            'Modules/indexeddb/IDBRequest.h',
+            'Modules/indexeddb/IDBTracing.h',
+            'Modules/indexeddb/IDBTransaction.cpp',
+            'Modules/indexeddb/IDBTransaction.h',
+            'Modules/indexeddb/IDBTransactionBackendImpl.cpp',
+            'Modules/indexeddb/IDBTransactionBackendImpl.h',
+            'Modules/indexeddb/IDBTransactionBackendInterface.h',
+            'Modules/indexeddb/IDBTransactionCallbacks.h',
+            'Modules/indexeddb/IDBTransactionCoordinator.cpp',
+            'Modules/indexeddb/IDBTransactionCoordinator.h',
+            'Modules/indexeddb/IDBVersionChangeEvent.cpp',
+            'Modules/indexeddb/IDBVersionChangeEvent.h',
+            'Modules/indexeddb/IDBVersionChangeRequest.cpp',
+            'Modules/indexeddb/IDBVersionChangeRequest.h',
+            'Modules/indexeddb/PageGroupIndexedDatabase.cpp',
+            'Modules/indexeddb/PageGroupIndexedDatabase.h',
+            'Modules/indexeddb/WorkerContextIndexedDatabase.cpp',
+            'Modules/indexeddb/WorkerContextIndexedDatabase.h',
             'Modules/intents/Intent.cpp',
             'Modules/intents/Intent.h',
             'Modules/intents/IntentRequest.cpp',
@@ -1299,6 +1384,118 @@
             'Modules/intents/IntentResultCallback.h',
             'Modules/intents/NavigatorIntents.cpp',
             'Modules/intents/NavigatorIntents.h',
+            'Modules/mediastream/LocalMediaStream.cpp',
+            'Modules/mediastream/LocalMediaStream.h',
+            'Modules/mediastream/MediaStream.cpp',
+            'Modules/mediastream/MediaStream.h',
+            'Modules/mediastream/MediaStreamEvent.cpp',
+            'Modules/mediastream/MediaStreamEvent.h',
+            'Modules/mediastream/MediaStreamList.cpp',
+            'Modules/mediastream/MediaStreamList.h',
+            'Modules/mediastream/MediaStreamRegistry.cpp',
+            'Modules/mediastream/MediaStreamRegistry.h',
+            'Modules/mediastream/MediaStreamTrack.cpp',
+            'Modules/mediastream/MediaStreamTrack.h',
+            'Modules/mediastream/MediaStreamTrackList.cpp',
+            'Modules/mediastream/MediaStreamTrackList.h',
+            'Modules/mediastream/NavigatorMediaStream.cpp',
+            'Modules/mediastream/NavigatorMediaStream.h',
+            'Modules/mediastream/NavigatorUserMediaError.h',
+            'Modules/mediastream/NavigatorUserMediaErrorCallback.h',
+            'Modules/mediastream/NavigatorUserMediaSuccessCallback.h',
+            'Modules/mediastream/PeerConnection.cpp',
+            'Modules/mediastream/PeerConnection.h',
+            'Modules/mediastream/SignalingCallback.h',
+            'Modules/mediastream/UserMediaClient.h',
+            'Modules/mediastream/UserMediaController.h',
+            'Modules/mediastream/UserMediaController.cpp',
+            'Modules/mediastream/UserMediaRequest.cpp',
+            'Modules/mediastream/UserMediaRequest.h',
+            'Modules/speech/SpeechGrammar.cpp',
+            'Modules/speech/SpeechGrammar.h',
+            'Modules/speech/SpeechGrammarList.cpp',
+            'Modules/speech/SpeechGrammarList.h',
+            'Modules/speech/SpeechRecognitionAlternative.cpp',
+            'Modules/speech/SpeechRecognitionAlternative.h',
+            'Modules/speech/SpeechRecognitionError.cpp',
+            'Modules/speech/SpeechRecognitionError.h',
+            'Modules/speech/SpeechRecognitionEvent.cpp',
+            'Modules/speech/SpeechRecognitionEvent.h',
+            'Modules/speech/SpeechRecognitionResult.cpp',
+            'Modules/speech/SpeechRecognitionResult.h',
+            'Modules/speech/SpeechRecognitionResultList.cpp',
+            'Modules/speech/SpeechRecognitionResultList.h',
+            'Modules/webdatabase/AbstractDatabase.cpp',
+            'Modules/webdatabase/ChangeVersionWrapper.cpp',
+            'Modules/webdatabase/ChangeVersionWrapper.h',
+            'Modules/webdatabase/Database.cpp',
+            'Modules/webdatabase/DatabaseAuthorizer.cpp',
+            'Modules/webdatabase/DatabaseAuthorizer.h',
+            'Modules/webdatabase/DatabaseCallback.h',
+            'Modules/webdatabase/DatabaseContext.cpp',
+            'Modules/webdatabase/DatabaseContext.h',
+            'Modules/webdatabase/DatabaseSync.cpp',
+            'Modules/webdatabase/DatabaseSync.h',
+            'Modules/webdatabase/DatabaseTask.cpp',
+            'Modules/webdatabase/DatabaseTask.h',
+            'Modules/webdatabase/DatabaseThread.cpp',
+            'Modules/webdatabase/DatabaseThread.h',
+            'Modules/webdatabase/DatabaseTracker.cpp',
+            'Modules/webdatabase/DOMWindowSQLDatabase.cpp',
+            'Modules/webdatabase/DOMWindowSQLDatabase.h',
+            'Modules/webdatabase/OriginQuotaManager.cpp',
+            'Modules/webdatabase/OriginQuotaManager.h',
+            'Modules/webdatabase/OriginUsageRecord.cpp',
+            'Modules/webdatabase/OriginUsageRecord.h',
+            'Modules/webdatabase/SQLCallbackWrapper.h',
+            'Modules/webdatabase/SQLException.cpp',
+            'Modules/webdatabase/SQLException.h',
+            'Modules/webdatabase/SQLResultSet.cpp',
+            'Modules/webdatabase/SQLResultSetRowList.cpp',
+            'Modules/webdatabase/SQLStatement.cpp',
+            'Modules/webdatabase/SQLStatementSync.cpp',
+            'Modules/webdatabase/SQLStatementSync.h',
+            'Modules/webdatabase/SQLTransaction.cpp',
+            'Modules/webdatabase/SQLTransactionClient.cpp',
+            'Modules/webdatabase/SQLTransactionClient.h',
+            'Modules/webdatabase/SQLTransactionCoordinator.cpp',
+            'Modules/webdatabase/SQLTransactionCoordinator.h',
+            'Modules/webdatabase/SQLTransactionSync.cpp',
+            'Modules/webdatabase/SQLTransactionSync.h',
+            'Modules/webdatabase/SQLTransactionSyncCallback.h',
+            'Modules/webdatabase/WorkerContextSQLDatabase.cpp',
+            'Modules/webdatabase/WorkerContextSQLDatabase.h',
+            'Modules/webdatabase/chromium/DatabaseObserver.h',
+            'Modules/webdatabase/chromium/DatabaseTrackerChromium.cpp',
+            'Modules/webdatabase/chromium/QuotaTracker.cpp',
+            'Modules/webdatabase/chromium/QuotaTracker.h',
+            'Modules/webdatabase/chromium/SQLTransactionClientChromium.cpp',
+            'Modules/websockets/CloseEvent.h',
+            'Modules/websockets/ThreadableWebSocketChannel.cpp',
+            'Modules/websockets/ThreadableWebSocketChannel.h',
+            'Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp',
+            'Modules/websockets/ThreadableWebSocketChannelClientWrapper.h',
+            'Modules/websockets/WebSocket.cpp',
+            'Modules/websockets/WebSocket.h',
+            'Modules/websockets/WebSocketChannel.cpp',
+            'Modules/websockets/WebSocketChannel.h',
+            'Modules/websockets/WebSocketChannelClient.h',
+            'Modules/websockets/WebSocketDeflateFramer.cpp',
+            'Modules/websockets/WebSocketDeflateFramer.h',
+            'Modules/websockets/WebSocketDeflater.cpp',
+            'Modules/websockets/WebSocketDeflater.h',
+            'Modules/websockets/WebSocketExtensionDispatcher.cpp',
+            'Modules/websockets/WebSocketExtensionDispatcher.h',
+            'Modules/websockets/WebSocketExtensionProcessor.h',
+            'Modules/websockets/WebSocketFrame.h',
+            'Modules/websockets/WebSocketHandshake.cpp',
+            'Modules/websockets/WebSocketHandshake.h',
+            'Modules/websockets/WebSocketHandshakeRequest.cpp',
+            'Modules/websockets/WebSocketHandshakeRequest.h',
+            'Modules/websockets/WebSocketHandshakeResponse.cpp',
+            'Modules/websockets/WebSocketHandshakeResponse.h',
+            'Modules/websockets/WorkerThreadableWebSocketChannel.cpp',
+            'Modules/websockets/WorkerThreadableWebSocketChannel.h',
             'accessibility/AXObjectCache.cpp',
             'accessibility/AccessibilityARIAGrid.cpp',
             'accessibility/AccessibilityARIAGrid.h',
@@ -1837,7 +2034,6 @@
             'bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp',
             'bindings/v8/custom/V8DocumentCustom.cpp',
             'bindings/v8/custom/V8DocumentLocationCustom.cpp',
-            'bindings/v8/custom/V8ElementCustom.cpp',
             'bindings/v8/custom/V8EntryCustom.cpp',
             'bindings/v8/custom/V8EntrySyncCustom.cpp',
             'bindings/v8/custom/V8EventCustom.cpp',
@@ -2108,6 +2304,8 @@
             'css/StyleMedia.h',
             'css/StylePropertySet.cpp',
             'css/StylePropertySet.h',
+            'css/StyleRule.cpp',
+            'css/StyleRule.h',
             'css/StyleSheet.cpp',
             'css/StyleSheet.h',
             'css/StyleSheetList.cpp',
@@ -2225,6 +2423,8 @@
             'editing/qt/SmartReplaceQt.cpp',
             'editing/visible_units.cpp',
             'editing/wx/EditorWx.cpp',
+            'fileapi/AsyncFileStream.cpp',
+            'fileapi/AsyncFileStream.h',
             'fileapi/AsyncFileWriter.h',
             'fileapi/AsyncFileWriterClient.h',
             'fileapi/Blob.cpp',
@@ -2282,8 +2482,6 @@
             'fileapi/FileReaderLoaderClient.h',
             'fileapi/FileReaderSync.cpp',
             'fileapi/FileReaderSync.h',
-            'fileapi/FileStreamProxy.cpp',
-            'fileapi/FileStreamProxy.h',
             'fileapi/FileSystemCallback.h',
             'fileapi/FileSystemCallbacks.cpp',
             'fileapi/FileSystemCallbacks.h',
@@ -2299,6 +2497,8 @@
             'fileapi/FileWriterSync.cpp',
             'fileapi/FileWriterSync.h',
             'fileapi/WebKitFlags.h',
+            'fileapi/WorkerContextFileSystem.cpp',
+            'fileapi/WorkerContextFileSystem.h',
             'fileapi/LocalFileSystem.cpp',
             'fileapi/LocalFileSystem.h',
             'fileapi/Metadata.h',
@@ -2580,33 +2780,6 @@
             'mathml/MathMLMathElement.h',
             'mathml/MathMLTextElement.cpp',
             'mathml/MathMLTextElement.h',
-            'mediastream/LocalMediaStream.cpp',
-            'mediastream/LocalMediaStream.h',
-            'mediastream/MediaStream.cpp',
-            'mediastream/MediaStream.h',
-            'mediastream/MediaStreamEvent.cpp',
-            'mediastream/MediaStreamEvent.h',
-            'mediastream/MediaStreamList.cpp',
-            'mediastream/MediaStreamList.h',
-            'mediastream/MediaStreamRegistry.cpp',
-            'mediastream/MediaStreamRegistry.h',
-            'mediastream/MediaStreamTrack.cpp',
-            'mediastream/MediaStreamTrack.h',
-            'mediastream/MediaStreamTrackList.cpp',
-            'mediastream/MediaStreamTrackList.h',
-            'mediastream/NavigatorMediaStream.cpp',
-            'mediastream/NavigatorMediaStream.h',
-            'mediastream/NavigatorUserMediaError.h',
-            'mediastream/NavigatorUserMediaErrorCallback.h',
-            'mediastream/NavigatorUserMediaSuccessCallback.h',
-            'mediastream/PeerConnection.cpp',
-            'mediastream/PeerConnection.h',
-            'mediastream/SignalingCallback.h',
-            'mediastream/UserMediaClient.h',
-            'mediastream/UserMediaController.h',
-            'mediastream/UserMediaController.cpp',
-            'mediastream/UserMediaRequest.cpp',
-            'mediastream/UserMediaRequest.h',
             'notifications/Notification.cpp',
             'notifications/Notification.h',
             'notifications/NotificationCenter.cpp',
@@ -2656,8 +2829,6 @@
             'page/NavigatorBase.h',
             'page/NavigatorRegisterProtocolHandler.cpp',
             'page/NavigatorRegisterProtocolHandler.h',
-            'page/NavigatorSupplement.cpp',
-            'page/NavigatorSupplement.h',
             'page/OriginAccessEntry.cpp',
             'page/OriginAccessEntry.h',
             'page/Page.cpp',
@@ -2665,7 +2836,6 @@
             'page/PageGroupLoadDeferrer.cpp',
             'page/PageGroupLoadDeferrer.h',
             'page/PageSerializer.cpp',
-            'page/PageSupplement.cpp',
             'page/PageVisibilityState.cpp',
             'page/Performance.cpp',
             'page/Performance.h',
@@ -2745,6 +2915,8 @@
             'page/wince/FrameWinCE.cpp',
             'page/wx/DragControllerWx.cpp',
             'page/wx/EventHandlerWx.cpp',
+            'platform/ActivePlatformGestureAnimation.cpp',
+            'platform/ActivePlatformGestureAnimation.h',
             'platform/Arena.cpp',
             'platform/Arena.h',
             'platform/AsyncFileSystem.cpp',
@@ -2790,6 +2962,7 @@
             'platform/MemoryPressureHandler.cpp',
             'platform/MIMETypeRegistry.cpp',
             'platform/Pasteboard.h',
+            'platform/PlatformGestureCurve.h',
             'platform/PlatformStrategies.cpp',
             'platform/PlatformTouchEvent.h',
             'platform/PlatformTouchPoint.h',
@@ -2821,8 +2994,12 @@
             'platform/ThreadTimers.cpp',
             'platform/ThreadTimers.h',
             'platform/Timer.cpp',
+            'platform/TouchFlingPlatformGestureCurve.cpp',
+            'platform/TouchFlingPlatformGestureCurve.h',
             'platform/UUID.cpp',
             'platform/UUID.h',
+            'platform/WheelFlingPlatformGestureCurve.cpp',
+            'platform/WheelFlingPlatformGestureCurve.h',
             'platform/Widget.cpp',
             'platform/animation/Animation.cpp',
             'platform/animation/AnimationList.cpp',
@@ -3049,6 +3226,8 @@
             'platform/graphics/FontFastPath.cpp',
             'platform/graphics/FontPlatformData.cpp',
             'platform/graphics/FontPlatformData.h',
+            'platform/graphics/FractionalLayoutRect.cpp',
+            'platform/graphics/FractionalLayoutSize.cpp',
             'platform/graphics/GeneratorGeneratedImage.cpp',
             'platform/graphics/GeneratedImage.h',
             'platform/graphics/GlyphPageTreeNode.cpp',
@@ -3207,6 +3386,8 @@
             'platform/graphics/chromium/LayerTextureSubImage.h',
             'platform/graphics/chromium/LayerTextureUpdater.h',
             'platform/graphics/chromium/MediaPlayerPrivateChromium.h',
+            'platform/graphics/chromium/ScrollbarLayerChromium.cpp',
+            'platform/graphics/chromium/ScrollbarLayerChromium.h',
             'platform/graphics/chromium/SolidColorLayerChromium.cpp',
             'platform/graphics/chromium/SolidColorLayerChromium.h',
             'platform/graphics/chromium/PlatformCanvas.cpp',
@@ -3253,9 +3434,12 @@
             'platform/graphics/chromium/WebGLLayerChromium.h',
             'platform/graphics/chromium/cc/CCActiveAnimation.cpp',
             'platform/graphics/chromium/cc/CCActiveAnimation.h',
+            'platform/graphics/chromium/cc/CCActiveGestureAnimation.cpp',
+            'platform/graphics/chromium/cc/CCActiveGestureAnimation.h',
             'platform/graphics/chromium/cc/CCAnimationCurve.cpp',
             'platform/graphics/chromium/cc/CCAnimationCurve.h',
-            'platform/graphics/chromium/cc/CCAnimationResults.h',
+            'platform/graphics/chromium/cc/CCAnimationEvents.cpp',
+            'platform/graphics/chromium/cc/CCAnimationEvents.h',
             'platform/graphics/chromium/cc/CCCanvasDrawQuad.cpp',
             'platform/graphics/chromium/cc/CCCanvasDrawQuad.h',
             'platform/graphics/chromium/cc/CCCanvasLayerImpl.cpp',
@@ -3270,6 +3454,7 @@
             'platform/graphics/chromium/cc/CCDrawQuad.h',
             'platform/graphics/chromium/cc/CCFrameRateController.cpp',
             'platform/graphics/chromium/cc/CCFrameRateController.h',
+            'platform/graphics/chromium/cc/CCGestureCurve.h',
             'platform/graphics/chromium/cc/CCHeadsUpDisplay.cpp',
             'platform/graphics/chromium/cc/CCHeadsUpDisplay.h',
             'platform/graphics/chromium/cc/CCInputHandler.h',
@@ -3279,6 +3464,7 @@
             'platform/graphics/chromium/cc/CCLayerAnimationController.cpp',
             'platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h',
             'platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp',
+            'platform/graphics/chromium/cc/CCLayerAnimationDelegate.h',
             'platform/graphics/chromium/cc/CCLayerImpl.cpp',
             'platform/graphics/chromium/cc/CCLayerImpl.h',
             'platform/graphics/chromium/cc/CCLayerIterator.cpp',
@@ -3320,6 +3506,8 @@
             'platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp',
             'platform/graphics/chromium/cc/CCSchedulerStateMachine.h',
             'platform/graphics/chromium/cc/CCScopedThreadProxy.h',
+            'platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp',
+            'platform/graphics/chromium/cc/CCScrollbarLayerImpl.h',
             'platform/graphics/chromium/cc/CCSharedQuadState.cpp',
             'platform/graphics/chromium/cc/CCSharedQuadState.h',
             'platform/graphics/chromium/cc/CCSingleThreadProxy.cpp',
@@ -3332,6 +3520,8 @@
             'platform/graphics/chromium/cc/CCTextureUpdater.h',
             'platform/graphics/chromium/cc/CCTileDrawQuad.cpp',
             'platform/graphics/chromium/cc/CCTileDrawQuad.h',
+            'platform/graphics/chromium/cc/CCTimingFunction.cpp',
+            'platform/graphics/chromium/cc/CCTimingFunction.h',
             'platform/graphics/chromium/cc/CCThread.h',
             'platform/graphics/chromium/cc/CCThreadProxy.cpp',
             'platform/graphics/chromium/cc/CCThreadProxy.h',
@@ -3856,12 +4046,11 @@
             'platform/mac/Language.mm',
             'platform/mac/LocalCurrentGraphicsContext.h',
             'platform/mac/LocalCurrentGraphicsContext.mm',
-            'platform/mac/LocalizedStringsMac.mm',
+            'platform/mac/LocalizedStringsMac.cpp',
             'platform/mac/LoggingMac.mm',
             'platform/mac/MIMETypeRegistryMac.mm',
             'platform/mac/NSScrollerImpDetails.h',
             'platform/mac/NSScrollerImpDetails.mm',
-            'platform/mac/PasteboardHelper.h',
             'platform/mac/PasteboardMac.mm',
             'platform/mac/PlatformClockCA.cpp',
             'platform/mac/PlatformScreenMac.mm',
@@ -4068,14 +4257,11 @@
             'platform/qt/PlatformTouchEventQt.cpp',
             'platform/qt/PlatformTouchPointQt.cpp',
             'platform/qt/QWebPageClient.h',
-            'platform/qt/QtStyleOptionWebComboBox.h',
             'platform/qt/RenderThemeQt.cpp',
             'platform/qt/RenderThemeQt.h',
             'platform/qt/ScreenQt.cpp',
             'platform/qt/ScrollViewQt.cpp',
-            'platform/qt/ScrollbarQt.cpp',
             'platform/qt/ScrollbarThemeQt.cpp',
-            'platform/qt/ScrollbarThemeQt.h',
             'platform/qt/SharedBufferQt.cpp',
             'platform/qt/SharedTimerQt.cpp',
             'platform/qt/SoundQt.cpp',
@@ -4106,6 +4292,7 @@
             'platform/text/LocalizedDateNone.cpp',
             'platform/text/LocalizedNumber.h',
             'platform/text/LocalizedNumberICU.cpp',
+            'platform/text/LocalizedNumberICU.h',
             'platform/text/LocalizedNumberNone.cpp',
             'platform/text/ParserUtilities.h',
             'platform/text/QuotedPrintable.h',
@@ -4362,8 +4549,6 @@
             'rendering/RenderCounter.h',
             'rendering/RenderDeprecatedFlexibleBox.cpp',
             'rendering/RenderDeprecatedFlexibleBox.h',
-            'rendering/RenderDetails.cpp',
-            'rendering/RenderDetails.h',
             'rendering/RenderDetailsMarker.cpp',
             'rendering/RenderDetailsMarker.h',
             'rendering/RenderEmbeddedObject.cpp',
@@ -4445,8 +4630,6 @@
             'rendering/RenderSelectionInfo.h',
             'rendering/RenderSlider.cpp',
             'rendering/RenderSlider.h',
-            'rendering/RenderSummary.cpp',
-            'rendering/RenderSummary.h',
             'rendering/RenderTable.cpp',
             'rendering/RenderTable.h',
             'rendering/RenderTableCaption.cpp',
@@ -4546,6 +4729,7 @@
             'rendering/style/StyleFlexibleBoxData.cpp',
             'rendering/style/StyleGeneratedImage.cpp',
             'rendering/style/StyleGridData.cpp',
+            'rendering/style/StyleGridItemData.cpp',
             'rendering/style/StyleInheritedData.cpp',
             'rendering/style/StyleMarqueeData.cpp',
             'rendering/style/StyleMultiColData.cpp',
@@ -4572,6 +4756,8 @@
             'rendering/svg/SVGRenderSupport.h',
             'rendering/svg/SVGRenderTreeAsText.cpp',
             'rendering/svg/SVGRenderTreeAsText.h',
+            'rendering/svg/SVGRenderingContext.cpp',
+            'rendering/svg/SVGRenderingContext.h',
             'rendering/svg/SVGResources.cpp',
             'rendering/svg/SVGResources.h',
             'rendering/svg/SVGResourcesCache.cpp',
@@ -4579,8 +4765,6 @@
             'rendering/svg/SVGResourcesCycleSolver.h',
             'rendering/svg/SVGRootInlineBox.cpp',
             'rendering/svg/SVGRootInlineBox.h',
-            'rendering/svg/SVGShadowTreeElements.cpp',
-            'rendering/svg/SVGShadowTreeElements.h',
             'rendering/svg/SVGTextChunk.cpp',
             'rendering/svg/SVGTextChunk.h',
             'rendering/svg/SVGTextChunkBuilder.cpp',
@@ -4604,116 +4788,6 @@
             'rendering/svg/SVGTextQuery.h',
             'rendering/svg/SVGTextRunRenderingContext.cpp',
             'rendering/svg/SVGTextRunRenderingContext.h',
-            'storage/AbstractDatabase.cpp',
-            'storage/ChangeVersionWrapper.cpp',
-            'storage/ChangeVersionWrapper.h',
-            'storage/DOMWindowSQLDatabase.cpp',
-            'storage/DOMWindowSQLDatabase.h',
-            'storage/Database.cpp',
-            'storage/DatabaseAuthorizer.cpp',
-            'storage/DatabaseAuthorizer.h',
-            'storage/DatabaseCallback.h',
-            'storage/DatabaseSync.cpp',
-            'storage/DatabaseSync.h',
-            'storage/DatabaseTask.cpp',
-            'storage/DatabaseTask.h',
-            'storage/DatabaseThread.cpp',
-            'storage/DatabaseThread.h',
-            'storage/DatabaseTracker.cpp',
-            'storage/IDBAny.cpp',
-            'storage/IDBAny.h',
-            'storage/IDBBackingStore.h',
-            'storage/IDBCallbacks.h',
-            'storage/IDBCursor.cpp',
-            'storage/IDBCursor.h',
-            'storage/IDBCursorBackendImpl.cpp',
-            'storage/IDBCursorBackendImpl.h',
-            'storage/IDBCursorBackendInterface.h',
-            'storage/IDBCursorWithValue.cpp',
-            'storage/IDBCursorWithValue.h',
-            'storage/IDBDatabase.cpp',
-            'storage/IDBDatabase.h',
-            'storage/IDBDatabaseBackendImpl.cpp',
-            'storage/IDBDatabaseBackendImpl.h',
-            'storage/IDBDatabaseBackendInterface.h',
-            'storage/IDBDatabaseCallbacks.h',
-            'storage/IDBDatabaseCallbacks.h',
-            'storage/IDBDatabaseCallbacksImpl.cpp',
-            'storage/IDBDatabaseCallbacksImpl.h',
-            'storage/IDBDatabaseError.h',
-            'storage/IDBDatabaseException.cpp',
-            'storage/IDBDatabaseException.h',
-            'storage/IDBEventDispatcher.cpp',
-            'storage/IDBEventDispatcher.h',
-            'storage/IDBFactory.cpp',
-            'storage/IDBFactory.h',
-            'storage/IDBFactoryBackendImpl.cpp',
-            'storage/IDBFactoryBackendImpl.h',
-            'storage/IDBFactoryBackendInterface.cpp',
-            'storage/IDBFactoryBackendInterface.h',
-            'storage/IDBIndex.cpp',
-            'storage/IDBIndex.h',
-            'storage/IDBIndexBackendImpl.cpp',
-            'storage/IDBIndexBackendImpl.h',
-            'storage/IDBIndexBackendInterface.h',
-            'storage/IDBKey.cpp',
-            'storage/IDBKey.h',
-            'storage/IDBKeyPath.cpp',
-            'storage/IDBKeyPath.h',
-            'storage/IDBKeyPathBackendImpl.cpp',
-            'storage/IDBKeyPathBackendImpl.h',
-            'storage/IDBKeyRange.cpp',
-            'storage/IDBKeyRange.h',
-            'storage/IDBLevelDBCoding.cpp',
-            'storage/IDBLevelDBCoding.h',
-            'storage/IDBLevelDBBackingStore.cpp',
-            'storage/IDBLevelDBBackingStore.h',
-            'storage/IDBObjectStore.cpp',
-            'storage/IDBObjectStore.h',
-            'storage/IDBObjectStoreBackendImpl.cpp',
-            'storage/IDBObjectStoreBackendImpl.h',
-            'storage/IDBObjectStoreBackendInterface.h',
-            'storage/IDBPendingTransactionMonitor.cpp',
-            'storage/IDBPendingTransactionMonitor.h',
-            'storage/IDBRequest.cpp',
-            'storage/IDBRequest.h',
-            'storage/IDBTracing.h',
-            'storage/IDBTransaction.cpp',
-            'storage/IDBTransaction.h',
-            'storage/IDBTransactionBackendImpl.cpp',
-            'storage/IDBTransactionBackendImpl.h',
-            'storage/IDBTransactionBackendInterface.h',
-            'storage/IDBTransactionCallbacks.h',
-            'storage/IDBTransactionCoordinator.cpp',
-            'storage/IDBTransactionCoordinator.h',
-            'storage/IDBVersionChangeEvent.cpp',
-            'storage/IDBVersionChangeEvent.h',
-            'storage/IDBVersionChangeRequest.cpp',
-            'storage/IDBVersionChangeRequest.h',
-            'storage/StorageTask.cpp',
-            'storage/StorageTask.h',
-            'storage/StorageThread.cpp',
-            'storage/StorageThread.h',
-            'storage/OriginQuotaManager.cpp',
-            'storage/OriginQuotaManager.h',
-            'storage/OriginUsageRecord.cpp',
-            'storage/OriginUsageRecord.h',
-            'storage/SQLCallbackWrapper.h',
-            'storage/SQLException.cpp',
-            'storage/SQLException.h',
-            'storage/SQLResultSet.cpp',
-            'storage/SQLResultSetRowList.cpp',
-            'storage/SQLStatement.cpp',
-            'storage/SQLStatementSync.cpp',
-            'storage/SQLStatementSync.h',
-            'storage/SQLTransaction.cpp',
-            'storage/SQLTransactionClient.cpp',
-            'storage/SQLTransactionClient.h',
-            'storage/SQLTransactionCoordinator.cpp',
-            'storage/SQLTransactionCoordinator.h',
-            'storage/SQLTransactionSync.cpp',
-            'storage/SQLTransactionSync.h',
-            'storage/SQLTransactionSyncCallback.h',
             'storage/Storage.cpp',
             'storage/Storage.h',
             'storage/StorageArea.h',
@@ -4738,14 +4812,13 @@
             'storage/StorageNamespaceImpl.h',
             'storage/StorageSyncManager.cpp',
             'storage/StorageSyncManager.h',
+            'storage/StorageTask.cpp',
+            'storage/StorageTask.h',
+            'storage/StorageThread.cpp',
+            'storage/StorageThread.h',
             'storage/StorageTracker.cpp',
-            'storage/chromium/DatabaseObserver.h',
-            'storage/chromium/DatabaseTrackerChromium.cpp',
             'storage/chromium/IDBFactoryBackendInterface.cpp',
             'storage/chromium/IDBKeyPathBackendImpl.cpp',
-            'storage/chromium/QuotaTracker.cpp',
-            'storage/chromium/QuotaTracker.h',
-            'storage/chromium/SQLTransactionClientChromium.cpp',
             'storage/wince/DatabaseThreadWinCE.cpp',
             'storage/wince/DatabaseThreadWinCE.h',
             'storage/wince/StorageThreadWinCE.cpp',
@@ -4827,30 +4900,6 @@
             'webaudio/WaveShaperNode.h',
             'webaudio/WaveShaperProcessor.cpp',
             'webaudio/WaveShaperProcessor.h',
-            'websockets/CloseEvent.h',
-            'websockets/ThreadableWebSocketChannel.cpp',
-            'websockets/ThreadableWebSocketChannel.h',
-            'websockets/ThreadableWebSocketChannelClientWrapper.cpp',
-            'websockets/ThreadableWebSocketChannelClientWrapper.h',
-            'websockets/WebSocket.cpp',
-            'websockets/WebSocket.h',
-            'websockets/WebSocketChannel.cpp',
-            'websockets/WebSocketChannel.h',
-            'websockets/WebSocketChannelClient.h',
-            'websockets/WebSocketDeflater.cpp',
-            'websockets/WebSocketDeflater.h',
-            'websockets/WebSocketExtensionDispatcher.cpp',
-            'websockets/WebSocketExtensionDispatcher.h',
-            'websockets/WebSocketExtensionProcessor.h',
-            'websockets/WebSocketFrame.h',
-            'websockets/WebSocketHandshake.cpp',
-            'websockets/WebSocketHandshake.h',
-            'websockets/WebSocketHandshakeRequest.cpp',
-            'websockets/WebSocketHandshakeRequest.h',
-            'websockets/WebSocketHandshakeResponse.cpp',
-            'websockets/WebSocketHandshakeResponse.h',
-            'websockets/WorkerThreadableWebSocketChannel.cpp',
-            'websockets/WorkerThreadableWebSocketChannel.h',
             'workers/AbstractWorker.cpp',
             'workers/AbstractWorker.h',
             'workers/DedicatedWorkerContext.cpp',
@@ -4999,6 +5048,7 @@
             'dom/CompositionEvent.h',
             'dom/ContainerNode.cpp',
             'dom/ContainerNodeAlgorithms.h',
+            'dom/ContextDestructionObserver.cpp',
             'dom/CrossThreadTask.h',
             'dom/CustomEvent.cpp',
             'dom/CustomEvent.h',
@@ -5128,6 +5178,8 @@
             'dom/Range.cpp',
             'dom/RangeException.cpp',
             'dom/RangeException.h',
+            'dom/RegionNodeList.cpp',
+            'dom/RegionNodeList.h',
             'dom/RawDataDocumentParser.h',
             'dom/RegisteredEventListener.cpp',
             'dom/RequestAnimationFrameCallback.h',
@@ -5147,8 +5199,8 @@
             'dom/SelectorQuery.h',
             'dom/ShadowRoot.cpp',
             'dom/ShadowRoot.h',
-            'dom/ShadowRootList.cpp',
-            'dom/ShadowRootList.h',
+            'dom/ShadowTree.cpp',
+            'dom/ShadowTree.h',
             'dom/SpaceSplitString.cpp',
             'dom/StaticHashSetNodeList.cpp',
             'dom/StaticHashSetNodeList.h',
@@ -5207,6 +5259,8 @@
             'html/BaseButtonInputType.h',
             'html/BaseCheckableInputType.cpp',
             'html/BaseCheckableInputType.h',
+            'html/BaseClickableWithKeyInputType.cpp',
+            'html/BaseClickableWithKeyInputType.h',
             'html/BaseDateAndTimeInputType.cpp',
             'html/BaseDateAndTimeInputType.h',
             'html/BaseTextInputType.cpp',
@@ -5407,6 +5461,7 @@
             'html/ImageInputType.cpp',
             'html/ImageInputType.h',
             'html/InputType.cpp',
+            'html/LabelableElement.cpp',
             'html/LabelsNodeList.cpp',
             'html/LabelsNodeList.h',
             'html/LinkRelAttribute.cpp',
@@ -5479,6 +5534,8 @@
             'html/canvas/CheckedInt.h',
             'html/canvas/DataView.cpp',
             'html/canvas/DataView.h',
+            'html/canvas/EXTTextureFilterAnisotropic.cpp',
+            'html/canvas/EXTTextureFilterAnisotropic.h',
             'html/canvas/OESStandardDerivatives.cpp',
             'html/canvas/OESStandardDerivatives.h',
             'html/canvas/OESTextureFloat.cpp',
@@ -5665,8 +5722,6 @@
             'rendering/svg/RenderSVGResourceSolidColor.h',
             'rendering/svg/RenderSVGRoot.cpp',
             'rendering/svg/RenderSVGRoot.h',
-            'rendering/svg/RenderSVGShadowTreeRootContainer.cpp',
-            'rendering/svg/RenderSVGShadowTreeRootContainer.h',
             'rendering/svg/RenderSVGShape.cpp',
             'rendering/svg/RenderSVGShape.h',
             'rendering/svg/RenderSVGTSpan.cpp',
@@ -5694,6 +5749,8 @@
             'rendering/svg/SVGRenderSupport.h',
             'rendering/svg/SVGRenderTreeAsText.cpp',
             'rendering/svg/SVGRenderTreeAsText.h',
+            'rendering/svg/SVGRenderingContext.cpp',
+            'rendering/svg/SVGRenderingContext.h',
             'rendering/svg/SVGResources.cpp',
             'rendering/svg/SVGResources.h',
             'rendering/svg/SVGResourcesCache.cpp',
@@ -5701,8 +5758,6 @@
             'rendering/svg/SVGResourcesCycleSolver.h',
             'rendering/svg/SVGRootInlineBox.cpp',
             'rendering/svg/SVGRootInlineBox.h',
-            'rendering/svg/SVGShadowTreeElements.cpp',
-            'rendering/svg/SVGShadowTreeElements.h',
             'rendering/svg/SVGTextChunk.cpp',
             'rendering/svg/SVGTextChunk.h',
             'rendering/svg/SVGTextChunkBuilder.cpp',
@@ -6219,6 +6274,7 @@
             'inspector/front-end/Script.js',
             'inspector/front-end/ScriptFormatter.js',
             'inspector/front-end/ScriptFormatterWorker.js',
+            'inspector/front-end/ScriptMapping.js',
             'inspector/front-end/ScriptsNavigator.js',
             'inspector/front-end/ScriptsPanel.js',
             'inspector/front-end/ScriptsSearchScope.js',
@@ -6248,8 +6304,9 @@
             'inspector/front-end/TextEditorModel.js',
             'inspector/front-end/TextPrompt.js',
             'inspector/front-end/TextViewer.js',
-            'inspector/front-end/TimelineAgent.js',
             'inspector/front-end/TimelineManager.js',
+            'inspector/front-end/TimelineModel.js',
+            'inspector/front-end/TimelinePresentationModel.js',
             'inspector/front-end/TimelineOverviewPane.js',
             'inspector/front-end/TimelineGrid.js',
             'inspector/front-end/TimelinePanel.js',
@@ -7166,6 +7223,8 @@
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSErrorCallback.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSErrorEvent.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSErrorEvent.h',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSEXTTextureFilterAnisotropic.cpp',
+            '<(PRODUCT_DIR)/DerivedSources/WebCore/JSEXTTextureFilterAnisotropic.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSEvent.cpp',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSEvent.h',
             '<(PRODUCT_DIR)/DerivedSources/WebCore/JSEventException.cpp',
diff --git a/Source/WebCore/WebCore.order b/Source/WebCore/WebCore.order
index 952c2992b..0cbed9ef6 100644
--- a/Source/WebCore/WebCore.order
+++ b/Source/WebCore/WebCore.order
@@ -78,7 +78,6 @@ __ZN7WebCore12IconDatabase21wasExcludedFromBackupEv
 __ZN7WebCore12IconDatabase8importedEv
 __ZN7WebCore12IconDatabase16performURLImportEv
 __ZN7WebCore15SQLiteStatement13getColumnTextEi
-__ZN7WebCore22protocolIsInHTTPFamilyERKN3WTF6StringE
 __ZN7WebCore13PageURLRecordC1ERKN3WTF6StringE
 __ZN7WebCore12IconDatabase21getOrCreateIconRecordERKN3WTF6StringE
 __ZN7WebCore10IconRecordC1ERKN3WTF6StringE
@@ -19684,7 +19683,6 @@ __ZN7WebCore23jsHTMLAnchorElementHashEPN3JSC9ExecStateENS0_7JSValueERKNS0_10Iden
 __ZNK7WebCore17HTMLAnchorElement4hashEv
 __ZN7WebCore48jsHTMLAnchorElementPrototypeFunctionGetParameterEPN3JSC9ExecStateE
 __ZNK7WebCore17HTMLAnchorElement12getParameterERKN3WTF6StringE
-__ZNK7WebCore4KURL17copyParsedQueryToERN3WTF7HashMapINS1_6StringES3_NS1_10StringHashENS1_10HashTraitsIS3_EES6_EE
 __ZN7WebCore25jsHTMLAnchorElementOriginEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
 __ZNK7WebCore17HTMLAnchorElement6originEv
 __ZN7WebCore23jsHTMLAnchorElementTextEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
diff --git a/Source/WebCore/WebCore.pri b/Source/WebCore/WebCore.pri
index af9941a25..bdcd10780 100644
--- a/Source/WebCore/WebCore.pri
+++ b/Source/WebCore/WebCore.pri
@@ -19,6 +19,9 @@ WEBCORE_GENERATED_SOURCES_DIR = $${ROOT_BUILD_DIR}/Source/WebCore/$${GENERATED_S
 INCLUDEPATH += \
     $$SOURCE_DIR \
     $$SOURCE_DIR/Modules/geolocation \
+    $$SOURCE_DIR/Modules/indexeddb \
+    $$SOURCE_DIR/Modules/webdatabase \
+    $$SOURCE_DIR/Modules/websockets \
     $$SOURCE_DIR/accessibility \
     $$SOURCE_DIR/bindings \
     $$SOURCE_DIR/bindings/generic \
@@ -182,18 +185,21 @@ contains(DEFINES, ENABLE_WEBGL=1) {
     !contains(QT_CONFIG, opengl) {
         error( "This configuration needs an OpenGL enabled Qt. Your Qt is missing OpenGL.")
     }
-    QT *= opengl
 }
 
 contains(CONFIG, texmap) {
     DEFINES += WTF_USE_TEXTURE_MAPPER=1
     !win32-*:contains(QT_CONFIG, opengl) {
-        DEFINES += WTF_USE_TEXTURE_MAPPER_GL
-        QT *= opengl
+        DEFINES += WTF_USE_TEXTURE_MAPPER_GL=1
         contains(QT_CONFIG, opengles2): LIBS += -lEGL
     }
 }
 
+contains(DEFINES, WTF_USE_TEXTURE_MAPPER_GL=1)|contains(DEFINES, ENABLE_WEBGL=1) {
+    # Only Qt 4 needs the opengl module, for Qt 5 everything we need is part of QtGui.
+    haveQt(4): QT *= opengl
+}
+
 !system-sqlite:exists( $${SQLITE3SRCDIR}/sqlite3.c ) {
     INCLUDEPATH += $${SQLITE3SRCDIR}
     DEFINES += SQLITE_CORE SQLITE_OMIT_LOAD_EXTENSION SQLITE_OMIT_COMPLETE
@@ -203,6 +209,28 @@ contains(CONFIG, texmap) {
     LIBS += -lsqlite3
 }
 
+contains(DEFINES, WTF_USE_QT_IMAGE_DECODER=0) {
+    INCLUDEPATH += \
+        $$SOURCE_DIR/platform/image-decoders/bmp \
+        $$SOURCE_DIR/platform/image-decoders/gif \
+        $$SOURCE_DIR/platform/image-decoders/ico \
+        $$SOURCE_DIR/platform/image-decoders/jpeg \
+        $$SOURCE_DIR/platform/image-decoders/png
+
+    haveQt(5) {
+        # Qt5 allows us to use config tests to check for the presence of these libraries
+        !contains(config_test_libjpeg, yes): error("JPEG library not found!")
+        !contains(config_test_libpng, yes): error("PNG 1.2 library not found!")
+    }
+
+    LIBS += -ljpeg -lpng12
+
+    contains(DEFINES, WTF_USE_WEBP=1) {
+        INCLUDEPATH += $$SOURCE_DIR/platform/image-decoders/webp
+        LIBS += -lwebp
+    }
+}
+
 win32-*|wince* {
     DLLDESTDIR = $${ROOT_BUILD_DIR}/bin
 
diff --git a/Source/WebCore/WebCore.vcproj/MigrateScripts b/Source/WebCore/WebCore.vcproj/MigrateScripts
index 4cdb17314..9cb049552 100644
--- a/Source/WebCore/WebCore.vcproj/MigrateScripts
+++ b/Source/WebCore/WebCore.vcproj/MigrateScripts
@@ -31,7 +31,7 @@ all : \
     $(WEBKIT_OUTPUT)/IDLStructure.pm \
     $(WEBKIT_OUTPUT)/generate-bindings.pl \
     $(WEBKIT_OUTPUT)/preprocessor.pm \
-    $(WEBKIT_OUTPUT)/resolve-supplemental.pl \
+    $(WEBKIT_OUTPUT)/preprocess-idls.pl \
 #
 
 MIGRATE_CMD = cp $< $@
diff --git a/Source/WebCore/WebCore.vcproj/WebCore.vcproj b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
index 19106c0e5..3ad09cf45 100755
--- a/Source/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/Source/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -24109,6 +24109,510 @@
 					>
 				</File>
 			</Filter>
+			<Filter
+				Name="indexeddb"
+				>
+				<File
+					RelativePath="..\Modules\indexeddb\DOMWindowIndexedDatabase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\DOMWindowIndexedDatabase.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBAny.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBAny.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBCallbacks.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBCursor.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBCursor.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBCursorBackendImpl.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBCursorBackendImpl.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBCursorBackendInterface.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBDatabase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBDatabase.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBDatabaseBackendImpl.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBDatabaseBackendImpl.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBDatabaseBackendInterface.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBDatabaseError.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBDatabaseException.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBFactory.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBFactory.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBFactoryBackendImpl.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBFactoryBackendImpl.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBFactoryBackendInterface.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBFactoryBackendInterface.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBIndex.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBIndex.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBIndexBackendImpl.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBIndexBackendImpl.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBIndexBackendInterface.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBKey.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBKey.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBKeyRange.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBKeyRange.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBObjectStore.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBObjectStore.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBObjectStoreBackendImpl.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBObjectStoreBackendImpl.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBObjectStoreBackendInterface.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBRequest.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBRequest.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBTransaction.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\IDBTransaction.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\PageGroupIndexedDatabase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\PageGroupIndexedDatabase.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\WorkerContextIndexedDatabase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\indexeddb\WorkerContextIndexedDatabase.h"
+					>
+				</File>
+			</Filter>
+			<Filter
+				Name="webdatabase"
+				>
+				<File
+					RelativePath="..\Modules\webdatabase\AbstractDatabase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\AbstractDatabase.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\ChangeVersionWrapper.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\ChangeVersionWrapper.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\Database.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\Database.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseAuthorizer.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseAuthorizer.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseContext.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseContext.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseSync.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseSync.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseTask.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseTask.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseThread.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseThread.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseTracker.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DatabaseTracker.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DOMWindowSQLDatabase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\DOMWindowSQLDatabase.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\OriginQuotaManager.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\OriginQuotaManager.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\OriginUsageRecord.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\OriginUsageRecord.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLCallbackWrapper.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLError.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLException.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLException.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLResultSet.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLResultSet.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLResultSetRowList.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLResultSetRowList.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLStatement.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLStatement.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLStatementCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLStatementErrorCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLStatementSync.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLStatementSync.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransaction.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransaction.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionClient.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionClient.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionCoordinator.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionCoordinator.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionErrorCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionSync.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionSync.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\SQLTransactionSyncCallback.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\WorkerContextSQLDatabase.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\webdatabase\WorkerContextSQLDatabase.h"
+					>
+				</File>
+			</Filter>
+			<Filter
+				Name="websockets"
+				>
+				<File
+					RelativePath="..\Modules\websockets\CloseEvent.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\ThreadableWebSocketChannel.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\ThreadableWebSocketChannel.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\ThreadableWebSocketChannelClientWrapper.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\ThreadableWebSocketChannelClientWrapper.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocket.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocket.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketChannel.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketChannel.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketChannelClient.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketDeflateFramer.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketDeflateFramer.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketDeflater.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketDeflater.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketExtensionDispatcher.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketExtensionDispatcher.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketExtensionProcessor.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketFrame.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketHandshake.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketHandshake.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketHandshakeRequest.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketHandshakeRequest.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketHandshakeResponse.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WebSocketHandshakeResponse.h"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WorkerThreadableWebSocketChannel.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\Modules\websockets\WorkerThreadableWebSocketChannel.h"
+					>
+				</File>
+			</Filter>
 		</Filter>
 		<Filter
 			Name="accessibility"
@@ -25610,14 +26114,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\page\NavigatorSupplement.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\page\NavigatorSupplement.h"
-				>
-			</File>
-			<File
 				RelativePath="..\page\OriginAccessEntry.cpp"
 				>
 			</File>
@@ -25654,14 +26150,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\page\PageSupplement.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\page\PageSupplement.h"
-				>
-			</File>
-			<File
 				RelativePath="..\page\PageVisibilityState.cpp"
 				>
 			</File>
@@ -25710,6 +26198,18 @@
 				>
 			</File>
 			<File
+				RelativePath="..\page\scrolling\ScrollingCoordinator.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\page\scrolling\ScrollingCoordinator.h"
+				>
+			</File>
+			<File
+				RelativePath="..\page\scrolling\ScrollingCoordinatorNone.cpp"
+				>
+			</File>
+			<File
 				RelativePath="..\page\SecurityOrigin.cpp"
 				>
 			</File>
@@ -25833,18 +26333,6 @@
 				RelativePath="..\page\WorkerNavigator.h"
 				>
 			</File>
-			<File
-				RelativePath="..\page\scrolling\ScrollingCoordinator.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\page\scrolling\ScrollingCoordinator.h"
-				>
-			</File>
-			<File
-				RelativePath="..\page\scrolling\ScrollingCoordinatorNone.cpp"
-				>
-			</File>
 			<Filter
 				Name="win"
 				>
@@ -26299,14 +26787,82 @@
 				<File
 					RelativePath="..\loader\appcache\ApplicationCache.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\loader\appcache\ApplicationCache.h"
 					>
 				</File>
 				<File
+					RelativePath="..\loader\appcache\ApplicationCacheAllInOne.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
 					RelativePath="..\loader\appcache\ApplicationCacheGroup.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\loader\appcache\ApplicationCacheGroup.h"
@@ -26315,6 +26871,22 @@
 				<File
 					RelativePath="..\loader\appcache\ApplicationCacheHost.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\loader\appcache\ApplicationCacheHost.h"
@@ -26323,6 +26895,22 @@
 				<File
 					RelativePath="..\loader\appcache\ApplicationCacheResource.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\loader\appcache\ApplicationCacheResource.h"
@@ -26331,6 +26919,22 @@
 				<File
 					RelativePath="..\loader\appcache\ApplicationCacheStorage.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\loader\appcache\ApplicationCacheStorage.h"
@@ -26550,10 +27154,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\platform\AsyncFileStream.h"
-				>
-			</File>
-			<File
 				RelativePath="..\platform\AsyncFileSystem.cpp"
 				>
 			</File>
@@ -26950,6 +27550,10 @@
 				>
 			</File>
 			<File
+				RelativePath="..\platform\ScrollbarThemeClient.h"
+				>
+			</File>
+			<File
 				RelativePath="..\platform\ScrollbarThemeComposite.cpp"
 				>
 			</File>
@@ -27605,26 +28209,6 @@
 					>
 				</File>
 				<File
-					RelativePath="..\platform\graphics\FractionalLayoutRect.cpp"
-					>
-				</File>
-				<File
-					RelativePath="..\platform\graphics\FractionalLayoutRect.h"
-					>
-				</File>
-				<File
-					RelativePath="..\platform\graphics\FractionalLayoutSize.cpp"
-					>
-				</File>
-				<File
-					RelativePath="..\platform\graphics\FractionalLayoutSize.h"
-					>
-				</File>
-				<File
-					RelativePath="..\platform\graphics\FractionalLayoutPoint.h"
-					>
-				</File>
-				<File
 					RelativePath="..\platform\graphics\FloatPoint.cpp"
 					>
 				</File>
@@ -27753,6 +28337,26 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\graphics\FractionalLayoutPoint.h"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FractionalLayoutRect.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FractionalLayoutRect.h"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FractionalLayoutSize.cpp"
+					>
+				</File>
+				<File
+					RelativePath="..\platform\graphics\FractionalLayoutSize.h"
+					>
+				</File>
+				<File
 					RelativePath="..\platform\graphics\GeneratedImage.h"
 					>
 				</File>
@@ -31729,8 +32333,60 @@
 					>
 				</File>
 				<File
+					RelativePath="..\platform\text\TextAllInOne.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
 					RelativePath="..\platform\text\TextBoundaries.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextBoundaries.h"
@@ -31743,6 +32399,22 @@
 				<File
 					RelativePath="..\platform\text\TextBreakIteratorICU.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextBreakIteratorInternalICU.h"
@@ -31759,6 +32431,22 @@
 				<File
 					RelativePath="..\platform\text\TextCodec.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextCodec.h"
@@ -31771,6 +32459,22 @@
 				<File
 					RelativePath="..\platform\text\TextCodecICU.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextCodecICU.h"
@@ -31779,6 +32483,22 @@
 				<File
 					RelativePath="..\platform\text\TextCodecLatin1.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextCodecLatin1.h"
@@ -31787,6 +32507,22 @@
 				<File
 					RelativePath="..\platform\text\TextCodecUserDefined.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextCodecUserDefined.h"
@@ -31795,6 +32531,22 @@
 				<File
 					RelativePath="..\platform\text\TextCodecUTF16.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextCodecUTF16.h"
@@ -31803,6 +32555,22 @@
 				<File
 					RelativePath="..\platform\text\TextCodecUTF8.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextCodecUTF8.h"
@@ -31815,6 +32583,22 @@
 				<File
 					RelativePath="..\platform\text\TextEncoding.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextEncoding.h"
@@ -31827,10 +32611,42 @@
 				<File
 					RelativePath="..\platform\text\TextEncodingDetectorICU.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextEncodingRegistry.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextEncodingRegistry.h"
@@ -31839,6 +32655,22 @@
 				<File
 					RelativePath="..\platform\text\TextStream.cpp"
 					>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
 				</File>
 				<File
 					RelativePath="..\platform\text\TextStream.h"
@@ -35418,12 +36250,64 @@
 				>
 			</File>
 			<File
+				RelativePath="..\css\MediaAllInOne.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
 				RelativePath="..\css\mediaControls.css"
 				>
 			</File>
 			<File
 				RelativePath="..\css\MediaFeatureNames.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\css\MediaFeatureNames.h"
@@ -35432,6 +36316,22 @@
 			<File
 				RelativePath="..\css\MediaList.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\css\MediaList.h"
@@ -35440,6 +36340,22 @@
 			<File
 				RelativePath="..\css\MediaQuery.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\css\MediaQuery.h"
@@ -35448,6 +36364,22 @@
 			<File
 				RelativePath="..\css\MediaQueryEvaluator.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\css\MediaQueryEvaluator.h"
@@ -35456,6 +36388,22 @@
 			<File
 				RelativePath="..\css\MediaQueryExp.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\css\MediaQueryExp.h"
@@ -35464,6 +36412,22 @@
 			<File
 				RelativePath="..\css\MediaQueryList.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\css\MediaQueryList.h"
@@ -35472,6 +36436,22 @@
 			<File
 				RelativePath="..\css\MediaQueryListListener.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\css\MediaQueryListListener.h"
@@ -35480,6 +36460,22 @@
 			<File
 				RelativePath="..\css\MediaQueryMatcher.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
 				RelativePath="..\css\MediaQueryMatcher.h"
@@ -35594,6 +36590,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\css\StyleRule.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\css\StyleRule.h"
+				>
+			</File>
+			<File
 				RelativePath="..\css\StyleSheet.cpp"
 				>
 			</File>
@@ -37162,62 +38166,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\RenderDetails.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="..\rendering\RenderDetails.h"
-				>
-			</File>
-			<File
 				RelativePath="..\rendering\RenderDetailsMarker.cpp"
 				>
 				<FileConfiguration
@@ -39522,62 +40470,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\RenderSummary.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="..\rendering\RenderSummary.h"
-				>
-			</File>
-			<File
 				RelativePath="..\rendering\svg\RenderSVGAllInOne.cpp"
 				>
 			</File>
@@ -40646,114 +41538,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\RenderSVGShadowTreeRootContainer.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
-				RelativePath="..\rendering\svg\RenderSVGShadowTreeRootContainer.h"
-				>
-			</File>
-			<File
-				RelativePath="..\rendering\svg\RenderSVGTransformableContainer.cpp"
-				>
-				<FileConfiguration
-					Name="Debug|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Release_Cairo_CFLite|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Debug_All|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-				<FileConfiguration
-					Name="Production|Win32"
-					ExcludedFromBuild="true"
-					>
-					<Tool
-						Name="VCCLCompilerTool"
-					/>
-				</FileConfiguration>
-			</File>
-			<File
 				RelativePath="..\rendering\svg\RenderSVGTransformableContainer.h"
 				>
 			</File>
@@ -42240,7 +43024,7 @@
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGResources.cpp"
+				RelativePath="..\rendering\svg\SVGRenderingContext.cpp"
 				>
 				<FileConfiguration
 					Name="Debug|Win32"
@@ -42292,11 +43076,11 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGResources.h"
+				RelativePath="..\rendering\svg\SVGRenderingContext.h"
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGResourcesCache.cpp"
+				RelativePath="..\rendering\svg\SVGResources.cpp"
 				>
 				<FileConfiguration
 					Name="Debug|Win32"
@@ -42348,11 +43132,11 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGResourcesCache.h"
+				RelativePath="..\rendering\svg\SVGResources.h"
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGResourcesCycleSolver.cpp"
+				RelativePath="..\rendering\svg\SVGResourcesCache.cpp"
 				>
 				<FileConfiguration
 					Name="Debug|Win32"
@@ -42404,11 +43188,11 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGResourcesCycleSolver.h"
+				RelativePath="..\rendering\svg\SVGResourcesCache.h"
 				>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGShadowTreeElements.cpp"
+				RelativePath="..\rendering\svg\SVGResourcesCycleSolver.cpp"
 				>
 				<FileConfiguration
 					Name="Debug|Win32"
@@ -42460,7 +43244,7 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\rendering\svg\SVGShadowTreeElements.h"
+				RelativePath="..\rendering\svg\SVGResourcesCycleSolver.h"
 				>
 			</File>
 			<File
@@ -43507,6 +44291,62 @@
 					>
 				</File>
 				<File
+					RelativePath="..\rendering\style\StyleGridItemData.cpp"
+					>
+					<FileConfiguration
+						Name="Debug|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Release_Cairo_CFLite|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Debug_All|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+					<FileConfiguration
+						Name="Production|Win32"
+						ExcludedFromBuild="true"
+						>
+						<Tool
+							Name="VCCLCompilerTool"
+						/>
+					</FileConfiguration>
+				</File>
+				<File
+					RelativePath="..\rendering\style\StyleGridItemData.h"
+					>
+				</File>
+				<File
 					RelativePath="..\rendering\style\StyleImage.h"
 					>
 				</File>
@@ -46814,6 +47654,62 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\ContextDestructionObserver.cpp"
+				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+			</File>
+			<File
+				RelativePath="..\dom\ContextDestructionObserver.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\CrossThreadTask.h"
 				>
 			</File>
@@ -50654,6 +51550,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\dom\RegionNodeList.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\dom\RegionNodeList.h"
+				>
+			</File>
+			<File
 				RelativePath="..\dom\RegisteredEventListener.cpp"
 				>
 				<FileConfiguration
@@ -52690,11 +53594,11 @@
 				>
 			</File>
 			<File
-				RelativePath="..\notifications\NotificationContents.h"
+				RelativePath="..\notifications\NotificationClient.h"
 				>
 			</File>
 			<File
-				RelativePath="..\notifications\NotificationPresenter.h"
+				RelativePath="..\notifications\NotificationContents.h"
 				>
 			</File>
 		</Filter>
@@ -55766,6 +56670,14 @@
 			Name="html"
 			>
 			<File
+				RelativePath="..\fileapi\AsyncFileStream.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\fileapi\AsyncFileStream.h"
+				>
+			</File>
+			<File
 				RelativePath="..\fileapi\AsyncFileWriter.h"
 				>
 			</File>
@@ -55790,6 +56702,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\html\BaseClickableWithKeyInputType.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\BaseClickableWithKeyInputType.h"
+				>
+			</File>
+			<File
 				RelativePath="..\html\BaseDateAndTimeInputType.cpp"
 				>
 			</File>
@@ -56178,14 +57098,6 @@
 				>
 			</File>
 			<File
-				RelativePath="..\fileapi\FileStreamProxy.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\fileapi\FileStreamProxy.h"
-				>
-			</File>
-			<File
 				RelativePath="..\fileapi\FileSystemCallback.h"
 				>
 			</File>
@@ -60554,6 +61466,14 @@
 				>
 			</File>
 			<File
+				RelativePath="..\html\LabelableElement.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\html\LabelableElement.h"
+				>
+			</File>
+			<File
 				RelativePath="..\html\LabelsNodeList.cpp"
 				>
 			</File>
@@ -68889,19 +69809,19 @@
 					>
 				</File>
 				<File
-					RelativePath="..\bindings\scripts\IDLParser.pm"
+					RelativePath="..\bindings\scripts\IDLAttributes.txt"
 					>
 				</File>
 				<File
-					RelativePath="..\bindings\scripts\IDLStructure.pm"
+					RelativePath="..\bindings\scripts\IDLParser.pm"
 					>
 				</File>
 				<File
-					RelativePath="..\bindings\scripts\resolve-supplemental.pl"
+					RelativePath="..\bindings\scripts\IDLStructure.pm"
 					>
 				</File>
 				<File
-					RelativePath="..\bindings\scripts\IDLAttributes.txt"
+					RelativePath="..\bindings\scripts\preprocess-idls.pl"
 					>
 				</File>
 			</Filter>
@@ -70702,370 +71622,6 @@
 			Name="storage"
 			>
 			<File
-				RelativePath="..\storage\AbstractDatabase.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\AbstractDatabase.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\ChangeVersionWrapper.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\ChangeVersionWrapper.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\Database.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\Database.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseAuthorizer.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseAuthorizer.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseCallback.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseSync.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseSync.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseTask.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseTask.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseThread.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseThread.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseTracker.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DatabaseTracker.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DOMWindowSQLDatabase.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\DOMWindowSQLDatabase.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBAny.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBAny.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBCallbacks.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBCursor.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBCursor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBCursorBackendImpl.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBCursorBackendImpl.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBCursorBackendInterface.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBDatabase.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBDatabase.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBDatabaseBackendImpl.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBDatabaseBackendImpl.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBDatabaseBackendInterface.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBDatabaseError.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBDatabaseException.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBFactory.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBFactory.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBFactoryBackendImpl.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBFactoryBackendImpl.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBFactoryBackendInterface.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBFactoryBackendInterface.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBIndex.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBIndex.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBIndexBackendImpl.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBIndexBackendImpl.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBIndexBackendInterface.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBKey.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBKey.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBKeyRange.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBKeyRange.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBObjectStore.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBObjectStore.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBObjectStoreBackendImpl.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBObjectStoreBackendImpl.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBObjectStoreBackendInterface.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBRequest.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBRequest.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBTransaction.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\IDBTransaction.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\StorageTask.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\StorageTask.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\StorageThread.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\StorageThread.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\OriginQuotaManager.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\OriginQuotaManager.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\OriginUsageRecord.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\OriginUsageRecord.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLCallbackWrapper.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLError.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLException.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLException.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLResultSet.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLResultSet.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLResultSetRowList.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLResultSetRowList.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLStatement.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLStatement.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLStatementCallback.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLStatementErrorCallback.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLStatementSync.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLStatementSync.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransaction.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransaction.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionCallback.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionClient.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionClient.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionCoordinator.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionCoordinator.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionErrorCallback.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionSync.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionSync.h"
-				>
-			</File>
-			<File
-				RelativePath="..\storage\SQLTransactionSyncCallback.h"
-				>
-			</File>
-			<File
 				RelativePath="..\storage\Storage.cpp"
 				>
 			</File>
@@ -71162,15 +71718,27 @@
 				>
 			</File>
 			<File
-				RelativePath="..\storage\StorageTracker.cpp"
+				RelativePath="..\storage\StorageTask.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\storage\StorageTracker.h"
+				RelativePath="..\storage\StorageTask.h"
+				>
+			</File>
+			<File
+				RelativePath="..\storage\StorageThread.cpp"
+				>
+			</File>
+			<File
+				RelativePath="..\storage\StorageThread.h"
+				>
+			</File>
+			<File
+				RelativePath="..\storage\StorageTracker.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\storage\VersionChangeCallback.h"
+				RelativePath="..\storage\StorageTracker.h"
 				>
 			</File>
 		</Filter>
@@ -71178,15 +71746,15 @@
 			Name="strings"
 			>
 			<File
-				RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\AtomicString.cpp"
+				RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\wtf\text\AtomicString.cpp"
 				>
 			</File>
 			<File
-				RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\StringImpl.cpp"
+				RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\wtf\text\StringImpl.cpp"
 				>
 			</File>
 			<File
-				RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\WTFString.cpp"
+				RelativePath="$(ConfigurationBuildDir)\include\private\JavaScriptCore\wtf\text\WTFString.cpp"
 				>
 			</File>
 		</Filter>
@@ -71714,7 +72282,7 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\inspector\InspectorCounters.h"
+				RelativePath="..\inspector\InspectorController.h"
 				>
 			</File>
 			<File
@@ -71738,7 +72306,7 @@
 				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\inspector\InspectorController.h"
+				RelativePath="..\inspector\InspectorCounters.h"
 				>
 			</File>
 			<File
@@ -73233,6 +73801,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\ScriptMapping.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\ScriptsNavigator.js"
 					>
 				</File>
@@ -73373,15 +73945,15 @@
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\TimelineAgent.js"
+					RelativePath="..\inspector\front-end\TimelineGrid.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\TimelineGrid.js"
+					RelativePath="..\inspector\front-end\TimelineManager.js"
 					>
 				</File>
 				<File
-					RelativePath="..\inspector\front-end\TimelineManager.js"
+					RelativePath="..\inspector\front-end\TimelineModel.js"
 					>
 				</File>
 				<File
@@ -73397,6 +73969,10 @@
 					>
 				</File>
 				<File
+					RelativePath="..\inspector\front-end\TimelinePresentationModel.js"
+					>
+				</File>
+				<File
 					RelativePath="..\inspector\front-end\Toolbar.js"
 					>
 				</File>
@@ -73439,138 +74015,166 @@
 			</Filter>
 		</Filter>
 		<Filter
-			Name="websockets"
+			Name="mathml"
 			>
 			<File
-				RelativePath="..\websockets\CloseEvent.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\ThreadableWebSocketChannel.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\ThreadableWebSocketChannel.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\ThreadableWebSocketChannelClientWrapper.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\ThreadableWebSocketChannelClientWrapper.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocket.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocket.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketChannel.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketChannel.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketChannelClient.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketDeflater.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketDeflater.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketExtensionDispatcher.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketExtensionDispatcher.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketExtensionProcessor.h"
-				>
-			</File>
-			<File
-				RelativePath="..\websockets\WebSocketFrame.h"
+				RelativePath="..\mathml\MathMLAllInOne.cpp"
 				>
+				<FileConfiguration
+					Name="Debug|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Release_Cairo_CFLite|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Debug_All|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\websockets\WebSocketHandshake.cpp"
+				RelativePath="..\mathml\MathMLElement.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\websockets\WebSocketHandshake.h"
+				RelativePath="..\mathml\MathMLElement.h"
 				>
 			</File>
 			<File
-				RelativePath="..\websockets\WebSocketHandshakeRequest.cpp"
+				RelativePath="..\mathml\MathMLInlineContainerElement.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\websockets\WebSocketHandshakeRequest.h"
+				RelativePath="..\mathml\MathMLInlineContainerElement.h"
 				>
 			</File>
 			<File
-				RelativePath="..\websockets\WebSocketHandshakeResponse.cpp"
+				RelativePath="..\mathml\MathMLMathElement.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\websockets\WebSocketHandshakeResponse.h"
+				RelativePath="..\mathml\MathMLMathElement.h"
 				>
 			</File>
 			<File
-				RelativePath="..\websockets\WorkerThreadableWebSocketChannel.cpp"
+				RelativePath="..\mathml\MathMLTextElement.cpp"
 				>
+				<FileConfiguration
+					Name="Release|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
+				<FileConfiguration
+					Name="Production|Win32"
+					ExcludedFromBuild="true"
+					>
+					<Tool
+						Name="VCCLCompilerTool"
+					/>
+				</FileConfiguration>
 			</File>
 			<File
-				RelativePath="..\websockets\WorkerThreadableWebSocketChannel.h"
+				RelativePath="..\mathml\MathMLTextElement.h"
 				>
 			</File>
 		</Filter>
 		<Filter
-			Name="mathml"
+			Name="fileapi"
 			>
 			<File
-				RelativePath="..\mathml\MathMLElement.cpp"
-				>
-			</File>
-			<File
-				RelativePath="..\mathml\MathMLElement.h"
-				>
-			</File>
-			<File
-				RelativePath="..\mathml\MathMLInlineContainerElement.cpp"
+				RelativePath="..\fileapi\DOMWindowFileSystem.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\mathml\MathMLInlineContainerElement.h"
+				RelativePath="..\fileapi\DOMWindowFileSystem.h"
 				>
 			</File>
 			<File
-				RelativePath="..\mathml\MathMLMathElement.cpp"
+				RelativePath="..\fileapi\EntryBase.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\mathml\MathMLMathElement.h"
+				RelativePath="..\fileapi\SyncCallbackHelper.h"
 				>
 			</File>
 			<File
-				RelativePath="..\mathml\MathMLTextElement.cpp"
+				RelativePath="..\fileapi\WorkerContextFileSystem.cpp"
 				>
 			</File>
 			<File
-				RelativePath="..\mathml\MathMLTextElement.h"
+				RelativePath="..\fileapi\WorkerContextFileSystem.h"
 				>
 			</File>
 		</Filter>
diff --git a/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops b/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
index 838c080a6..48621c27c 100644
--- a/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
+++ b/Source/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
@@ -7,7 +7,7 @@
 	>
 	<Tool
 		Name="VCCLCompilerTool"
-		AdditionalIncludeDirectories="&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\Modules\geolocation&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\bridge\jsc&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\fileapi&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\mathml&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\rendering\svg&quot;;&quot;$(ProjectDir)..\bindings&quot;;&quot;$(ProjectDir)..\bindings\generic&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\bindings\js\specialization&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\html\parser&quot;;&quot;$(ProjectDir)..\html\shadow&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\cache&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\mathml&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\scrolling&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\ca&quot;;&quot;$(ProjectDir)..\platform\graphics\filters&quot;;&quot;$(ProjectDir)..\platform\graphics\filters\arm&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\text\transcoder&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(ProjectDir)..\xml\parser&quot;;&quot;$(ConfigurationBuildDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\animation&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\properties&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\testing&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\zlib&quot;"
+		AdditionalIncludeDirectories="&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\Modules\geolocation&quot;;&quot;$(ProjectDir)..\Modules\indexeddb&quot;;&quot;$(ProjectDir)..\Modules\webdatabase&quot;;&quot;$(ProjectDir)..\Modules\websockets&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\bridge\jsc&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\fileapi&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\mathml&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\rendering\svg&quot;;&quot;$(ProjectDir)..\bindings&quot;;&quot;$(ProjectDir)..\bindings\generic&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\bindings\js\specialization&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\html\parser&quot;;&quot;$(ProjectDir)..\html\shadow&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\cache&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\mathml&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\scrolling&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\ca&quot;;&quot;$(ProjectDir)..\platform\graphics\filters&quot;;&quot;$(ProjectDir)..\platform\graphics\filters\arm&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\text\transcoder&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(ProjectDir)..\xml\parser&quot;;&quot;$(ConfigurationBuildDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\animation&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\properties&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\testing&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(ConfigurationBuildDir)\include&quot;;&quot;$(ConfigurationBuildDir)\include\private&quot;;&quot;$(ConfigurationBuildDir)\include\JavaScriptCore&quot;;&quot;$(ConfigurationBuildDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\zlib&quot;"
 		PreprocessorDefinitions="__WIN32__;DISABLE_3D_RENDERING;WEBCORE_CONTEXT_MENUS"
 		UsePrecompiledHeader="2"
 		PrecompiledHeaderThrough="WebCorePrefix.h"
diff --git a/Source/WebCore/WebCore.vcproj/build-generated-files.sh b/Source/WebCore/WebCore.vcproj/build-generated-files.sh
index 5660538c6..5660538c6 100644..100755
--- a/Source/WebCore/WebCore.vcproj/build-generated-files.sh
+++ b/Source/WebCore/WebCore.vcproj/build-generated-files.sh
diff --git a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
index dfd62b12d..f46ff4658 100755
--- a/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
+++ b/Source/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
@@ -20,6 +20,8 @@ mkdir 2>NUL "%CONFIGURATIONBUILDDIR%\include\WebCoreTestSupport"
 xcopy /y /d "%ProjectDir%..\config.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%CONFIGURATIONBUILDDIR%\obj\WebCore\DerivedSources\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\Modules\geolocation\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
+xcopy /y /d "%ProjectDir%..\Modules\webdatabase\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
+xcopy /y /d "%ProjectDir%..\Modules\websockets\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\accessibility\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\accessibility\win\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\inspector\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
@@ -77,7 +79,6 @@ xcopy /y /d "%ProjectDir%..\svg\graphics\*.h" "%CONFIGURATIONBUILDDIR%\include\W
 xcopy /y /d "%ProjectDir%..\svg\properties\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\svg\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\storage\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
-xcopy /y /d "%ProjectDir%..\websockets\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\workers\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\bindings\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\bindings"
 xcopy /y /d "%ProjectDir%..\ForwardingHeaders\parser\*.h" "%CONFIGURATIONBUILDDIR%\include\WebCore\ForwardingHeaders\parser"
diff --git a/Source/WebCore/WebCore.vcproj/migrate-scripts.sh b/Source/WebCore/WebCore.vcproj/migrate-scripts.sh
index d68075a88..d68075a88 100644..100755
--- a/Source/WebCore/WebCore.vcproj/migrate-scripts.sh
+++ b/Source/WebCore/WebCore.vcproj/migrate-scripts.sh
diff --git a/Source/WebCore/WebCore.xcodeproj/project.pbxproj b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
index 729d53276..2e9059eb3 100644
--- a/Source/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/Source/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -355,6 +355,7 @@
 		18F831B80FD48C7800D8C56B /* WorkerLoaderProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 18F831B70FD48C7800D8C56B /* WorkerLoaderProxy.h */; };
 		1921327411C0E6BB00456238 /* SVGFEConvolveMatrixElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1921327111C0E6BB00456238 /* SVGFEConvolveMatrixElement.cpp */; };
 		1921327511C0E6BB00456238 /* SVGFEConvolveMatrixElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 1921327211C0E6BB00456238 /* SVGFEConvolveMatrixElement.h */; };
+		197B180C1506353200E4ADA8 /* SVGRenderingContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 197B180B150634C000E4ADA8 /* SVGRenderingContext.h */; };
 		19BFF64B11C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 19BFF64611C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.h */; };
 		19BFF64C11C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = 19BFF64711C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.mm */; };
 		19BFF64D11C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElementInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 19BFF64811C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElementInternal.h */; };
@@ -452,11 +453,6 @@
 		1A762C780A074F2600989F5B /* JSXPathNSResolver.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A762C700A074F2600989F5B /* JSXPathNSResolver.h */; };
 		1A762C790A074F2600989F5B /* JSXPathResult.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A762C710A074F2600989F5B /* JSXPathResult.cpp */; };
 		1A762C7A0A074F2600989F5B /* JSXPathResult.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A762C720A074F2600989F5B /* JSXPathResult.h */; };
-		1A7CCB190CD9469A00B7B64E /* SQLStatementCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A7CCB150CD9469A00B7B64E /* SQLStatementCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		1A7CCB1A0CD9469A00B7B64E /* SQLStatementErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A7CCB160CD9469A00B7B64E /* SQLStatementErrorCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		1A7CCB1B0CD9469A00B7B64E /* SQLTransactionCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A7CCB170CD9469A00B7B64E /* SQLTransactionCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		1A7CCB1C0CD9469A00B7B64E /* SQLTransactionErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A7CCB180CD9469A00B7B64E /* SQLTransactionErrorCallback.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		1A7CCB240CD946FD00B7B64E /* SQLTransaction.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A7CCB220CD946FD00B7B64E /* SQLTransaction.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1A7FA6190DDA3B3A0028F8A5 /* NetworkStateNotifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A7FA6180DDA3B3A0028F8A5 /* NetworkStateNotifier.h */; };
 		1A7FA61B0DDA3BBE0028F8A5 /* NetworkStateNotifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A7FA61A0DDA3BBE0028F8A5 /* NetworkStateNotifier.cpp */; };
 		1A7FA6490DDA3CBA0028F8A5 /* NetworkStateNotifierMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A7FA6470DDA3CBA0028F8A5 /* NetworkStateNotifierMac.cpp */; };
@@ -535,7 +531,6 @@
 		1ABA76C911D20E47004C201C /* ColorData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E406F3FB1198307D009D59D6 /* ColorData.cpp */; };
 		1ABA76CA11D20E50004C201C /* CSSPropertyNames.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E41EA038119836DB00710BC5 /* CSSPropertyNames.cpp */; };
 		1ABA76CB11D20E57004C201C /* CSSValueKeywords.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E41EA0391198374900710BC5 /* CSSValueKeywords.cpp */; };
-		1ABFE7530CD968D000FE4834 /* SQLTransaction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1ABFE7520CD968D000FE4834 /* SQLTransaction.cpp */; };
 		1AC2260C0DB69F190089B669 /* JSDOMApplicationCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AC2260A0DB69F190089B669 /* JSDOMApplicationCache.cpp */; };
 		1AC2260D0DB69F190089B669 /* JSDOMApplicationCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AC2260B0DB69F190089B669 /* JSDOMApplicationCache.h */; };
 		1ACD1B630B029739007E5016 /* DOMCSSStyleDeclarationInternal.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85E711440AC5D5340053270F /* DOMCSSStyleDeclarationInternal.h */; };
@@ -548,8 +543,6 @@
 		1ACE53F60A8D19470022947D /* JSXMLSerializer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1ACE53F40A8D19470022947D /* JSXMLSerializer.cpp */; };
 		1ACE53F70A8D19470022947D /* JSXMLSerializer.h in Headers */ = {isa = PBXBuildFile; fileRef = 1ACE53F50A8D19470022947D /* JSXMLSerializer.h */; };
 		1AD2316E0CD269E700C1F194 /* JSSQLTransactionCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AD2316D0CD269E700C1F194 /* JSSQLTransactionCustom.cpp */; };
-		1AD51A140CB59CD300953D11 /* DatabaseTracker.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AD51A120CB59CD300953D11 /* DatabaseTracker.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		1AD51A150CB59CD300953D11 /* DatabaseTracker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AD51A130CB59CD300953D11 /* DatabaseTracker.cpp */; };
 		1AD8F81B11CAB9E900E93E54 /* PlatformStrategies.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AD8F81911CAB9E900E93E54 /* PlatformStrategies.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AD8F81C11CAB9E900E93E54 /* PlatformStrategies.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AD8F81A11CAB9E900E93E54 /* PlatformStrategies.cpp */; };
 		1ADA14100E1AE5D900023EE5 /* PluginMainThreadScheduler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1ADA140E0E1AE5D900023EE5 /* PluginMainThreadScheduler.cpp */; };
@@ -608,8 +601,6 @@
 		1AF8E11A1256592600230FF7 /* ProxyServer.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AF8E1191256592600230FF7 /* ProxyServer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AF8E13312565A4400230FF7 /* ProxyServer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AF8E13212565A4400230FF7 /* ProxyServer.cpp */; };
 		1AF8E1C3125673E000230FF7 /* ProxyServerCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AF8E1C1125673E000230FF7 /* ProxyServerCFNet.cpp */; };
-		1AFE117D0CBFFB36003017FA /* SQLResultSetRowList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AFE117B0CBFFB36003017FA /* SQLResultSetRowList.cpp */; };
-		1AFE117E0CBFFB36003017FA /* SQLResultSetRowList.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AFE117C0CBFFB36003017FA /* SQLResultSetRowList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AFE11990CBFFCC4003017FA /* JSSQLResultSetRowList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AFE11970CBFFCC4003017FA /* JSSQLResultSetRowList.cpp */; };
 		1AFE119A0CBFFCC4003017FA /* JSSQLResultSetRowList.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AFE11980CBFFCC4003017FA /* JSSQLResultSetRowList.h */; };
 		1C11CCB50AA6093700DADB20 /* DOMNotation.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85CA96E80A9624E900690CCF /* DOMNotation.h */; };
@@ -678,7 +669,6 @@
 		2292B27C1356669400CF11EF /* ImageBufferDataCG.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2292B27B1356669400CF11EF /* ImageBufferDataCG.cpp */; };
 		22BD9F7F1353625C009BD102 /* ImageBufferData.h in Headers */ = {isa = PBXBuildFile; fileRef = 22BD9F7D1353625C009BD102 /* ImageBufferData.h */; };
 		22BD9F81135364FE009BD102 /* ImageBufferDataCG.h in Headers */ = {isa = PBXBuildFile; fileRef = 22BD9F80135364FE009BD102 /* ImageBufferDataCG.h */; };
-		245D80A313280E40003492A6 /* SQLCallbackWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 245D80A213280E40003492A6 /* SQLCallbackWrapper.h */; };
 		24AA568D13CC94CE00E902F6 /* DOMSVGAltGlyphItemElementInternal.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 24D912A313CA977D00D21915 /* DOMSVGAltGlyphItemElementInternal.h */; };
 		24AA568E13CC950900E902F6 /* DOMSVGAltGlyphItemElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 24D912A113CA977D00D21915 /* DOMSVGAltGlyphItemElement.h */; };
 		24AA569013CC952F00E902F6 /* DOMSVGAltGlyphDefElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 24D9129B13CA975A00D21915 /* DOMSVGAltGlyphDefElement.h */; };
@@ -713,6 +703,8 @@
 		265541391489811C000DFC5D /* KeyEventCodesIOS.h in Headers */ = {isa = PBXBuildFile; fileRef = 265541371489811C000DFC5D /* KeyEventCodesIOS.h */; };
 		2655413A1489811C000DFC5D /* KeyEventIOS.mm in Sources */ = {isa = PBXBuildFile; fileRef = 265541381489811C000DFC5D /* KeyEventIOS.mm */; };
 		265541521489B233000DFC5D /* CursorIOS.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2655414B1489AA2B000DFC5D /* CursorIOS.cpp */; };
+		26A5034E14F0983600AA730D /* KURLWTFURLImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 26A5034D14F0983600AA730D /* KURLWTFURLImpl.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		26A5035A14F0A2BC00AA730D /* KURLWTFURL.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 26A5035914F0A2BC00AA730D /* KURLWTFURL.cpp */; };
 		26C17A3E1491D2D400D12BA2 /* FileSystemIOS.h in Headers */ = {isa = PBXBuildFile; fileRef = 26C17A3C1491D2D400D12BA2 /* FileSystemIOS.h */; };
 		26C17A3F1491D2D400D12BA2 /* FileSystemIOS.mm in Sources */ = {isa = PBXBuildFile; fileRef = 26C17A3D1491D2D400D12BA2 /* FileSystemIOS.mm */; };
 		26E98A10130A9FCA008EB7B2 /* TextCodecASCIIFastPath.h in Headers */ = {isa = PBXBuildFile; fileRef = 26E98A0F130A9FCA008EB7B2 /* TextCodecASCIIFastPath.h */; };
@@ -760,6 +752,7 @@
 		2D8FEBDD143E3EF70072502B /* CSSCrossfadeValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 2D8FEBDB143E3EF70072502B /* CSSCrossfadeValue.h */; };
 		2D9066060BE141D400956998 /* LayoutState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2D9066040BE141D400956998 /* LayoutState.cpp */; };
 		2D9066070BE141D400956998 /* LayoutState.h in Headers */ = {isa = PBXBuildFile; fileRef = 2D9066050BE141D400956998 /* LayoutState.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		2D9F0E1314FF1CBF00BA0FF7 /* linearSRGB.icc in Resources */ = {isa = PBXBuildFile; fileRef = 2D9F0E1214FF1CBF00BA0FF7 /* linearSRGB.icc */; };
 		2E0888D41148848A00AF4265 /* JSDOMFormData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2E0888D21148848A00AF4265 /* JSDOMFormData.cpp */; };
 		2E0888D51148848A00AF4265 /* JSDOMFormData.h in Headers */ = {isa = PBXBuildFile; fileRef = 2E0888D31148848A00AF4265 /* JSDOMFormData.h */; };
 		2E0888E6114884E200AF4265 /* JSDOMFormDataCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2E0888E5114884E200AF4265 /* JSDOMFormDataCustom.cpp */; };
@@ -832,7 +825,6 @@
 		2EDF369F122C94C8002F7D4E /* FileException.h in Headers */ = {isa = PBXBuildFile; fileRef = 2EDF369E122C94C8002F7D4E /* FileException.h */; };
 		2EF1BFEA121C9F4200C27627 /* FileStream.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2EF1BFE8121C9F4200C27627 /* FileStream.cpp */; };
 		2EF1BFEB121C9F4200C27627 /* FileStream.h in Headers */ = {isa = PBXBuildFile; fileRef = 2EF1BFE9121C9F4200C27627 /* FileStream.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		2EF1BFF7121CB0BD00C27627 /* AsyncFileStream.h in Headers */ = {isa = PBXBuildFile; fileRef = 2EF1BFF6121CB0BD00C27627 /* AsyncFileStream.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		2EF1BFF9121CB0CE00C27627 /* FileStreamClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 2EF1BFF8121CB0CE00C27627 /* FileStreamClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		3106036F14327D2E00ABF4BA /* WebKitCSSFilterValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3106036C14327D2E00ABF4BA /* WebKitCSSFilterValue.cpp */; };
 		3106037014327D2E00ABF4BA /* WebKitCSSFilterValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 3106036D14327D2E00ABF4BA /* WebKitCSSFilterValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -919,7 +911,7 @@
 		31FB1A6C120A5D6900DC02A0 /* JSDeviceMotionEventCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 31FB1A6B120A5D6900DC02A0 /* JSDeviceMotionEventCustom.cpp */; };
 		3314ACEB10892086000F0E56 /* JSExceptionBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 3314ACE910892086000F0E56 /* JSExceptionBase.cpp */; };
 		3314ACEC10892086000F0E56 /* JSExceptionBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 3314ACEA10892086000F0E56 /* JSExceptionBase.h */; };
-		33503C9A10179A74003B47E1 /* NotificationPresenter.h in Headers */ = {isa = PBXBuildFile; fileRef = 33503C9910179A74003B47E1 /* NotificationPresenter.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		33503C9A10179A74003B47E1 /* NotificationClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 33503C9910179A74003B47E1 /* NotificationClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		33503CA310179AD7003B47E1 /* JSNotification.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33503C9F10179AD7003B47E1 /* JSNotification.cpp */; };
 		33503CA410179AD7003B47E1 /* JSNotification.h in Headers */ = {isa = PBXBuildFile; fileRef = 33503CA010179AD7003B47E1 /* JSNotification.h */; };
 		33503CA510179AD7003B47E1 /* JSNotificationCenter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 33503CA110179AD7003B47E1 /* JSNotificationCenter.cpp */; };
@@ -1112,7 +1104,6 @@
 		436708E112D9CA4B00044234 /* RenderSVGResourceRadialGradient.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708A212D9CA4B00044234 /* RenderSVGResourceRadialGradient.h */; };
 		436708E312D9CA4B00044234 /* RenderSVGResourceSolidColor.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708A412D9CA4B00044234 /* RenderSVGResourceSolidColor.h */; };
 		436708E512D9CA4B00044234 /* RenderSVGRoot.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708A612D9CA4B00044234 /* RenderSVGRoot.h */; };
-		436708E712D9CA4B00044234 /* RenderSVGShadowTreeRootContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708A812D9CA4B00044234 /* RenderSVGShadowTreeRootContainer.h */; };
 		436708E912D9CA4B00044234 /* RenderSVGTransformableContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708AA12D9CA4B00044234 /* RenderSVGTransformableContainer.h */; };
 		436708EB12D9CA4B00044234 /* RenderSVGViewportContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708AC12D9CA4B00044234 /* RenderSVGViewportContainer.h */; };
 		436708ED12D9CA4B00044234 /* SVGImageBufferTools.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708AE12D9CA4B00044234 /* SVGImageBufferTools.h */; };
@@ -1123,7 +1114,6 @@
 		436708F612D9CA4B00044234 /* SVGResources.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708B712D9CA4B00044234 /* SVGResources.h */; };
 		436708F812D9CA4B00044234 /* SVGResourcesCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708B912D9CA4B00044234 /* SVGResourcesCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		436708FA12D9CA4B00044234 /* SVGResourcesCycleSolver.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708BB12D9CA4B00044234 /* SVGResourcesCycleSolver.h */; };
-		436708FC12D9CA4B00044234 /* SVGShadowTreeElements.h in Headers */ = {isa = PBXBuildFile; fileRef = 436708BD12D9CA4B00044234 /* SVGShadowTreeElements.h */; };
 		4381763B13A697D4007D1187 /* SVGAnimatedLength.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4381763A13A697D4007D1187 /* SVGAnimatedLength.cpp */; };
 		439046D712DA25E800AF80A2 /* RenderMathMLBlock.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 439046C312DA25E800AF80A2 /* RenderMathMLBlock.cpp */; };
 		439046D812DA25E800AF80A2 /* RenderMathMLBlock.h in Headers */ = {isa = PBXBuildFile; fileRef = 439046C412DA25E800AF80A2 /* RenderMathMLBlock.h */; };
@@ -1179,6 +1169,8 @@
 		44A28AAC12DFB8AC00AE923B /* MathMLElementFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = 44A28AAB12DFB8AC00AE923B /* MathMLElementFactory.h */; };
 		44A28AAF12DFB8BF00AE923B /* MathMLNames.h in Headers */ = {isa = PBXBuildFile; fileRef = 44A28AAE12DFB8BF00AE923B /* MathMLNames.h */; };
 		45099C411370A7800058D513 /* IconURL.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 45099C401370A7800058D513 /* IconURL.cpp */; };
+		450CEBF015073BBE002BB149 /* LabelableElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 450CEBEE15073BBE002BB149 /* LabelableElement.cpp */; };
+		450CEBF115073BBE002BB149 /* LabelableElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 450CEBEF15073BBE002BB149 /* LabelableElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		45BAC2B01360BBAB005DA258 /* IconURL.h in Headers */ = {isa = PBXBuildFile; fileRef = 45BAC2AF1360BBAB005DA258 /* IconURL.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4614A1FE0B23A8D600446E1C /* copyCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 4614A1FD0B23A8D600446E1C /* copyCursor.png */; };
 		46700ED0127B96CB00F5D5D6 /* FileWriterSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 46700ECE127B96CB00F5D5D6 /* FileWriterSync.cpp */; };
@@ -1367,14 +1359,13 @@
 		4A1E719614E101F900626F9D /* JSHTMLShadowElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A1E719414E101F900626F9D /* JSHTMLShadowElement.h */; };
 		4A1E71A514E106AC00626F9D /* JSShadowRoot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A1E71A314E106AC00626F9D /* JSShadowRoot.cpp */; };
 		4A1E71A614E106AC00626F9D /* JSShadowRoot.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A1E71A414E106AC00626F9D /* JSShadowRoot.h */; };
-		4A4A234614F1E1440046FBF1 /* WebSocketFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A4A234514F1E1440046FBF1 /* WebSocketFrame.h */; };
+		4A38BF5014FE1C0900612512 /* WebSocketDeflateFramer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A38BF4E14FE1C0900612512 /* WebSocketDeflateFramer.cpp */; };
+		4A38BF5114FE1C0900612512 /* WebSocketDeflateFramer.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A38BF4F14FE1C0900612512 /* WebSocketDeflateFramer.h */; };
 		4A6E9FC313C17D1D0046A7F8 /* FontFeatureValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A6E9FC113C17D1D0046A7F8 /* FontFeatureValue.cpp */; };
 		4A6E9FC413C17D1D0046A7F8 /* FontFeatureValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A6E9FC213C17D1D0046A7F8 /* FontFeatureValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4A6E9FC713C17D570046A7F8 /* FontFeatureSettings.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A6E9FC513C17D570046A7F8 /* FontFeatureSettings.cpp */; };
 		4A6E9FC813C17D570046A7F8 /* FontFeatureSettings.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A6E9FC613C17D570046A7F8 /* FontFeatureSettings.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4A8C96EB0BE69032004EEFF0 /* FrameSelectionMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 4A8C96EA0BE69032004EEFF0 /* FrameSelectionMac.mm */; };
-		4A957F0614E2412A0049DBFB /* WebSocketExtensionDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4A957F0314E241100049DBFB /* WebSocketExtensionDispatcher.cpp */; };
-		4A957F0714E241300049DBFB /* WebSocketExtensionDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 4A957F0414E241100049DBFB /* WebSocketExtensionDispatcher.h */; };
 		4ABDFF0B14DBE385004D117D /* HTMLShadowElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4ABDFF0714DBE312004D117D /* HTMLShadowElement.cpp */; };
 		4ABDFF0C14DBE385004D117D /* HTMLShadowElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4ABDFF0814DBE312004D117D /* HTMLShadowElement.h */; };
 		4ACBC0BE12713CBD0094F9B2 /* ClassList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4ACBC0BC12713CBD0094F9B2 /* ClassList.cpp */; };
@@ -1388,9 +1379,6 @@
 		4AD01009127E642A0015035F /* HTMLOutputElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4AD01006127E642A0015035F /* HTMLOutputElement.h */; };
 		4AD0173C127E82860015035F /* JSHTMLOutputElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4AD0173A127E82860015035F /* JSHTMLOutputElement.cpp */; };
 		4AD0173D127E82860015035F /* JSHTMLOutputElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 4AD0173B127E82860015035F /* JSHTMLOutputElement.h */; };
-		4ADE25FA14E3BB4C004C2213 /* WebSocketExtensionProcessor.h in Headers */ = {isa = PBXBuildFile; fileRef = 4ADE25F914E3BB4C004C2213 /* WebSocketExtensionProcessor.h */; };
-		4AE02ABD14E8A9D200BC3BA7 /* WebSocketDeflater.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4AE02ABB14E8A9D200BC3BA7 /* WebSocketDeflater.cpp */; };
-		4AE02ABE14E8A9D200BC3BA7 /* WebSocketDeflater.h in Headers */ = {isa = PBXBuildFile; fileRef = 4AE02ABC14E8A9D200BC3BA7 /* WebSocketDeflater.h */; };
 		4AF1AD3E13FD23A400AA9590 /* EventDispatchMediator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4AF1AD3C13FD23A400AA9590 /* EventDispatchMediator.cpp */; };
 		4AF1AD3F13FD23A400AA9590 /* EventDispatchMediator.h in Headers */ = {isa = PBXBuildFile; fileRef = 4AF1AD3D13FD23A400AA9590 /* EventDispatchMediator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		4B2708C70AF19EE40065127F /* Pasteboard.h in Headers */ = {isa = PBXBuildFile; fileRef = 4B2708C50AF19EE40065127F /* Pasteboard.h */; };
@@ -1463,16 +1451,6 @@
 		510D4A36103165EE0049EA54 /* SocketStreamHandleBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510D4A30103165EE0049EA54 /* SocketStreamHandleBase.cpp */; };
 		510D4A37103165EE0049EA54 /* SocketStreamHandleBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A31103165EE0049EA54 /* SocketStreamHandleBase.h */; };
 		510D4A38103165EE0049EA54 /* SocketStreamHandleClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A32103165EE0049EA54 /* SocketStreamHandleClient.h */; };
-		510D4A4E103177A20049EA54 /* WebSocketChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510D4A47103177A20049EA54 /* WebSocketChannel.cpp */; };
-		510D4A4F103177A20049EA54 /* WebSocketChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A48103177A20049EA54 /* WebSocketChannel.h */; };
-		510D4A50103177A20049EA54 /* WebSocketChannelClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 510D4A49103177A20049EA54 /* WebSocketChannelClient.h */; };
-		510F079B11FEE9C000B8EE49 /* ThreadableWebSocketChannelClientWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 510F078111FEBE7500B8EE49 /* ThreadableWebSocketChannelClientWrapper.cpp */; };
-		5112247210CFB8C6008099D7 /* ThreadableWebSocketChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5112247110CFB8C6008099D7 /* ThreadableWebSocketChannel.cpp */; };
-		5112247410CFB8D8008099D7 /* ThreadableWebSocketChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 5112247310CFB8D8008099D7 /* ThreadableWebSocketChannel.h */; };
-		5112247610CFB8E8008099D7 /* ThreadableWebSocketChannelClientWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 5112247510CFB8E8008099D7 /* ThreadableWebSocketChannelClientWrapper.h */; };
-		5112247810CFB8F4008099D7 /* WorkerThreadableWebSocketChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5112247710CFB8F4008099D7 /* WorkerThreadableWebSocketChannel.cpp */; };
-		5112247A10CFB8FF008099D7 /* WorkerThreadableWebSocketChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 5112247910CFB8FF008099D7 /* WorkerThreadableWebSocketChannel.h */; };
-		5116D9770CF177BD00C2B84D /* DatabaseDetails.h in Headers */ = {isa = PBXBuildFile; fileRef = 5116D9750CF177BD00C2B84D /* DatabaseDetails.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		511F23170DC160DA004F0032 /* StorageTask.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511F23130DC160DA004F0032 /* StorageTask.cpp */; };
 		511F23180DC160DA004F0032 /* StorageTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 511F23140DC160DA004F0032 /* StorageTask.h */; };
 		511F23190DC160DA004F0032 /* StorageThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 511F23150DC160DA004F0032 /* StorageThread.cpp */; };
@@ -1493,8 +1471,6 @@
 		51327D6111A33A2B004F9D65 /* SinkDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51327D5F11A33A2B004F9D65 /* SinkDocument.cpp */; };
 		513F14530AB634C400094DDF /* IconLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 513F14510AB634C400094DDF /* IconLoader.cpp */; };
 		513F14540AB634C400094DDF /* IconLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = 513F14520AB634C400094DDF /* IconLoader.h */; };
-		514185EE0CD65F0400763C99 /* ChangeVersionWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 514185EC0CD65F0400763C99 /* ChangeVersionWrapper.h */; };
-		514185EF0CD65F0400763C99 /* ChangeVersionWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 514185ED0CD65F0400763C99 /* ChangeVersionWrapper.cpp */; };
 		514B3F730C722047000530DF /* FileSystem.h in Headers */ = {isa = PBXBuildFile; fileRef = 514B3F720C722047000530DF /* FileSystem.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		514B3F760C722055000530DF /* FileSystemMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 514B3F750C722055000530DF /* FileSystemMac.mm */; };
 		514C76370CE9225E007EF3CD /* JSSQLError.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 514C76350CE9225E007EF3CD /* JSSQLError.cpp */; };
@@ -1525,8 +1501,6 @@
 		514C767E0CE923A1007EF3CD /* ResourceResponseBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 514C76690CE923A1007EF3CD /* ResourceResponseBase.cpp */; };
 		514C767F0CE923A1007EF3CD /* ResourceResponseBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 514C766A0CE923A1007EF3CD /* ResourceResponseBase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		515788C11207852C00A37C4A /* VisitedLinkStrategy.h in Headers */ = {isa = PBXBuildFile; fileRef = 515788C01207852C00A37C4A /* VisitedLinkStrategy.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		515B03990CD1642A00B7EA9C /* SQLStatement.h in Headers */ = {isa = PBXBuildFile; fileRef = 515B03970CD1642A00B7EA9C /* SQLStatement.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		515B039A0CD1642A00B7EA9C /* SQLStatement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 515B03980CD1642A00B7EA9C /* SQLStatement.cpp */; };
 		5160300B0CC4251200C8AC25 /* FileSystemPOSIX.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5160300A0CC4251200C8AC25 /* FileSystemPOSIX.cpp */; };
 		5160306C0CC4362300C8AC25 /* FileSystemCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5160306B0CC4362300C8AC25 /* FileSystemCF.cpp */; };
 		5160F4980B0AA75F00C1D2AF /* HistoryItemMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 5160F4970B0AA75F00C1D2AF /* HistoryItemMac.mm */; };
@@ -1542,32 +1516,14 @@
 		5189F01D10B37BD900F3C739 /* JSPopStateEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5189F01B10B37BD900F3C739 /* JSPopStateEvent.cpp */; };
 		5189F01E10B37BD900F3C739 /* JSPopStateEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 5189F01C10B37BD900F3C739 /* JSPopStateEvent.h */; };
 		5189F0DE10B46B0E00F3C739 /* PopStateEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5189F0DD10B46B0E00F3C739 /* PopStateEvent.cpp */; };
-		518A34C11026C831001B6896 /* WebSocket.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 518A34BE1026C831001B6896 /* WebSocket.cpp */; };
-		518A34C21026C831001B6896 /* WebSocket.h in Headers */ = {isa = PBXBuildFile; fileRef = 518A34BF1026C831001B6896 /* WebSocket.h */; };
 		518A34C91026C8C9001B6896 /* JSWebSocketCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 518A34C61026C8C9001B6896 /* JSWebSocketCustom.cpp */; };
-		5196116A0CAC56570010A80C /* Database.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5196115E0CAC56570010A80C /* Database.cpp */; };
-		5196116B0CAC56570010A80C /* Database.h in Headers */ = {isa = PBXBuildFile; fileRef = 5196115F0CAC56570010A80C /* Database.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		5196116D0CAC56570010A80C /* DatabaseThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 519611610CAC56570010A80C /* DatabaseThread.cpp */; };
-		519611730CAC56570010A80C /* SQLResultSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 519611670CAC56570010A80C /* SQLResultSet.cpp */; };
-		519611740CAC56570010A80C /* SQLResultSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 519611680CAC56570010A80C /* SQLResultSet.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		519611780CAC56A80010A80C /* DatabaseThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 519611620CAC56570010A80C /* DatabaseThread.h */; };
-		519611EA0CAC749C0010A80C /* DatabaseTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 519611E80CAC749C0010A80C /* DatabaseTask.h */; };
-		519611EB0CAC749C0010A80C /* DatabaseTask.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 519611E90CAC749C0010A80C /* DatabaseTask.cpp */; };
 		51A052331058774F00CC9E95 /* CredentialStorage.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A052311058774F00CC9E95 /* CredentialStorage.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		51A052341058774F00CC9E95 /* CredentialStorage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A052321058774F00CC9E95 /* CredentialStorage.cpp */; };
 		51A052561058874000CC9E95 /* ProtectionSpaceHash.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A052551058874000CC9E95 /* ProtectionSpaceHash.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		51A45B560CAD7FD7000D2BE9 /* DatabaseAuthorizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A45B540CAD7FD7000D2BE9 /* DatabaseAuthorizer.h */; };
-		51A45B570CAD7FD7000D2BE9 /* DatabaseAuthorizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A45B550CAD7FD7000D2BE9 /* DatabaseAuthorizer.cpp */; };
-		51A9267C0D53F0570063ECC2 /* OriginQuotaManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A926780D53F0570063ECC2 /* OriginQuotaManager.cpp */; };
-		51A9267D0D53F0570063ECC2 /* OriginQuotaManager.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A926790D53F0570063ECC2 /* OriginQuotaManager.h */; };
-		51A9267E0D53F0570063ECC2 /* OriginUsageRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51A9267A0D53F0570063ECC2 /* OriginUsageRecord.cpp */; };
-		51A9267F0D53F0570063ECC2 /* OriginUsageRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = 51A9267B0D53F0570063ECC2 /* OriginUsageRecord.h */; };
 		51AA3F6F0BD5AA9E00892971 /* ResourceLoaderMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51AA3F6E0BD5AA9E00892971 /* ResourceLoaderMac.mm */; };
 		51ABAE1B103C18FF008C5260 /* SocketStreamError.h in Headers */ = {isa = PBXBuildFile; fileRef = 51ABAE1A103C18FF008C5260 /* SocketStreamError.h */; };
 		51ABAE1E103C1913008C5260 /* SocketStreamHandle.h in Headers */ = {isa = PBXBuildFile; fileRef = 51ABAE1C103C1913008C5260 /* SocketStreamHandle.h */; };
 		51ABAE1F103C1913008C5260 /* SocketStreamHandleCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51ABAE1D103C1913008C5260 /* SocketStreamHandleCFNet.cpp */; };
-		51ABAE441043AB4A008C5260 /* WebSocketHandshake.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */; };
-		51ABAE451043AB4A008C5260 /* WebSocketHandshake.h in Headers */ = {isa = PBXBuildFile; fileRef = 51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */; };
 		51B2417B0D931F3F00E83F5C /* LegacyWebArchiveMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 51B2417A0D931F3F00E83F5C /* LegacyWebArchiveMac.mm */; };
 		51BE37E00DAEE00E001085FC /* StorageArea.h in Headers */ = {isa = PBXBuildFile; fileRef = 51BE37DE0DAEE00E001085FC /* StorageArea.h */; };
 		51C0AA390F2AA10A001648C2 /* CachedFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 51C0AA380F2AA10A001648C2 /* CachedFrame.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1594,10 +1550,7 @@
 		51E1ECC30C91C90400DC255B /* PageURLRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = 51E1ECBD0C91C90400DC255B /* PageURLRecord.h */; };
 		51E3F9C70DA059DC00250911 /* Storage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51E3F9C50DA059DC00250911 /* Storage.cpp */; };
 		51E3F9D60DA05E1D00250911 /* JSStorage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51E3F9D40DA05E1D00250911 /* JSStorage.cpp */; };
-		51EC92590CE90DB400F90308 /* SQLError.h in Headers */ = {isa = PBXBuildFile; fileRef = 51EC92570CE90DB400F90308 /* SQLError.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		51EC92650CE90DD400F90308 /* JSCustomSQLStatementErrorCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51EC925D0CE90DD400F90308 /* JSCustomSQLStatementErrorCallback.cpp */; };
-		51FAFE340CECBF2D00BB3F24 /* DatabaseTrackerClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 51FAFE330CECBF2D00BB3F24 /* DatabaseTrackerClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		51FB54F5113E364200821176 /* CloseEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 51FB54F4113E364200821176 /* CloseEvent.h */; };
 		51FB5504113E3E9100821176 /* JSCloseEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 51FB5502113E3E9100821176 /* JSCloseEvent.h */; };
 		51FB5505113E3E9100821176 /* JSCloseEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51FB5503113E3E9100821176 /* JSCloseEvent.cpp */; };
 		521D46F611AEC98100514613 /* KillRingMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 521D46F511AEC98100514613 /* KillRingMac.mm */; };
@@ -1611,8 +1564,6 @@
 		53C8298E13D8D92700DE2DEB /* RenderFlexibleBox.h in Headers */ = {isa = PBXBuildFile; fileRef = 53C8298C13D8D92700DE2DEB /* RenderFlexibleBox.h */; };
 		550A0BC9085F6039007353D6 /* QualifiedName.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 550A0BC7085F6039007353D6 /* QualifiedName.cpp */; };
 		550A0BCA085F6039007353D6 /* QualifiedName.h in Headers */ = {isa = PBXBuildFile; fileRef = 550A0BC8085F6039007353D6 /* QualifiedName.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		572E92FB14E540580087FFBA /* ShadowRootList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 572E92F914E540580087FFBA /* ShadowRootList.cpp */; };
-		572E92FC14E540580087FFBA /* ShadowRootList.h in Headers */ = {isa = PBXBuildFile; fileRef = 572E92FA14E540580087FFBA /* ShadowRootList.h */; };
 		573D134714CE39FF0057ABCA /* InspectorTypeBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 573D134514CE39FF0057ABCA /* InspectorTypeBuilder.cpp */; };
 		57B791A314C6A62900F202D1 /* HTMLContentSelector.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57B7919F14C6A62900F202D1 /* HTMLContentSelector.cpp */; };
 		57B791A414C6A62900F202D1 /* HTMLContentSelector.h in Headers */ = {isa = PBXBuildFile; fileRef = 57B791A014C6A62900F202D1 /* HTMLContentSelector.h */; };
@@ -1622,6 +1573,8 @@
 		57B791AA14C6A63300F202D1 /* HTMLContentElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 57B791A814C6A63300F202D1 /* HTMLContentElement.h */; };
 		57CF497414EE36D700ECFF14 /* InsertionPoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57CF497214EE36D700ECFF14 /* InsertionPoint.cpp */; };
 		57CF497514EE36D700ECFF14 /* InsertionPoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 57CF497314EE36D700ECFF14 /* InsertionPoint.h */; };
+		57CF4C8614F7597A00ECFF14 /* ShadowTree.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 57CF4C8414F7597A00ECFF14 /* ShadowTree.cpp */; };
+		57CF4C8714F7597A00ECFF14 /* ShadowTree.h in Headers */ = {isa = PBXBuildFile; fileRef = 57CF4C8514F7597A00ECFF14 /* ShadowTree.h */; };
 		5905ADBF1302F3CE00F116DF /* XMLTreeViewer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5905ADBD1302F3CE00F116DF /* XMLTreeViewer.cpp */; };
 		5905ADC01302F3CE00F116DF /* XMLTreeViewer.h in Headers */ = {isa = PBXBuildFile; fileRef = 5905ADBE1302F3CE00F116DF /* XMLTreeViewer.h */; };
 		590E1B4911E4EF4B0069F784 /* DeviceOrientation.h in Headers */ = {isa = PBXBuildFile; fileRef = 590E1B4811E4EF4B0069F784 /* DeviceOrientation.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1862,10 +1815,6 @@
 		758978EC127090D60076D5A9 /* SpeechInputResult.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 758978EA127090D60076D5A9 /* SpeechInputResult.cpp */; };
 		7633A72613D8B33A008501B6 /* LocaleToScriptMapping.h in Headers */ = {isa = PBXBuildFile; fileRef = 7633A72413D8B33A008501B6 /* LocaleToScriptMapping.h */; };
 		7633A72713D8B33A008501B6 /* LocaleToScriptMappingDefault.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7633A72513D8B33A008501B6 /* LocaleToScriptMappingDefault.cpp */; };
-		7637C541112E7B74003D6CDC /* WebSocketHandshakeRequest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7637C540112E7B74003D6CDC /* WebSocketHandshakeRequest.cpp */; };
-		7637C543112E7B7E003D6CDC /* WebSocketHandshakeRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = 7637C542112E7B7E003D6CDC /* WebSocketHandshakeRequest.h */; };
-		767F99BE11A1194A0080C51D /* WebSocketHandshakeResponse.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 767F99BD11A1194A0080C51D /* WebSocketHandshakeResponse.cpp */; };
-		767F99C011A119560080C51D /* WebSocketHandshakeResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 767F99BF11A119560080C51D /* WebSocketHandshakeResponse.h */; };
 		7694563C1214D97C0007CBAE /* JSDOMTokenList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7694563A1214D97C0007CBAE /* JSDOMTokenList.cpp */; };
 		7694563D1214D97C0007CBAE /* JSDOMTokenList.h in Headers */ = {isa = PBXBuildFile; fileRef = 7694563B1214D97C0007CBAE /* JSDOMTokenList.h */; };
 		7694565B1214DB630007CBAE /* DOMDOMTokenList.h in Headers */ = {isa = PBXBuildFile; fileRef = 769456591214DB630007CBAE /* DOMDOMTokenList.h */; };
@@ -1879,6 +1828,10 @@
 		76FC2B0B12370DA0006A991A /* DOMTokenList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 76FC2B0812370DA0006A991A /* DOMTokenList.cpp */; };
 		76FC2B0C12370DA0006A991A /* DOMTokenList.h in Headers */ = {isa = PBXBuildFile; fileRef = 76FC2B0912370DA0006A991A /* DOMTokenList.h */; };
 		76FF17E311235673001D61B5 /* PluginViewNone.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 76FF17E211235673001D61B5 /* PluginViewNone.cpp */; };
+		7728694E14F8882500F484DC /* EXTTextureFilterAnisotropic.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7728694B14F8882500F484DC /* EXTTextureFilterAnisotropic.cpp */; };
+		7728694F14F8882500F484DC /* EXTTextureFilterAnisotropic.h in Headers */ = {isa = PBXBuildFile; fileRef = 7728694C14F8882500F484DC /* EXTTextureFilterAnisotropic.h */; };
+		7728698314FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7728698114FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.cpp */; };
+		7728698414FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.h in Headers */ = {isa = PBXBuildFile; fileRef = 7728698214FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.h */; };
 		77A17A7112F28182004E02F6 /* OESVertexArrayObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 77A17A6E12F28182004E02F6 /* OESVertexArrayObject.cpp */; };
 		77A17A7212F28182004E02F6 /* OESVertexArrayObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 77A17A6F12F28182004E02F6 /* OESVertexArrayObject.h */; };
 		77A17A7712F28642004E02F6 /* WebGLVertexArrayObjectOES.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 77A17A7412F28642004E02F6 /* WebGLVertexArrayObjectOES.cpp */; };
@@ -1954,14 +1907,9 @@
 		809DD1E0130DE2AD00CAE3ED /* CSSStyleApplyProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = 809DD1DE130DE2AD00CAE3ED /* CSSStyleApplyProperty.h */; };
 		8102C5881325BB1100DDE67A /* StringCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8102C5871325BB1100DDE67A /* StringCallback.cpp */; };
 		815E6167132587AA00B622B0 /* DataTransferItem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 815E6166132587AA00B622B0 /* DataTransferItem.cpp */; };
-		81A7325E1210189B00FC0D9E /* IDBCursor.h in Headers */ = {isa = PBXBuildFile; fileRef = 81A7325D1210189B00FC0D9E /* IDBCursor.h */; };
-		81A73260121018A400FC0D9E /* IDBCursor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 81A7325F121018A400FC0D9E /* IDBCursor.cpp */; };
-		81A73278121019E100FC0D9E /* IDBCursorBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 81A73277121019E100FC0D9E /* IDBCursorBackendImpl.h */; };
 		81AC5999131636E60009A7E0 /* DataTransferItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 81AC5997131636E60009A7E0 /* DataTransferItem.h */; };
 		81AC599A131636E60009A7E0 /* DataTransferItemList.h in Headers */ = {isa = PBXBuildFile; fileRef = 81AC5998131636E60009A7E0 /* DataTransferItemList.h */; };
 		81AC6C36131C57D30009A7E0 /* StringCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 81AC6C35131C57D30009A7E0 /* StringCallback.h */; };
-		81BE209811F4AB8D00915DFA /* IDBCursorBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 81BE209311F4AB8D00915DFA /* IDBCursorBackendImpl.cpp */; };
-		81BE209911F4AB8D00915DFA /* IDBCursorBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 81BE209411F4AB8D00915DFA /* IDBCursorBackendInterface.h */; };
 		81BE20D211F4BC3200915DFA /* JSIDBCursor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 81BE20A711F4B66F00915DFA /* JSIDBCursor.cpp */; };
 		81BE20D311F4BC3200915DFA /* JSIDBCursor.h in Headers */ = {isa = PBXBuildFile; fileRef = 81BE20A811F4B66F00915DFA /* JSIDBCursor.h */; };
 		81F65FF613788FAA00FF6F2D /* DragState.h in Headers */ = {isa = PBXBuildFile; fileRef = 81F65FF513788FAA00FF6F2D /* DragState.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -3033,6 +2981,8 @@
 		8AA61CFF144D595B00F37350 /* WebKitCSSRegionRule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8AA61CFD144D595B00F37350 /* WebKitCSSRegionRule.cpp */; };
 		8AA61D00144D595B00F37350 /* WebKitCSSRegionRule.h in Headers */ = {isa = PBXBuildFile; fileRef = 8AA61CFE144D595B00F37350 /* WebKitCSSRegionRule.h */; };
 		8AB4BC77126FDB7100DEB727 /* IgnoreDestructiveWriteCountIncrementer.h in Headers */ = {isa = PBXBuildFile; fileRef = 8AB4BC76126FDB7100DEB727 /* IgnoreDestructiveWriteCountIncrementer.h */; };
+		8ABAFB9F14F5107500A4984B /* RegionNodeList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8ABAFB9D14F5107500A4984B /* RegionNodeList.cpp */; };
+		8ABAFBA014F5107500A4984B /* RegionNodeList.h in Headers */ = {isa = PBXBuildFile; fileRef = 8ABAFB9E14F5107500A4984B /* RegionNodeList.h */; };
 		8AD0A59414C88336000D83C5 /* JSWebKitCSSRegionRule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8ACC24CD148E24B200EFCC0D /* JSWebKitCSSRegionRule.cpp */; };
 		8AD0A59514C88336000D83C5 /* JSWebKitCSSRegionRule.h in Headers */ = {isa = PBXBuildFile; fileRef = 8ACC24CE148E24B200EFCC0D /* JSWebKitCSSRegionRule.h */; };
 		8AD0A59614C88358000D83C5 /* DOMWebKitCSSRegionRule.h in Headers */ = {isa = PBXBuildFile; fileRef = 8ACC2817148E47E700EFCC0D /* DOMWebKitCSSRegionRule.h */; };
@@ -3327,6 +3277,81 @@
 		970B72A6145008EB00F00A37 /* EventHeaders.h in Headers */ = {isa = PBXBuildFile; fileRef = 970B72A5145008EB00F00A37 /* EventHeaders.h */; };
 		9711460314EF009A00674FD9 /* NavigatorGeolocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9711460014EF009A00674FD9 /* NavigatorGeolocation.cpp */; };
 		9711460414EF009A00674FD9 /* NavigatorGeolocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 9711460114EF009A00674FD9 /* NavigatorGeolocation.h */; };
+		9712A5AD15004EDA0048AF10 /* DOMWindowIndexedDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A55415004EDA0048AF10 /* DOMWindowIndexedDatabase.cpp */; };
+		9712A5AE15004EDA0048AF10 /* DOMWindowIndexedDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A55515004EDA0048AF10 /* DOMWindowIndexedDatabase.h */; };
+		9712A5B015004EDA0048AF10 /* IDBAny.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A55715004EDA0048AF10 /* IDBAny.cpp */; };
+		9712A5B115004EDA0048AF10 /* IDBAny.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A55815004EDA0048AF10 /* IDBAny.h */; };
+		9712A5B315004EDA0048AF10 /* IDBBackingStore.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A55A15004EDA0048AF10 /* IDBBackingStore.h */; };
+		9712A5B415004EDA0048AF10 /* IDBCallbacks.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A55B15004EDA0048AF10 /* IDBCallbacks.h */; };
+		9712A5B515004EDA0048AF10 /* IDBCursor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A55C15004EDA0048AF10 /* IDBCursor.cpp */; };
+		9712A5B615004EDA0048AF10 /* IDBCursor.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A55D15004EDA0048AF10 /* IDBCursor.h */; };
+		9712A5B815004EDA0048AF10 /* IDBCursorBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A55F15004EDA0048AF10 /* IDBCursorBackendImpl.cpp */; };
+		9712A5B915004EDA0048AF10 /* IDBCursorBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56015004EDA0048AF10 /* IDBCursorBackendImpl.h */; };
+		9712A5BA15004EDA0048AF10 /* IDBCursorBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56115004EDA0048AF10 /* IDBCursorBackendInterface.h */; };
+		9712A5BB15004EDA0048AF10 /* IDBCursorWithValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A56215004EDA0048AF10 /* IDBCursorWithValue.cpp */; };
+		9712A5BC15004EDA0048AF10 /* IDBCursorWithValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56315004EDA0048AF10 /* IDBCursorWithValue.h */; };
+		9712A5BE15004EDA0048AF10 /* IDBDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A56515004EDA0048AF10 /* IDBDatabase.cpp */; };
+		9712A5BF15004EDA0048AF10 /* IDBDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56615004EDA0048AF10 /* IDBDatabase.h */; };
+		9712A5C115004EDA0048AF10 /* IDBDatabaseBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A56815004EDA0048AF10 /* IDBDatabaseBackendImpl.cpp */; };
+		9712A5C215004EDA0048AF10 /* IDBDatabaseBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56915004EDA0048AF10 /* IDBDatabaseBackendImpl.h */; };
+		9712A5C315004EDA0048AF10 /* IDBDatabaseBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56A15004EDA0048AF10 /* IDBDatabaseBackendInterface.h */; };
+		9712A5C415004EDA0048AF10 /* IDBDatabaseCallbacks.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56B15004EDA0048AF10 /* IDBDatabaseCallbacks.h */; };
+		9712A5C515004EDA0048AF10 /* IDBDatabaseCallbacksImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A56C15004EDA0048AF10 /* IDBDatabaseCallbacksImpl.cpp */; };
+		9712A5C615004EDA0048AF10 /* IDBDatabaseCallbacksImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56D15004EDA0048AF10 /* IDBDatabaseCallbacksImpl.h */; };
+		9712A5C715004EDA0048AF10 /* IDBDatabaseError.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A56E15004EDA0048AF10 /* IDBDatabaseError.h */; };
+		9712A5C915004EDA0048AF10 /* IDBDatabaseException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A57015004EDA0048AF10 /* IDBDatabaseException.cpp */; };
+		9712A5CA15004EDA0048AF10 /* IDBDatabaseException.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A57115004EDA0048AF10 /* IDBDatabaseException.h */; };
+		9712A5CC15004EDA0048AF10 /* IDBEventDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A57315004EDA0048AF10 /* IDBEventDispatcher.cpp */; };
+		9712A5CD15004EDA0048AF10 /* IDBEventDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A57415004EDA0048AF10 /* IDBEventDispatcher.h */; };
+		9712A5CE15004EDA0048AF10 /* IDBFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A57515004EDA0048AF10 /* IDBFactory.cpp */; };
+		9712A5CF15004EDA0048AF10 /* IDBFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A57615004EDA0048AF10 /* IDBFactory.h */; };
+		9712A5D115004EDA0048AF10 /* IDBFactoryBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A57815004EDA0048AF10 /* IDBFactoryBackendImpl.cpp */; };
+		9712A5D215004EDA0048AF10 /* IDBFactoryBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A57915004EDA0048AF10 /* IDBFactoryBackendImpl.h */; };
+		9712A5D315004EDA0048AF10 /* IDBFactoryBackendInterface.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A57A15004EDA0048AF10 /* IDBFactoryBackendInterface.cpp */; };
+		9712A5D415004EDA0048AF10 /* IDBFactoryBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A57B15004EDA0048AF10 /* IDBFactoryBackendInterface.h */; };
+		9712A5D515004EDA0048AF10 /* IDBIndex.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A57C15004EDA0048AF10 /* IDBIndex.cpp */; };
+		9712A5D615004EDA0048AF10 /* IDBIndex.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A57D15004EDA0048AF10 /* IDBIndex.h */; };
+		9712A5D815004EDA0048AF10 /* IDBIndexBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A57F15004EDA0048AF10 /* IDBIndexBackendImpl.cpp */; };
+		9712A5D915004EDA0048AF10 /* IDBIndexBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A58015004EDA0048AF10 /* IDBIndexBackendImpl.h */; };
+		9712A5DA15004EDA0048AF10 /* IDBIndexBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A58115004EDA0048AF10 /* IDBIndexBackendInterface.h */; };
+		9712A5DB15004EDA0048AF10 /* IDBKey.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A58215004EDA0048AF10 /* IDBKey.cpp */; };
+		9712A5DC15004EDA0048AF10 /* IDBKey.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A58315004EDA0048AF10 /* IDBKey.h */; };
+		9712A5DE15004EDA0048AF10 /* IDBKeyPath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A58515004EDA0048AF10 /* IDBKeyPath.cpp */; };
+		9712A5DF15004EDA0048AF10 /* IDBKeyPath.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A58615004EDA0048AF10 /* IDBKeyPath.h */; };
+		9712A5E015004EDA0048AF10 /* IDBKeyPathBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A58715004EDA0048AF10 /* IDBKeyPathBackendImpl.cpp */; };
+		9712A5E115004EDA0048AF10 /* IDBKeyPathBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A58815004EDA0048AF10 /* IDBKeyPathBackendImpl.h */; };
+		9712A5E215004EDA0048AF10 /* IDBKeyRange.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A58915004EDA0048AF10 /* IDBKeyRange.cpp */; };
+		9712A5E315004EDA0048AF10 /* IDBKeyRange.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A58A15004EDA0048AF10 /* IDBKeyRange.h */; };
+		9712A5E515004EDA0048AF10 /* IDBLevelDBBackingStore.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A58C15004EDA0048AF10 /* IDBLevelDBBackingStore.cpp */; };
+		9712A5E615004EDA0048AF10 /* IDBLevelDBBackingStore.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A58D15004EDA0048AF10 /* IDBLevelDBBackingStore.h */; };
+		9712A5E715004EDA0048AF10 /* IDBLevelDBCoding.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A58E15004EDA0048AF10 /* IDBLevelDBCoding.cpp */; };
+		9712A5E815004EDA0048AF10 /* IDBLevelDBCoding.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A58F15004EDA0048AF10 /* IDBLevelDBCoding.h */; };
+		9712A5E915004EDA0048AF10 /* IDBObjectStore.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A59015004EDA0048AF10 /* IDBObjectStore.cpp */; };
+		9712A5EA15004EDA0048AF10 /* IDBObjectStore.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A59115004EDA0048AF10 /* IDBObjectStore.h */; };
+		9712A5EC15004EDA0048AF10 /* IDBObjectStoreBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A59315004EDA0048AF10 /* IDBObjectStoreBackendImpl.cpp */; };
+		9712A5ED15004EDA0048AF10 /* IDBObjectStoreBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A59415004EDA0048AF10 /* IDBObjectStoreBackendImpl.h */; };
+		9712A5EE15004EDA0048AF10 /* IDBObjectStoreBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A59515004EDA0048AF10 /* IDBObjectStoreBackendInterface.h */; };
+		9712A5EF15004EDA0048AF10 /* IDBPendingTransactionMonitor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A59615004EDA0048AF10 /* IDBPendingTransactionMonitor.cpp */; };
+		9712A5F015004EDA0048AF10 /* IDBPendingTransactionMonitor.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A59715004EDA0048AF10 /* IDBPendingTransactionMonitor.h */; };
+		9712A5F115004EDA0048AF10 /* IDBRequest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A59815004EDA0048AF10 /* IDBRequest.cpp */; };
+		9712A5F215004EDA0048AF10 /* IDBRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A59915004EDA0048AF10 /* IDBRequest.h */; };
+		9712A5F415004EDA0048AF10 /* IDBTracing.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A59B15004EDA0048AF10 /* IDBTracing.h */; };
+		9712A5F515004EDA0048AF10 /* IDBTransaction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A59C15004EDA0048AF10 /* IDBTransaction.cpp */; };
+		9712A5F615004EDA0048AF10 /* IDBTransaction.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A59D15004EDA0048AF10 /* IDBTransaction.h */; };
+		9712A5F815004EDA0048AF10 /* IDBTransactionBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A59F15004EDA0048AF10 /* IDBTransactionBackendImpl.cpp */; };
+		9712A5F915004EDA0048AF10 /* IDBTransactionBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A5A015004EDA0048AF10 /* IDBTransactionBackendImpl.h */; };
+		9712A5FA15004EDA0048AF10 /* IDBTransactionBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A5A115004EDA0048AF10 /* IDBTransactionBackendInterface.h */; };
+		9712A5FB15004EDA0048AF10 /* IDBTransactionCallbacks.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A5A215004EDA0048AF10 /* IDBTransactionCallbacks.h */; };
+		9712A5FC15004EDA0048AF10 /* IDBTransactionCoordinator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A5A315004EDA0048AF10 /* IDBTransactionCoordinator.cpp */; };
+		9712A5FD15004EDA0048AF10 /* IDBTransactionCoordinator.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A5A415004EDA0048AF10 /* IDBTransactionCoordinator.h */; };
+		9712A5FE15004EDA0048AF10 /* IDBVersionChangeEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A5A515004EDA0048AF10 /* IDBVersionChangeEvent.cpp */; };
+		9712A5FF15004EDA0048AF10 /* IDBVersionChangeEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A5A615004EDA0048AF10 /* IDBVersionChangeEvent.h */; };
+		9712A60115004EDA0048AF10 /* IDBVersionChangeRequest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A5A815004EDA0048AF10 /* IDBVersionChangeRequest.cpp */; };
+		9712A60215004EDA0048AF10 /* IDBVersionChangeRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A5A915004EDA0048AF10 /* IDBVersionChangeRequest.h */; };
+		9712A60415004EDA0048AF10 /* PageGroupIndexedDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A5AB15004EDA0048AF10 /* PageGroupIndexedDatabase.cpp */; };
+		9712A60515004EDA0048AF10 /* PageGroupIndexedDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A5AC15004EDA0048AF10 /* PageGroupIndexedDatabase.h */; };
+		9712A611150090CE0048AF10 /* WorkerContextIndexedDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9712A60E150090CE0048AF10 /* WorkerContextIndexedDatabase.cpp */; };
+		9712A612150090CE0048AF10 /* WorkerContextIndexedDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 9712A60F150090CE0048AF10 /* WorkerContextIndexedDatabase.h */; };
 		97205AAF123928CA00B17380 /* FTPDirectoryDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97205AAD123928CA00B17380 /* FTPDirectoryDocument.cpp */; };
 		97205AB0123928CA00B17380 /* FTPDirectoryDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = 97205AAE123928CA00B17380 /* FTPDirectoryDocument.h */; };
 		97205AB51239291000B17380 /* ImageDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97205AB11239291000B17380 /* ImageDocument.cpp */; };
@@ -3372,6 +3397,9 @@
 		975CA28B130365F800E99AD9 /* Crypto.h in Headers */ = {isa = PBXBuildFile; fileRef = 975CA288130365F800E99AD9 /* Crypto.h */; };
 		975CA2A11303679D00E99AD9 /* JSCrypto.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 975CA29F1303679D00E99AD9 /* JSCrypto.cpp */; };
 		975CA2A21303679D00E99AD9 /* JSCrypto.h in Headers */ = {isa = PBXBuildFile; fileRef = 975CA2A01303679D00E99AD9 /* JSCrypto.h */; };
+		97627B8D14FB3CEE002CDCA1 /* ContextDestructionObserver.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97627B8B14FB3CEE002CDCA1 /* ContextDestructionObserver.cpp */; };
+		97627B8E14FB3CEE002CDCA1 /* ContextDestructionObserver.h in Headers */ = {isa = PBXBuildFile; fileRef = 97627B8C14FB3CEE002CDCA1 /* ContextDestructionObserver.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97627B9814FB5424002CDCA1 /* Supplementable.h in Headers */ = {isa = PBXBuildFile; fileRef = 97627B9714FB5424002CDCA1 /* Supplementable.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97665013144FAA4200F6BB51 /* EventFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = 97665011144FAA4200F6BB51 /* EventFactory.h */; };
 		9766504F144FBFFE00F6BB51 /* EventFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9766504E144FBFFE00F6BB51 /* EventFactory.cpp */; };
 		9767CE0B145ABC13005E64DB /* ExceptionHeaders.h in Headers */ = {isa = PBXBuildFile; fileRef = 9767CE09145ABC12005E64DB /* ExceptionHeaders.h */; };
@@ -3390,8 +3418,6 @@
 		976D6C86122B8A3D001FD1F7 /* FileList.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C67122B8A3D001FD1F7 /* FileList.h */; };
 		976D6C88122B8A3D001FD1F7 /* FileReader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 976D6C69122B8A3D001FD1F7 /* FileReader.cpp */; };
 		976D6C89122B8A3D001FD1F7 /* FileReader.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C6A122B8A3D001FD1F7 /* FileReader.h */; };
-		976D6C8B122B8A3D001FD1F7 /* FileStreamProxy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 976D6C6C122B8A3D001FD1F7 /* FileStreamProxy.cpp */; };
-		976D6C8C122B8A3D001FD1F7 /* FileStreamProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C6D122B8A3D001FD1F7 /* FileStreamProxy.h */; };
 		976D6C8D122B8A3D001FD1F7 /* FileThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 976D6C6E122B8A3D001FD1F7 /* FileThread.cpp */; };
 		976D6C8E122B8A3D001FD1F7 /* FileThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C6F122B8A3D001FD1F7 /* FileThread.h */; };
 		976D6C8F122B8A3D001FD1F7 /* FileThreadTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 976D6C70122B8A3D001FD1F7 /* FileThreadTask.h */; };
@@ -3436,8 +3462,6 @@
 		977E2E0F12F0FC9C00C13379 /* XSSAuditor.h in Headers */ = {isa = PBXBuildFile; fileRef = 977E2E0C12F0FC9C00C13379 /* XSSAuditor.h */; };
 		978AD67414130A8D00C7CAE3 /* HTMLSpanElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 978AD67114130A8D00C7CAE3 /* HTMLSpanElement.cpp */; };
 		978AD67514130A8D00C7CAE3 /* HTMLSpanElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 978AD67214130A8D00C7CAE3 /* HTMLSpanElement.h */; };
-		978D07B2145A0EBD0096908D /* IDBDatabaseException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 978D07B1145A0EBD0096908D /* IDBDatabaseException.cpp */; };
-		978D07B4145A0ECD0096908D /* SQLException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 978D07B3145A0ECD0096908D /* SQLException.cpp */; };
 		978D07B6145A0F030096908D /* FileException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 978D07B5145A0F030096908D /* FileException.cpp */; };
 		978D07B8145A0F1B0096908D /* OperationNotAllowedException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 978D07B7145A0F1B0096908D /* OperationNotAllowedException.cpp */; };
 		978D07BA145A0F3C0096908D /* RangeException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 978D07B9145A0F3C0096908D /* RangeException.cpp */; };
@@ -3450,8 +3474,86 @@
 		979F43D41075E44A0000F83B /* NavigationScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 979F43D21075E44A0000F83B /* NavigationScheduler.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97AA3CA5145237CC003E1DA6 /* EventTargetHeaders.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AA3CA3145237CC003E1DA6 /* EventTargetHeaders.h */; };
 		97AA3CA6145237CC003E1DA6 /* EventTargetInterfaces.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AA3CA4145237CC003E1DA6 /* EventTargetInterfaces.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97AABD1314FA09D5007457AE /* CloseEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABCF814FA09D5007457AE /* CloseEvent.h */; };
+		97AABD1614FA09D5007457AE /* ThreadableWebSocketChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABCFB14FA09D5007457AE /* ThreadableWebSocketChannel.cpp */; };
+		97AABD1714FA09D5007457AE /* ThreadableWebSocketChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABCFC14FA09D5007457AE /* ThreadableWebSocketChannel.h */; };
+		97AABD1814FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABCFD14FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.cpp */; };
+		97AABD1914FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABCFE14FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.h */; };
+		97AABD1A14FA09D5007457AE /* WebSocket.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABCFF14FA09D5007457AE /* WebSocket.cpp */; };
+		97AABD1B14FA09D5007457AE /* WebSocket.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0014FA09D5007457AE /* WebSocket.h */; };
+		97AABD1D14FA09D5007457AE /* WebSocketChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABD0214FA09D5007457AE /* WebSocketChannel.cpp */; };
+		97AABD1E14FA09D5007457AE /* WebSocketChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0314FA09D5007457AE /* WebSocketChannel.h */; };
+		97AABD1F14FA09D5007457AE /* WebSocketChannelClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0414FA09D5007457AE /* WebSocketChannelClient.h */; };
+		97AABD2014FA09D5007457AE /* WebSocketDeflater.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABD0514FA09D5007457AE /* WebSocketDeflater.cpp */; };
+		97AABD2114FA09D5007457AE /* WebSocketDeflater.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0614FA09D5007457AE /* WebSocketDeflater.h */; };
+		97AABD2214FA09D5007457AE /* WebSocketExtensionDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABD0714FA09D5007457AE /* WebSocketExtensionDispatcher.cpp */; };
+		97AABD2314FA09D5007457AE /* WebSocketExtensionDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0814FA09D5007457AE /* WebSocketExtensionDispatcher.h */; };
+		97AABD2414FA09D5007457AE /* WebSocketExtensionProcessor.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0914FA09D5007457AE /* WebSocketExtensionProcessor.h */; };
+		97AABD2514FA09D5007457AE /* WebSocketFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0A14FA09D5007457AE /* WebSocketFrame.h */; };
+		97AABD2614FA09D5007457AE /* WebSocketHandshake.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABD0B14FA09D5007457AE /* WebSocketHandshake.cpp */; };
+		97AABD2714FA09D5007457AE /* WebSocketHandshake.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0C14FA09D5007457AE /* WebSocketHandshake.h */; };
+		97AABD2814FA09D5007457AE /* WebSocketHandshakeRequest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABD0D14FA09D5007457AE /* WebSocketHandshakeRequest.cpp */; };
+		97AABD2914FA09D5007457AE /* WebSocketHandshakeRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD0E14FA09D5007457AE /* WebSocketHandshakeRequest.h */; };
+		97AABD2A14FA09D5007457AE /* WebSocketHandshakeResponse.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABD0F14FA09D5007457AE /* WebSocketHandshakeResponse.cpp */; };
+		97AABD2B14FA09D5007457AE /* WebSocketHandshakeResponse.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD1014FA09D5007457AE /* WebSocketHandshakeResponse.h */; };
+		97AABD2C14FA09D5007457AE /* WorkerThreadableWebSocketChannel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97AABD1114FA09D5007457AE /* WorkerThreadableWebSocketChannel.cpp */; };
+		97AABD2D14FA09D5007457AE /* WorkerThreadableWebSocketChannel.h in Headers */ = {isa = PBXBuildFile; fileRef = 97AABD1214FA09D5007457AE /* WorkerThreadableWebSocketChannel.h */; };
 		97B1F02E13B025CA00F5103F /* SharedBufferChunkReader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 37569E0013AF172C00CDBA8E /* SharedBufferChunkReader.cpp */; };
 		97B1F02F13B025D200F5103F /* SharedBufferChunkReader.h in Headers */ = {isa = PBXBuildFile; fileRef = 37569E0213AF172C00CDBA8E /* SharedBufferChunkReader.h */; };
+		97BC69DA1505F076001B74AC /* AbstractDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69D61505F076001B74AC /* AbstractDatabase.cpp */; };
+		97BC69DB1505F076001B74AC /* AbstractDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69D71505F076001B74AC /* AbstractDatabase.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97BC69DC1505F076001B74AC /* ChangeVersionWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69D81505F076001B74AC /* ChangeVersionWrapper.cpp */; };
+		97BC69DD1505F076001B74AC /* ChangeVersionWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69D91505F076001B74AC /* ChangeVersionWrapper.h */; };
+		97BC6A201505F081001B74AC /* Database.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69DE1505F081001B74AC /* Database.cpp */; };
+		97BC6A211505F081001B74AC /* Database.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69DF1505F081001B74AC /* Database.h */; };
+		97BC6A231505F081001B74AC /* DatabaseAuthorizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69E11505F081001B74AC /* DatabaseAuthorizer.cpp */; };
+		97BC6A241505F081001B74AC /* DatabaseAuthorizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69E21505F081001B74AC /* DatabaseAuthorizer.h */; };
+		97BC6A251505F081001B74AC /* DatabaseCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69E31505F081001B74AC /* DatabaseCallback.h */; };
+		97BC6A271505F081001B74AC /* DatabaseContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69E51505F081001B74AC /* DatabaseContext.cpp */; };
+		97BC6A281505F081001B74AC /* DatabaseContext.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69E61505F081001B74AC /* DatabaseContext.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97BC6A291505F081001B74AC /* DatabaseDetails.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69E71505F081001B74AC /* DatabaseDetails.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97BC6A2A1505F081001B74AC /* DatabaseSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69E81505F081001B74AC /* DatabaseSync.cpp */; };
+		97BC6A2B1505F081001B74AC /* DatabaseSync.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69E91505F081001B74AC /* DatabaseSync.h */; };
+		97BC6A2D1505F081001B74AC /* DatabaseTask.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69EB1505F081001B74AC /* DatabaseTask.cpp */; };
+		97BC6A2E1505F081001B74AC /* DatabaseTask.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69EC1505F081001B74AC /* DatabaseTask.h */; };
+		97BC6A2F1505F081001B74AC /* DatabaseThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69ED1505F081001B74AC /* DatabaseThread.cpp */; };
+		97BC6A301505F081001B74AC /* DatabaseThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69EE1505F081001B74AC /* DatabaseThread.h */; };
+		97BC6A311505F081001B74AC /* DatabaseTracker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69EF1505F081001B74AC /* DatabaseTracker.cpp */; };
+		97BC6A321505F081001B74AC /* DatabaseTracker.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69F01505F081001B74AC /* DatabaseTracker.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97BC6A331505F081001B74AC /* DatabaseTrackerClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69F11505F081001B74AC /* DatabaseTrackerClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		97BC6A341505F081001B74AC /* DOMWindowSQLDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69F21505F081001B74AC /* DOMWindowSQLDatabase.cpp */; };
+		97BC6A351505F081001B74AC /* DOMWindowSQLDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69F31505F081001B74AC /* DOMWindowSQLDatabase.h */; };
+		97BC6A371505F081001B74AC /* OriginQuotaManager.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69F51505F081001B74AC /* OriginQuotaManager.cpp */; };
+		97BC6A381505F081001B74AC /* OriginQuotaManager.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69F61505F081001B74AC /* OriginQuotaManager.h */; };
+		97BC6A391505F081001B74AC /* OriginUsageRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69F71505F081001B74AC /* OriginUsageRecord.cpp */; };
+		97BC6A3A1505F081001B74AC /* OriginUsageRecord.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69F81505F081001B74AC /* OriginUsageRecord.h */; };
+		97BC6A3B1505F081001B74AC /* SQLCallbackWrapper.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69F91505F081001B74AC /* SQLCallbackWrapper.h */; };
+		97BC6A3C1505F081001B74AC /* SQLError.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69FA1505F081001B74AC /* SQLError.h */; };
+		97BC6A3E1505F081001B74AC /* SQLException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69FC1505F081001B74AC /* SQLException.cpp */; };
+		97BC6A3F1505F081001B74AC /* SQLException.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC69FD1505F081001B74AC /* SQLException.h */; };
+		97BC6A411505F081001B74AC /* SQLResultSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC69FF1505F081001B74AC /* SQLResultSet.cpp */; };
+		97BC6A421505F081001B74AC /* SQLResultSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A001505F081001B74AC /* SQLResultSet.h */; };
+		97BC6A441505F081001B74AC /* SQLResultSetRowList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC6A021505F081001B74AC /* SQLResultSetRowList.cpp */; };
+		97BC6A451505F081001B74AC /* SQLResultSetRowList.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A031505F081001B74AC /* SQLResultSetRowList.h */; };
+		97BC6A471505F081001B74AC /* SQLStatement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC6A051505F081001B74AC /* SQLStatement.cpp */; };
+		97BC6A481505F081001B74AC /* SQLStatement.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A061505F081001B74AC /* SQLStatement.h */; };
+		97BC6A491505F081001B74AC /* SQLStatementCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A071505F081001B74AC /* SQLStatementCallback.h */; };
+		97BC6A4B1505F081001B74AC /* SQLStatementErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A091505F081001B74AC /* SQLStatementErrorCallback.h */; };
+		97BC6A4D1505F081001B74AC /* SQLStatementSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC6A0B1505F081001B74AC /* SQLStatementSync.cpp */; };
+		97BC6A4E1505F081001B74AC /* SQLStatementSync.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A0C1505F081001B74AC /* SQLStatementSync.h */; };
+		97BC6A4F1505F081001B74AC /* SQLTransaction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC6A0D1505F081001B74AC /* SQLTransaction.cpp */; };
+		97BC6A501505F081001B74AC /* SQLTransaction.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A0E1505F081001B74AC /* SQLTransaction.h */; };
+		97BC6A521505F081001B74AC /* SQLTransactionCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A101505F081001B74AC /* SQLTransactionCallback.h */; };
+		97BC6A541505F081001B74AC /* SQLTransactionClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC6A121505F081001B74AC /* SQLTransactionClient.cpp */; };
+		97BC6A551505F081001B74AC /* SQLTransactionClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A131505F081001B74AC /* SQLTransactionClient.h */; };
+		97BC6A561505F081001B74AC /* SQLTransactionCoordinator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC6A141505F081001B74AC /* SQLTransactionCoordinator.cpp */; };
+		97BC6A571505F081001B74AC /* SQLTransactionCoordinator.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A151505F081001B74AC /* SQLTransactionCoordinator.h */; };
+		97BC6A581505F081001B74AC /* SQLTransactionErrorCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A161505F081001B74AC /* SQLTransactionErrorCallback.h */; };
+		97BC6A5A1505F081001B74AC /* SQLTransactionSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC6A181505F081001B74AC /* SQLTransactionSync.cpp */; };
+		97BC6A5B1505F081001B74AC /* SQLTransactionSync.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A191505F081001B74AC /* SQLTransactionSync.h */; };
+		97BC6A5D1505F081001B74AC /* SQLTransactionSyncCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A1B1505F081001B74AC /* SQLTransactionSyncCallback.h */; };
+		97BC6A5F1505F081001B74AC /* WorkerContextSQLDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC6A1D1505F081001B74AC /* WorkerContextSQLDatabase.cpp */; };
+		97BC6A601505F081001B74AC /* WorkerContextSQLDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC6A1E1505F081001B74AC /* WorkerContextSQLDatabase.h */; };
 		97BC84831236FD93000C6161 /* TextDocumentParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC84811236FD93000C6161 /* TextDocumentParser.cpp */; };
 		97BC84841236FD93000C6161 /* TextDocumentParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC84821236FD93000C6161 /* TextDocumentParser.h */; };
 		97BC849B12370A4B000C6161 /* HTMLInputStream.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC849A12370A4B000C6161 /* HTMLInputStream.h */; };
@@ -3462,8 +3564,6 @@
 		97C078501165D5BE003A32EF /* SuffixTree.h in Headers */ = {isa = PBXBuildFile; fileRef = 97C0784F1165D5BE003A32EF /* SuffixTree.h */; };
 		97C471DB12F925BD0086354B /* ContentSecurityPolicy.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97C471D912F925BC0086354B /* ContentSecurityPolicy.cpp */; };
 		97C471DC12F925BD0086354B /* ContentSecurityPolicy.h in Headers */ = {isa = PBXBuildFile; fileRef = 97C471DA12F925BD0086354B /* ContentSecurityPolicy.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		97CC3AE214E8E4A200894988 /* NavigatorSupplement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97CC3AE014E8E4A200894988 /* NavigatorSupplement.cpp */; };
-		97CC3AE314E8E4A200894988 /* NavigatorSupplement.h in Headers */ = {isa = PBXBuildFile; fileRef = 97CC3AE114E8E4A200894988 /* NavigatorSupplement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97D2AD0314B823A60093DF32 /* DOMWindowProperty.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97D2AD0114B823A60093DF32 /* DOMWindowProperty.cpp */; };
 		97D2AD0414B823A60093DF32 /* DOMWindowProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = 97D2AD0214B823A60093DF32 /* DOMWindowProperty.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97DCE20110807C750057D394 /* HistoryController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97DCE1FF10807C750057D394 /* HistoryController.cpp */; };
@@ -3481,6 +3581,7 @@
 		98EB1F951313FE0500D0E1EA /* NotImplemented.h in Headers */ = {isa = PBXBuildFile; fileRef = 98EB1F941313FE0500D0E1EA /* NotImplemented.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9B0FB191140DB5790022588F /* HTTPValidation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9B0FB18F140DB5790022588F /* HTTPValidation.cpp */; };
 		9B0FB192140DB5790022588F /* HTTPValidation.h in Headers */ = {isa = PBXBuildFile; fileRef = 9B0FB190140DB5790022588F /* HTTPValidation.h */; };
+		9B2B7AC11509850A008932CC /* MicroDataItemValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9B2F7CF714562120007F8B50 /* MicroDataItemValue.cpp */; };
 		9B2D8A7914997CCF00ECEF3E /* UndoStep.h in Headers */ = {isa = PBXBuildFile; fileRef = 9B2D8A7814997CCF00ECEF3E /* UndoStep.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9B32CDA913DF7FA900F34D13 /* RenderedPosition.h in Headers */ = {isa = PBXBuildFile; fileRef = 9B32CDA713DF7FA900F34D13 /* RenderedPosition.h */; };
 		9B32CDAA13DF7FA900F34D13 /* RenderedPosition.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9B32CDA813DF7FA900F34D13 /* RenderedPosition.cpp */; };
@@ -3527,6 +3628,8 @@
 		A10BB58B1484E3B300B2E87A /* RenderSVGShape.h in Headers */ = {isa = PBXBuildFile; fileRef = A10BB5891484E3B300B2E87A /* RenderSVGShape.h */; };
 		A10DC76A14747BAB005E2471 /* StyleGridData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A10DC76814747BAB005E2471 /* StyleGridData.cpp */; };
 		A10DC76B14747BAB005E2471 /* StyleGridData.h in Headers */ = {isa = PBXBuildFile; fileRef = A10DC76914747BAB005E2471 /* StyleGridData.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A110DB9B14F5DF7700A03B93 /* StyleGridItemData.h in Headers */ = {isa = PBXBuildFile; fileRef = A110DB9A14F5DF7700A03B93 /* StyleGridItemData.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A110DB9D14F5DF8700A03B93 /* StyleGridItemData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A110DB9C14F5DF8700A03B93 /* StyleGridItemData.cpp */; };
 		A120ACA413F998CA00FE4AC7 /* LayoutRepainter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A120ACA113F9984600FE4AC7 /* LayoutRepainter.cpp */; };
 		A12538D413F9B60A00024754 /* LayoutRepainter.h in Headers */ = {isa = PBXBuildFile; fileRef = A120ACA013F9983700FE4AC7 /* LayoutRepainter.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A136A00C1134DBD200CC8D50 /* XMLHttpRequestProgressEventThrottle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A136A00A1134DBD200CC8D50 /* XMLHttpRequestProgressEventThrottle.cpp */; };
@@ -3585,8 +3688,6 @@
 		A715E653134BBBEC00D8E713 /* ProgressShadowElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A715E651134BBBEC00D8E713 /* ProgressShadowElement.h */; };
 		A718760E0B2A120100A16ECE /* DragActions.h in Headers */ = {isa = PBXBuildFile; fileRef = A718760D0B2A120100A16ECE /* DragActions.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A71878900B2D04AC00A16ECE /* DragControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = A718788F0B2D04AC00A16ECE /* DragControllerMac.mm */; };
-		A71E083714E3CEAF006A4619 /* PageSupplement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A71E083514E3CEAF006A4619 /* PageSupplement.cpp */; };
-		A71E083814E3CEAF006A4619 /* PageSupplement.h in Headers */ = {isa = PBXBuildFile; fileRef = A71E083614E3CEAF006A4619 /* PageSupplement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A723F77B1484CA4C008C6DBE /* PlatformExportMacros.h in Headers */ = {isa = PBXBuildFile; fileRef = A723F77A1484CA4C008C6DBE /* PlatformExportMacros.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A73F95FE12C97BFE0031AAF9 /* RoundedRect.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A73F95FC12C97BFE0031AAF9 /* RoundedRect.cpp */; };
 		A73F95FF12C97BFE0031AAF9 /* RoundedRect.h in Headers */ = {isa = PBXBuildFile; fileRef = A73F95FD12C97BFE0031AAF9 /* RoundedRect.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -3642,7 +3743,6 @@
 		A7D20F62107F406900A80392 /* JSWebGLActiveInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D20F60107F406900A80392 /* JSWebGLActiveInfo.cpp */; };
 		A7D20F63107F406900A80392 /* JSWebGLActiveInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D20F61107F406900A80392 /* JSWebGLActiveInfo.h */; };
 		A7D20F6D107F438B00A80392 /* WebGLActiveInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D20F6B107F438B00A80392 /* WebGLActiveInfo.h */; };
-		A7D3C5240B576B4B002CA450 /* PasteboardHelper.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D3C5230B576B4B002CA450 /* PasteboardHelper.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7D6B3490F61104500B79FD1 /* WorkerScriptLoader.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D6B3470F61104500B79FD1 /* WorkerScriptLoader.h */; };
 		A7D6B34A0F61104500B79FD1 /* WorkerScriptLoader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7D6B3480F61104500B79FD1 /* WorkerScriptLoader.cpp */; };
 		A7DBF8DD1276919C006B6008 /* TextCheckingHelper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7DBF8DB1276919C006B6008 /* TextCheckingHelper.cpp */; };
@@ -4138,8 +4238,6 @@
 		A8EA800C0A19516E00A8EF5F /* StyleSheet.h in Headers */ = {isa = PBXBuildFile; fileRef = A8EA80040A19516E00A8EF5F /* StyleSheet.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A8EA800D0A19516E00A8EF5F /* StyleSheet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8EA80050A19516E00A8EF5F /* StyleSheet.cpp */; };
 		A8EA800E0A19516E00A8EF5F /* MediaList.h in Headers */ = {isa = PBXBuildFile; fileRef = A8EA80060A19516E00A8EF5F /* MediaList.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		A8F457A014BC1A88000CEA59 /* DOMWindowSQLDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8F4579D14BC13EC000CEA59 /* DOMWindowSQLDatabase.cpp */; };
-		A8F457A114BC1A94000CEA59 /* DOMWindowSQLDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = A8F4579E14BC13EC000CEA59 /* DOMWindowSQLDatabase.h */; };
 		A8F46A840CB20A9D003A9670 /* DOMSVGClipPathElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 8503612C0ACE007B001F3D9E /* DOMSVGClipPathElement.h */; };
 		A8F46A880CB20A9D003A9670 /* DOMSVGGradientElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85C9A2EC0AD7E90300FBFF1E /* DOMSVGGradientElement.h */; };
 		A8F46A890CB20A9D003A9670 /* DOMSVGAnimateColorElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 850361280ACE007B001F3D9E /* DOMSVGAnimateColorElement.h */; };
@@ -4959,23 +5057,13 @@
 		B2FA3E180AB75A6F000E5AC4 /* JSSVGZoomEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B2FA3D300AB75A6F000E5AC4 /* JSSVGZoomEvent.cpp */; };
 		B2FA3E190AB75A6F000E5AC4 /* JSSVGZoomEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = B2FA3D310AB75A6F000E5AC4 /* JSSVGZoomEvent.h */; };
 		B50F5B810E96CD9900AD71A6 /* WebCoreObjCExtras.mm in Sources */ = {isa = PBXBuildFile; fileRef = B50F5B800E96CD9900AD71A6 /* WebCoreObjCExtras.mm */; settings = {COMPILER_FLAGS = "-Wno-deprecated-declarations"; }; };
-		B51BF6F0102C9E590002C15A /* SQLTransactionClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B51BF6EE102C9E590002C15A /* SQLTransactionClient.cpp */; };
-		B51BF6F1102C9E590002C15A /* SQLTransactionClient.h in Headers */ = {isa = PBXBuildFile; fileRef = B51BF6EF102C9E590002C15A /* SQLTransactionClient.h */; };
-		B523CF061182675400EBB29C /* SQLTransactionSyncCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = B523CEFF1182675400EBB29C /* SQLTransactionSyncCallback.h */; };
-		B523CF081182675400EBB29C /* SQLTransactionSync.h in Headers */ = {isa = PBXBuildFile; fileRef = B523CF011182675400EBB29C /* SQLTransactionSync.h */; };
-		B523CF091182675400EBB29C /* SQLTransactionSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B523CF021182675400EBB29C /* SQLTransactionSync.cpp */; };
-		B523CF0A1182675400EBB29C /* DatabaseSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B523CF031182675400EBB29C /* DatabaseSync.cpp */; };
-		B523CF0B1182675400EBB29C /* DatabaseSync.h in Headers */ = {isa = PBXBuildFile; fileRef = B523CF041182675400EBB29C /* DatabaseSync.h */; };
 		B525A96511CA2340003A23A8 /* JSSQLException.h in Headers */ = {isa = PBXBuildFile; fileRef = B525A96311CA2340003A23A8 /* JSSQLException.h */; };
 		B525A96611CA2340003A23A8 /* JSSQLException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B525A96411CA2340003A23A8 /* JSSQLException.cpp */; };
 		B5320D6B122A24E9002D1440 /* FontPlatformData.h in Headers */ = {isa = PBXBuildFile; fileRef = B5320D69122A24E9002D1440 /* FontPlatformData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B5320D6C122A24E9002D1440 /* FontPlatformDataCocoa.mm in Sources */ = {isa = PBXBuildFile; fileRef = B5320D6A122A24E9002D1440 /* FontPlatformDataCocoa.mm */; };
-		B550B52511DC68A800923885 /* SQLStatementSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B550B52111DC68A800923885 /* SQLStatementSync.cpp */; };
-		B550B52611DC68A800923885 /* SQLStatementSync.h in Headers */ = {isa = PBXBuildFile; fileRef = B550B52211DC68A800923885 /* SQLStatementSync.h */; };
 		B55D5AA4119131FC00BCC315 /* JSSQLTransactionSyncCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = B55D5AA2119131FC00BCC315 /* JSSQLTransactionSyncCallback.h */; };
 		B55D5AA5119131FC00BCC315 /* JSSQLTransactionSyncCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B55D5AA3119131FC00BCC315 /* JSSQLTransactionSyncCallback.cpp */; };
 		B55D5AA91191325000BCC315 /* JSSQLTransactionSyncCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B55D5AA71191325000BCC315 /* JSSQLTransactionSyncCustom.cpp */; };
-		B56EBA8511C9FF8100B04477 /* SQLException.h in Headers */ = {isa = PBXBuildFile; fileRef = B56EBA8311C9FF8100B04477 /* SQLException.h */; };
 		B58CEB6911913607002A6790 /* JSDatabaseSync.h in Headers */ = {isa = PBXBuildFile; fileRef = B58CEB6711913607002A6790 /* JSDatabaseSync.h */; };
 		B58CEB6A11913607002A6790 /* JSDatabaseSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B58CEB6811913607002A6790 /* JSDatabaseSync.cpp */; };
 		B58CEB6D1191361C002A6790 /* JSSQLTransactionSync.h in Headers */ = {isa = PBXBuildFile; fileRef = B58CEB6B1191361C002A6790 /* JSSQLTransactionSync.h */; };
@@ -4992,20 +5080,10 @@
 		B59DD6AA11902A71007E9684 /* JSSQLStatementErrorCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B59DD6A811902A71007E9684 /* JSSQLStatementErrorCallback.cpp */; };
 		B5A684220FFABE9800D24689 /* SQLiteFileSystem.h in Headers */ = {isa = PBXBuildFile; fileRef = B5A684210FFABE9800D24689 /* SQLiteFileSystem.h */; };
 		B5A684240FFABEAA00D24689 /* SQLiteFileSystem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B5A684230FFABEAA00D24689 /* SQLiteFileSystem.cpp */; };
-		B5B5DC69119BB3D5002A8790 /* AbstractDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B5B5DC67119BB3D5002A8790 /* AbstractDatabase.cpp */; };
-		B5B5DC6A119BB3D5002A8790 /* AbstractDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = B5B5DC68119BB3D5002A8790 /* AbstractDatabase.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		B5C1123B102B6C4600096578 /* SQLTransactionCoordinator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B5C11239102B6C4600096578 /* SQLTransactionCoordinator.cpp */; };
-		B5C1123C102B6C4600096578 /* SQLTransactionCoordinator.h in Headers */ = {isa = PBXBuildFile; fileRef = B5C1123A102B6C4600096578 /* SQLTransactionCoordinator.h */; };
 		B5D31DFA11CF610B009F22B4 /* ActiveDOMCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B5D31DF811CF610B009F22B4 /* ActiveDOMCallback.cpp */; };
 		B5D31DFB11CF610B009F22B4 /* ActiveDOMCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = B5D31DF911CF610B009F22B4 /* ActiveDOMCallback.h */; };
-		B5D3601A112F8B560048DEA8 /* DatabaseCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = B5D36019112F8B560048DEA8 /* DatabaseCallback.h */; };
-		B61762541203374F00EF9114 /* IDBDatabaseBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = B61762531203374F00EF9114 /* IDBDatabaseBackendInterface.h */; };
-		B61762621203490800EF9114 /* IDBDatabaseBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = B61762611203490800EF9114 /* IDBDatabaseBackendImpl.h */; };
-		B656626A120B115A006EA85C /* IDBTransaction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B6566267120B115A006EA85C /* IDBTransaction.cpp */; };
-		B656626B120B115A006EA85C /* IDBTransaction.h in Headers */ = {isa = PBXBuildFile; fileRef = B6566268120B115A006EA85C /* IDBTransaction.h */; };
 		B6566270120B1227006EA85C /* JSIDBTransaction.h in Headers */ = {isa = PBXBuildFile; fileRef = B656626E120B1227006EA85C /* JSIDBTransaction.h */; };
 		B6566271120B1227006EA85C /* JSIDBTransaction.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B656626F120B1227006EA85C /* JSIDBTransaction.cpp */; };
-		B691C1F91206D4A00025D980 /* IDBDatabase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6A311D4FB3D004C3E4B /* IDBDatabase.cpp */; };
 		B71FE6DF11091CB300DAEF77 /* PrintContext.h in Headers */ = {isa = PBXBuildFile; fileRef = B776D43A1104525D00BEB0EC /* PrintContext.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B734B181119B9911006587BD /* FontTranscoder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B734B180119B9911006587BD /* FontTranscoder.cpp */; };
 		B734B183119B991D006587BD /* FontTranscoder.h in Headers */ = {isa = PBXBuildFile; fileRef = B734B182119B991D006587BD /* FontTranscoder.h */; };
@@ -5095,7 +5173,7 @@
 		BC23EE920DAED2BC009FDC91 /* CSSImageGeneratorValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC23EE910DAED2BC009FDC91 /* CSSImageGeneratorValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC23F0DB0DAFF4A4009FDC91 /* GeneratedImage.h in Headers */ = {isa = PBXBuildFile; fileRef = BC23F0DA0DAFF4A4009FDC91 /* GeneratedImage.h */; };
 		BC2441C40E8B65D00055320F /* ScrollView.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2441C30E8B65D00055320F /* ScrollView.cpp */; };
-		BC25B52A131C6D3900180E10 /* LocalizedStringsMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC25B528131C6D3900180E10 /* LocalizedStringsMac.mm */; };
+		BC25B52A131C6D3900180E10 /* LocalizedStringsMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC25B528131C6D3900180E10 /* LocalizedStringsMac.cpp */; };
 		BC274B2F140EBEB200EADFA6 /* CSSBorderImageSliceValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC274B2E140EBEB200EADFA6 /* CSSBorderImageSliceValue.h */; };
 		BC274B31140EBED800EADFA6 /* CSSBorderImageSliceValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC274B30140EBED800EADFA6 /* CSSBorderImageSliceValue.cpp */; };
 		BC275B7911C5D1C300C9206C /* JSWebKitPointCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC275B7811C5D1C300C9206C /* JSWebKitPointCustom.cpp */; };
@@ -5525,6 +5603,8 @@
 		C105DA620F3AA68F001DD44F /* TextEncodingDetectorICU.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C105DA610F3AA68F001DD44F /* TextEncodingDetectorICU.cpp */; };
 		C105DA640F3AA6B8001DD44F /* TextEncodingDetector.h in Headers */ = {isa = PBXBuildFile; fileRef = C105DA630F3AA6B8001DD44F /* TextEncodingDetector.h */; };
 		C330A22313EC196B0000B45B /* ColorChooser.h in Headers */ = {isa = PBXBuildFile; fileRef = C330A22113EC196B0000B45B /* ColorChooser.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C33EE5C414FB49610002095A /* BaseClickableWithKeyInputType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C33EE5C214FB49610002095A /* BaseClickableWithKeyInputType.cpp */; };
+		C33EE5C514FB49610002095A /* BaseClickableWithKeyInputType.h in Headers */ = {isa = PBXBuildFile; fileRef = C33EE5C314FB49610002095A /* BaseClickableWithKeyInputType.h */; };
 		C37CDEBD149EF2030042090D /* ColorChooserClient.h in Headers */ = {isa = PBXBuildFile; fileRef = C37CDEBC149EF2030042090D /* ColorChooserClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C50B561612119D23008B46E0 /* GroupSettings.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C50B561412119D23008B46E0 /* GroupSettings.cpp */; };
 		C50B561712119D23008B46E0 /* GroupSettings.h in Headers */ = {isa = PBXBuildFile; fileRef = C50B561512119D23008B46E0 /* GroupSettings.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -5542,11 +5622,6 @@
 		C55610F111A704EB00B82D27 /* DOMStringList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C55610F011A704EB00B82D27 /* DOMStringList.cpp */; };
 		C55E38BF10040D5D00A56BDB /* StorageNamespaceImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = C55E38BB10040D5D00A56BDB /* StorageNamespaceImpl.h */; };
 		C55E38C010040D5D00A56BDB /* StorageNamespaceImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C55E38BC10040D5D00A56BDB /* StorageNamespaceImpl.cpp */; };
-		C572EE0A1201C736007D8F82 /* IDBIndex.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C572EE041201C736007D8F82 /* IDBIndex.cpp */; };
-		C572EE0B1201C736007D8F82 /* IDBIndex.h in Headers */ = {isa = PBXBuildFile; fileRef = C572EE051201C736007D8F82 /* IDBIndex.h */; };
-		C572EE0D1201C736007D8F82 /* IDBIndexBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C572EE071201C736007D8F82 /* IDBIndexBackendImpl.cpp */; };
-		C572EE0E1201C736007D8F82 /* IDBIndexBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = C572EE081201C736007D8F82 /* IDBIndexBackendImpl.h */; };
-		C572EE0F1201C736007D8F82 /* IDBIndexBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = C572EE091201C736007D8F82 /* IDBIndexBackendInterface.h */; };
 		C572EE1E1201C9BC007D8F82 /* JSIDBIndex.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C572EE1C1201C9BC007D8F82 /* JSIDBIndex.cpp */; };
 		C572EE1F1201C9BC007D8F82 /* JSIDBIndex.h in Headers */ = {isa = PBXBuildFile; fileRef = C572EE1D1201C9BC007D8F82 /* JSIDBIndex.h */; };
 		C57FEDE11212EE9C0097BE65 /* FileSystem.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C57FEDE01212EE9C0097BE65 /* FileSystem.cpp */; };
@@ -5572,36 +5647,15 @@
 		C585A69111D4FB08004C3E4B /* JSIDBRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A67911D4FB07004C3E4B /* JSIDBRequest.h */; };
 		C585A69611D4FB13004C3E4B /* JSIDBFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A69411D4FB13004C3E4B /* JSIDBFactory.cpp */; };
 		C585A69711D4FB13004C3E4B /* JSIDBFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A69511D4FB13004C3E4B /* JSIDBFactory.h */; };
-		C585A6CC11D4FB3D004C3E4B /* IDBAny.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A69811D4FB3D004C3E4B /* IDBAny.cpp */; };
-		C585A6CD11D4FB3D004C3E4B /* IDBAny.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A69911D4FB3D004C3E4B /* IDBAny.h */; };
-		C585A6CF11D4FB3D004C3E4B /* IDBCallbacks.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A69B11D4FB3D004C3E4B /* IDBCallbacks.h */; };
-		C585A6D111D4FB3D004C3E4B /* IDBDatabaseError.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A69D11D4FB3D004C3E4B /* IDBDatabaseError.h */; };
-		C585A6D311D4FB3D004C3E4B /* IDBDatabaseException.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A69F11D4FB3D004C3E4B /* IDBDatabaseException.h */; };
-		C585A6D511D4FB3D004C3E4B /* IDBDatabaseBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6A111D4FB3D004C3E4B /* IDBDatabaseBackendImpl.cpp */; };
-		C585A6D811D4FB3D004C3E4B /* IDBDatabase.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6A411D4FB3D004C3E4B /* IDBDatabase.h */; };
-		C585A6E611D4FB3D004C3E4B /* IDBKey.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6B211D4FB3D004C3E4B /* IDBKey.cpp */; };
-		C585A6E711D4FB3D004C3E4B /* IDBKey.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6B311D4FB3D004C3E4B /* IDBKey.h */; };
-		C585A6E911D4FB3D004C3E4B /* IDBKeyRange.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6B511D4FB3D004C3E4B /* IDBKeyRange.cpp */; };
-		C585A6EA11D4FB3D004C3E4B /* IDBKeyRange.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6B611D4FB3D004C3E4B /* IDBKeyRange.h */; };
-		C585A6ED11D4FB3D004C3E4B /* IDBObjectStore.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6B911D4FB3D004C3E4B /* IDBObjectStore.h */; };
-		C585A6EE11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6BA11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.cpp */; };
-		C585A6EF11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6BB11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.h */; };
-		C585A6F011D4FB3D004C3E4B /* IDBObjectStore.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6BC11D4FB3D004C3E4B /* IDBObjectStore.cpp */; };
-		C585A6F111D4FB3D004C3E4B /* IDBObjectStoreBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6BD11D4FB3D004C3E4B /* IDBObjectStoreBackendInterface.h */; };
-		C585A6F311D4FB3D004C3E4B /* IDBRequest.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6BF11D4FB3D004C3E4B /* IDBRequest.cpp */; };
-		C585A6F411D4FB3D004C3E4B /* IDBRequest.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6C011D4FB3D004C3E4B /* IDBRequest.h */; };
-		C585A6F911D4FB3D004C3E4B /* IDBFactoryBackendInterface.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6C511D4FB3D004C3E4B /* IDBFactoryBackendInterface.cpp */; };
-		C585A6FA11D4FB3D004C3E4B /* IDBFactoryBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6C611D4FB3D004C3E4B /* IDBFactoryBackendInterface.h */; };
-		C585A6FB11D4FB3D004C3E4B /* IDBFactoryBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6C711D4FB3D004C3E4B /* IDBFactoryBackendImpl.cpp */; };
-		C585A6FC11D4FB3D004C3E4B /* IDBFactoryBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6C811D4FB3D004C3E4B /* IDBFactoryBackendImpl.h */; };
-		C585A6FD11D4FB3D004C3E4B /* IDBFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6C911D4FB3D004C3E4B /* IDBFactory.cpp */; };
-		C585A6FE11D4FB3D004C3E4B /* IDBFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6CA11D4FB3D004C3E4B /* IDBFactory.h */; };
 		C598902E14E9B0F800E8D18B /* PlatformPasteboardMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = C5F765BA14E1ECF4006C899B /* PlatformPasteboardMac.mm */; };
 		C598905714E9C28000E8D18B /* PasteboardStrategy.h in Headers */ = {isa = PBXBuildFile; fileRef = C5F765B414E1D414006C899B /* PasteboardStrategy.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C598905814E9C29900E8D18B /* PlatformPasteboard.h in Headers */ = {isa = PBXBuildFile; fileRef = C5BAC16F14E30E4700008837 /* PlatformPasteboard.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C5B4C24D1509236C00A6EF37 /* WebCoreNSURLExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = C5B4C24B1509236C00A6EF37 /* WebCoreNSURLExtras.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		C5B4C24E1509236C00A6EF37 /* WebCoreNSURLExtras.mm in Sources */ = {isa = PBXBuildFile; fileRef = C5B4C24C1509236C00A6EF37 /* WebCoreNSURLExtras.mm */; };
 		C5D4AA7A116BAFB60069CA93 /* GlyphMetricsMap.h in Headers */ = {isa = PBXBuildFile; fileRef = C5D4AA78116BAFB60069CA93 /* GlyphMetricsMap.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C5E9B67710697E1300C7BB1A /* StorageEventDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C5E9B67610697E1300C7BB1A /* StorageEventDispatcher.cpp */; };
 		C5EBDD84105EDDEC0056816F /* StorageEventDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = C5EBDD81105EDDEC0056816F /* StorageEventDispatcher.h */; };
+		C6B31B2E14F841FB0089F23F /* ScrollbarThemeClient.h in Headers */ = {isa = PBXBuildFile; fileRef = C691614714F6EBA70046375C /* ScrollbarThemeClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		C6D74AD509AA282E000B0A52 /* ModifySelectionListLevel.h in Headers */ = {isa = PBXBuildFile; fileRef = C6D74AD309AA282E000B0A52 /* ModifySelectionListLevel.h */; };
 		C6D74AE409AA290A000B0A52 /* ModifySelectionListLevel.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6D74AE309AA290A000B0A52 /* ModifySelectionListLevel.cpp */; };
 		C6F08FBC1430FE8F00685849 /* MutationRecord.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C6F08FB91430FE8F00685849 /* MutationRecord.cpp */; };
@@ -5622,6 +5676,8 @@
 		CA3BF67E10D99BAE00E6CE53 /* ScrollAnimator.h in Headers */ = {isa = PBXBuildFile; fileRef = CA3BF67D10D99BAE00E6CE53 /* ScrollAnimator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		CAE9F90F146441F000C245B0 /* CSSAspectRatioValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CAE9F90D146441F000C245B0 /* CSSAspectRatioValue.cpp */; };
 		CAE9F910146441F000C245B0 /* CSSAspectRatioValue.h in Headers */ = {isa = PBXBuildFile; fileRef = CAE9F90E146441F000C245B0 /* CSSAspectRatioValue.h */; };
+		CD127DED14F3097D00E84779 /* WebCoreFullScreenWindow.mm in Sources */ = {isa = PBXBuildFile; fileRef = CD127DEB14F3097900E84779 /* WebCoreFullScreenWindow.mm */; };
+		CD127DEE14F3098400E84779 /* WebCoreFullScreenWindow.h in Headers */ = {isa = PBXBuildFile; fileRef = CD127DEA14F3097900E84779 /* WebCoreFullScreenWindow.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		CD27F6E51457685A0078207D /* JSMediaController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CD27F6E2145767580078207D /* JSMediaController.cpp */; };
 		CD27F6E7145770D30078207D /* MediaController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CD27F6E6145770D30078207D /* MediaController.cpp */; };
 		CD4AC52A1496AE9A0087C4EF /* Composite.wav in Copy Audio Resources */ = {isa = PBXBuildFile; fileRef = CD4AC5281496AE2F0087C4EF /* Composite.wav */; };
@@ -5629,7 +5685,7 @@
 		CD82030B1395AB6A00F956C6 /* WebVideoFullscreenController.mm in Sources */ = {isa = PBXBuildFile; fileRef = CD8203071395AB6A00F956C6 /* WebVideoFullscreenController.mm */; settings = {COMPILER_FLAGS = "-Wno-undef"; }; };
 		CD82030C1395AB6A00F956C6 /* WebVideoFullscreenHUDWindowController.h in Headers */ = {isa = PBXBuildFile; fileRef = CD8203081395AB6A00F956C6 /* WebVideoFullscreenHUDWindowController.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		CD82030D1395AB6A00F956C6 /* WebVideoFullscreenHUDWindowController.mm in Sources */ = {isa = PBXBuildFile; fileRef = CD8203091395AB6A00F956C6 /* WebVideoFullscreenHUDWindowController.mm */; };
-		CD8203101395ACE700F956C6 /* WebWindowAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = CD82030E1395ACE700F956C6 /* WebWindowAnimation.h */; };
+		CD8203101395ACE700F956C6 /* WebWindowAnimation.h in Headers */ = {isa = PBXBuildFile; fileRef = CD82030E1395ACE700F956C6 /* WebWindowAnimation.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		CD8203111395ACE700F956C6 /* WebWindowAnimation.mm in Sources */ = {isa = PBXBuildFile; fileRef = CD82030F1395ACE700F956C6 /* WebWindowAnimation.mm */; };
 		CDAA8D0A14D71B2E0061EA60 /* PlatformClockCM.mm in Sources */ = {isa = PBXBuildFile; fileRef = CDAA8D0814D385600061EA60 /* PlatformClockCM.mm */; };
 		CDD525D7145B6DD0008D204D /* JSHTMLMediaElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = CDF65CCC145B6AFE00C4C7AA /* JSHTMLMediaElementCustom.cpp */; };
@@ -5676,12 +5732,8 @@
 		D23CA55D0AB0EAAE005108A5 /* JSRangeException.h in Headers */ = {isa = PBXBuildFile; fileRef = D23CA55C0AB0EAAE005108A5 /* JSRangeException.h */; };
 		D23CA55F0AB0EAB6005108A5 /* JSRangeException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D23CA55E0AB0EAB6005108A5 /* JSRangeException.cpp */; };
 		D23CA56C0AB0EB8D005108A5 /* RangeException.h in Headers */ = {isa = PBXBuildFile; fileRef = D23CA56B0AB0EB8D005108A5 /* RangeException.h */; };
-		D302754712A5FE84004BD828 /* RenderDetails.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D302754312A5FE84004BD828 /* RenderDetails.cpp */; };
-		D302754812A5FE84004BD828 /* RenderDetails.h in Headers */ = {isa = PBXBuildFile; fileRef = D302754412A5FE84004BD828 /* RenderDetails.h */; };
 		D302754912A5FE84004BD828 /* RenderDetailsMarker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D302754512A5FE84004BD828 /* RenderDetailsMarker.cpp */; };
 		D302754A12A5FE84004BD828 /* RenderDetailsMarker.h in Headers */ = {isa = PBXBuildFile; fileRef = D302754612A5FE84004BD828 /* RenderDetailsMarker.h */; };
-		D302754D12A5FEAB004BD828 /* RenderSummary.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D302754B12A5FEAB004BD828 /* RenderSummary.cpp */; };
-		D302754E12A5FEAB004BD828 /* RenderSummary.h in Headers */ = {isa = PBXBuildFile; fileRef = D302754C12A5FEAB004BD828 /* RenderSummary.h */; };
 		D340629B1253BC8C009E4259 /* MediaQueryListListener.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D340629A1253BC8C009E4259 /* MediaQueryListListener.cpp */; };
 		D359D789129CA2710006E5D2 /* HTMLDetailsElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = D359D786129CA2710006E5D2 /* HTMLDetailsElement.cpp */; };
 		D359D78A129CA2710006E5D2 /* HTMLDetailsElement.h in Headers */ = {isa = PBXBuildFile; fileRef = D359D787129CA2710006E5D2 /* HTMLDetailsElement.h */; };
@@ -5821,6 +5873,8 @@
 		E1C8BE5D0E8BD15A0064CB7D /* JSWorker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1C8BE5C0E8BD15A0064CB7D /* JSWorker.cpp */; };
 		E1CA5CBC0E8CDCAF00E8EF90 /* JSWorkerCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1CA5CBB0E8CDCAF00E8EF90 /* JSWorkerCustom.cpp */; };
 		E1CAA5C60E8BD23600A73ECA /* JSWorker.h in Headers */ = {isa = PBXBuildFile; fileRef = E1CAA5C50E8BD23600A73ECA /* JSWorker.h */; };
+		E1CDE92015018ED000862CC5 /* AsyncFileStream.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1CDE91F15018ED000862CC5 /* AsyncFileStream.cpp */; };
+		E1CDE9221501916900862CC5 /* AsyncFileStream.h in Headers */ = {isa = PBXBuildFile; fileRef = E1CDE9211501916900862CC5 /* AsyncFileStream.h */; };
 		E1E1BF00115FF6FB006F52CA /* WindowsKeyboardCodes.h in Headers */ = {isa = PBXBuildFile; fileRef = E1E1BEFF115FF6FB006F52CA /* WindowsKeyboardCodes.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E1E6EEA40B628DA8005F2F70 /* JSHTMLSelectElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1E6EEA30B628DA8005F2F70 /* JSHTMLSelectElement.cpp */; };
 		E1E6EEA80B628DB3005F2F70 /* JSHTMLSelectElement.h in Headers */ = {isa = PBXBuildFile; fileRef = E1E6EEA70B628DB3005F2F70 /* JSHTMLSelectElement.h */; };
@@ -5889,13 +5943,14 @@
 		E4AFD0100DAF335500F5F55C /* SVGSMILElement.h in Headers */ = {isa = PBXBuildFile; fileRef = E4AFD00A0DAF335400F5F55C /* SVGSMILElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		E4BBED0E14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4BBED0C14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp */; };
 		E4BBED0F14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h in Headers */ = {isa = PBXBuildFile; fileRef = E4BBED0D14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h */; };
+		E4BBED4C14FCDBA1003F0B98 /* StyleRule.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4BBED4A14FCDBA1003F0B98 /* StyleRule.cpp */; };
+		E4BBED4D14FCDBA1003F0B98 /* StyleRule.h in Headers */ = {isa = PBXBuildFile; fileRef = E4BBED4B14FCDBA1003F0B98 /* StyleRule.h */; };
 		E4C1789A0EE6903800824D69 /* CSSSelectorList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4C178950EE6903800824D69 /* CSSSelectorList.cpp */; };
 		E4C1789B0EE6903800824D69 /* CSSSelectorList.h in Headers */ = {isa = PBXBuildFile; fileRef = E4C178960EE6903800824D69 /* CSSSelectorList.h */; };
 		E4C279580CF9741900E97B98 /* RenderMedia.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4C279560CF9741900E97B98 /* RenderMedia.cpp */; };
 		E4C279590CF9741900E97B98 /* RenderMedia.h in Headers */ = {isa = PBXBuildFile; fileRef = E4C279570CF9741900E97B98 /* RenderMedia.h */; };
 		E4D687770ED7AE3D006EA978 /* PurgeableBufferMac.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4D687760ED7AE3D006EA978 /* PurgeableBufferMac.cpp */; };
 		E4D687790ED7AE4F006EA978 /* PurgeableBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = E4D687780ED7AE4F006EA978 /* PurgeableBuffer.h */; };
-		EB49DB8F14F46E8B002299D9 /* IDBTracing.h in Headers */ = {isa = PBXBuildFile; fileRef = EB49DB8E14F46E8B002299D9 /* IDBTracing.h */; };
 		ED2BA83C09A24B91006C0AC4 /* DocumentMarker.h in Headers */ = {isa = PBXBuildFile; fileRef = ED2BA83B09A24B91006C0AC4 /* DocumentMarker.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		ED501DC60B249F2900AE18D9 /* EditorMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = ED501DC50B249F2900AE18D9 /* EditorMac.mm */; };
 		EDE3A5000C7A430600956A37 /* ColorMac.h in Headers */ = {isa = PBXBuildFile; fileRef = EDE3A4FF0C7A430600956A37 /* ColorMac.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -7100,6 +7155,8 @@
 		1921327111C0E6BB00456238 /* SVGFEConvolveMatrixElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFEConvolveMatrixElement.cpp; sourceTree = "<group>"; };
 		1921327211C0E6BB00456238 /* SVGFEConvolveMatrixElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGFEConvolveMatrixElement.h; sourceTree = "<group>"; };
 		1921327311C0E6BB00456238 /* SVGFEConvolveMatrixElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SVGFEConvolveMatrixElement.idl; sourceTree = "<group>"; };
+		197B180A150634C000E4ADA8 /* SVGRenderingContext.cpp */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.cpp; path = SVGRenderingContext.cpp; sourceTree = "<group>"; };
+		197B180B150634C000E4ADA8 /* SVGRenderingContext.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = SVGRenderingContext.h; sourceTree = "<group>"; };
 		19BFF64611C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMSVGFEConvolveMatrixElement.h; sourceTree = "<group>"; };
 		19BFF64711C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMSVGFEConvolveMatrixElement.mm; sourceTree = "<group>"; };
 		19BFF64811C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElementInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMSVGFEConvolveMatrixElementInternal.h; sourceTree = "<group>"; };
@@ -7203,12 +7260,6 @@
 		1A762C700A074F2600989F5B /* JSXPathNSResolver.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSXPathNSResolver.h; sourceTree = "<group>"; };
 		1A762C710A074F2600989F5B /* JSXPathResult.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSXPathResult.cpp; sourceTree = "<group>"; };
 		1A762C720A074F2600989F5B /* JSXPathResult.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSXPathResult.h; sourceTree = "<group>"; };
-		1A7CCB150CD9469A00B7B64E /* SQLStatementCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLStatementCallback.h; sourceTree = "<group>"; };
-		1A7CCB160CD9469A00B7B64E /* SQLStatementErrorCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLStatementErrorCallback.h; sourceTree = "<group>"; };
-		1A7CCB170CD9469A00B7B64E /* SQLTransactionCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransactionCallback.h; sourceTree = "<group>"; };
-		1A7CCB180CD9469A00B7B64E /* SQLTransactionErrorCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransactionErrorCallback.h; sourceTree = "<group>"; };
-		1A7CCB220CD946FD00B7B64E /* SQLTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransaction.h; sourceTree = "<group>"; };
-		1A7CCB230CD946FD00B7B64E /* SQLTransaction.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLTransaction.idl; sourceTree = "<group>"; };
 		1A7FA6180DDA3B3A0028F8A5 /* NetworkStateNotifier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NetworkStateNotifier.h; sourceTree = "<group>"; };
 		1A7FA61A0DDA3BBE0028F8A5 /* NetworkStateNotifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NetworkStateNotifier.cpp; sourceTree = "<group>"; };
 		1A7FA6470DDA3CBA0028F8A5 /* NetworkStateNotifierMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NetworkStateNotifierMac.cpp; sourceTree = "<group>"; };
@@ -7297,7 +7348,6 @@
 		1AB7FC650A8B92EC00D9D37B /* XPathValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = XPathValue.h; sourceTree = "<group>"; };
 		1AB7FC660A8B92EC00D9D37B /* XPathVariableReference.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = XPathVariableReference.cpp; sourceTree = "<group>"; };
 		1AB7FC670A8B92EC00D9D37B /* XPathVariableReference.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = XPathVariableReference.h; sourceTree = "<group>"; };
-		1ABFE7520CD968D000FE4834 /* SQLTransaction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLTransaction.cpp; sourceTree = "<group>"; };
 		1AC2260A0DB69F190089B669 /* JSDOMApplicationCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMApplicationCache.cpp; sourceTree = "<group>"; };
 		1AC2260B0DB69F190089B669 /* JSDOMApplicationCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMApplicationCache.h; sourceTree = "<group>"; };
 		1ACE53DD0A8D18810022947D /* JSDOMParser.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMParser.cpp; sourceTree = "<group>"; };
@@ -7311,8 +7361,6 @@
 		1ACE53F40A8D19470022947D /* JSXMLSerializer.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSXMLSerializer.cpp; sourceTree = "<group>"; };
 		1ACE53F50A8D19470022947D /* JSXMLSerializer.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSXMLSerializer.h; sourceTree = "<group>"; };
 		1AD2316D0CD269E700C1F194 /* JSSQLTransactionCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLTransactionCustom.cpp; sourceTree = "<group>"; };
-		1AD51A120CB59CD300953D11 /* DatabaseTracker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseTracker.h; sourceTree = "<group>"; };
-		1AD51A130CB59CD300953D11 /* DatabaseTracker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatabaseTracker.cpp; sourceTree = "<group>"; };
 		1AD8F81911CAB9E900E93E54 /* PlatformStrategies.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformStrategies.h; sourceTree = "<group>"; };
 		1AD8F81A11CAB9E900E93E54 /* PlatformStrategies.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PlatformStrategies.cpp; sourceTree = "<group>"; };
 		1ADA140E0E1AE5D900023EE5 /* PluginMainThreadScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginMainThreadScheduler.cpp; sourceTree = "<group>"; };
@@ -7391,9 +7439,6 @@
 		1AF8E1191256592600230FF7 /* ProxyServer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProxyServer.h; sourceTree = "<group>"; };
 		1AF8E13212565A4400230FF7 /* ProxyServer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProxyServer.cpp; sourceTree = "<group>"; };
 		1AF8E1C1125673E000230FF7 /* ProxyServerCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProxyServerCFNet.cpp; sourceTree = "<group>"; };
-		1AFE117B0CBFFB36003017FA /* SQLResultSetRowList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLResultSetRowList.cpp; sourceTree = "<group>"; };
-		1AFE117C0CBFFB36003017FA /* SQLResultSetRowList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLResultSetRowList.h; sourceTree = "<group>"; };
-		1AFE118C0CBFFC4E003017FA /* SQLResultSetRowList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLResultSetRowList.idl; sourceTree = "<group>"; };
 		1AFE11970CBFFCC4003017FA /* JSSQLResultSetRowList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLResultSetRowList.cpp; sourceTree = "<group>"; };
 		1AFE11980CBFFCC4003017FA /* JSSQLResultSetRowList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLResultSetRowList.h; sourceTree = "<group>"; };
 		1C2649790D7E248A00BD10F2 /* DocumentLoaderMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentLoaderMac.cpp; sourceTree = "<group>"; };
@@ -7448,7 +7493,6 @@
 		22BD9F7D1353625C009BD102 /* ImageBufferData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ImageBufferData.h; sourceTree = "<group>"; };
 		22BD9F80135364FE009BD102 /* ImageBufferDataCG.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ImageBufferDataCG.h; sourceTree = "<group>"; };
 		2442BBF81194C9D300D49469 /* HashChangeEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HashChangeEvent.h; sourceTree = "<group>"; };
-		245D80A213280E40003492A6 /* SQLCallbackWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLCallbackWrapper.h; sourceTree = "<group>"; };
 		24D9128F13CA951E00D21915 /* JSSVGAltGlyphDefElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGAltGlyphDefElement.cpp; sourceTree = "<group>"; };
 		24D9129013CA951E00D21915 /* JSSVGAltGlyphDefElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSVGAltGlyphDefElement.h; sourceTree = "<group>"; };
 		24D9129313CA956100D21915 /* JSSVGAltGlyphItemElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGAltGlyphItemElement.cpp; sourceTree = "<group>"; };
@@ -7480,6 +7524,8 @@
 		265541371489811C000DFC5D /* KeyEventCodesIOS.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = KeyEventCodesIOS.h; path = ios/KeyEventCodesIOS.h; sourceTree = "<group>"; };
 		265541381489811C000DFC5D /* KeyEventIOS.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = KeyEventIOS.mm; path = ios/KeyEventIOS.mm; sourceTree = "<group>"; };
 		2655414B1489AA2B000DFC5D /* CursorIOS.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CursorIOS.cpp; path = ios/CursorIOS.cpp; sourceTree = "<group>"; };
+		26A5034D14F0983600AA730D /* KURLWTFURLImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = KURLWTFURLImpl.h; sourceTree = "<group>"; };
+		26A5035914F0A2BC00AA730D /* KURLWTFURL.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = KURLWTFURL.cpp; sourceTree = "<group>"; };
 		26C17A3C1491D2D400D12BA2 /* FileSystemIOS.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileSystemIOS.h; path = ios/FileSystemIOS.h; sourceTree = "<group>"; };
 		26C17A3D1491D2D400D12BA2 /* FileSystemIOS.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = FileSystemIOS.mm; path = ios/FileSystemIOS.mm; sourceTree = "<group>"; };
 		26E98A0F130A9FCA008EB7B2 /* TextCodecASCIIFastPath.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextCodecASCIIFastPath.h; sourceTree = "<group>"; };
@@ -7548,6 +7594,7 @@
 		2D9066050BE141D400956998 /* LayoutState.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = LayoutState.h; sourceTree = "<group>"; };
 		2D90660B0665D937006B6F1A /* ClipboardMac.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = ClipboardMac.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		2D90660C0665D937006B6F1A /* ClipboardMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ClipboardMac.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		2D9F0E1214FF1CBF00BA0FF7 /* linearSRGB.icc */ = {isa = PBXFileReference; lastKnownFileType = file; path = linearSRGB.icc; sourceTree = "<group>"; };
 		2E0888C3114883A900AF4265 /* DOMFormData.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMFormData.idl; sourceTree = "<group>"; };
 		2E0888D21148848A00AF4265 /* JSDOMFormData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMFormData.cpp; sourceTree = "<group>"; };
 		2E0888D31148848A00AF4265 /* JSDOMFormData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMFormData.h; sourceTree = "<group>"; };
@@ -7626,7 +7673,6 @@
 		2EDF369E122C94C8002F7D4E /* FileException.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileException.h; path = fileapi/FileException.h; sourceTree = "<group>"; };
 		2EF1BFE8121C9F4200C27627 /* FileStream.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FileStream.cpp; sourceTree = "<group>"; };
 		2EF1BFE9121C9F4200C27627 /* FileStream.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FileStream.h; sourceTree = "<group>"; };
-		2EF1BFF6121CB0BD00C27627 /* AsyncFileStream.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AsyncFileStream.h; sourceTree = "<group>"; };
 		2EF1BFF8121CB0CE00C27627 /* FileStreamClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FileStreamClient.h; sourceTree = "<group>"; };
 		3106036C14327D2E00ABF4BA /* WebKitCSSFilterValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitCSSFilterValue.cpp; sourceTree = "<group>"; };
 		3106036D14327D2E00ABF4BA /* WebKitCSSFilterValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitCSSFilterValue.h; sourceTree = "<group>"; };
@@ -7723,7 +7769,7 @@
 		3314ACEA10892086000F0E56 /* JSExceptionBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSExceptionBase.h; sourceTree = "<group>"; };
 		333F704E0FB49CA2008E12A6 /* Notification.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Notification.idl; path = notifications/Notification.idl; sourceTree = "<group>"; };
 		333F704F0FB49CA2008E12A6 /* Notification.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Notification.h; path = notifications/Notification.h; sourceTree = "<group>"; };
-		33503C9910179A74003B47E1 /* NotificationPresenter.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; name = NotificationPresenter.h; path = notifications/NotificationPresenter.h; sourceTree = "<group>"; };
+		33503C9910179A74003B47E1 /* NotificationClient.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; name = NotificationClient.h; path = notifications/NotificationClient.h; sourceTree = "<group>"; };
 		33503C9F10179AD7003B47E1 /* JSNotification.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNotification.cpp; sourceTree = "<group>"; };
 		33503CA010179AD7003B47E1 /* JSNotification.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSNotification.h; sourceTree = "<group>"; };
 		33503CA110179AD7003B47E1 /* JSNotificationCenter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSNotificationCenter.cpp; sourceTree = "<group>"; };
@@ -7942,8 +7988,6 @@
 		436708A412D9CA4B00044234 /* RenderSVGResourceSolidColor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGResourceSolidColor.h; sourceTree = "<group>"; };
 		436708A512D9CA4B00044234 /* RenderSVGRoot.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGRoot.cpp; sourceTree = "<group>"; };
 		436708A612D9CA4B00044234 /* RenderSVGRoot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGRoot.h; sourceTree = "<group>"; };
-		436708A712D9CA4B00044234 /* RenderSVGShadowTreeRootContainer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGShadowTreeRootContainer.cpp; sourceTree = "<group>"; };
-		436708A812D9CA4B00044234 /* RenderSVGShadowTreeRootContainer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGShadowTreeRootContainer.h; sourceTree = "<group>"; };
 		436708A912D9CA4B00044234 /* RenderSVGTransformableContainer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGTransformableContainer.cpp; sourceTree = "<group>"; };
 		436708AA12D9CA4B00044234 /* RenderSVGTransformableContainer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGTransformableContainer.h; sourceTree = "<group>"; };
 		436708AB12D9CA4B00044234 /* RenderSVGViewportContainer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGViewportContainer.cpp; sourceTree = "<group>"; };
@@ -7963,8 +8007,6 @@
 		436708B912D9CA4B00044234 /* SVGResourcesCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGResourcesCache.h; sourceTree = "<group>"; };
 		436708BA12D9CA4B00044234 /* SVGResourcesCycleSolver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGResourcesCycleSolver.cpp; sourceTree = "<group>"; };
 		436708BB12D9CA4B00044234 /* SVGResourcesCycleSolver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGResourcesCycleSolver.h; sourceTree = "<group>"; };
-		436708BC12D9CA4B00044234 /* SVGShadowTreeElements.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGShadowTreeElements.cpp; sourceTree = "<group>"; };
-		436708BD12D9CA4B00044234 /* SVGShadowTreeElements.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGShadowTreeElements.h; sourceTree = "<group>"; };
 		4381763A13A697D4007D1187 /* SVGAnimatedLength.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGAnimatedLength.cpp; sourceTree = "<group>"; };
 		439046C312DA25E800AF80A2 /* RenderMathMLBlock.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = RenderMathMLBlock.cpp; path = mathml/RenderMathMLBlock.cpp; sourceTree = "<group>"; };
 		439046C412DA25E800AF80A2 /* RenderMathMLBlock.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = RenderMathMLBlock.h; path = mathml/RenderMathMLBlock.h; sourceTree = "<group>"; };
@@ -8022,6 +8064,8 @@
 		44D8DA98139545BE00337B75 /* SVGMPathElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SVGMPathElement.idl; sourceTree = "<group>"; };
 		44D8DA9A139545CD00337B75 /* SVGAnimateMotionElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SVGAnimateMotionElement.idl; sourceTree = "<group>"; };
 		45099C401370A7800058D513 /* IconURL.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IconURL.cpp; sourceTree = "<group>"; };
+		450CEBEE15073BBE002BB149 /* LabelableElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LabelableElement.cpp; sourceTree = "<group>"; };
+		450CEBEF15073BBE002BB149 /* LabelableElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LabelableElement.h; sourceTree = "<group>"; };
 		45BAC2AF1360BBAB005DA258 /* IconURL.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IconURL.h; sourceTree = "<group>"; };
 		4614A1FD0B23A8D600446E1C /* copyCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = copyCursor.png; sourceTree = "<group>"; };
 		46700ECE127B96CB00F5D5D6 /* FileWriterSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FileWriterSync.cpp; path = fileapi/FileWriterSync.cpp; sourceTree = "<group>"; };
@@ -8234,14 +8278,13 @@
 		4A1E719414E101F900626F9D /* JSHTMLShadowElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLShadowElement.h; sourceTree = "<group>"; };
 		4A1E71A314E106AC00626F9D /* JSShadowRoot.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSShadowRoot.cpp; sourceTree = "<group>"; };
 		4A1E71A414E106AC00626F9D /* JSShadowRoot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSShadowRoot.h; sourceTree = "<group>"; };
-		4A4A234514F1E1440046FBF1 /* WebSocketFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketFrame.h; sourceTree = "<group>"; };
+		4A38BF4E14FE1C0900612512 /* WebSocketDeflateFramer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebSocketDeflateFramer.cpp; path = Modules/websockets/WebSocketDeflateFramer.cpp; sourceTree = "<group>"; };
+		4A38BF4F14FE1C0900612512 /* WebSocketDeflateFramer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketDeflateFramer.h; path = Modules/websockets/WebSocketDeflateFramer.h; sourceTree = "<group>"; };
 		4A6E9FC113C17D1D0046A7F8 /* FontFeatureValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontFeatureValue.cpp; sourceTree = "<group>"; };
 		4A6E9FC213C17D1D0046A7F8 /* FontFeatureValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontFeatureValue.h; sourceTree = "<group>"; };
 		4A6E9FC513C17D570046A7F8 /* FontFeatureSettings.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontFeatureSettings.cpp; sourceTree = "<group>"; };
 		4A6E9FC613C17D570046A7F8 /* FontFeatureSettings.h */ = {isa = PBXFileReference; explicitFileType = sourcecode.c.h; fileEncoding = 4; path = FontFeatureSettings.h; sourceTree = "<group>"; };
 		4A8C96EA0BE69032004EEFF0 /* FrameSelectionMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = FrameSelectionMac.mm; path = mac/FrameSelectionMac.mm; sourceTree = "<group>"; };
-		4A957F0314E241100049DBFB /* WebSocketExtensionDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketExtensionDispatcher.cpp; sourceTree = "<group>"; };
-		4A957F0414E241100049DBFB /* WebSocketExtensionDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketExtensionDispatcher.h; sourceTree = "<group>"; };
 		4ABDFF0714DBE312004D117D /* HTMLShadowElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLShadowElement.cpp; sourceTree = "<group>"; };
 		4ABDFF0814DBE312004D117D /* HTMLShadowElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLShadowElement.h; sourceTree = "<group>"; };
 		4ABDFF0914DBE312004D117D /* HTMLShadowElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLShadowElement.idl; sourceTree = "<group>"; };
@@ -8258,9 +8301,6 @@
 		4AD01007127E642A0015035F /* HTMLOutputElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLOutputElement.idl; sourceTree = "<group>"; };
 		4AD0173A127E82860015035F /* JSHTMLOutputElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLOutputElement.cpp; sourceTree = "<group>"; };
 		4AD0173B127E82860015035F /* JSHTMLOutputElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSHTMLOutputElement.h; sourceTree = "<group>"; };
-		4ADE25F914E3BB4C004C2213 /* WebSocketExtensionProcessor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketExtensionProcessor.h; sourceTree = "<group>"; };
-		4AE02ABB14E8A9D200BC3BA7 /* WebSocketDeflater.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketDeflater.cpp; sourceTree = "<group>"; };
-		4AE02ABC14E8A9D200BC3BA7 /* WebSocketDeflater.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketDeflater.h; sourceTree = "<group>"; };
 		4AF1AD3C13FD23A400AA9590 /* EventDispatchMediator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventDispatchMediator.cpp; sourceTree = "<group>"; };
 		4AF1AD3D13FD23A400AA9590 /* EventDispatchMediator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventDispatchMediator.h; sourceTree = "<group>"; };
 		4B2708C50AF19EE40065127F /* Pasteboard.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Pasteboard.h; sourceTree = "<group>"; };
@@ -8335,16 +8375,6 @@
 		510D4A30103165EE0049EA54 /* SocketStreamHandleBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SocketStreamHandleBase.cpp; sourceTree = "<group>"; };
 		510D4A31103165EE0049EA54 /* SocketStreamHandleBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamHandleBase.h; sourceTree = "<group>"; };
 		510D4A32103165EE0049EA54 /* SocketStreamHandleClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamHandleClient.h; sourceTree = "<group>"; };
-		510D4A47103177A20049EA54 /* WebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketChannel.cpp; sourceTree = "<group>"; };
-		510D4A48103177A20049EA54 /* WebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketChannel.h; sourceTree = "<group>"; };
-		510D4A49103177A20049EA54 /* WebSocketChannelClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketChannelClient.h; sourceTree = "<group>"; };
-		510F078111FEBE7500B8EE49 /* ThreadableWebSocketChannelClientWrapper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ThreadableWebSocketChannelClientWrapper.cpp; sourceTree = "<group>"; };
-		5112247110CFB8C6008099D7 /* ThreadableWebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ThreadableWebSocketChannel.cpp; sourceTree = "<group>"; };
-		5112247310CFB8D8008099D7 /* ThreadableWebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThreadableWebSocketChannel.h; sourceTree = "<group>"; };
-		5112247510CFB8E8008099D7 /* ThreadableWebSocketChannelClientWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThreadableWebSocketChannelClientWrapper.h; sourceTree = "<group>"; };
-		5112247710CFB8F4008099D7 /* WorkerThreadableWebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerThreadableWebSocketChannel.cpp; sourceTree = "<group>"; };
-		5112247910CFB8FF008099D7 /* WorkerThreadableWebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerThreadableWebSocketChannel.h; sourceTree = "<group>"; };
-		5116D9750CF177BD00C2B84D /* DatabaseDetails.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseDetails.h; sourceTree = "<group>"; };
 		511F23130DC160DA004F0032 /* StorageTask.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageTask.cpp; sourceTree = "<group>"; };
 		511F23140DC160DA004F0032 /* StorageTask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageTask.h; sourceTree = "<group>"; };
 		511F23150DC160DA004F0032 /* StorageThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageThread.cpp; sourceTree = "<group>"; };
@@ -8365,8 +8395,6 @@
 		51327D5F11A33A2B004F9D65 /* SinkDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SinkDocument.cpp; sourceTree = "<group>"; };
 		513F14510AB634C400094DDF /* IconLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = IconLoader.cpp; sourceTree = "<group>"; };
 		513F14520AB634C400094DDF /* IconLoader.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = IconLoader.h; sourceTree = "<group>"; };
-		514185EC0CD65F0400763C99 /* ChangeVersionWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ChangeVersionWrapper.h; sourceTree = "<group>"; };
-		514185ED0CD65F0400763C99 /* ChangeVersionWrapper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ChangeVersionWrapper.cpp; sourceTree = "<group>"; };
 		514B3F720C722047000530DF /* FileSystem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FileSystem.h; sourceTree = "<group>"; };
 		514B3F750C722055000530DF /* FileSystemMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = FileSystemMac.mm; sourceTree = "<group>"; };
 		514C76350CE9225E007EF3CD /* JSSQLError.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLError.cpp; sourceTree = "<group>"; };
@@ -8397,8 +8425,6 @@
 		514C76690CE923A1007EF3CD /* ResourceResponseBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResourceResponseBase.cpp; sourceTree = "<group>"; };
 		514C766A0CE923A1007EF3CD /* ResourceResponseBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResourceResponseBase.h; sourceTree = "<group>"; };
 		515788C01207852C00A37C4A /* VisitedLinkStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = VisitedLinkStrategy.h; sourceTree = "<group>"; };
-		515B03970CD1642A00B7EA9C /* SQLStatement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLStatement.h; sourceTree = "<group>"; };
-		515B03980CD1642A00B7EA9C /* SQLStatement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLStatement.cpp; sourceTree = "<group>"; };
 		5160300A0CC4251200C8AC25 /* FileSystemPOSIX.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FileSystemPOSIX.cpp; sourceTree = "<group>"; };
 		5160306B0CC4362300C8AC25 /* FileSystemCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FileSystemCF.cpp; sourceTree = "<group>"; };
 		5160F4970B0AA75F00C1D2AF /* HistoryItemMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = HistoryItemMac.mm; path = mac/HistoryItemMac.mm; sourceTree = "<group>"; };
@@ -8415,37 +8441,16 @@
 		5189F01B10B37BD900F3C739 /* JSPopStateEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPopStateEvent.cpp; sourceTree = "<group>"; };
 		5189F01C10B37BD900F3C739 /* JSPopStateEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPopStateEvent.h; sourceTree = "<group>"; };
 		5189F0DD10B46B0E00F3C739 /* PopStateEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PopStateEvent.cpp; sourceTree = "<group>"; };
-		518A34BE1026C831001B6896 /* WebSocket.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocket.cpp; sourceTree = "<group>"; };
-		518A34BF1026C831001B6896 /* WebSocket.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocket.h; sourceTree = "<group>"; };
-		518A34C01026C831001B6896 /* WebSocket.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebSocket.idl; sourceTree = "<group>"; };
 		518A34C61026C8C9001B6896 /* JSWebSocketCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebSocketCustom.cpp; sourceTree = "<group>"; };
-		5196115E0CAC56570010A80C /* Database.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Database.cpp; sourceTree = "<group>"; };
-		5196115F0CAC56570010A80C /* Database.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Database.h; sourceTree = "<group>"; };
-		519611600CAC56570010A80C /* Database.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Database.idl; sourceTree = "<group>"; };
-		519611610CAC56570010A80C /* DatabaseThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatabaseThread.cpp; sourceTree = "<group>"; };
-		519611620CAC56570010A80C /* DatabaseThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseThread.h; sourceTree = "<group>"; };
-		519611670CAC56570010A80C /* SQLResultSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLResultSet.cpp; sourceTree = "<group>"; };
-		519611680CAC56570010A80C /* SQLResultSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLResultSet.h; sourceTree = "<group>"; };
-		519611690CAC56570010A80C /* SQLResultSet.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLResultSet.idl; sourceTree = "<group>"; };
-		519611E80CAC749C0010A80C /* DatabaseTask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseTask.h; sourceTree = "<group>"; };
-		519611E90CAC749C0010A80C /* DatabaseTask.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatabaseTask.cpp; sourceTree = "<group>"; };
 		519FE0A10DAD446E00A08F21 /* HTMLAttributeNames.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLAttributeNames.in; sourceTree = "<group>"; };
 		519FE0A20DAD446E00A08F21 /* HTMLTagNames.in */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLTagNames.in; sourceTree = "<group>"; };
 		51A052311058774F00CC9E95 /* CredentialStorage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CredentialStorage.h; sourceTree = "<group>"; };
 		51A052321058774F00CC9E95 /* CredentialStorage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CredentialStorage.cpp; sourceTree = "<group>"; };
 		51A052551058874000CC9E95 /* ProtectionSpaceHash.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProtectionSpaceHash.h; sourceTree = "<group>"; };
-		51A45B540CAD7FD7000D2BE9 /* DatabaseAuthorizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseAuthorizer.h; sourceTree = "<group>"; };
-		51A45B550CAD7FD7000D2BE9 /* DatabaseAuthorizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatabaseAuthorizer.cpp; sourceTree = "<group>"; };
-		51A926780D53F0570063ECC2 /* OriginQuotaManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OriginQuotaManager.cpp; sourceTree = "<group>"; };
-		51A926790D53F0570063ECC2 /* OriginQuotaManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OriginQuotaManager.h; sourceTree = "<group>"; };
-		51A9267A0D53F0570063ECC2 /* OriginUsageRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OriginUsageRecord.cpp; sourceTree = "<group>"; };
-		51A9267B0D53F0570063ECC2 /* OriginUsageRecord.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OriginUsageRecord.h; sourceTree = "<group>"; };
 		51AA3F6E0BD5AA9E00892971 /* ResourceLoaderMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ResourceLoaderMac.mm; sourceTree = "<group>"; };
 		51ABAE1A103C18FF008C5260 /* SocketStreamError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamError.h; sourceTree = "<group>"; };
 		51ABAE1C103C1913008C5260 /* SocketStreamHandle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamHandle.h; sourceTree = "<group>"; };
 		51ABAE1D103C1913008C5260 /* SocketStreamHandleCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SocketStreamHandleCFNet.cpp; sourceTree = "<group>"; };
-		51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketHandshake.cpp; sourceTree = "<group>"; };
-		51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketHandshake.h; sourceTree = "<group>"; };
 		51B2417A0D931F3F00E83F5C /* LegacyWebArchiveMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = LegacyWebArchiveMac.mm; sourceTree = "<group>"; };
 		51BE37DE0DAEE00E001085FC /* StorageArea.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageArea.h; sourceTree = "<group>"; };
 		51C0AA380F2AA10A001648C2 /* CachedFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedFrame.h; sourceTree = "<group>"; };
@@ -8476,14 +8481,9 @@
 		51E3F9D10DA05D7100250911 /* Storage.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Storage.idl; sourceTree = "<group>"; };
 		51E3F9D40DA05E1D00250911 /* JSStorage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStorage.cpp; sourceTree = "<group>"; };
 		51E3F9D50DA05E1D00250911 /* JSStorage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStorage.h; sourceTree = "<group>"; };
-		51EC92570CE90DB400F90308 /* SQLError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLError.h; sourceTree = "<group>"; };
-		51EC92580CE90DB400F90308 /* SQLError.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLError.idl; sourceTree = "<group>"; };
 		51EC925D0CE90DD400F90308 /* JSCustomSQLStatementErrorCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCustomSQLStatementErrorCallback.cpp; sourceTree = "<group>"; };
 		51F6A3D50663BF04004D2919 /* HTMLCanvasElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLCanvasElement.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		51F6A3D60663BF04004D2919 /* HTMLCanvasElement.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = HTMLCanvasElement.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
-		51FAFE330CECBF2D00BB3F24 /* DatabaseTrackerClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseTrackerClient.h; sourceTree = "<group>"; };
-		51FB54F4113E364200821176 /* CloseEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CloseEvent.h; sourceTree = "<group>"; };
-		51FB54F6113E365900821176 /* CloseEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = CloseEvent.idl; sourceTree = "<group>"; };
 		51FB5502113E3E9100821176 /* JSCloseEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCloseEvent.h; sourceTree = "<group>"; };
 		51FB5503113E3E9100821176 /* JSCloseEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCloseEvent.cpp; sourceTree = "<group>"; };
 		521D46F511AEC98100514613 /* KillRingMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = KillRingMac.mm; sourceTree = "<group>"; };
@@ -8497,8 +8497,6 @@
 		53C8298C13D8D92700DE2DEB /* RenderFlexibleBox.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderFlexibleBox.h; sourceTree = "<group>"; };
 		550A0BC7085F6039007353D6 /* QualifiedName.cpp */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = QualifiedName.cpp; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		550A0BC8085F6039007353D6 /* QualifiedName.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = QualifiedName.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
-		572E92F914E540580087FFBA /* ShadowRootList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ShadowRootList.cpp; path = ../../dom/ShadowRootList.cpp; sourceTree = "<group>"; };
-		572E92FA14E540580087FFBA /* ShadowRootList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ShadowRootList.h; path = ../../dom/ShadowRootList.h; sourceTree = "<group>"; };
 		573D134514CE39FF0057ABCA /* InspectorTypeBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorTypeBuilder.cpp; sourceTree = "<group>"; };
 		573D134614CE39FF0057ABCA /* InspectorTypeBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorTypeBuilder.h; sourceTree = "<group>"; };
 		57B7919F14C6A62900F202D1 /* HTMLContentSelector.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLContentSelector.cpp; sourceTree = "<group>"; };
@@ -8509,6 +8507,8 @@
 		57B791A814C6A63300F202D1 /* HTMLContentElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLContentElement.h; sourceTree = "<group>"; };
 		57CF497214EE36D700ECFF14 /* InsertionPoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InsertionPoint.cpp; sourceTree = "<group>"; };
 		57CF497314EE36D700ECFF14 /* InsertionPoint.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InsertionPoint.h; sourceTree = "<group>"; };
+		57CF4C8414F7597A00ECFF14 /* ShadowTree.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ShadowTree.cpp; sourceTree = "<group>"; };
+		57CF4C8514F7597A00ECFF14 /* ShadowTree.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ShadowTree.h; sourceTree = "<group>"; };
 		5905ADBD1302F3CE00F116DF /* XMLTreeViewer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XMLTreeViewer.cpp; sourceTree = "<group>"; };
 		5905ADBE1302F3CE00F116DF /* XMLTreeViewer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XMLTreeViewer.h; sourceTree = "<group>"; };
 		590E1B4811E4EF4B0069F784 /* DeviceOrientation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeviceOrientation.h; sourceTree = "<group>"; };
@@ -8768,10 +8768,6 @@
 		758978EB127090D60076D5A9 /* SpeechInputResult.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SpeechInputResult.h; sourceTree = "<group>"; };
 		7633A72413D8B33A008501B6 /* LocaleToScriptMapping.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LocaleToScriptMapping.h; sourceTree = "<group>"; };
 		7633A72513D8B33A008501B6 /* LocaleToScriptMappingDefault.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LocaleToScriptMappingDefault.cpp; sourceTree = "<group>"; };
-		7637C540112E7B74003D6CDC /* WebSocketHandshakeRequest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketHandshakeRequest.cpp; sourceTree = "<group>"; };
-		7637C542112E7B7E003D6CDC /* WebSocketHandshakeRequest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketHandshakeRequest.h; sourceTree = "<group>"; };
-		767F99BD11A1194A0080C51D /* WebSocketHandshakeResponse.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketHandshakeResponse.cpp; sourceTree = "<group>"; };
-		767F99BF11A119560080C51D /* WebSocketHandshakeResponse.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketHandshakeResponse.h; sourceTree = "<group>"; };
 		7694563A1214D97C0007CBAE /* JSDOMTokenList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMTokenList.cpp; sourceTree = "<group>"; };
 		7694563B1214D97C0007CBAE /* JSDOMTokenList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMTokenList.h; sourceTree = "<group>"; };
 		769456591214DB630007CBAE /* DOMDOMTokenList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMDOMTokenList.h; sourceTree = "<group>"; };
@@ -8786,6 +8782,11 @@
 		76FC2B0912370DA0006A991A /* DOMTokenList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMTokenList.h; sourceTree = "<group>"; };
 		76FC2B0A12370DA0006A991A /* DOMTokenList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMTokenList.idl; sourceTree = "<group>"; };
 		76FF17E211235673001D61B5 /* PluginViewNone.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginViewNone.cpp; sourceTree = "<group>"; };
+		7728694B14F8882500F484DC /* EXTTextureFilterAnisotropic.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = EXTTextureFilterAnisotropic.cpp; path = canvas/EXTTextureFilterAnisotropic.cpp; sourceTree = "<group>"; };
+		7728694C14F8882500F484DC /* EXTTextureFilterAnisotropic.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = EXTTextureFilterAnisotropic.h; path = canvas/EXTTextureFilterAnisotropic.h; sourceTree = "<group>"; };
+		7728694D14F8882500F484DC /* EXTTextureFilterAnisotropic.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = EXTTextureFilterAnisotropic.idl; path = canvas/EXTTextureFilterAnisotropic.idl; sourceTree = "<group>"; };
+		7728698114FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSEXTTextureFilterAnisotropic.cpp; sourceTree = "<group>"; };
+		7728698214FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSEXTTextureFilterAnisotropic.h; sourceTree = "<group>"; };
 		77A17A6E12F28182004E02F6 /* OESVertexArrayObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = OESVertexArrayObject.cpp; path = canvas/OESVertexArrayObject.cpp; sourceTree = "<group>"; };
 		77A17A6F12F28182004E02F6 /* OESVertexArrayObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = OESVertexArrayObject.h; path = canvas/OESVertexArrayObject.h; sourceTree = "<group>"; };
 		77A17A7012F28182004E02F6 /* OESVertexArrayObject.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = OESVertexArrayObject.idl; path = canvas/OESVertexArrayObject.idl; sourceTree = "<group>"; };
@@ -8868,18 +8869,12 @@
 		809DD1DE130DE2AD00CAE3ED /* CSSStyleApplyProperty.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSStyleApplyProperty.h; sourceTree = "<group>"; };
 		8102C5871325BB1100DDE67A /* StringCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StringCallback.cpp; sourceTree = "<group>"; };
 		815E6166132587AA00B622B0 /* DataTransferItem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DataTransferItem.cpp; sourceTree = "<group>"; };
-		81A7325D1210189B00FC0D9E /* IDBCursor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBCursor.h; sourceTree = "<group>"; };
-		81A7325F121018A400FC0D9E /* IDBCursor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBCursor.cpp; sourceTree = "<group>"; };
-		81A73277121019E100FC0D9E /* IDBCursorBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBCursorBackendImpl.h; sourceTree = "<group>"; };
 		81AC5997131636E60009A7E0 /* DataTransferItem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataTransferItem.h; sourceTree = "<group>"; };
 		81AC5998131636E60009A7E0 /* DataTransferItemList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DataTransferItemList.h; sourceTree = "<group>"; };
 		81AC5AE81316392E0009A7E0 /* DataTransferItem.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DataTransferItem.idl; sourceTree = "<group>"; };
 		81AC5AE91316392E0009A7E0 /* DataTransferItemList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DataTransferItemList.idl; sourceTree = "<group>"; };
 		81AC6C34131C57C20009A7E0 /* StringCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = StringCallback.idl; sourceTree = "<group>"; };
 		81AC6C35131C57D30009A7E0 /* StringCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringCallback.h; sourceTree = "<group>"; };
-		81BE209311F4AB8D00915DFA /* IDBCursorBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBCursorBackendImpl.cpp; sourceTree = "<group>"; };
-		81BE209411F4AB8D00915DFA /* IDBCursorBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBCursorBackendInterface.h; sourceTree = "<group>"; };
-		81BE209C11F4ABBD00915DFA /* IDBCursor.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBCursor.idl; sourceTree = "<group>"; };
 		81BE20A711F4B66F00915DFA /* JSIDBCursor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSIDBCursor.cpp; sourceTree = "<group>"; };
 		81BE20A811F4B66F00915DFA /* JSIDBCursor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSIDBCursor.h; sourceTree = "<group>"; };
 		81F65FF513788FAA00FF6F2D /* DragState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DragState.h; sourceTree = "<group>"; };
@@ -9901,6 +9896,8 @@
 		8AA61CFD144D595B00F37350 /* WebKitCSSRegionRule.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitCSSRegionRule.cpp; sourceTree = "<group>"; };
 		8AA61CFE144D595B00F37350 /* WebKitCSSRegionRule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitCSSRegionRule.h; sourceTree = "<group>"; };
 		8AB4BC76126FDB7100DEB727 /* IgnoreDestructiveWriteCountIncrementer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IgnoreDestructiveWriteCountIncrementer.h; sourceTree = "<group>"; };
+		8ABAFB9D14F5107500A4984B /* RegionNodeList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegionNodeList.cpp; sourceTree = "<group>"; };
+		8ABAFB9E14F5107500A4984B /* RegionNodeList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegionNodeList.h; sourceTree = "<group>"; };
 		8ACC24CD148E24B200EFCC0D /* JSWebKitCSSRegionRule.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitCSSRegionRule.cpp; sourceTree = "<group>"; };
 		8ACC24CE148E24B200EFCC0D /* JSWebKitCSSRegionRule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebKitCSSRegionRule.h; sourceTree = "<group>"; };
 		8ACC2817148E47E700EFCC0D /* DOMWebKitCSSRegionRule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWebKitCSSRegionRule.h; sourceTree = "<group>"; };
@@ -10196,6 +10193,98 @@
 		9711460014EF009A00674FD9 /* NavigatorGeolocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = NavigatorGeolocation.cpp; path = Modules/geolocation/NavigatorGeolocation.cpp; sourceTree = "<group>"; };
 		9711460114EF009A00674FD9 /* NavigatorGeolocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = NavigatorGeolocation.h; path = Modules/geolocation/NavigatorGeolocation.h; sourceTree = "<group>"; };
 		9711460214EF009A00674FD9 /* NavigatorGeolocation.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = NavigatorGeolocation.idl; path = Modules/geolocation/NavigatorGeolocation.idl; sourceTree = "<group>"; };
+		9712A55415004EDA0048AF10 /* DOMWindowIndexedDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DOMWindowIndexedDatabase.cpp; path = Modules/indexeddb/DOMWindowIndexedDatabase.cpp; sourceTree = "<group>"; };
+		9712A55515004EDA0048AF10 /* DOMWindowIndexedDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DOMWindowIndexedDatabase.h; path = Modules/indexeddb/DOMWindowIndexedDatabase.h; sourceTree = "<group>"; };
+		9712A55615004EDA0048AF10 /* DOMWindowIndexedDatabase.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DOMWindowIndexedDatabase.idl; path = Modules/indexeddb/DOMWindowIndexedDatabase.idl; sourceTree = "<group>"; };
+		9712A55715004EDA0048AF10 /* IDBAny.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBAny.cpp; path = Modules/indexeddb/IDBAny.cpp; sourceTree = "<group>"; };
+		9712A55815004EDA0048AF10 /* IDBAny.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBAny.h; path = Modules/indexeddb/IDBAny.h; sourceTree = "<group>"; };
+		9712A55915004EDA0048AF10 /* IDBAny.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBAny.idl; path = Modules/indexeddb/IDBAny.idl; sourceTree = "<group>"; };
+		9712A55A15004EDA0048AF10 /* IDBBackingStore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBBackingStore.h; path = Modules/indexeddb/IDBBackingStore.h; sourceTree = "<group>"; };
+		9712A55B15004EDA0048AF10 /* IDBCallbacks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBCallbacks.h; path = Modules/indexeddb/IDBCallbacks.h; sourceTree = "<group>"; };
+		9712A55C15004EDA0048AF10 /* IDBCursor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBCursor.cpp; path = Modules/indexeddb/IDBCursor.cpp; sourceTree = "<group>"; };
+		9712A55D15004EDA0048AF10 /* IDBCursor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBCursor.h; path = Modules/indexeddb/IDBCursor.h; sourceTree = "<group>"; };
+		9712A55E15004EDA0048AF10 /* IDBCursor.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBCursor.idl; path = Modules/indexeddb/IDBCursor.idl; sourceTree = "<group>"; };
+		9712A55F15004EDA0048AF10 /* IDBCursorBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBCursorBackendImpl.cpp; path = Modules/indexeddb/IDBCursorBackendImpl.cpp; sourceTree = "<group>"; };
+		9712A56015004EDA0048AF10 /* IDBCursorBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBCursorBackendImpl.h; path = Modules/indexeddb/IDBCursorBackendImpl.h; sourceTree = "<group>"; };
+		9712A56115004EDA0048AF10 /* IDBCursorBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBCursorBackendInterface.h; path = Modules/indexeddb/IDBCursorBackendInterface.h; sourceTree = "<group>"; };
+		9712A56215004EDA0048AF10 /* IDBCursorWithValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBCursorWithValue.cpp; path = Modules/indexeddb/IDBCursorWithValue.cpp; sourceTree = "<group>"; };
+		9712A56315004EDA0048AF10 /* IDBCursorWithValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBCursorWithValue.h; path = Modules/indexeddb/IDBCursorWithValue.h; sourceTree = "<group>"; };
+		9712A56415004EDA0048AF10 /* IDBCursorWithValue.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBCursorWithValue.idl; path = Modules/indexeddb/IDBCursorWithValue.idl; sourceTree = "<group>"; };
+		9712A56515004EDA0048AF10 /* IDBDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBDatabase.cpp; path = Modules/indexeddb/IDBDatabase.cpp; sourceTree = "<group>"; };
+		9712A56615004EDA0048AF10 /* IDBDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBDatabase.h; path = Modules/indexeddb/IDBDatabase.h; sourceTree = "<group>"; };
+		9712A56715004EDA0048AF10 /* IDBDatabase.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBDatabase.idl; path = Modules/indexeddb/IDBDatabase.idl; sourceTree = "<group>"; };
+		9712A56815004EDA0048AF10 /* IDBDatabaseBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBDatabaseBackendImpl.cpp; path = Modules/indexeddb/IDBDatabaseBackendImpl.cpp; sourceTree = "<group>"; };
+		9712A56915004EDA0048AF10 /* IDBDatabaseBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBDatabaseBackendImpl.h; path = Modules/indexeddb/IDBDatabaseBackendImpl.h; sourceTree = "<group>"; };
+		9712A56A15004EDA0048AF10 /* IDBDatabaseBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBDatabaseBackendInterface.h; path = Modules/indexeddb/IDBDatabaseBackendInterface.h; sourceTree = "<group>"; };
+		9712A56B15004EDA0048AF10 /* IDBDatabaseCallbacks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBDatabaseCallbacks.h; path = Modules/indexeddb/IDBDatabaseCallbacks.h; sourceTree = "<group>"; };
+		9712A56C15004EDA0048AF10 /* IDBDatabaseCallbacksImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBDatabaseCallbacksImpl.cpp; path = Modules/indexeddb/IDBDatabaseCallbacksImpl.cpp; sourceTree = "<group>"; };
+		9712A56D15004EDA0048AF10 /* IDBDatabaseCallbacksImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBDatabaseCallbacksImpl.h; path = Modules/indexeddb/IDBDatabaseCallbacksImpl.h; sourceTree = "<group>"; };
+		9712A56E15004EDA0048AF10 /* IDBDatabaseError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBDatabaseError.h; path = Modules/indexeddb/IDBDatabaseError.h; sourceTree = "<group>"; };
+		9712A56F15004EDA0048AF10 /* IDBDatabaseError.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBDatabaseError.idl; path = Modules/indexeddb/IDBDatabaseError.idl; sourceTree = "<group>"; };
+		9712A57015004EDA0048AF10 /* IDBDatabaseException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBDatabaseException.cpp; path = Modules/indexeddb/IDBDatabaseException.cpp; sourceTree = "<group>"; };
+		9712A57115004EDA0048AF10 /* IDBDatabaseException.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBDatabaseException.h; path = Modules/indexeddb/IDBDatabaseException.h; sourceTree = "<group>"; };
+		9712A57215004EDA0048AF10 /* IDBDatabaseException.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBDatabaseException.idl; path = Modules/indexeddb/IDBDatabaseException.idl; sourceTree = "<group>"; };
+		9712A57315004EDA0048AF10 /* IDBEventDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBEventDispatcher.cpp; path = Modules/indexeddb/IDBEventDispatcher.cpp; sourceTree = "<group>"; };
+		9712A57415004EDA0048AF10 /* IDBEventDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBEventDispatcher.h; path = Modules/indexeddb/IDBEventDispatcher.h; sourceTree = "<group>"; };
+		9712A57515004EDA0048AF10 /* IDBFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBFactory.cpp; path = Modules/indexeddb/IDBFactory.cpp; sourceTree = "<group>"; };
+		9712A57615004EDA0048AF10 /* IDBFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBFactory.h; path = Modules/indexeddb/IDBFactory.h; sourceTree = "<group>"; };
+		9712A57715004EDA0048AF10 /* IDBFactory.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBFactory.idl; path = Modules/indexeddb/IDBFactory.idl; sourceTree = "<group>"; };
+		9712A57815004EDA0048AF10 /* IDBFactoryBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBFactoryBackendImpl.cpp; path = Modules/indexeddb/IDBFactoryBackendImpl.cpp; sourceTree = "<group>"; };
+		9712A57915004EDA0048AF10 /* IDBFactoryBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBFactoryBackendImpl.h; path = Modules/indexeddb/IDBFactoryBackendImpl.h; sourceTree = "<group>"; };
+		9712A57A15004EDA0048AF10 /* IDBFactoryBackendInterface.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBFactoryBackendInterface.cpp; path = Modules/indexeddb/IDBFactoryBackendInterface.cpp; sourceTree = "<group>"; };
+		9712A57B15004EDA0048AF10 /* IDBFactoryBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBFactoryBackendInterface.h; path = Modules/indexeddb/IDBFactoryBackendInterface.h; sourceTree = "<group>"; };
+		9712A57C15004EDA0048AF10 /* IDBIndex.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBIndex.cpp; path = Modules/indexeddb/IDBIndex.cpp; sourceTree = "<group>"; };
+		9712A57D15004EDA0048AF10 /* IDBIndex.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBIndex.h; path = Modules/indexeddb/IDBIndex.h; sourceTree = "<group>"; };
+		9712A57E15004EDA0048AF10 /* IDBIndex.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBIndex.idl; path = Modules/indexeddb/IDBIndex.idl; sourceTree = "<group>"; };
+		9712A57F15004EDA0048AF10 /* IDBIndexBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBIndexBackendImpl.cpp; path = Modules/indexeddb/IDBIndexBackendImpl.cpp; sourceTree = "<group>"; };
+		9712A58015004EDA0048AF10 /* IDBIndexBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBIndexBackendImpl.h; path = Modules/indexeddb/IDBIndexBackendImpl.h; sourceTree = "<group>"; };
+		9712A58115004EDA0048AF10 /* IDBIndexBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBIndexBackendInterface.h; path = Modules/indexeddb/IDBIndexBackendInterface.h; sourceTree = "<group>"; };
+		9712A58215004EDA0048AF10 /* IDBKey.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBKey.cpp; path = Modules/indexeddb/IDBKey.cpp; sourceTree = "<group>"; };
+		9712A58315004EDA0048AF10 /* IDBKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBKey.h; path = Modules/indexeddb/IDBKey.h; sourceTree = "<group>"; };
+		9712A58415004EDA0048AF10 /* IDBKey.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBKey.idl; path = Modules/indexeddb/IDBKey.idl; sourceTree = "<group>"; };
+		9712A58515004EDA0048AF10 /* IDBKeyPath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBKeyPath.cpp; path = Modules/indexeddb/IDBKeyPath.cpp; sourceTree = "<group>"; };
+		9712A58615004EDA0048AF10 /* IDBKeyPath.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBKeyPath.h; path = Modules/indexeddb/IDBKeyPath.h; sourceTree = "<group>"; };
+		9712A58715004EDA0048AF10 /* IDBKeyPathBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBKeyPathBackendImpl.cpp; path = Modules/indexeddb/IDBKeyPathBackendImpl.cpp; sourceTree = "<group>"; };
+		9712A58815004EDA0048AF10 /* IDBKeyPathBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBKeyPathBackendImpl.h; path = Modules/indexeddb/IDBKeyPathBackendImpl.h; sourceTree = "<group>"; };
+		9712A58915004EDA0048AF10 /* IDBKeyRange.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBKeyRange.cpp; path = Modules/indexeddb/IDBKeyRange.cpp; sourceTree = "<group>"; };
+		9712A58A15004EDA0048AF10 /* IDBKeyRange.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBKeyRange.h; path = Modules/indexeddb/IDBKeyRange.h; sourceTree = "<group>"; };
+		9712A58B15004EDA0048AF10 /* IDBKeyRange.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBKeyRange.idl; path = Modules/indexeddb/IDBKeyRange.idl; sourceTree = "<group>"; };
+		9712A58C15004EDA0048AF10 /* IDBLevelDBBackingStore.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBLevelDBBackingStore.cpp; path = Modules/indexeddb/IDBLevelDBBackingStore.cpp; sourceTree = "<group>"; };
+		9712A58D15004EDA0048AF10 /* IDBLevelDBBackingStore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBLevelDBBackingStore.h; path = Modules/indexeddb/IDBLevelDBBackingStore.h; sourceTree = "<group>"; };
+		9712A58E15004EDA0048AF10 /* IDBLevelDBCoding.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBLevelDBCoding.cpp; path = Modules/indexeddb/IDBLevelDBCoding.cpp; sourceTree = "<group>"; };
+		9712A58F15004EDA0048AF10 /* IDBLevelDBCoding.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBLevelDBCoding.h; path = Modules/indexeddb/IDBLevelDBCoding.h; sourceTree = "<group>"; };
+		9712A59015004EDA0048AF10 /* IDBObjectStore.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBObjectStore.cpp; path = Modules/indexeddb/IDBObjectStore.cpp; sourceTree = "<group>"; };
+		9712A59115004EDA0048AF10 /* IDBObjectStore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBObjectStore.h; path = Modules/indexeddb/IDBObjectStore.h; sourceTree = "<group>"; };
+		9712A59215004EDA0048AF10 /* IDBObjectStore.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBObjectStore.idl; path = Modules/indexeddb/IDBObjectStore.idl; sourceTree = "<group>"; };
+		9712A59315004EDA0048AF10 /* IDBObjectStoreBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBObjectStoreBackendImpl.cpp; path = Modules/indexeddb/IDBObjectStoreBackendImpl.cpp; sourceTree = "<group>"; };
+		9712A59415004EDA0048AF10 /* IDBObjectStoreBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBObjectStoreBackendImpl.h; path = Modules/indexeddb/IDBObjectStoreBackendImpl.h; sourceTree = "<group>"; };
+		9712A59515004EDA0048AF10 /* IDBObjectStoreBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBObjectStoreBackendInterface.h; path = Modules/indexeddb/IDBObjectStoreBackendInterface.h; sourceTree = "<group>"; };
+		9712A59615004EDA0048AF10 /* IDBPendingTransactionMonitor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBPendingTransactionMonitor.cpp; path = Modules/indexeddb/IDBPendingTransactionMonitor.cpp; sourceTree = "<group>"; };
+		9712A59715004EDA0048AF10 /* IDBPendingTransactionMonitor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBPendingTransactionMonitor.h; path = Modules/indexeddb/IDBPendingTransactionMonitor.h; sourceTree = "<group>"; };
+		9712A59815004EDA0048AF10 /* IDBRequest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBRequest.cpp; path = Modules/indexeddb/IDBRequest.cpp; sourceTree = "<group>"; };
+		9712A59915004EDA0048AF10 /* IDBRequest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBRequest.h; path = Modules/indexeddb/IDBRequest.h; sourceTree = "<group>"; };
+		9712A59A15004EDA0048AF10 /* IDBRequest.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBRequest.idl; path = Modules/indexeddb/IDBRequest.idl; sourceTree = "<group>"; };
+		9712A59B15004EDA0048AF10 /* IDBTracing.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBTracing.h; path = Modules/indexeddb/IDBTracing.h; sourceTree = "<group>"; };
+		9712A59C15004EDA0048AF10 /* IDBTransaction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBTransaction.cpp; path = Modules/indexeddb/IDBTransaction.cpp; sourceTree = "<group>"; };
+		9712A59D15004EDA0048AF10 /* IDBTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBTransaction.h; path = Modules/indexeddb/IDBTransaction.h; sourceTree = "<group>"; };
+		9712A59E15004EDA0048AF10 /* IDBTransaction.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBTransaction.idl; path = Modules/indexeddb/IDBTransaction.idl; sourceTree = "<group>"; };
+		9712A59F15004EDA0048AF10 /* IDBTransactionBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBTransactionBackendImpl.cpp; path = Modules/indexeddb/IDBTransactionBackendImpl.cpp; sourceTree = "<group>"; };
+		9712A5A015004EDA0048AF10 /* IDBTransactionBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBTransactionBackendImpl.h; path = Modules/indexeddb/IDBTransactionBackendImpl.h; sourceTree = "<group>"; };
+		9712A5A115004EDA0048AF10 /* IDBTransactionBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBTransactionBackendInterface.h; path = Modules/indexeddb/IDBTransactionBackendInterface.h; sourceTree = "<group>"; };
+		9712A5A215004EDA0048AF10 /* IDBTransactionCallbacks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBTransactionCallbacks.h; path = Modules/indexeddb/IDBTransactionCallbacks.h; sourceTree = "<group>"; };
+		9712A5A315004EDA0048AF10 /* IDBTransactionCoordinator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBTransactionCoordinator.cpp; path = Modules/indexeddb/IDBTransactionCoordinator.cpp; sourceTree = "<group>"; };
+		9712A5A415004EDA0048AF10 /* IDBTransactionCoordinator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBTransactionCoordinator.h; path = Modules/indexeddb/IDBTransactionCoordinator.h; sourceTree = "<group>"; };
+		9712A5A515004EDA0048AF10 /* IDBVersionChangeEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBVersionChangeEvent.cpp; path = Modules/indexeddb/IDBVersionChangeEvent.cpp; sourceTree = "<group>"; };
+		9712A5A615004EDA0048AF10 /* IDBVersionChangeEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBVersionChangeEvent.h; path = Modules/indexeddb/IDBVersionChangeEvent.h; sourceTree = "<group>"; };
+		9712A5A715004EDA0048AF10 /* IDBVersionChangeEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBVersionChangeEvent.idl; path = Modules/indexeddb/IDBVersionChangeEvent.idl; sourceTree = "<group>"; };
+		9712A5A815004EDA0048AF10 /* IDBVersionChangeRequest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = IDBVersionChangeRequest.cpp; path = Modules/indexeddb/IDBVersionChangeRequest.cpp; sourceTree = "<group>"; };
+		9712A5A915004EDA0048AF10 /* IDBVersionChangeRequest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = IDBVersionChangeRequest.h; path = Modules/indexeddb/IDBVersionChangeRequest.h; sourceTree = "<group>"; };
+		9712A5AA15004EDA0048AF10 /* IDBVersionChangeRequest.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDBVersionChangeRequest.idl; path = Modules/indexeddb/IDBVersionChangeRequest.idl; sourceTree = "<group>"; };
+		9712A5AB15004EDA0048AF10 /* PageGroupIndexedDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = PageGroupIndexedDatabase.cpp; path = Modules/indexeddb/PageGroupIndexedDatabase.cpp; sourceTree = "<group>"; };
+		9712A5AC15004EDA0048AF10 /* PageGroupIndexedDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PageGroupIndexedDatabase.h; path = Modules/indexeddb/PageGroupIndexedDatabase.h; sourceTree = "<group>"; };
+		9712A60E150090CE0048AF10 /* WorkerContextIndexedDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WorkerContextIndexedDatabase.cpp; path = Modules/indexeddb/WorkerContextIndexedDatabase.cpp; sourceTree = "<group>"; };
+		9712A60F150090CE0048AF10 /* WorkerContextIndexedDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerContextIndexedDatabase.h; path = Modules/indexeddb/WorkerContextIndexedDatabase.h; sourceTree = "<group>"; };
+		9712A610150090CE0048AF10 /* WorkerContextIndexedDatabase.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WorkerContextIndexedDatabase.idl; path = Modules/indexeddb/WorkerContextIndexedDatabase.idl; sourceTree = "<group>"; };
 		97205AAD123928CA00B17380 /* FTPDirectoryDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FTPDirectoryDocument.cpp; sourceTree = "<group>"; };
 		97205AAE123928CA00B17380 /* FTPDirectoryDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FTPDirectoryDocument.h; sourceTree = "<group>"; };
 		97205AB11239291000B17380 /* ImageDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ImageDocument.cpp; sourceTree = "<group>"; };
@@ -10253,6 +10342,9 @@
 		975CA289130365F800E99AD9 /* Crypto.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Crypto.idl; sourceTree = "<group>"; };
 		975CA29F1303679D00E99AD9 /* JSCrypto.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSCrypto.cpp; sourceTree = "<group>"; };
 		975CA2A01303679D00E99AD9 /* JSCrypto.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSCrypto.h; sourceTree = "<group>"; };
+		97627B8B14FB3CEE002CDCA1 /* ContextDestructionObserver.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ContextDestructionObserver.cpp; sourceTree = "<group>"; };
+		97627B8C14FB3CEE002CDCA1 /* ContextDestructionObserver.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContextDestructionObserver.h; sourceTree = "<group>"; };
+		97627B9714FB5424002CDCA1 /* Supplementable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Supplementable.h; sourceTree = "<group>"; };
 		97665011144FAA4200F6BB51 /* EventFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventFactory.h; sourceTree = "<group>"; };
 		9766504E144FBFFE00F6BB51 /* EventFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventFactory.cpp; sourceTree = "<group>"; };
 		9767CE09145ABC12005E64DB /* ExceptionHeaders.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExceptionHeaders.h; sourceTree = "<group>"; };
@@ -10271,8 +10363,6 @@
 		976D6C67122B8A3D001FD1F7 /* FileList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileList.h; path = fileapi/FileList.h; sourceTree = "<group>"; };
 		976D6C69122B8A3D001FD1F7 /* FileReader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FileReader.cpp; path = fileapi/FileReader.cpp; sourceTree = "<group>"; };
 		976D6C6A122B8A3D001FD1F7 /* FileReader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileReader.h; path = fileapi/FileReader.h; sourceTree = "<group>"; };
-		976D6C6C122B8A3D001FD1F7 /* FileStreamProxy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FileStreamProxy.cpp; path = fileapi/FileStreamProxy.cpp; sourceTree = "<group>"; };
-		976D6C6D122B8A3D001FD1F7 /* FileStreamProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileStreamProxy.h; path = fileapi/FileStreamProxy.h; sourceTree = "<group>"; };
 		976D6C6E122B8A3D001FD1F7 /* FileThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FileThread.cpp; path = fileapi/FileThread.cpp; sourceTree = "<group>"; };
 		976D6C6F122B8A3D001FD1F7 /* FileThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileThread.h; path = fileapi/FileThread.h; sourceTree = "<group>"; };
 		976D6C70122B8A3D001FD1F7 /* FileThreadTask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileThreadTask.h; path = fileapi/FileThreadTask.h; sourceTree = "<group>"; };
@@ -10319,8 +10409,6 @@
 		978AD67114130A8D00C7CAE3 /* HTMLSpanElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLSpanElement.cpp; sourceTree = "<group>"; };
 		978AD67214130A8D00C7CAE3 /* HTMLSpanElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLSpanElement.h; sourceTree = "<group>"; };
 		978AD67314130A8D00C7CAE3 /* HTMLSpanElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLSpanElement.idl; sourceTree = "<group>"; };
-		978D07B1145A0EBD0096908D /* IDBDatabaseException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBDatabaseException.cpp; sourceTree = "<group>"; };
-		978D07B3145A0ECD0096908D /* SQLException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLException.cpp; sourceTree = "<group>"; };
 		978D07B5145A0F030096908D /* FileException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FileException.cpp; path = fileapi/FileException.cpp; sourceTree = "<group>"; };
 		978D07B7145A0F1B0096908D /* OperationNotAllowedException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = OperationNotAllowedException.cpp; path = fileapi/OperationNotAllowedException.cpp; sourceTree = "<group>"; };
 		978D07B9145A0F3C0096908D /* RangeException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RangeException.cpp; sourceTree = "<group>"; };
@@ -10333,6 +10421,103 @@
 		979F43D21075E44A0000F83B /* NavigationScheduler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NavigationScheduler.h; sourceTree = "<group>"; };
 		97AA3CA3145237CC003E1DA6 /* EventTargetHeaders.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventTargetHeaders.h; sourceTree = "<group>"; };
 		97AA3CA4145237CC003E1DA6 /* EventTargetInterfaces.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventTargetInterfaces.h; sourceTree = "<group>"; };
+		97AABCF814FA09D5007457AE /* CloseEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CloseEvent.h; path = Modules/websockets/CloseEvent.h; sourceTree = "<group>"; };
+		97AABCF914FA09D5007457AE /* CloseEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CloseEvent.idl; path = Modules/websockets/CloseEvent.idl; sourceTree = "<group>"; };
+		97AABCFA14FA09D5007457AE /* DOMWindowWebSocket.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DOMWindowWebSocket.idl; path = Modules/websockets/DOMWindowWebSocket.idl; sourceTree = "<group>"; };
+		97AABCFB14FA09D5007457AE /* ThreadableWebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ThreadableWebSocketChannel.cpp; path = Modules/websockets/ThreadableWebSocketChannel.cpp; sourceTree = "<group>"; };
+		97AABCFC14FA09D5007457AE /* ThreadableWebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ThreadableWebSocketChannel.h; path = Modules/websockets/ThreadableWebSocketChannel.h; sourceTree = "<group>"; };
+		97AABCFD14FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ThreadableWebSocketChannelClientWrapper.cpp; path = Modules/websockets/ThreadableWebSocketChannelClientWrapper.cpp; sourceTree = "<group>"; };
+		97AABCFE14FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ThreadableWebSocketChannelClientWrapper.h; path = Modules/websockets/ThreadableWebSocketChannelClientWrapper.h; sourceTree = "<group>"; };
+		97AABCFF14FA09D5007457AE /* WebSocket.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebSocket.cpp; path = Modules/websockets/WebSocket.cpp; sourceTree = "<group>"; };
+		97AABD0014FA09D5007457AE /* WebSocket.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocket.h; path = Modules/websockets/WebSocket.h; sourceTree = "<group>"; };
+		97AABD0114FA09D5007457AE /* WebSocket.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WebSocket.idl; path = Modules/websockets/WebSocket.idl; sourceTree = "<group>"; };
+		97AABD0214FA09D5007457AE /* WebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebSocketChannel.cpp; path = Modules/websockets/WebSocketChannel.cpp; sourceTree = "<group>"; };
+		97AABD0314FA09D5007457AE /* WebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketChannel.h; path = Modules/websockets/WebSocketChannel.h; sourceTree = "<group>"; };
+		97AABD0414FA09D5007457AE /* WebSocketChannelClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketChannelClient.h; path = Modules/websockets/WebSocketChannelClient.h; sourceTree = "<group>"; };
+		97AABD0514FA09D5007457AE /* WebSocketDeflater.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebSocketDeflater.cpp; path = Modules/websockets/WebSocketDeflater.cpp; sourceTree = "<group>"; };
+		97AABD0614FA09D5007457AE /* WebSocketDeflater.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketDeflater.h; path = Modules/websockets/WebSocketDeflater.h; sourceTree = "<group>"; };
+		97AABD0714FA09D5007457AE /* WebSocketExtensionDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebSocketExtensionDispatcher.cpp; path = Modules/websockets/WebSocketExtensionDispatcher.cpp; sourceTree = "<group>"; };
+		97AABD0814FA09D5007457AE /* WebSocketExtensionDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketExtensionDispatcher.h; path = Modules/websockets/WebSocketExtensionDispatcher.h; sourceTree = "<group>"; };
+		97AABD0914FA09D5007457AE /* WebSocketExtensionProcessor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketExtensionProcessor.h; path = Modules/websockets/WebSocketExtensionProcessor.h; sourceTree = "<group>"; };
+		97AABD0A14FA09D5007457AE /* WebSocketFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketFrame.h; path = Modules/websockets/WebSocketFrame.h; sourceTree = "<group>"; };
+		97AABD0B14FA09D5007457AE /* WebSocketHandshake.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebSocketHandshake.cpp; path = Modules/websockets/WebSocketHandshake.cpp; sourceTree = "<group>"; };
+		97AABD0C14FA09D5007457AE /* WebSocketHandshake.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketHandshake.h; path = Modules/websockets/WebSocketHandshake.h; sourceTree = "<group>"; };
+		97AABD0D14FA09D5007457AE /* WebSocketHandshakeRequest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebSocketHandshakeRequest.cpp; path = Modules/websockets/WebSocketHandshakeRequest.cpp; sourceTree = "<group>"; };
+		97AABD0E14FA09D5007457AE /* WebSocketHandshakeRequest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketHandshakeRequest.h; path = Modules/websockets/WebSocketHandshakeRequest.h; sourceTree = "<group>"; };
+		97AABD0F14FA09D5007457AE /* WebSocketHandshakeResponse.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WebSocketHandshakeResponse.cpp; path = Modules/websockets/WebSocketHandshakeResponse.cpp; sourceTree = "<group>"; };
+		97AABD1014FA09D5007457AE /* WebSocketHandshakeResponse.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebSocketHandshakeResponse.h; path = Modules/websockets/WebSocketHandshakeResponse.h; sourceTree = "<group>"; };
+		97AABD1114FA09D5007457AE /* WorkerThreadableWebSocketChannel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WorkerThreadableWebSocketChannel.cpp; path = Modules/websockets/WorkerThreadableWebSocketChannel.cpp; sourceTree = "<group>"; };
+		97AABD1214FA09D5007457AE /* WorkerThreadableWebSocketChannel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerThreadableWebSocketChannel.h; path = Modules/websockets/WorkerThreadableWebSocketChannel.h; sourceTree = "<group>"; };
+		97BC69D61505F076001B74AC /* AbstractDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AbstractDatabase.cpp; path = Modules/webdatabase/AbstractDatabase.cpp; sourceTree = "<group>"; };
+		97BC69D71505F076001B74AC /* AbstractDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AbstractDatabase.h; path = Modules/webdatabase/AbstractDatabase.h; sourceTree = "<group>"; };
+		97BC69D81505F076001B74AC /* ChangeVersionWrapper.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ChangeVersionWrapper.cpp; path = Modules/webdatabase/ChangeVersionWrapper.cpp; sourceTree = "<group>"; };
+		97BC69D91505F076001B74AC /* ChangeVersionWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ChangeVersionWrapper.h; path = Modules/webdatabase/ChangeVersionWrapper.h; sourceTree = "<group>"; };
+		97BC69DE1505F081001B74AC /* Database.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Database.cpp; path = Modules/webdatabase/Database.cpp; sourceTree = "<group>"; };
+		97BC69DF1505F081001B74AC /* Database.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Database.h; path = Modules/webdatabase/Database.h; sourceTree = "<group>"; };
+		97BC69E01505F081001B74AC /* Database.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = Database.idl; path = Modules/webdatabase/Database.idl; sourceTree = "<group>"; };
+		97BC69E11505F081001B74AC /* DatabaseAuthorizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DatabaseAuthorizer.cpp; path = Modules/webdatabase/DatabaseAuthorizer.cpp; sourceTree = "<group>"; };
+		97BC69E21505F081001B74AC /* DatabaseAuthorizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseAuthorizer.h; path = Modules/webdatabase/DatabaseAuthorizer.h; sourceTree = "<group>"; };
+		97BC69E31505F081001B74AC /* DatabaseCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseCallback.h; path = Modules/webdatabase/DatabaseCallback.h; sourceTree = "<group>"; };
+		97BC69E41505F081001B74AC /* DatabaseCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DatabaseCallback.idl; path = Modules/webdatabase/DatabaseCallback.idl; sourceTree = "<group>"; };
+		97BC69E51505F081001B74AC /* DatabaseContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DatabaseContext.cpp; path = Modules/webdatabase/DatabaseContext.cpp; sourceTree = "<group>"; };
+		97BC69E61505F081001B74AC /* DatabaseContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseContext.h; path = Modules/webdatabase/DatabaseContext.h; sourceTree = "<group>"; };
+		97BC69E71505F081001B74AC /* DatabaseDetails.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseDetails.h; path = Modules/webdatabase/DatabaseDetails.h; sourceTree = "<group>"; };
+		97BC69E81505F081001B74AC /* DatabaseSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DatabaseSync.cpp; path = Modules/webdatabase/DatabaseSync.cpp; sourceTree = "<group>"; };
+		97BC69E91505F081001B74AC /* DatabaseSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseSync.h; path = Modules/webdatabase/DatabaseSync.h; sourceTree = "<group>"; };
+		97BC69EA1505F081001B74AC /* DatabaseSync.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DatabaseSync.idl; path = Modules/webdatabase/DatabaseSync.idl; sourceTree = "<group>"; };
+		97BC69EB1505F081001B74AC /* DatabaseTask.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DatabaseTask.cpp; path = Modules/webdatabase/DatabaseTask.cpp; sourceTree = "<group>"; };
+		97BC69EC1505F081001B74AC /* DatabaseTask.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseTask.h; path = Modules/webdatabase/DatabaseTask.h; sourceTree = "<group>"; };
+		97BC69ED1505F081001B74AC /* DatabaseThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DatabaseThread.cpp; path = Modules/webdatabase/DatabaseThread.cpp; sourceTree = "<group>"; };
+		97BC69EE1505F081001B74AC /* DatabaseThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseThread.h; path = Modules/webdatabase/DatabaseThread.h; sourceTree = "<group>"; };
+		97BC69EF1505F081001B74AC /* DatabaseTracker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DatabaseTracker.cpp; path = Modules/webdatabase/DatabaseTracker.cpp; sourceTree = "<group>"; };
+		97BC69F01505F081001B74AC /* DatabaseTracker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseTracker.h; path = Modules/webdatabase/DatabaseTracker.h; sourceTree = "<group>"; };
+		97BC69F11505F081001B74AC /* DatabaseTrackerClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DatabaseTrackerClient.h; path = Modules/webdatabase/DatabaseTrackerClient.h; sourceTree = "<group>"; };
+		97BC69F21505F081001B74AC /* DOMWindowSQLDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DOMWindowSQLDatabase.cpp; path = Modules/webdatabase/DOMWindowSQLDatabase.cpp; sourceTree = "<group>"; };
+		97BC69F31505F081001B74AC /* DOMWindowSQLDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DOMWindowSQLDatabase.h; path = Modules/webdatabase/DOMWindowSQLDatabase.h; sourceTree = "<group>"; };
+		97BC69F41505F081001B74AC /* DOMWindowSQLDatabase.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DOMWindowSQLDatabase.idl; path = Modules/webdatabase/DOMWindowSQLDatabase.idl; sourceTree = "<group>"; };
+		97BC69F51505F081001B74AC /* OriginQuotaManager.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = OriginQuotaManager.cpp; path = Modules/webdatabase/OriginQuotaManager.cpp; sourceTree = "<group>"; };
+		97BC69F61505F081001B74AC /* OriginQuotaManager.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = OriginQuotaManager.h; path = Modules/webdatabase/OriginQuotaManager.h; sourceTree = "<group>"; };
+		97BC69F71505F081001B74AC /* OriginUsageRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = OriginUsageRecord.cpp; path = Modules/webdatabase/OriginUsageRecord.cpp; sourceTree = "<group>"; };
+		97BC69F81505F081001B74AC /* OriginUsageRecord.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = OriginUsageRecord.h; path = Modules/webdatabase/OriginUsageRecord.h; sourceTree = "<group>"; };
+		97BC69F91505F081001B74AC /* SQLCallbackWrapper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLCallbackWrapper.h; path = Modules/webdatabase/SQLCallbackWrapper.h; sourceTree = "<group>"; };
+		97BC69FA1505F081001B74AC /* SQLError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLError.h; path = Modules/webdatabase/SQLError.h; sourceTree = "<group>"; };
+		97BC69FB1505F081001B74AC /* SQLError.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLError.idl; path = Modules/webdatabase/SQLError.idl; sourceTree = "<group>"; };
+		97BC69FC1505F081001B74AC /* SQLException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLException.cpp; path = Modules/webdatabase/SQLException.cpp; sourceTree = "<group>"; };
+		97BC69FD1505F081001B74AC /* SQLException.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLException.h; path = Modules/webdatabase/SQLException.h; sourceTree = "<group>"; };
+		97BC69FE1505F081001B74AC /* SQLException.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLException.idl; path = Modules/webdatabase/SQLException.idl; sourceTree = "<group>"; };
+		97BC69FF1505F081001B74AC /* SQLResultSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLResultSet.cpp; path = Modules/webdatabase/SQLResultSet.cpp; sourceTree = "<group>"; };
+		97BC6A001505F081001B74AC /* SQLResultSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLResultSet.h; path = Modules/webdatabase/SQLResultSet.h; sourceTree = "<group>"; };
+		97BC6A011505F081001B74AC /* SQLResultSet.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLResultSet.idl; path = Modules/webdatabase/SQLResultSet.idl; sourceTree = "<group>"; };
+		97BC6A021505F081001B74AC /* SQLResultSetRowList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLResultSetRowList.cpp; path = Modules/webdatabase/SQLResultSetRowList.cpp; sourceTree = "<group>"; };
+		97BC6A031505F081001B74AC /* SQLResultSetRowList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLResultSetRowList.h; path = Modules/webdatabase/SQLResultSetRowList.h; sourceTree = "<group>"; };
+		97BC6A041505F081001B74AC /* SQLResultSetRowList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLResultSetRowList.idl; path = Modules/webdatabase/SQLResultSetRowList.idl; sourceTree = "<group>"; };
+		97BC6A051505F081001B74AC /* SQLStatement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLStatement.cpp; path = Modules/webdatabase/SQLStatement.cpp; sourceTree = "<group>"; };
+		97BC6A061505F081001B74AC /* SQLStatement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLStatement.h; path = Modules/webdatabase/SQLStatement.h; sourceTree = "<group>"; };
+		97BC6A071505F081001B74AC /* SQLStatementCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLStatementCallback.h; path = Modules/webdatabase/SQLStatementCallback.h; sourceTree = "<group>"; };
+		97BC6A081505F081001B74AC /* SQLStatementCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLStatementCallback.idl; path = Modules/webdatabase/SQLStatementCallback.idl; sourceTree = "<group>"; };
+		97BC6A091505F081001B74AC /* SQLStatementErrorCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLStatementErrorCallback.h; path = Modules/webdatabase/SQLStatementErrorCallback.h; sourceTree = "<group>"; };
+		97BC6A0A1505F081001B74AC /* SQLStatementErrorCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLStatementErrorCallback.idl; path = Modules/webdatabase/SQLStatementErrorCallback.idl; sourceTree = "<group>"; };
+		97BC6A0B1505F081001B74AC /* SQLStatementSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLStatementSync.cpp; path = Modules/webdatabase/SQLStatementSync.cpp; sourceTree = "<group>"; };
+		97BC6A0C1505F081001B74AC /* SQLStatementSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLStatementSync.h; path = Modules/webdatabase/SQLStatementSync.h; sourceTree = "<group>"; };
+		97BC6A0D1505F081001B74AC /* SQLTransaction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLTransaction.cpp; path = Modules/webdatabase/SQLTransaction.cpp; sourceTree = "<group>"; };
+		97BC6A0E1505F081001B74AC /* SQLTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLTransaction.h; path = Modules/webdatabase/SQLTransaction.h; sourceTree = "<group>"; };
+		97BC6A0F1505F081001B74AC /* SQLTransaction.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLTransaction.idl; path = Modules/webdatabase/SQLTransaction.idl; sourceTree = "<group>"; };
+		97BC6A101505F081001B74AC /* SQLTransactionCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLTransactionCallback.h; path = Modules/webdatabase/SQLTransactionCallback.h; sourceTree = "<group>"; };
+		97BC6A111505F081001B74AC /* SQLTransactionCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLTransactionCallback.idl; path = Modules/webdatabase/SQLTransactionCallback.idl; sourceTree = "<group>"; };
+		97BC6A121505F081001B74AC /* SQLTransactionClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLTransactionClient.cpp; path = Modules/webdatabase/SQLTransactionClient.cpp; sourceTree = "<group>"; };
+		97BC6A131505F081001B74AC /* SQLTransactionClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLTransactionClient.h; path = Modules/webdatabase/SQLTransactionClient.h; sourceTree = "<group>"; };
+		97BC6A141505F081001B74AC /* SQLTransactionCoordinator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLTransactionCoordinator.cpp; path = Modules/webdatabase/SQLTransactionCoordinator.cpp; sourceTree = "<group>"; };
+		97BC6A151505F081001B74AC /* SQLTransactionCoordinator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLTransactionCoordinator.h; path = Modules/webdatabase/SQLTransactionCoordinator.h; sourceTree = "<group>"; };
+		97BC6A161505F081001B74AC /* SQLTransactionErrorCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLTransactionErrorCallback.h; path = Modules/webdatabase/SQLTransactionErrorCallback.h; sourceTree = "<group>"; };
+		97BC6A171505F081001B74AC /* SQLTransactionErrorCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLTransactionErrorCallback.idl; path = Modules/webdatabase/SQLTransactionErrorCallback.idl; sourceTree = "<group>"; };
+		97BC6A181505F081001B74AC /* SQLTransactionSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLTransactionSync.cpp; path = Modules/webdatabase/SQLTransactionSync.cpp; sourceTree = "<group>"; };
+		97BC6A191505F081001B74AC /* SQLTransactionSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLTransactionSync.h; path = Modules/webdatabase/SQLTransactionSync.h; sourceTree = "<group>"; };
+		97BC6A1A1505F081001B74AC /* SQLTransactionSync.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLTransactionSync.idl; path = Modules/webdatabase/SQLTransactionSync.idl; sourceTree = "<group>"; };
+		97BC6A1B1505F081001B74AC /* SQLTransactionSyncCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLTransactionSyncCallback.h; path = Modules/webdatabase/SQLTransactionSyncCallback.h; sourceTree = "<group>"; };
+		97BC6A1C1505F081001B74AC /* SQLTransactionSyncCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = SQLTransactionSyncCallback.idl; path = Modules/webdatabase/SQLTransactionSyncCallback.idl; sourceTree = "<group>"; };
+		97BC6A1D1505F081001B74AC /* WorkerContextSQLDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WorkerContextSQLDatabase.cpp; path = Modules/webdatabase/WorkerContextSQLDatabase.cpp; sourceTree = "<group>"; };
+		97BC6A1E1505F081001B74AC /* WorkerContextSQLDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerContextSQLDatabase.h; path = Modules/webdatabase/WorkerContextSQLDatabase.h; sourceTree = "<group>"; };
+		97BC6A1F1505F081001B74AC /* WorkerContextSQLDatabase.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = WorkerContextSQLDatabase.idl; path = Modules/webdatabase/WorkerContextSQLDatabase.idl; sourceTree = "<group>"; };
 		97BC84811236FD93000C6161 /* TextDocumentParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = TextDocumentParser.cpp; path = parser/TextDocumentParser.cpp; sourceTree = "<group>"; };
 		97BC84821236FD93000C6161 /* TextDocumentParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TextDocumentParser.h; path = parser/TextDocumentParser.h; sourceTree = "<group>"; };
 		97BC849A12370A4B000C6161 /* HTMLInputStream.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HTMLInputStream.h; path = parser/HTMLInputStream.h; sourceTree = "<group>"; };
@@ -10344,8 +10529,6 @@
 		97C1F552122855CB00EDE616 /* HTMLToken.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HTMLToken.h; path = parser/HTMLToken.h; sourceTree = "<group>"; };
 		97C471D912F925BC0086354B /* ContentSecurityPolicy.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ContentSecurityPolicy.cpp; sourceTree = "<group>"; };
 		97C471DA12F925BD0086354B /* ContentSecurityPolicy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContentSecurityPolicy.h; sourceTree = "<group>"; };
-		97CC3AE014E8E4A200894988 /* NavigatorSupplement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NavigatorSupplement.cpp; sourceTree = "<group>"; };
-		97CC3AE114E8E4A200894988 /* NavigatorSupplement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NavigatorSupplement.h; sourceTree = "<group>"; };
 		97D2AD0114B823A60093DF32 /* DOMWindowProperty.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMWindowProperty.cpp; sourceTree = "<group>"; };
 		97D2AD0214B823A60093DF32 /* DOMWindowProperty.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWindowProperty.h; sourceTree = "<group>"; };
 		97DCE1FF10807C750057D394 /* HistoryController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HistoryController.cpp; sourceTree = "<group>"; };
@@ -10416,6 +10599,8 @@
 		A10BB5891484E3B300B2E87A /* RenderSVGShape.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGShape.h; sourceTree = "<group>"; };
 		A10DC76814747BAB005E2471 /* StyleGridData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = StyleGridData.cpp; path = style/StyleGridData.cpp; sourceTree = "<group>"; };
 		A10DC76914747BAB005E2471 /* StyleGridData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = StyleGridData.h; path = style/StyleGridData.h; sourceTree = "<group>"; };
+		A110DB9A14F5DF7700A03B93 /* StyleGridItemData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = StyleGridItemData.h; path = style/StyleGridItemData.h; sourceTree = "<group>"; };
+		A110DB9C14F5DF8700A03B93 /* StyleGridItemData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = StyleGridItemData.cpp; path = style/StyleGridItemData.cpp; sourceTree = "<group>"; };
 		A120ACA013F9983700FE4AC7 /* LayoutRepainter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LayoutRepainter.h; sourceTree = "<group>"; };
 		A120ACA113F9984600FE4AC7 /* LayoutRepainter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LayoutRepainter.cpp; sourceTree = "<group>"; };
 		A136A00A1134DBD200CC8D50 /* XMLHttpRequestProgressEventThrottle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XMLHttpRequestProgressEventThrottle.cpp; sourceTree = "<group>"; };
@@ -10477,8 +10662,6 @@
 		A718760D0B2A120100A16ECE /* DragActions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DragActions.h; sourceTree = "<group>"; };
 		A718788F0B2D04AC00A16ECE /* DragControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DragControllerMac.mm; sourceTree = "<group>"; };
 		A71A70C911AFB02000989D6D /* HTMLMeterElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLMeterElement.idl; sourceTree = "<group>"; };
-		A71E083514E3CEAF006A4619 /* PageSupplement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageSupplement.cpp; sourceTree = "<group>"; };
-		A71E083614E3CEAF006A4619 /* PageSupplement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageSupplement.h; sourceTree = "<group>"; };
 		A723F77A1484CA4C008C6DBE /* PlatformExportMacros.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformExportMacros.h; sourceTree = "<group>"; };
 		A73F95FC12C97BFE0031AAF9 /* RoundedRect.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RoundedRect.cpp; sourceTree = "<group>"; };
 		A73F95FD12C97BFE0031AAF9 /* RoundedRect.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RoundedRect.h; sourceTree = "<group>"; };
@@ -10538,7 +10721,6 @@
 		A7D20F60107F406900A80392 /* JSWebGLActiveInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLActiveInfo.cpp; sourceTree = "<group>"; };
 		A7D20F61107F406900A80392 /* JSWebGLActiveInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLActiveInfo.h; sourceTree = "<group>"; };
 		A7D20F6B107F438B00A80392 /* WebGLActiveInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebGLActiveInfo.h; path = canvas/WebGLActiveInfo.h; sourceTree = "<group>"; };
-		A7D3C5230B576B4B002CA450 /* PasteboardHelper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PasteboardHelper.h; sourceTree = "<group>"; };
 		A7D6B3470F61104500B79FD1 /* WorkerScriptLoader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerScriptLoader.h; path = workers/WorkerScriptLoader.h; sourceTree = "<group>"; };
 		A7D6B3480F61104500B79FD1 /* WorkerScriptLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = WorkerScriptLoader.cpp; path = workers/WorkerScriptLoader.cpp; sourceTree = "<group>"; };
 		A7DB418114CE1F0A00A2E316 /* ShadowRoot.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = ShadowRoot.idl; sourceTree = "<group>"; };
@@ -10677,8 +10859,7 @@
 		A833C80A0A2CF25600D57664 /* XMLNames.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = XMLNames.cpp; sourceTree = "<group>"; };
 		A833C80B0A2CF25600D57664 /* XMLNames.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = XMLNames.h; sourceTree = "<group>"; };
 		A83B533814F399BB00720D9D /* IDLAttributes.txt */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = IDLAttributes.txt; path = scripts/IDLAttributes.txt; sourceTree = "<group>"; };
-		A83B535B14F7413A00720D9D /* DOMWindowWebGL.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = DOMWindowWebGL.idl; path = canvas/DOMWindowWebGL.idl; sourceTree = "<group>"; };
-		A83B536C14F749E200720D9D /* DOMWindowXML.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMWindowXML.idl; sourceTree = "<group>"; };
+		A83B538014FBB2EC00720D9D /* preprocess-idls.pl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.perl; name = "preprocess-idls.pl"; path = "scripts/preprocess-idls.pl"; sourceTree = "<group>"; };
 		A83B78F20CCAFF15000B0825 /* JSSVGFontFaceUriElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSVGFontFaceUriElement.h; sourceTree = "<group>"; };
 		A83B78F30CCAFF15000B0825 /* JSSVGFontFaceUriElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGFontFaceUriElement.cpp; sourceTree = "<group>"; };
 		A83B78F40CCAFF15000B0825 /* JSSVGFontFaceSrcElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSVGFontFaceSrcElement.h; sourceTree = "<group>"; };
@@ -10786,10 +10967,8 @@
 		A88DD4880B4629B000C02990 /* PathTraversalState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PathTraversalState.cpp; sourceTree = "<group>"; };
 		A89943260B42338700D7C802 /* BitmapImage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BitmapImage.h; sourceTree = "<group>"; };
 		A89943270B42338700D7C802 /* BitmapImage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BitmapImage.cpp; sourceTree = "<group>"; };
-		A89AACD514F6C12700C1FA4A /* DOMWindowSVG.idl */ = {isa = PBXFileReference; lastKnownFileType = text; path = DOMWindowSVG.idl; sourceTree = "<group>"; };
 		A89CCC500F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ReplaceNodeWithSpanCommand.cpp; sourceTree = "<group>"; };
 		A89CCC510F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ReplaceNodeWithSpanCommand.h; sourceTree = "<group>"; };
-		A8A5205D14F6BD3C00FBA19E /* DOMWindowHTML.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMWindowHTML.idl; sourceTree = "<group>"; };
 		A8BC04911214F69600B5F122 /* HTMLEntityTable.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLEntityTable.cpp; sourceTree = "<group>"; };
 		A8C2280D11D4A59700D5A7D3 /* DocumentParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentParser.cpp; sourceTree = "<group>"; };
 		A8C2289F11D5722E00D5A7D3 /* DecodedDataDocumentParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DecodedDataDocumentParser.h; sourceTree = "<group>"; };
@@ -11032,10 +11211,6 @@
 		A8EA80040A19516E00A8EF5F /* StyleSheet.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = StyleSheet.h; sourceTree = "<group>"; };
 		A8EA80050A19516E00A8EF5F /* StyleSheet.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = StyleSheet.cpp; sourceTree = "<group>"; };
 		A8EA80060A19516E00A8EF5F /* MediaList.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = MediaList.h; sourceTree = "<group>"; };
-		A8F4578F14B2B004000CEA59 /* resolve-supplemental.pl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.script.perl; name = "resolve-supplemental.pl"; path = "scripts/resolve-supplemental.pl"; sourceTree = "<group>"; };
-		A8F4579D14BC13EC000CEA59 /* DOMWindowSQLDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMWindowSQLDatabase.cpp; sourceTree = "<group>"; };
-		A8F4579E14BC13EC000CEA59 /* DOMWindowSQLDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMWindowSQLDatabase.h; sourceTree = "<group>"; };
-		A8F4579F14BC13EC000CEA59 /* DOMWindowSQLDatabase.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMWindowSQLDatabase.idl; sourceTree = "<group>"; };
 		A8FA6E5B0E4CFDED00D5CF49 /* Pattern.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Pattern.h; sourceTree = "<group>"; };
 		A8FA6E5C0E4CFDED00D5CF49 /* Pattern.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Pattern.cpp; sourceTree = "<group>"; };
 		A9C6E4E10D745E05006442E9 /* DOMMimeType.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = DOMMimeType.cpp; sourceTree = "<group>"; };
@@ -11890,36 +12065,17 @@
 		B2FA3D300AB75A6F000E5AC4 /* JSSVGZoomEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGZoomEvent.cpp; sourceTree = "<group>"; };
 		B2FA3D310AB75A6F000E5AC4 /* JSSVGZoomEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSSVGZoomEvent.h; sourceTree = "<group>"; };
 		B50F5B800E96CD9900AD71A6 /* WebCoreObjCExtras.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreObjCExtras.mm; sourceTree = "<group>"; };
-		B51BF6EE102C9E590002C15A /* SQLTransactionClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLTransactionClient.cpp; sourceTree = "<group>"; };
-		B51BF6EF102C9E590002C15A /* SQLTransactionClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransactionClient.h; sourceTree = "<group>"; };
-		B523CEFF1182675400EBB29C /* SQLTransactionSyncCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransactionSyncCallback.h; sourceTree = "<group>"; };
-		B523CF011182675400EBB29C /* SQLTransactionSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransactionSync.h; sourceTree = "<group>"; };
-		B523CF021182675400EBB29C /* SQLTransactionSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLTransactionSync.cpp; sourceTree = "<group>"; };
-		B523CF031182675400EBB29C /* DatabaseSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatabaseSync.cpp; sourceTree = "<group>"; };
-		B523CF041182675400EBB29C /* DatabaseSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseSync.h; sourceTree = "<group>"; };
 		B525A96311CA2340003A23A8 /* JSSQLException.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLException.h; sourceTree = "<group>"; };
 		B525A96411CA2340003A23A8 /* JSSQLException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLException.cpp; sourceTree = "<group>"; };
 		B5320D69122A24E9002D1440 /* FontPlatformData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FontPlatformData.h; sourceTree = "<group>"; };
 		B5320D6A122A24E9002D1440 /* FontPlatformDataCocoa.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = FontPlatformDataCocoa.mm; sourceTree = "<group>"; };
-		B550B52111DC68A800923885 /* SQLStatementSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLStatementSync.cpp; sourceTree = "<group>"; };
-		B550B52211DC68A800923885 /* SQLStatementSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLStatementSync.h; sourceTree = "<group>"; };
 		B55D5AA2119131FC00BCC315 /* JSSQLTransactionSyncCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLTransactionSyncCallback.h; sourceTree = "<group>"; };
 		B55D5AA3119131FC00BCC315 /* JSSQLTransactionSyncCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLTransactionSyncCallback.cpp; sourceTree = "<group>"; };
 		B55D5AA71191325000BCC315 /* JSSQLTransactionSyncCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLTransactionSyncCustom.cpp; sourceTree = "<group>"; };
-		B55D5ABB1191327200BCC315 /* DatabaseSync.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DatabaseSync.idl; sourceTree = "<group>"; };
-		B55D5ABC1191327200BCC315 /* SQLTransactionSync.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLTransactionSync.idl; sourceTree = "<group>"; };
-		B55D5ABD1191327200BCC315 /* SQLTransactionSyncCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLTransactionSyncCallback.idl; sourceTree = "<group>"; };
-		B56EBA8311C9FF8100B04477 /* SQLException.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLException.h; sourceTree = "<group>"; };
-		B56EBA8411C9FF8100B04477 /* SQLException.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLException.idl; sourceTree = "<group>"; };
 		B58CEB6711913607002A6790 /* JSDatabaseSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDatabaseSync.h; sourceTree = "<group>"; };
 		B58CEB6811913607002A6790 /* JSDatabaseSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDatabaseSync.cpp; sourceTree = "<group>"; };
 		B58CEB6B1191361C002A6790 /* JSSQLTransactionSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLTransactionSync.h; sourceTree = "<group>"; };
 		B58CEB6C1191361C002A6790 /* JSSQLTransactionSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLTransactionSync.cpp; sourceTree = "<group>"; };
-		B59DD68D1190298E007E9684 /* DatabaseCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DatabaseCallback.idl; sourceTree = "<group>"; };
-		B59DD68E1190298E007E9684 /* SQLStatementCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLStatementCallback.idl; sourceTree = "<group>"; };
-		B59DD68F1190298E007E9684 /* SQLStatementErrorCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLStatementErrorCallback.idl; sourceTree = "<group>"; };
-		B59DD6901190298E007E9684 /* SQLTransactionCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLTransactionCallback.idl; sourceTree = "<group>"; };
-		B59DD6911190298E007E9684 /* SQLTransactionErrorCallback.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLTransactionErrorCallback.idl; sourceTree = "<group>"; };
 		B59DD697119029E5007E9684 /* JSDatabaseCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDatabaseCallback.h; sourceTree = "<group>"; };
 		B59DD698119029E5007E9684 /* JSDatabaseCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDatabaseCallback.cpp; sourceTree = "<group>"; };
 		B59DD69B11902A42007E9684 /* JSSQLTransactionCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLTransactionCallback.h; sourceTree = "<group>"; };
@@ -11932,19 +12088,8 @@
 		B59DD6A811902A71007E9684 /* JSSQLStatementErrorCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLStatementErrorCallback.cpp; sourceTree = "<group>"; };
 		B5A684210FFABE9800D24689 /* SQLiteFileSystem.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLiteFileSystem.h; path = sql/SQLiteFileSystem.h; sourceTree = "<group>"; };
 		B5A684230FFABEAA00D24689 /* SQLiteFileSystem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLiteFileSystem.cpp; path = sql/SQLiteFileSystem.cpp; sourceTree = "<group>"; };
-		B5B5DC67119BB3D5002A8790 /* AbstractDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AbstractDatabase.cpp; sourceTree = "<group>"; };
-		B5B5DC68119BB3D5002A8790 /* AbstractDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AbstractDatabase.h; sourceTree = "<group>"; };
-		B5C11239102B6C4600096578 /* SQLTransactionCoordinator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLTransactionCoordinator.cpp; sourceTree = "<group>"; };
-		B5C1123A102B6C4600096578 /* SQLTransactionCoordinator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLTransactionCoordinator.h; sourceTree = "<group>"; };
 		B5D31DF811CF610B009F22B4 /* ActiveDOMCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ActiveDOMCallback.cpp; path = generic/ActiveDOMCallback.cpp; sourceTree = "<group>"; };
 		B5D31DF911CF610B009F22B4 /* ActiveDOMCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ActiveDOMCallback.h; path = generic/ActiveDOMCallback.h; sourceTree = "<group>"; };
-		B5D36019112F8B560048DEA8 /* DatabaseCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatabaseCallback.h; sourceTree = "<group>"; };
-		B61762531203374F00EF9114 /* IDBDatabaseBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBDatabaseBackendInterface.h; sourceTree = "<group>"; };
-		B61762611203490800EF9114 /* IDBDatabaseBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBDatabaseBackendImpl.h; sourceTree = "<group>"; };
-		B6566267120B115A006EA85C /* IDBTransaction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBTransaction.cpp; sourceTree = "<group>"; };
-		B6566268120B115A006EA85C /* IDBTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBTransaction.h; sourceTree = "<group>"; };
-		B6566269120B115A006EA85C /* IDBTransaction.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBTransaction.idl; sourceTree = "<group>"; };
-		B656626D120B116B006EA85C /* IDBTransactionBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBTransactionBackendInterface.h; sourceTree = "<group>"; };
 		B656626E120B1227006EA85C /* JSIDBTransaction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSIDBTransaction.h; sourceTree = "<group>"; };
 		B656626F120B1227006EA85C /* JSIDBTransaction.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSIDBTransaction.cpp; sourceTree = "<group>"; };
 		B734B180119B9911006587BD /* FontTranscoder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FontTranscoder.cpp; path = transcoder/FontTranscoder.cpp; sourceTree = "<group>"; };
@@ -12039,7 +12184,7 @@
 		BC23EE910DAED2BC009FDC91 /* CSSImageGeneratorValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSImageGeneratorValue.h; sourceTree = "<group>"; };
 		BC23F0DA0DAFF4A4009FDC91 /* GeneratedImage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GeneratedImage.h; sourceTree = "<group>"; };
 		BC2441C30E8B65D00055320F /* ScrollView.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScrollView.cpp; sourceTree = "<group>"; };
-		BC25B528131C6D3900180E10 /* LocalizedStringsMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = LocalizedStringsMac.mm; sourceTree = "<group>"; };
+		BC25B528131C6D3900180E10 /* LocalizedStringsMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LocalizedStringsMac.cpp; sourceTree = "<group>"; };
 		BC274B2E140EBEB200EADFA6 /* CSSBorderImageSliceValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSBorderImageSliceValue.h; sourceTree = "<group>"; };
 		BC274B30140EBED800EADFA6 /* CSSBorderImageSliceValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSBorderImageSliceValue.cpp; sourceTree = "<group>"; };
 		BC275B7811C5D1C300C9206C /* JSWebKitPointCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebKitPointCustom.cpp; sourceTree = "<group>"; };
@@ -12274,7 +12419,7 @@
 		BC98A27C0C0C9950004BEBF7 /* JSStyleSheetCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStyleSheetCustom.cpp; sourceTree = "<group>"; };
 		BC99812D0DBE807A008CE9EF /* DOMAbstractViewFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMAbstractViewFrame.h; sourceTree = "<group>"; };
 		BC9A6141146859D9006057FD /* DOMExceptions.in */ = {isa = PBXFileReference; lastKnownFileType = text; path = DOMExceptions.in; sourceTree = "<group>"; };
-		BC9A6142146859D9006057FD /* EventFactory.in */ = {isa = PBXFileReference; lastKnownFileType = text; path = EventFactory.in; sourceTree = "<group>"; };
+		BC9A6142146859D9006057FD /* EventNames.in */ = {isa = PBXFileReference; lastKnownFileType = text; path = EventNames.in; sourceTree = "<group>"; };
 		BC9A6144146859D9006057FD /* make_dom_exceptions.pl */ = {isa = PBXFileReference; lastKnownFileType = text.script.perl; path = make_dom_exceptions.pl; sourceTree = "<group>"; };
 		BC9A6145146859D9006057FD /* make_event_factory.pl */ = {isa = PBXFileReference; lastKnownFileType = text.script.perl; path = make_event_factory.pl; sourceTree = "<group>"; };
 		BC9A6146146859D9006057FD /* make_names.pl */ = {isa = PBXFileReference; lastKnownFileType = text.script.perl; path = make_names.pl; sourceTree = "<group>"; };
@@ -12500,6 +12645,8 @@
 		C105DA610F3AA68F001DD44F /* TextEncodingDetectorICU.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TextEncodingDetectorICU.cpp; sourceTree = "<group>"; };
 		C105DA630F3AA6B8001DD44F /* TextEncodingDetector.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TextEncodingDetector.h; sourceTree = "<group>"; };
 		C330A22113EC196B0000B45B /* ColorChooser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ColorChooser.h; sourceTree = "<group>"; };
+		C33EE5C214FB49610002095A /* BaseClickableWithKeyInputType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BaseClickableWithKeyInputType.cpp; sourceTree = "<group>"; };
+		C33EE5C314FB49610002095A /* BaseClickableWithKeyInputType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BaseClickableWithKeyInputType.h; sourceTree = "<group>"; };
 		C37CDEBC149EF2030042090D /* ColorChooserClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ColorChooserClient.h; sourceTree = "<group>"; };
 		C50B561412119D23008B46E0 /* GroupSettings.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GroupSettings.cpp; sourceTree = "<group>"; };
 		C50B561512119D23008B46E0 /* GroupSettings.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GroupSettings.h; sourceTree = "<group>"; };
@@ -12520,12 +12667,6 @@
 		C55610F011A704EB00B82D27 /* DOMStringList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMStringList.cpp; sourceTree = "<group>"; };
 		C55E38BB10040D5D00A56BDB /* StorageNamespaceImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageNamespaceImpl.h; sourceTree = "<group>"; };
 		C55E38BC10040D5D00A56BDB /* StorageNamespaceImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageNamespaceImpl.cpp; sourceTree = "<group>"; };
-		C572EE041201C736007D8F82 /* IDBIndex.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBIndex.cpp; sourceTree = "<group>"; };
-		C572EE051201C736007D8F82 /* IDBIndex.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBIndex.h; sourceTree = "<group>"; };
-		C572EE061201C736007D8F82 /* IDBIndex.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBIndex.idl; sourceTree = "<group>"; };
-		C572EE071201C736007D8F82 /* IDBIndexBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBIndexBackendImpl.cpp; sourceTree = "<group>"; };
-		C572EE081201C736007D8F82 /* IDBIndexBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBIndexBackendImpl.h; sourceTree = "<group>"; };
-		C572EE091201C736007D8F82 /* IDBIndexBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBIndexBackendInterface.h; sourceTree = "<group>"; };
 		C572EE1C1201C9BC007D8F82 /* JSIDBIndex.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSIDBIndex.cpp; sourceTree = "<group>"; };
 		C572EE1D1201C9BC007D8F82 /* JSIDBIndex.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSIDBIndex.h; sourceTree = "<group>"; };
 		C57FEDE01212EE9C0097BE65 /* FileSystem.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FileSystem.cpp; sourceTree = "<group>"; };
@@ -12551,46 +12692,15 @@
 		C585A67911D4FB07004C3E4B /* JSIDBRequest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSIDBRequest.h; sourceTree = "<group>"; };
 		C585A69411D4FB13004C3E4B /* JSIDBFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSIDBFactory.cpp; sourceTree = "<group>"; };
 		C585A69511D4FB13004C3E4B /* JSIDBFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSIDBFactory.h; sourceTree = "<group>"; };
-		C585A69811D4FB3D004C3E4B /* IDBAny.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBAny.cpp; sourceTree = "<group>"; };
-		C585A69911D4FB3D004C3E4B /* IDBAny.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBAny.h; sourceTree = "<group>"; };
-		C585A69A11D4FB3D004C3E4B /* IDBAny.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBAny.idl; sourceTree = "<group>"; };
-		C585A69B11D4FB3D004C3E4B /* IDBCallbacks.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBCallbacks.h; sourceTree = "<group>"; };
-		C585A69D11D4FB3D004C3E4B /* IDBDatabaseError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBDatabaseError.h; sourceTree = "<group>"; };
-		C585A69E11D4FB3D004C3E4B /* IDBDatabaseError.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBDatabaseError.idl; sourceTree = "<group>"; };
-		C585A69F11D4FB3D004C3E4B /* IDBDatabaseException.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBDatabaseException.h; sourceTree = "<group>"; };
-		C585A6A011D4FB3D004C3E4B /* IDBDatabaseException.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBDatabaseException.idl; sourceTree = "<group>"; };
-		C585A6A111D4FB3D004C3E4B /* IDBDatabaseBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBDatabaseBackendImpl.cpp; sourceTree = "<group>"; };
-		C585A6A311D4FB3D004C3E4B /* IDBDatabase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBDatabase.cpp; sourceTree = "<group>"; };
-		C585A6A411D4FB3D004C3E4B /* IDBDatabase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBDatabase.h; sourceTree = "<group>"; };
-		C585A6A511D4FB3D004C3E4B /* IDBDatabase.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBDatabase.idl; sourceTree = "<group>"; };
-		C585A6B211D4FB3D004C3E4B /* IDBKey.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBKey.cpp; sourceTree = "<group>"; };
-		C585A6B311D4FB3D004C3E4B /* IDBKey.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBKey.h; sourceTree = "<group>"; };
-		C585A6B411D4FB3D004C3E4B /* IDBKey.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBKey.idl; sourceTree = "<group>"; };
-		C585A6B511D4FB3D004C3E4B /* IDBKeyRange.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBKeyRange.cpp; sourceTree = "<group>"; };
-		C585A6B611D4FB3D004C3E4B /* IDBKeyRange.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBKeyRange.h; sourceTree = "<group>"; };
-		C585A6B711D4FB3D004C3E4B /* IDBKeyRange.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBKeyRange.idl; sourceTree = "<group>"; };
-		C585A6B911D4FB3D004C3E4B /* IDBObjectStore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBObjectStore.h; sourceTree = "<group>"; };
-		C585A6BA11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBObjectStoreBackendImpl.cpp; sourceTree = "<group>"; };
-		C585A6BB11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBObjectStoreBackendImpl.h; sourceTree = "<group>"; };
-		C585A6BC11D4FB3D004C3E4B /* IDBObjectStore.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBObjectStore.cpp; sourceTree = "<group>"; };
-		C585A6BD11D4FB3D004C3E4B /* IDBObjectStoreBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBObjectStoreBackendInterface.h; sourceTree = "<group>"; };
-		C585A6BE11D4FB3D004C3E4B /* IDBObjectStore.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBObjectStore.idl; sourceTree = "<group>"; };
-		C585A6BF11D4FB3D004C3E4B /* IDBRequest.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBRequest.cpp; sourceTree = "<group>"; };
-		C585A6C011D4FB3D004C3E4B /* IDBRequest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBRequest.h; sourceTree = "<group>"; };
-		C585A6C111D4FB3D004C3E4B /* IDBRequest.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBRequest.idl; sourceTree = "<group>"; };
-		C585A6C511D4FB3D004C3E4B /* IDBFactoryBackendInterface.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBFactoryBackendInterface.cpp; sourceTree = "<group>"; };
-		C585A6C611D4FB3D004C3E4B /* IDBFactoryBackendInterface.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBFactoryBackendInterface.h; sourceTree = "<group>"; };
-		C585A6C711D4FB3D004C3E4B /* IDBFactoryBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBFactoryBackendImpl.cpp; sourceTree = "<group>"; };
-		C585A6C811D4FB3D004C3E4B /* IDBFactoryBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBFactoryBackendImpl.h; sourceTree = "<group>"; };
-		C585A6C911D4FB3D004C3E4B /* IDBFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBFactory.cpp; sourceTree = "<group>"; };
-		C585A6CA11D4FB3D004C3E4B /* IDBFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBFactory.h; sourceTree = "<group>"; };
-		C585A6CB11D4FB3D004C3E4B /* IDBFactory.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBFactory.idl; sourceTree = "<group>"; };
+		C5B4C24B1509236C00A6EF37 /* WebCoreNSURLExtras.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebCoreNSURLExtras.h; sourceTree = "<group>"; };
+		C5B4C24C1509236C00A6EF37 /* WebCoreNSURLExtras.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreNSURLExtras.mm; sourceTree = "<group>"; };
 		C5BAC16F14E30E4700008837 /* PlatformPasteboard.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformPasteboard.h; sourceTree = "<group>"; };
 		C5D4AA78116BAFB60069CA93 /* GlyphMetricsMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GlyphMetricsMap.h; sourceTree = "<group>"; };
 		C5E9B67610697E1300C7BB1A /* StorageEventDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StorageEventDispatcher.cpp; sourceTree = "<group>"; };
 		C5EBDD81105EDDEC0056816F /* StorageEventDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StorageEventDispatcher.h; sourceTree = "<group>"; };
 		C5F765B414E1D414006C899B /* PasteboardStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PasteboardStrategy.h; sourceTree = "<group>"; };
 		C5F765BA14E1ECF4006C899B /* PlatformPasteboardMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PlatformPasteboardMac.mm; sourceTree = "<group>"; };
+		C691614714F6EBA70046375C /* ScrollbarThemeClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollbarThemeClient.h; sourceTree = "<group>"; };
 		C6D74AD309AA282E000B0A52 /* ModifySelectionListLevel.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ModifySelectionListLevel.h; sourceTree = "<group>"; };
 		C6D74AE309AA290A000B0A52 /* ModifySelectionListLevel.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ModifySelectionListLevel.cpp; sourceTree = "<group>"; };
 		C6F08FB91430FE8F00685849 /* MutationRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MutationRecord.cpp; sourceTree = "<group>"; };
@@ -12614,6 +12724,8 @@
 		CA3BF67D10D99BAE00E6CE53 /* ScrollAnimator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScrollAnimator.h; sourceTree = "<group>"; };
 		CAE9F90D146441F000C245B0 /* CSSAspectRatioValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSAspectRatioValue.cpp; sourceTree = "<group>"; };
 		CAE9F90E146441F000C245B0 /* CSSAspectRatioValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSAspectRatioValue.h; sourceTree = "<group>"; };
+		CD127DEA14F3097900E84779 /* WebCoreFullScreenWindow.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebCoreFullScreenWindow.h; sourceTree = "<group>"; };
+		CD127DEB14F3097900E84779 /* WebCoreFullScreenWindow.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebCoreFullScreenWindow.mm; sourceTree = "<group>"; };
 		CD27F6E014575C1B0078207D /* MediaController.idl */ = {isa = PBXFileReference; lastKnownFileType = text; path = MediaController.idl; sourceTree = "<group>"; };
 		CD27F6E2145767580078207D /* JSMediaController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMediaController.cpp; sourceTree = "<group>"; };
 		CD27F6E3145767580078207D /* JSMediaController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMediaController.h; sourceTree = "<group>"; };
@@ -12679,12 +12791,8 @@
 		D23CA55C0AB0EAAE005108A5 /* JSRangeException.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSRangeException.h; sourceTree = "<group>"; };
 		D23CA55E0AB0EAB6005108A5 /* JSRangeException.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSRangeException.cpp; sourceTree = "<group>"; };
 		D23CA56B0AB0EB8D005108A5 /* RangeException.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RangeException.h; sourceTree = "<group>"; };
-		D302754312A5FE84004BD828 /* RenderDetails.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderDetails.cpp; sourceTree = "<group>"; };
-		D302754412A5FE84004BD828 /* RenderDetails.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderDetails.h; sourceTree = "<group>"; };
 		D302754512A5FE84004BD828 /* RenderDetailsMarker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderDetailsMarker.cpp; sourceTree = "<group>"; };
 		D302754612A5FE84004BD828 /* RenderDetailsMarker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderDetailsMarker.h; sourceTree = "<group>"; };
-		D302754B12A5FEAB004BD828 /* RenderSummary.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSummary.cpp; sourceTree = "<group>"; };
-		D302754C12A5FEAB004BD828 /* RenderSummary.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSummary.h; sourceTree = "<group>"; };
 		D340629A1253BC8C009E4259 /* MediaQueryListListener.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaQueryListListener.cpp; sourceTree = "<group>"; };
 		D359D786129CA2710006E5D2 /* HTMLDetailsElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLDetailsElement.cpp; sourceTree = "<group>"; };
 		D359D787129CA2710006E5D2 /* HTMLDetailsElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLDetailsElement.h; sourceTree = "<group>"; };
@@ -12760,6 +12868,7 @@
 		E1284BB010449FFA00EAEB52 /* JSPageTransitionEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPageTransitionEvent.cpp; sourceTree = "<group>"; };
 		E1284BD31044A01E00EAEB52 /* DOMPageTransitionEvent.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMPageTransitionEvent.mm; sourceTree = "<group>"; };
 		E1284BD41044A01E00EAEB52 /* DOMPageTransitionEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMPageTransitionEvent.h; sourceTree = "<group>"; };
+		E129CBD21501702200A7C5FB /* npapi-sandbox.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = "npapi-sandbox.h"; sourceTree = "<group>"; };
 		E12EDB7A0B308A78002704B6 /* EventTarget.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EventTarget.h; sourceTree = "<group>"; };
 		E12EDBE90B308E0B002704B6 /* EventTarget.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EventTarget.cpp; sourceTree = "<group>"; };
 		E134F5AA12EE343F004EC58D /* IntRectHash.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntRectHash.h; sourceTree = "<group>"; };
@@ -12857,6 +12966,8 @@
 		E1C8BE5C0E8BD15A0064CB7D /* JSWorker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWorker.cpp; sourceTree = "<group>"; };
 		E1CA5CBB0E8CDCAF00E8EF90 /* JSWorkerCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWorkerCustom.cpp; sourceTree = "<group>"; };
 		E1CAA5C50E8BD23600A73ECA /* JSWorker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWorker.h; sourceTree = "<group>"; };
+		E1CDE91F15018ED000862CC5 /* AsyncFileStream.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = AsyncFileStream.cpp; path = fileapi/AsyncFileStream.cpp; sourceTree = "<group>"; };
+		E1CDE9211501916900862CC5 /* AsyncFileStream.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AsyncFileStream.h; path = fileapi/AsyncFileStream.h; sourceTree = "<group>"; };
 		E1E1BEFF115FF6FB006F52CA /* WindowsKeyboardCodes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WindowsKeyboardCodes.h; sourceTree = "<group>"; };
 		E1E6EEA30B628DA8005F2F70 /* JSHTMLSelectElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLSelectElement.cpp; sourceTree = "<group>"; };
 		E1E6EEA70B628DB3005F2F70 /* JSHTMLSelectElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.h; path = JSHTMLSelectElement.h; sourceTree = "<group>"; };
@@ -12937,13 +13048,14 @@
 		E4B423860CBFB73C00AF2ECE /* JSProgressEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSProgressEvent.h; sourceTree = "<group>"; };
 		E4BBED0C14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PropertySetCSSStyleDeclaration.cpp; sourceTree = "<group>"; };
 		E4BBED0D14F4025D003F0B98 /* PropertySetCSSStyleDeclaration.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PropertySetCSSStyleDeclaration.h; sourceTree = "<group>"; };
+		E4BBED4A14FCDBA1003F0B98 /* StyleRule.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StyleRule.cpp; sourceTree = "<group>"; };
+		E4BBED4B14FCDBA1003F0B98 /* StyleRule.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StyleRule.h; sourceTree = "<group>"; };
 		E4C178950EE6903800824D69 /* CSSSelectorList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSSelectorList.cpp; sourceTree = "<group>"; };
 		E4C178960EE6903800824D69 /* CSSSelectorList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CSSSelectorList.h; sourceTree = "<group>"; };
 		E4C279560CF9741900E97B98 /* RenderMedia.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderMedia.cpp; sourceTree = "<group>"; };
 		E4C279570CF9741900E97B98 /* RenderMedia.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderMedia.h; sourceTree = "<group>"; };
 		E4D687760ED7AE3D006EA978 /* PurgeableBufferMac.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PurgeableBufferMac.cpp; sourceTree = "<group>"; };
 		E4D687780ED7AE4F006EA978 /* PurgeableBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PurgeableBuffer.h; sourceTree = "<group>"; };
-		EB49DB8E14F46E8B002299D9 /* IDBTracing.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBTracing.h; sourceTree = "<group>"; };
 		ED2BA83B09A24B91006C0AC4 /* DocumentMarker.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentMarker.h; sourceTree = "<group>"; };
 		ED501DC50B249F2900AE18D9 /* EditorMac.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; name = EditorMac.mm; path = mac/EditorMac.mm; sourceTree = "<group>"; };
 		EDE3A4FF0C7A430600956A37 /* ColorMac.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ColorMac.h; sourceTree = "<group>"; };
@@ -13505,7 +13617,6 @@
 				B22277CA0D00BF1E0071B782 /* svg */,
 				417DA4CD13734204007C57FB /* testing */,
 				FD315FA212B025B100C1A359 /* webaudio */,
-				518A34BD1026C831001B6896 /* websockets */,
 				2E4346310F546A6800B0F1BA /* workers */,
 				E1F0424309839389006694EA /* xml */,
 				656580EC09D12B20000E61D7 /* Derived Sources */,
@@ -13595,8 +13706,6 @@
 				436708A412D9CA4B00044234 /* RenderSVGResourceSolidColor.h */,
 				436708A512D9CA4B00044234 /* RenderSVGRoot.cpp */,
 				436708A612D9CA4B00044234 /* RenderSVGRoot.h */,
-				436708A712D9CA4B00044234 /* RenderSVGShadowTreeRootContainer.cpp */,
-				436708A812D9CA4B00044234 /* RenderSVGShadowTreeRootContainer.h */,
 				A10BB5881484E3B300B2E87A /* RenderSVGShape.cpp */,
 				A10BB5891484E3B300B2E87A /* RenderSVGShape.h */,
 				0854B0061255E4E600B9CDD0 /* RenderSVGText.cpp */,
@@ -13624,6 +13733,8 @@
 				436708B312D9CA4B00044234 /* SVGRenderSupport.h */,
 				436708B412D9CA4B00044234 /* SVGRenderTreeAsText.cpp */,
 				436708B512D9CA4B00044234 /* SVGRenderTreeAsText.h */,
+				197B180A150634C000E4ADA8 /* SVGRenderingContext.cpp */,
+				197B180B150634C000E4ADA8 /* SVGRenderingContext.h */,
 				436708B612D9CA4B00044234 /* SVGResources.cpp */,
 				436708B712D9CA4B00044234 /* SVGResources.h */,
 				436708B812D9CA4B00044234 /* SVGResourcesCache.cpp */,
@@ -13632,8 +13743,6 @@
 				436708BB12D9CA4B00044234 /* SVGResourcesCycleSolver.h */,
 				0854B0101255E4E600B9CDD0 /* SVGRootInlineBox.cpp */,
 				0854B0111255E4E600B9CDD0 /* SVGRootInlineBox.h */,
-				436708BC12D9CA4B00044234 /* SVGShadowTreeElements.cpp */,
-				436708BD12D9CA4B00044234 /* SVGShadowTreeElements.h */,
 				08F0BFBD1255C53C00075185 /* SVGTextChunk.cpp */,
 				08F0BFBE1255C53C00075185 /* SVGTextChunk.h */,
 				081668D1125603BF006F25DE /* SVGTextChunkBuilder.cpp */,
@@ -13677,6 +13786,7 @@
 				85136C8A0AED665800F90A3D /* eastWestResizeCursor.png */,
 				85136C8B0AED665800F90A3D /* helpCursor.png */,
 				93153BE314195B2900FCF5BE /* inputSpeech.png */,
+				2D9F0E1214FF1CBF00BA0FF7 /* linearSRGB.icc */,
 				85136C8C0AED665800F90A3D /* linkCursor.png */,
 				BCAD1808131C7A0D00990406 /* Localizable.strings */,
 				93153BE114195A5700FCF5BE /* missingImage.png */,
@@ -13885,129 +13995,6 @@
 		1AE82EC90CAAE177002237AE /* storage */ = {
 			isa = PBXGroup;
 			children = (
-				B5B5DC67119BB3D5002A8790 /* AbstractDatabase.cpp */,
-				B5B5DC68119BB3D5002A8790 /* AbstractDatabase.h */,
-				514185ED0CD65F0400763C99 /* ChangeVersionWrapper.cpp */,
-				514185EC0CD65F0400763C99 /* ChangeVersionWrapper.h */,
-				5196115E0CAC56570010A80C /* Database.cpp */,
-				5196115F0CAC56570010A80C /* Database.h */,
-				519611600CAC56570010A80C /* Database.idl */,
-				51A45B550CAD7FD7000D2BE9 /* DatabaseAuthorizer.cpp */,
-				51A45B540CAD7FD7000D2BE9 /* DatabaseAuthorizer.h */,
-				B5D36019112F8B560048DEA8 /* DatabaseCallback.h */,
-				B59DD68D1190298E007E9684 /* DatabaseCallback.idl */,
-				5116D9750CF177BD00C2B84D /* DatabaseDetails.h */,
-				B523CF031182675400EBB29C /* DatabaseSync.cpp */,
-				B523CF041182675400EBB29C /* DatabaseSync.h */,
-				B55D5ABB1191327200BCC315 /* DatabaseSync.idl */,
-				519611E90CAC749C0010A80C /* DatabaseTask.cpp */,
-				519611E80CAC749C0010A80C /* DatabaseTask.h */,
-				519611610CAC56570010A80C /* DatabaseThread.cpp */,
-				519611620CAC56570010A80C /* DatabaseThread.h */,
-				1AD51A130CB59CD300953D11 /* DatabaseTracker.cpp */,
-				1AD51A120CB59CD300953D11 /* DatabaseTracker.h */,
-				51FAFE330CECBF2D00BB3F24 /* DatabaseTrackerClient.h */,
-				A8F4579D14BC13EC000CEA59 /* DOMWindowSQLDatabase.cpp */,
-				A8F4579E14BC13EC000CEA59 /* DOMWindowSQLDatabase.h */,
-				A8F4579F14BC13EC000CEA59 /* DOMWindowSQLDatabase.idl */,
-				C585A69811D4FB3D004C3E4B /* IDBAny.cpp */,
-				C585A69911D4FB3D004C3E4B /* IDBAny.h */,
-				C585A69A11D4FB3D004C3E4B /* IDBAny.idl */,
-				C585A69B11D4FB3D004C3E4B /* IDBCallbacks.h */,
-				81A7325F121018A400FC0D9E /* IDBCursor.cpp */,
-				81A7325D1210189B00FC0D9E /* IDBCursor.h */,
-				81BE209C11F4ABBD00915DFA /* IDBCursor.idl */,
-				81BE209311F4AB8D00915DFA /* IDBCursorBackendImpl.cpp */,
-				81A73277121019E100FC0D9E /* IDBCursorBackendImpl.h */,
-				81BE209411F4AB8D00915DFA /* IDBCursorBackendInterface.h */,
-				C585A6A311D4FB3D004C3E4B /* IDBDatabase.cpp */,
-				C585A6A411D4FB3D004C3E4B /* IDBDatabase.h */,
-				C585A6A511D4FB3D004C3E4B /* IDBDatabase.idl */,
-				C585A6A111D4FB3D004C3E4B /* IDBDatabaseBackendImpl.cpp */,
-				B61762611203490800EF9114 /* IDBDatabaseBackendImpl.h */,
-				B61762531203374F00EF9114 /* IDBDatabaseBackendInterface.h */,
-				C585A69D11D4FB3D004C3E4B /* IDBDatabaseError.h */,
-				C585A69E11D4FB3D004C3E4B /* IDBDatabaseError.idl */,
-				978D07B1145A0EBD0096908D /* IDBDatabaseException.cpp */,
-				C585A69F11D4FB3D004C3E4B /* IDBDatabaseException.h */,
-				C585A6A011D4FB3D004C3E4B /* IDBDatabaseException.idl */,
-				C585A6C911D4FB3D004C3E4B /* IDBFactory.cpp */,
-				C585A6CA11D4FB3D004C3E4B /* IDBFactory.h */,
-				C585A6CB11D4FB3D004C3E4B /* IDBFactory.idl */,
-				C585A6C711D4FB3D004C3E4B /* IDBFactoryBackendImpl.cpp */,
-				C585A6C811D4FB3D004C3E4B /* IDBFactoryBackendImpl.h */,
-				C585A6C511D4FB3D004C3E4B /* IDBFactoryBackendInterface.cpp */,
-				C585A6C611D4FB3D004C3E4B /* IDBFactoryBackendInterface.h */,
-				C572EE041201C736007D8F82 /* IDBIndex.cpp */,
-				C572EE051201C736007D8F82 /* IDBIndex.h */,
-				C572EE061201C736007D8F82 /* IDBIndex.idl */,
-				C572EE071201C736007D8F82 /* IDBIndexBackendImpl.cpp */,
-				C572EE081201C736007D8F82 /* IDBIndexBackendImpl.h */,
-				C572EE091201C736007D8F82 /* IDBIndexBackendInterface.h */,
-				C585A6B211D4FB3D004C3E4B /* IDBKey.cpp */,
-				C585A6B311D4FB3D004C3E4B /* IDBKey.h */,
-				C585A6B411D4FB3D004C3E4B /* IDBKey.idl */,
-				C585A6B511D4FB3D004C3E4B /* IDBKeyRange.cpp */,
-				C585A6B611D4FB3D004C3E4B /* IDBKeyRange.h */,
-				C585A6B711D4FB3D004C3E4B /* IDBKeyRange.idl */,
-				C585A6BC11D4FB3D004C3E4B /* IDBObjectStore.cpp */,
-				C585A6B911D4FB3D004C3E4B /* IDBObjectStore.h */,
-				C585A6BE11D4FB3D004C3E4B /* IDBObjectStore.idl */,
-				C585A6BA11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.cpp */,
-				C585A6BB11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.h */,
-				C585A6BD11D4FB3D004C3E4B /* IDBObjectStoreBackendInterface.h */,
-				C585A6BF11D4FB3D004C3E4B /* IDBRequest.cpp */,
-				C585A6C011D4FB3D004C3E4B /* IDBRequest.h */,
-				C585A6C111D4FB3D004C3E4B /* IDBRequest.idl */,
-				EB49DB8E14F46E8B002299D9 /* IDBTracing.h */,
-				B6566267120B115A006EA85C /* IDBTransaction.cpp */,
-				B6566268120B115A006EA85C /* IDBTransaction.h */,
-				B6566269120B115A006EA85C /* IDBTransaction.idl */,
-				B656626D120B116B006EA85C /* IDBTransactionBackendInterface.h */,
-				511F23130DC160DA004F0032 /* StorageTask.cpp */,
-				511F23140DC160DA004F0032 /* StorageTask.h */,
-				511F23150DC160DA004F0032 /* StorageThread.cpp */,
-				511F23160DC160DA004F0032 /* StorageThread.h */,
-				51A926780D53F0570063ECC2 /* OriginQuotaManager.cpp */,
-				51A926790D53F0570063ECC2 /* OriginQuotaManager.h */,
-				51A9267A0D53F0570063ECC2 /* OriginUsageRecord.cpp */,
-				51A9267B0D53F0570063ECC2 /* OriginUsageRecord.h */,
-				245D80A213280E40003492A6 /* SQLCallbackWrapper.h */,
-				51EC92570CE90DB400F90308 /* SQLError.h */,
-				51EC92580CE90DB400F90308 /* SQLError.idl */,
-				978D07B3145A0ECD0096908D /* SQLException.cpp */,
-				B56EBA8311C9FF8100B04477 /* SQLException.h */,
-				B56EBA8411C9FF8100B04477 /* SQLException.idl */,
-				519611670CAC56570010A80C /* SQLResultSet.cpp */,
-				519611680CAC56570010A80C /* SQLResultSet.h */,
-				519611690CAC56570010A80C /* SQLResultSet.idl */,
-				1AFE117B0CBFFB36003017FA /* SQLResultSetRowList.cpp */,
-				1AFE117C0CBFFB36003017FA /* SQLResultSetRowList.h */,
-				1AFE118C0CBFFC4E003017FA /* SQLResultSetRowList.idl */,
-				515B03980CD1642A00B7EA9C /* SQLStatement.cpp */,
-				515B03970CD1642A00B7EA9C /* SQLStatement.h */,
-				1A7CCB150CD9469A00B7B64E /* SQLStatementCallback.h */,
-				B59DD68E1190298E007E9684 /* SQLStatementCallback.idl */,
-				1A7CCB160CD9469A00B7B64E /* SQLStatementErrorCallback.h */,
-				B59DD68F1190298E007E9684 /* SQLStatementErrorCallback.idl */,
-				B550B52111DC68A800923885 /* SQLStatementSync.cpp */,
-				B550B52211DC68A800923885 /* SQLStatementSync.h */,
-				1ABFE7520CD968D000FE4834 /* SQLTransaction.cpp */,
-				1A7CCB220CD946FD00B7B64E /* SQLTransaction.h */,
-				1A7CCB230CD946FD00B7B64E /* SQLTransaction.idl */,
-				1A7CCB170CD9469A00B7B64E /* SQLTransactionCallback.h */,
-				B59DD6901190298E007E9684 /* SQLTransactionCallback.idl */,
-				B51BF6EE102C9E590002C15A /* SQLTransactionClient.cpp */,
-				B51BF6EF102C9E590002C15A /* SQLTransactionClient.h */,
-				B5C11239102B6C4600096578 /* SQLTransactionCoordinator.cpp */,
-				B5C1123A102B6C4600096578 /* SQLTransactionCoordinator.h */,
-				1A7CCB180CD9469A00B7B64E /* SQLTransactionErrorCallback.h */,
-				B59DD6911190298E007E9684 /* SQLTransactionErrorCallback.idl */,
-				B523CF021182675400EBB29C /* SQLTransactionSync.cpp */,
-				B523CF011182675400EBB29C /* SQLTransactionSync.h */,
-				B55D5ABC1191327200BCC315 /* SQLTransactionSync.idl */,
-				B523CEFF1182675400EBB29C /* SQLTransactionSyncCallback.h */,
-				B55D5ABD1191327200BCC315 /* SQLTransactionSyncCallback.idl */,
 				51E3F9C50DA059DC00250911 /* Storage.cpp */,
 				51E3F9C40DA059DC00250911 /* Storage.h */,
 				51E3F9D10DA05D7100250911 /* Storage.idl */,
@@ -14034,6 +14021,10 @@
 				C55E38BB10040D5D00A56BDB /* StorageNamespaceImpl.h */,
 				C5102D930FD9AA2D00FAFF04 /* StorageSyncManager.cpp */,
 				C5102D920FD9AA2D00FAFF04 /* StorageSyncManager.h */,
+				511F23130DC160DA004F0032 /* StorageTask.cpp */,
+				511F23140DC160DA004F0032 /* StorageTask.h */,
+				511F23150DC160DA004F0032 /* StorageThread.cpp */,
+				511F23160DC160DA004F0032 /* StorageThread.h */,
 				3AB02D2912D4F91600FBB694 /* StorageTracker.cpp */,
 				3AB02D2812D4F91600FBB694 /* StorageTracker.h */,
 				3AC367FE12EF7A09006A3D6F /* StorageTrackerClient.h */,
@@ -14400,10 +14391,10 @@
 				3390CA510FFC157B00921962 /* NotificationCenter.cpp */,
 				3390CA520FFC157B00921962 /* NotificationCenter.h */,
 				3390CA530FFC157B00921962 /* NotificationCenter.idl */,
+				33503C9910179A74003B47E1 /* NotificationClient.h */,
 				3390CA540FFC157B00921962 /* NotificationContents.h */,
 				3128CA67147331520074C72A /* NotificationController.cpp */,
 				3128CA6A147331630074C72A /* NotificationController.h */,
-				33503C9910179A74003B47E1 /* NotificationPresenter.h */,
 			);
 			name = notifications;
 			sourceTree = "<group>";
@@ -14457,8 +14448,6 @@
 				A78E526E1346BD1700AD9C31 /* MeterShadowElement.h */,
 				A715E650134BBBEC00D8E713 /* ProgressShadowElement.cpp */,
 				A715E651134BBBEC00D8E713 /* ProgressShadowElement.h */,
-				572E92F914E540580087FFBA /* ShadowRootList.cpp */,
-				572E92FA14E540580087FFBA /* ShadowRootList.h */,
 				4150F9F012B6E0E70008C860 /* SliderThumbElement.cpp */,
 				4150F9EF12B6E0E70008C860 /* SliderThumbElement.h */,
 				142B97C713138943008BEF4B /* TextControlInnerElements.cpp */,
@@ -14541,7 +14530,6 @@
 		49484FAE102CF01E00187DD3 /* canvas */ = {
 			isa = PBXGroup;
 			children = (
-				A83B535B14F7413A00720D9D /* DOMWindowWebGL.idl */,
 				49EECDCC10503C2300099FAB /* ArrayBuffer.idl */,
 				49EECDC910503C2300099FAB /* ArrayBufferView.idl */,
 				6E4E91A710F7FB3100A2779C /* CanvasContextAttributes.cpp */,
@@ -14567,6 +14555,9 @@
 				2E97CCE712939CB800C5C8FF /* DataView.cpp */,
 				2E97CCE812939CB800C5C8FF /* DataView.h */,
 				2E97CCE912939CB800C5C8FF /* DataView.idl */,
+				7728694B14F8882500F484DC /* EXTTextureFilterAnisotropic.cpp */,
+				7728694C14F8882500F484DC /* EXTTextureFilterAnisotropic.h */,
+				7728694D14F8882500F484DC /* EXTTextureFilterAnisotropic.idl */,
 				49EECDCF10503C2300099FAB /* Float32Array.idl */,
 				6EBC5D80138B4C4E00A0CF8A /* Float64Array.idl */,
 				49EECDD510503C2300099FAB /* Int16Array.idl */,
@@ -14852,39 +14843,6 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
-		518A34BD1026C831001B6896 /* websockets */ = {
-			isa = PBXGroup;
-			children = (
-				51FB54F4113E364200821176 /* CloseEvent.h */,
-				51FB54F6113E365900821176 /* CloseEvent.idl */,
-				5112247110CFB8C6008099D7 /* ThreadableWebSocketChannel.cpp */,
-				5112247310CFB8D8008099D7 /* ThreadableWebSocketChannel.h */,
-				510F078111FEBE7500B8EE49 /* ThreadableWebSocketChannelClientWrapper.cpp */,
-				5112247510CFB8E8008099D7 /* ThreadableWebSocketChannelClientWrapper.h */,
-				518A34BE1026C831001B6896 /* WebSocket.cpp */,
-				518A34BF1026C831001B6896 /* WebSocket.h */,
-				518A34C01026C831001B6896 /* WebSocket.idl */,
-				510D4A47103177A20049EA54 /* WebSocketChannel.cpp */,
-				510D4A48103177A20049EA54 /* WebSocketChannel.h */,
-				510D4A49103177A20049EA54 /* WebSocketChannelClient.h */,
-				4AE02ABB14E8A9D200BC3BA7 /* WebSocketDeflater.cpp */,
-				4AE02ABC14E8A9D200BC3BA7 /* WebSocketDeflater.h */,
-				4A957F0314E241100049DBFB /* WebSocketExtensionDispatcher.cpp */,
-				4A957F0414E241100049DBFB /* WebSocketExtensionDispatcher.h */,
-				4ADE25F914E3BB4C004C2213 /* WebSocketExtensionProcessor.h */,
-				4A4A234514F1E1440046FBF1 /* WebSocketFrame.h */,
-				51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */,
-				51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */,
-				7637C540112E7B74003D6CDC /* WebSocketHandshakeRequest.cpp */,
-				7637C542112E7B7E003D6CDC /* WebSocketHandshakeRequest.h */,
-				767F99BD11A1194A0080C51D /* WebSocketHandshakeResponse.cpp */,
-				767F99BF11A119560080C51D /* WebSocketHandshakeResponse.h */,
-				5112247710CFB8F4008099D7 /* WorkerThreadableWebSocketChannel.cpp */,
-				5112247910CFB8FF008099D7 /* WorkerThreadableWebSocketChannel.h */,
-			);
-			path = websockets;
-			sourceTree = "<group>";
-		};
 		599D1E2F10C97D4C00E0EF12 /* jsc */ = {
 			isa = PBXGroup;
 			children = (
@@ -14955,6 +14913,7 @@
 				A9C6E4ED0D745E38006442E9 /* DOMPluginArray.cpp */,
 				A9C6E4EE0D745E38006442E9 /* DOMPluginArray.h */,
 				A9C6E6610D74671E006442E9 /* DOMPluginArray.idl */,
+				E129CBD21501702200A7C5FB /* npapi-sandbox.h */,
 				1A927FCF1416A15B003A83C8 /* npapi.h */,
 				1A219B3A0DCA87AB0040E3A0 /* npfunctions.h */,
 				1A927FD01416A15B003A83C8 /* npruntime.h */,
@@ -15119,6 +15078,8 @@
 		6582A14809999D6C00BEEB6D /* mac */ = {
 			isa = PBXGroup;
 			children = (
+				CD127DEA14F3097900E84779 /* WebCoreFullScreenWindow.h */,
+				CD127DEB14F3097900E84779 /* WebCoreFullScreenWindow.mm */,
 				51E1ECAD0C91C54600DC255B /* AutodrainedPool.mm */,
 				65A640F00533BB1F0085E777 /* BlockExceptions.h */,
 				65F80697054D9F86008BF776 /* BlockExceptions.mm */,
@@ -15144,13 +15105,12 @@
 				9352084409BD43B900F2038D /* Language.mm */,
 				06E81ED60AB5D5E900C87837 /* LocalCurrentGraphicsContext.h */,
 				06E81EEB0AB5DA9700C87837 /* LocalCurrentGraphicsContext.mm */,
-				BC25B528131C6D3900180E10 /* LocalizedStringsMac.mm */,
+				BC25B528131C6D3900180E10 /* LocalizedStringsMac.cpp */,
 				1402645D0AFDC19B005919E2 /* LoggingMac.mm */,
 				657EDA0A1385CBD8004E0645 /* MemoryPressureHandlerMac.mm */,
 				BC772C5D0C4EB3440083285F /* MIMETypeRegistryMac.mm */,
 				93500F3113FDE3BE0099EC24 /* NSScrollerImpDetails.h */,
 				52F52E1014A0134F00ACC397 /* NSScrollerImpDetails.mm */,
-				A7D3C5230B576B4B002CA450 /* PasteboardHelper.h */,
 				4B2709810AF2E5E00065127F /* PasteboardMac.mm */,
 				CDEA762E146084DE008B31F1 /* PlatformClockCA.cpp */,
 				CDEA762F146084EE008B31F1 /* PlatformClockCA.h */,
@@ -15186,6 +15146,8 @@
 				51DF6D7F0B92A18E00C2DC85 /* ThreadCheck.mm */,
 				934D9BA60B8C1175007B42A9 /* WebCoreNSStringExtras.h */,
 				934D9BA40B8C116B007B42A9 /* WebCoreNSStringExtras.mm */,
+				C5B4C24B1509236C00A6EF37 /* WebCoreNSURLExtras.h */,
+				C5B4C24C1509236C00A6EF37 /* WebCoreNSURLExtras.mm */,
 				DD05FE0B0B8BA3C6009ACDFE /* WebCoreObjCExtras.h */,
 				B50F5B800E96CD9900AD71A6 /* WebCoreObjCExtras.mm */,
 				93EB169609F880C00091F8FF /* WebCoreSystemInterface.h */,
@@ -15294,8 +15256,6 @@
 				9730BE1414EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.cpp */,
 				9730BE1514EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.h */,
 				9730BE1614EF286B00DF06B9 /* NavigatorRegisterProtocolHandler.idl */,
-				97CC3AE014E8E4A200894988 /* NavigatorSupplement.cpp */,
-				97CC3AE114E8E4A200894988 /* NavigatorSupplement.h */,
 				00146288103CD1DE000B20DB /* OriginAccessEntry.cpp */,
 				00146289103CD1DE000B20DB /* OriginAccessEntry.h */,
 				65FEA86809833ADE00BED4AB /* Page.cpp */,
@@ -15306,8 +15266,6 @@
 				7A674BDA0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h */,
 				371E65CD13661EED00BEEDB0 /* PageSerializer.cpp */,
 				371E65CB13661EDC00BEEDB0 /* PageSerializer.h */,
-				A71E083514E3CEAF006A4619 /* PageSupplement.cpp */,
-				A71E083614E3CEAF006A4619 /* PageSupplement.h */,
 				FFD5B977135CC97800D5E92A /* PageVisibilityState.cpp */,
 				FFD5B978135CC97800D5E92A /* PageVisibilityState.h */,
 				8A844D0111D3C18E0014065C /* Performance.cpp */,
@@ -16721,6 +16679,8 @@
 				379E61C6126CA5C300B63E8D /* BaseButtonInputType.h */,
 				379E61C7126CA5C300B63E8D /* BaseCheckableInputType.cpp */,
 				379E61C8126CA5C300B63E8D /* BaseCheckableInputType.h */,
+				C33EE5C214FB49610002095A /* BaseClickableWithKeyInputType.cpp */,
+				C33EE5C314FB49610002095A /* BaseClickableWithKeyInputType.h */,
 				F59C95FD1255B23F000623C0 /* BaseDateAndTimeInputType.cpp */,
 				F59C95FE1255B23F000623C0 /* BaseDateAndTimeInputType.h */,
 				F55B3D791251F12D003EF269 /* BaseTextInputType.cpp */,
@@ -16752,7 +16712,6 @@
 				2E37DFD712DBAFB800A6B233 /* DOMURL.cpp */,
 				2E37DFD812DBAFB800A6B233 /* DOMURL.h */,
 				2E37DFD912DBAFB800A6B233 /* DOMURL.idl */,
-				A8A5205D14F6BD3C00FBA19E /* DOMWindowHTML.idl */,
 				F55B3D871251F12D003EF269 /* EmailInputType.cpp */,
 				F55B3D881251F12D003EF269 /* EmailInputType.h */,
 				F55B3D891251F12D003EF269 /* FileInputType.cpp */,
@@ -17023,6 +16982,8 @@
 				F55B3D8E1251F12D003EF269 /* ImageInputType.h */,
 				37E3524A12450C5200BAF5D9 /* InputType.cpp */,
 				37E3524C12450C6600BAF5D9 /* InputType.h */,
+				450CEBEE15073BBE002BB149 /* LabelableElement.cpp */,
+				450CEBEF15073BBE002BB149 /* LabelableElement.h */,
 				A456FA2411AD4A830020B420 /* LabelsNodeList.cpp */,
 				A456FA2511AD4A830020B420 /* LabelsNodeList.h */,
 				985BB96B13A94058007A0B69 /* LinkRelAttribute.cpp */,
@@ -17096,6 +17057,9 @@
 			isa = PBXGroup;
 			children = (
 				971145FF14EF007900674FD9 /* geolocation */,
+				9712A55315004E3C0048AF10 /* indexeddb */,
+				97BC69D51505F054001B74AC /* webdatabase */,
+				97AABCF714FA09B5007457AE /* websockets */,
 			);
 			name = Modules;
 			sourceTree = "<group>";
@@ -17126,9 +17090,110 @@
 			name = geolocation;
 			sourceTree = "<group>";
 		};
+		9712A55315004E3C0048AF10 /* indexeddb */ = {
+			isa = PBXGroup;
+			children = (
+				9712A55415004EDA0048AF10 /* DOMWindowIndexedDatabase.cpp */,
+				9712A55515004EDA0048AF10 /* DOMWindowIndexedDatabase.h */,
+				9712A55615004EDA0048AF10 /* DOMWindowIndexedDatabase.idl */,
+				9712A55715004EDA0048AF10 /* IDBAny.cpp */,
+				9712A55815004EDA0048AF10 /* IDBAny.h */,
+				9712A55915004EDA0048AF10 /* IDBAny.idl */,
+				9712A55A15004EDA0048AF10 /* IDBBackingStore.h */,
+				9712A55B15004EDA0048AF10 /* IDBCallbacks.h */,
+				9712A55C15004EDA0048AF10 /* IDBCursor.cpp */,
+				9712A55D15004EDA0048AF10 /* IDBCursor.h */,
+				9712A55E15004EDA0048AF10 /* IDBCursor.idl */,
+				9712A55F15004EDA0048AF10 /* IDBCursorBackendImpl.cpp */,
+				9712A56015004EDA0048AF10 /* IDBCursorBackendImpl.h */,
+				9712A56115004EDA0048AF10 /* IDBCursorBackendInterface.h */,
+				9712A56215004EDA0048AF10 /* IDBCursorWithValue.cpp */,
+				9712A56315004EDA0048AF10 /* IDBCursorWithValue.h */,
+				9712A56415004EDA0048AF10 /* IDBCursorWithValue.idl */,
+				9712A56515004EDA0048AF10 /* IDBDatabase.cpp */,
+				9712A56615004EDA0048AF10 /* IDBDatabase.h */,
+				9712A56715004EDA0048AF10 /* IDBDatabase.idl */,
+				9712A56815004EDA0048AF10 /* IDBDatabaseBackendImpl.cpp */,
+				9712A56915004EDA0048AF10 /* IDBDatabaseBackendImpl.h */,
+				9712A56A15004EDA0048AF10 /* IDBDatabaseBackendInterface.h */,
+				9712A56B15004EDA0048AF10 /* IDBDatabaseCallbacks.h */,
+				9712A56C15004EDA0048AF10 /* IDBDatabaseCallbacksImpl.cpp */,
+				9712A56D15004EDA0048AF10 /* IDBDatabaseCallbacksImpl.h */,
+				9712A56E15004EDA0048AF10 /* IDBDatabaseError.h */,
+				9712A56F15004EDA0048AF10 /* IDBDatabaseError.idl */,
+				9712A57015004EDA0048AF10 /* IDBDatabaseException.cpp */,
+				9712A57115004EDA0048AF10 /* IDBDatabaseException.h */,
+				9712A57215004EDA0048AF10 /* IDBDatabaseException.idl */,
+				9712A57315004EDA0048AF10 /* IDBEventDispatcher.cpp */,
+				9712A57415004EDA0048AF10 /* IDBEventDispatcher.h */,
+				9712A57515004EDA0048AF10 /* IDBFactory.cpp */,
+				9712A57615004EDA0048AF10 /* IDBFactory.h */,
+				9712A57715004EDA0048AF10 /* IDBFactory.idl */,
+				9712A57815004EDA0048AF10 /* IDBFactoryBackendImpl.cpp */,
+				9712A57915004EDA0048AF10 /* IDBFactoryBackendImpl.h */,
+				9712A57A15004EDA0048AF10 /* IDBFactoryBackendInterface.cpp */,
+				9712A57B15004EDA0048AF10 /* IDBFactoryBackendInterface.h */,
+				9712A57C15004EDA0048AF10 /* IDBIndex.cpp */,
+				9712A57D15004EDA0048AF10 /* IDBIndex.h */,
+				9712A57E15004EDA0048AF10 /* IDBIndex.idl */,
+				9712A57F15004EDA0048AF10 /* IDBIndexBackendImpl.cpp */,
+				9712A58015004EDA0048AF10 /* IDBIndexBackendImpl.h */,
+				9712A58115004EDA0048AF10 /* IDBIndexBackendInterface.h */,
+				9712A58215004EDA0048AF10 /* IDBKey.cpp */,
+				9712A58315004EDA0048AF10 /* IDBKey.h */,
+				9712A58415004EDA0048AF10 /* IDBKey.idl */,
+				9712A58515004EDA0048AF10 /* IDBKeyPath.cpp */,
+				9712A58615004EDA0048AF10 /* IDBKeyPath.h */,
+				9712A58715004EDA0048AF10 /* IDBKeyPathBackendImpl.cpp */,
+				9712A58815004EDA0048AF10 /* IDBKeyPathBackendImpl.h */,
+				9712A58915004EDA0048AF10 /* IDBKeyRange.cpp */,
+				9712A58A15004EDA0048AF10 /* IDBKeyRange.h */,
+				9712A58B15004EDA0048AF10 /* IDBKeyRange.idl */,
+				9712A58C15004EDA0048AF10 /* IDBLevelDBBackingStore.cpp */,
+				9712A58D15004EDA0048AF10 /* IDBLevelDBBackingStore.h */,
+				9712A58E15004EDA0048AF10 /* IDBLevelDBCoding.cpp */,
+				9712A58F15004EDA0048AF10 /* IDBLevelDBCoding.h */,
+				9712A59015004EDA0048AF10 /* IDBObjectStore.cpp */,
+				9712A59115004EDA0048AF10 /* IDBObjectStore.h */,
+				9712A59215004EDA0048AF10 /* IDBObjectStore.idl */,
+				9712A59315004EDA0048AF10 /* IDBObjectStoreBackendImpl.cpp */,
+				9712A59415004EDA0048AF10 /* IDBObjectStoreBackendImpl.h */,
+				9712A59515004EDA0048AF10 /* IDBObjectStoreBackendInterface.h */,
+				9712A59615004EDA0048AF10 /* IDBPendingTransactionMonitor.cpp */,
+				9712A59715004EDA0048AF10 /* IDBPendingTransactionMonitor.h */,
+				9712A59815004EDA0048AF10 /* IDBRequest.cpp */,
+				9712A59915004EDA0048AF10 /* IDBRequest.h */,
+				9712A59A15004EDA0048AF10 /* IDBRequest.idl */,
+				9712A59B15004EDA0048AF10 /* IDBTracing.h */,
+				9712A59C15004EDA0048AF10 /* IDBTransaction.cpp */,
+				9712A59D15004EDA0048AF10 /* IDBTransaction.h */,
+				9712A59E15004EDA0048AF10 /* IDBTransaction.idl */,
+				9712A59F15004EDA0048AF10 /* IDBTransactionBackendImpl.cpp */,
+				9712A5A015004EDA0048AF10 /* IDBTransactionBackendImpl.h */,
+				9712A5A115004EDA0048AF10 /* IDBTransactionBackendInterface.h */,
+				9712A5A215004EDA0048AF10 /* IDBTransactionCallbacks.h */,
+				9712A5A315004EDA0048AF10 /* IDBTransactionCoordinator.cpp */,
+				9712A5A415004EDA0048AF10 /* IDBTransactionCoordinator.h */,
+				9712A5A515004EDA0048AF10 /* IDBVersionChangeEvent.cpp */,
+				9712A5A615004EDA0048AF10 /* IDBVersionChangeEvent.h */,
+				9712A5A715004EDA0048AF10 /* IDBVersionChangeEvent.idl */,
+				9712A5A815004EDA0048AF10 /* IDBVersionChangeRequest.cpp */,
+				9712A5A915004EDA0048AF10 /* IDBVersionChangeRequest.h */,
+				9712A5AA15004EDA0048AF10 /* IDBVersionChangeRequest.idl */,
+				9712A5AB15004EDA0048AF10 /* PageGroupIndexedDatabase.cpp */,
+				9712A5AC15004EDA0048AF10 /* PageGroupIndexedDatabase.h */,
+				9712A60E150090CE0048AF10 /* WorkerContextIndexedDatabase.cpp */,
+				9712A60F150090CE0048AF10 /* WorkerContextIndexedDatabase.h */,
+				9712A610150090CE0048AF10 /* WorkerContextIndexedDatabase.idl */,
+			);
+			name = indexeddb;
+			sourceTree = "<group>";
+		};
 		976D6C57122B8A18001FD1F7 /* fileapi */ = {
 			isa = PBXGroup;
 			children = (
+				E1CDE91F15018ED000862CC5 /* AsyncFileStream.cpp */,
+				E1CDE9211501916900862CC5 /* AsyncFileStream.h */,
 				976D6C58122B8A3D001FD1F7 /* AsyncFileWriter.h */,
 				976D6C74122B8A3D001FD1F7 /* AsyncFileWriterClient.h */,
 				976D6C59122B8A3D001FD1F7 /* Blob.cpp */,
@@ -17208,8 +17273,6 @@
 				2EDF369A122C94B4002F7D4E /* FileReaderSync.cpp */,
 				2EDF369B122C94B4002F7D4E /* FileReaderSync.h */,
 				E1AB1EBD14E9E3A800449E13 /* FileReaderSync.idl */,
-				976D6C6C122B8A3D001FD1F7 /* FileStreamProxy.cpp */,
-				976D6C6D122B8A3D001FD1F7 /* FileStreamProxy.h */,
 				8987854A122CA064003AABDA /* FileSystemCallback.h */,
 				E1AB1EBE14E9E3B200449E13 /* FileSystemCallback.idl */,
 				8987854B122CA064003AABDA /* FileSystemCallbacks.cpp */,
@@ -17247,6 +17310,119 @@
 			name = fileapi;
 			sourceTree = "<group>";
 		};
+		97AABCF714FA09B5007457AE /* websockets */ = {
+			isa = PBXGroup;
+			children = (
+				97AABCF814FA09D5007457AE /* CloseEvent.h */,
+				97AABCF914FA09D5007457AE /* CloseEvent.idl */,
+				97AABCFA14FA09D5007457AE /* DOMWindowWebSocket.idl */,
+				97AABCFB14FA09D5007457AE /* ThreadableWebSocketChannel.cpp */,
+				97AABCFC14FA09D5007457AE /* ThreadableWebSocketChannel.h */,
+				97AABCFD14FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.cpp */,
+				97AABCFE14FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.h */,
+				97AABCFF14FA09D5007457AE /* WebSocket.cpp */,
+				97AABD0014FA09D5007457AE /* WebSocket.h */,
+				97AABD0114FA09D5007457AE /* WebSocket.idl */,
+				97AABD0214FA09D5007457AE /* WebSocketChannel.cpp */,
+				97AABD0314FA09D5007457AE /* WebSocketChannel.h */,
+				97AABD0414FA09D5007457AE /* WebSocketChannelClient.h */,
+				4A38BF4E14FE1C0900612512 /* WebSocketDeflateFramer.cpp */,
+				4A38BF4F14FE1C0900612512 /* WebSocketDeflateFramer.h */,
+				97AABD0514FA09D5007457AE /* WebSocketDeflater.cpp */,
+				97AABD0614FA09D5007457AE /* WebSocketDeflater.h */,
+				97AABD0714FA09D5007457AE /* WebSocketExtensionDispatcher.cpp */,
+				97AABD0814FA09D5007457AE /* WebSocketExtensionDispatcher.h */,
+				97AABD0914FA09D5007457AE /* WebSocketExtensionProcessor.h */,
+				97AABD0A14FA09D5007457AE /* WebSocketFrame.h */,
+				97AABD0B14FA09D5007457AE /* WebSocketHandshake.cpp */,
+				97AABD0C14FA09D5007457AE /* WebSocketHandshake.h */,
+				97AABD0D14FA09D5007457AE /* WebSocketHandshakeRequest.cpp */,
+				97AABD0E14FA09D5007457AE /* WebSocketHandshakeRequest.h */,
+				97AABD0F14FA09D5007457AE /* WebSocketHandshakeResponse.cpp */,
+				97AABD1014FA09D5007457AE /* WebSocketHandshakeResponse.h */,
+				97AABD1114FA09D5007457AE /* WorkerThreadableWebSocketChannel.cpp */,
+				97AABD1214FA09D5007457AE /* WorkerThreadableWebSocketChannel.h */,
+			);
+			name = websockets;
+			sourceTree = "<group>";
+		};
+		97BC69D51505F054001B74AC /* webdatabase */ = {
+			isa = PBXGroup;
+			children = (
+				97BC69D61505F076001B74AC /* AbstractDatabase.cpp */,
+				97BC69D71505F076001B74AC /* AbstractDatabase.h */,
+				97BC69D81505F076001B74AC /* ChangeVersionWrapper.cpp */,
+				97BC69D91505F076001B74AC /* ChangeVersionWrapper.h */,
+				97BC69DE1505F081001B74AC /* Database.cpp */,
+				97BC69DF1505F081001B74AC /* Database.h */,
+				97BC69E01505F081001B74AC /* Database.idl */,
+				97BC69E11505F081001B74AC /* DatabaseAuthorizer.cpp */,
+				97BC69E21505F081001B74AC /* DatabaseAuthorizer.h */,
+				97BC69E31505F081001B74AC /* DatabaseCallback.h */,
+				97BC69E41505F081001B74AC /* DatabaseCallback.idl */,
+				97BC69E51505F081001B74AC /* DatabaseContext.cpp */,
+				97BC69E61505F081001B74AC /* DatabaseContext.h */,
+				97BC69E71505F081001B74AC /* DatabaseDetails.h */,
+				97BC69E81505F081001B74AC /* DatabaseSync.cpp */,
+				97BC69E91505F081001B74AC /* DatabaseSync.h */,
+				97BC69EA1505F081001B74AC /* DatabaseSync.idl */,
+				97BC69EB1505F081001B74AC /* DatabaseTask.cpp */,
+				97BC69EC1505F081001B74AC /* DatabaseTask.h */,
+				97BC69ED1505F081001B74AC /* DatabaseThread.cpp */,
+				97BC69EE1505F081001B74AC /* DatabaseThread.h */,
+				97BC69EF1505F081001B74AC /* DatabaseTracker.cpp */,
+				97BC69F01505F081001B74AC /* DatabaseTracker.h */,
+				97BC69F11505F081001B74AC /* DatabaseTrackerClient.h */,
+				97BC69F21505F081001B74AC /* DOMWindowSQLDatabase.cpp */,
+				97BC69F31505F081001B74AC /* DOMWindowSQLDatabase.h */,
+				97BC69F41505F081001B74AC /* DOMWindowSQLDatabase.idl */,
+				97BC69F51505F081001B74AC /* OriginQuotaManager.cpp */,
+				97BC69F61505F081001B74AC /* OriginQuotaManager.h */,
+				97BC69F71505F081001B74AC /* OriginUsageRecord.cpp */,
+				97BC69F81505F081001B74AC /* OriginUsageRecord.h */,
+				97BC69F91505F081001B74AC /* SQLCallbackWrapper.h */,
+				97BC69FA1505F081001B74AC /* SQLError.h */,
+				97BC69FB1505F081001B74AC /* SQLError.idl */,
+				97BC69FC1505F081001B74AC /* SQLException.cpp */,
+				97BC69FD1505F081001B74AC /* SQLException.h */,
+				97BC69FE1505F081001B74AC /* SQLException.idl */,
+				97BC69FF1505F081001B74AC /* SQLResultSet.cpp */,
+				97BC6A001505F081001B74AC /* SQLResultSet.h */,
+				97BC6A011505F081001B74AC /* SQLResultSet.idl */,
+				97BC6A021505F081001B74AC /* SQLResultSetRowList.cpp */,
+				97BC6A031505F081001B74AC /* SQLResultSetRowList.h */,
+				97BC6A041505F081001B74AC /* SQLResultSetRowList.idl */,
+				97BC6A051505F081001B74AC /* SQLStatement.cpp */,
+				97BC6A061505F081001B74AC /* SQLStatement.h */,
+				97BC6A071505F081001B74AC /* SQLStatementCallback.h */,
+				97BC6A081505F081001B74AC /* SQLStatementCallback.idl */,
+				97BC6A091505F081001B74AC /* SQLStatementErrorCallback.h */,
+				97BC6A0A1505F081001B74AC /* SQLStatementErrorCallback.idl */,
+				97BC6A0B1505F081001B74AC /* SQLStatementSync.cpp */,
+				97BC6A0C1505F081001B74AC /* SQLStatementSync.h */,
+				97BC6A0D1505F081001B74AC /* SQLTransaction.cpp */,
+				97BC6A0E1505F081001B74AC /* SQLTransaction.h */,
+				97BC6A0F1505F081001B74AC /* SQLTransaction.idl */,
+				97BC6A101505F081001B74AC /* SQLTransactionCallback.h */,
+				97BC6A111505F081001B74AC /* SQLTransactionCallback.idl */,
+				97BC6A121505F081001B74AC /* SQLTransactionClient.cpp */,
+				97BC6A131505F081001B74AC /* SQLTransactionClient.h */,
+				97BC6A141505F081001B74AC /* SQLTransactionCoordinator.cpp */,
+				97BC6A151505F081001B74AC /* SQLTransactionCoordinator.h */,
+				97BC6A161505F081001B74AC /* SQLTransactionErrorCallback.h */,
+				97BC6A171505F081001B74AC /* SQLTransactionErrorCallback.idl */,
+				97BC6A181505F081001B74AC /* SQLTransactionSync.cpp */,
+				97BC6A191505F081001B74AC /* SQLTransactionSync.h */,
+				97BC6A1A1505F081001B74AC /* SQLTransactionSync.idl */,
+				97BC6A1B1505F081001B74AC /* SQLTransactionSyncCallback.h */,
+				97BC6A1C1505F081001B74AC /* SQLTransactionSyncCallback.idl */,
+				97BC6A1D1505F081001B74AC /* WorkerContextSQLDatabase.cpp */,
+				97BC6A1E1505F081001B74AC /* WorkerContextSQLDatabase.h */,
+				97BC6A1F1505F081001B74AC /* WorkerContextSQLDatabase.idl */,
+			);
+			name = webdatabase;
+			sourceTree = "<group>";
+		};
 		97C1F5511228558800EDE616 /* parser */ = {
 			isa = PBXGroup;
 			children = (
@@ -17419,6 +17595,8 @@
 				7694563B1214D97C0007CBAE /* JSDOMTokenList.h */,
 				2E37E00312DBC5A400A6B233 /* JSDOMURL.cpp */,
 				2E37E00412DBC5A400A6B233 /* JSDOMURL.h */,
+				7728698114FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.cpp */,
+				7728698214FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.h */,
 				49EECEF4105070C400099FAB /* JSFloat32Array.cpp */,
 				49EECEF5105070C400099FAB /* JSFloat32Array.h */,
 				6EBC5EAD138B50F200A0CF8A /* JSFloat64Array.cpp */,
@@ -18249,8 +18427,6 @@
 		A8D2B2521287A56000AF4DDA /* cache */ = {
 			isa = PBXGroup;
 			children = (
-				A104F24114C71F7A009E2C23 /* CachedSVGDocument.cpp */,
-				A104F24214C71F7A009E2C23 /* CachedSVGDocument.h */,
 				BCB16C000979C3BD00467741 /* CachedCSSStyleSheet.cpp */,
 				BCB16C010979C3BD00467741 /* CachedCSSStyleSheet.h */,
 				BC64B4C90CB4295D005F2B62 /* CachedFont.cpp */,
@@ -18272,6 +18448,8 @@
 				5038BE3E1472AD980095E0D1 /* CachedShader.cpp */,
 				5038BE3F1472AD980095E0D1 /* CachedShader.h */,
 				D0BC54481443AC4A00E105DA /* CachedStyleSheetClient.h */,
+				A104F24114C71F7A009E2C23 /* CachedSVGDocument.cpp */,
+				A104F24214C71F7A009E2C23 /* CachedSVGDocument.h */,
 				0753860014489E9800B78452 /* CachedTextTrack.cpp */,
 				0753860114489E9800B78452 /* CachedTextTrack.h */,
 				BCB16C0E0979C3BD00467741 /* CachedXSLStyleSheet.cpp */,
@@ -18337,7 +18515,6 @@
 				081CDFBD126ECFE800D215CA /* properties */,
 				B22277CB0D00BF1F0071B782 /* ColorDistance.cpp */,
 				B22277CC0D00BF1F0071B782 /* ColorDistance.h */,
-				A89AACD514F6C12700C1FA4A /* DOMWindowSVG.idl */,
 				E415F1830D9A1A830033CE97 /* ElementTimeControl.h */,
 				E415F10C0D9A05870033CE97 /* ElementTimeControl.idl */,
 				B22277CD0D00BF1F0071B782 /* GradientAttributes.h */,
@@ -19246,8 +19423,8 @@
 				A83B533814F399BB00720D9D /* IDLAttributes.txt */,
 				14813BF309EDF88E00F757E1 /* IDLParser.pm */,
 				93F8B3080A300FEA00F61AB8 /* IDLStructure.pm */,
+				A83B538014FBB2EC00720D9D /* preprocess-idls.pl */,
 				C0F2A43F13869A280066C534 /* preprocessor.pm */,
-				A8F4578F14B2B004000CEA59 /* resolve-supplemental.pl */,
 				8C6EA61711EF7E0400FD8EE3 /* RuntimeEnabledFeatures.cpp */,
 				8C6EA61811EF7E0400FD8EE3 /* RuntimeEnabledFeatures.h */,
 				97EF7DFD107E55B700D7C49C /* ScriptControllerBase.cpp */,
@@ -19590,6 +19767,8 @@
 				BCEF44490E6745E0001C1287 /* StyleGeneratedImage.h */,
 				A10DC76814747BAB005E2471 /* StyleGridData.cpp */,
 				A10DC76914747BAB005E2471 /* StyleGridData.h */,
+				A110DB9C14F5DF8700A03B93 /* StyleGridItemData.cpp */,
+				A110DB9A14F5DF7700A03B93 /* StyleGridItemData.h */,
 				BCEF43CE0E673DA1001C1287 /* StyleImage.h */,
 				BC2273010E82F1E600E7F975 /* StyleInheritedData.cpp */,
 				BC2273020E82F1E600E7F975 /* StyleInheritedData.h */,
@@ -19827,7 +20006,6 @@
 				B2C3D9EC0D006C1D00EF6F26 /* text */,
 				BCFB2F74097A2E1A00BA703D /* Arena.cpp */,
 				BCFB2F75097A2E1A00BA703D /* Arena.h */,
-				2EF1BFF6121CB0BD00C27627 /* AsyncFileStream.h */,
 				89D08D9C12228451001241DF /* AsyncFileSystem.cpp */,
 				89D08D9D12228451001241DF /* AsyncFileSystem.h */,
 				89D08D9E12228451001241DF /* AsyncFileSystemCallbacks.h */,
@@ -19879,6 +20057,8 @@
 				6593923509AE4346002C531F /* KURL.cpp */,
 				6593923609AE4346002C531F /* KURL.h */,
 				BCBD21AA0E417AD400A070F2 /* KURLHash.h */,
+				26A5035914F0A2BC00AA730D /* KURLWTFURL.cpp */,
+				26A5034D14F0983600AA730D /* KURLWTFURLImpl.h */,
 				E18772F0126E2629003DD586 /* Language.cpp */,
 				85EC9AF90A71A2C600EEEAED /* Language.h */,
 				BCE65BE80EACDF16007E4533 /* Length.cpp */,
@@ -19935,6 +20115,7 @@
 				BC7B2AF80450824100A8000F /* Scrollbar.h */,
 				0FE71415142189FC00DB33BA /* ScrollbarTheme.cpp */,
 				BC8B854A0E7C7F5600AB6984 /* ScrollbarTheme.h */,
+				C691614714F6EBA70046375C /* ScrollbarThemeClient.h */,
 				BC1402880E83680800319717 /* ScrollbarThemeComposite.cpp */,
 				BC1402890E83680800319717 /* ScrollbarThemeComposite.h */,
 				93C09C850B0657AA005ABD4D /* ScrollTypes.h */,
@@ -19951,6 +20132,7 @@
 				4B3043C60AE0370300A82647 /* Sound.h */,
 				F587866202DE3B1101EA4122 /* SSLKeyGenerator.h */,
 				93B2D8150F9920D2006AE6B2 /* SuddenTermination.h */,
+				97627B9714FB5424002CDCA1 /* Supplementable.h */,
 				93E62D990985F41600E1B5E3 /* SystemTime.h */,
 				BCE65D310EAD1211007E4533 /* Theme.cpp */,
 				BCE658FE0EA9248A007E4533 /* Theme.h */,
@@ -20018,7 +20200,6 @@
 		E1F0424309839389006694EA /* xml */ = {
 			isa = PBXGroup;
 			children = (
-				A83B536C14F749E200720D9D /* DOMWindowXML.idl */,
 				00B9318013BA867F0035A948 /* parser */,
 				1ACE53E10A8D18E70022947D /* DOMParser.cpp */,
 				1ACE53E20A8D18E70022947D /* DOMParser.h */,
@@ -20310,6 +20491,8 @@
 				0FF50270102BA96A0066F39A /* StyleMedia.idl */,
 				A80E6DF90A199067007FB8C5 /* StylePropertySet.cpp */,
 				A80E6DFA0A199067007FB8C5 /* StylePropertySet.h */,
+				E4BBED4A14FCDBA1003F0B98 /* StyleRule.cpp */,
+				E4BBED4B14FCDBA1003F0B98 /* StyleRule.h */,
 				A8EA80050A19516E00A8EF5F /* StyleSheet.cpp */,
 				A8EA80040A19516E00A8EF5F /* StyleSheet.h */,
 				850656DC0AAB44D9002D15C0 /* StyleSheet.idl */,
@@ -20416,8 +20599,6 @@
 				9392F1410AD185F400691BD4 /* RenderCounter.h */,
 				BCEA482E097D93020094C9E4 /* RenderDeprecatedFlexibleBox.cpp */,
 				BCEA482F097D93020094C9E4 /* RenderDeprecatedFlexibleBox.h */,
-				D302754312A5FE84004BD828 /* RenderDetails.cpp */,
-				D302754412A5FE84004BD828 /* RenderDetails.h */,
 				D302754512A5FE84004BD828 /* RenderDetailsMarker.cpp */,
 				D302754612A5FE84004BD828 /* RenderDetailsMarker.h */,
 				0F5B7A5210F65D7A00376302 /* RenderEmbeddedObject.cpp */,
@@ -20510,8 +20691,6 @@
 				0F11A54E0F39233100C37884 /* RenderSelectionInfo.h */,
 				AB247A6A0AFD6383003FA5FD /* RenderSlider.cpp */,
 				AB247A6B0AFD6383003FA5FD /* RenderSlider.h */,
-				D302754B12A5FEAB004BD828 /* RenderSummary.cpp */,
-				D302754C12A5FEAB004BD828 /* RenderSummary.h */,
 				A8DF4AE20980C42C0052981B /* RenderTable.cpp */,
 				A8DF4AE10980C42C0052981B /* RenderTable.h */,
 				6ED878C2147493F4004C3597 /* RenderTableCaption.cpp */,
@@ -20612,6 +20791,8 @@
 				A81872140977D3C0005826D9 /* ContainerNode.cpp */,
 				A81872110977D3C0005826D9 /* ContainerNode.h */,
 				E1A1470711102B1500EEC0F3 /* ContainerNodeAlgorithms.h */,
+				97627B8B14FB3CEE002CDCA1 /* ContextDestructionObserver.cpp */,
+				97627B8C14FB3CEE002CDCA1 /* ContextDestructionObserver.h */,
 				2E3FAA0811A36BF100576624 /* CrossThreadTask.h */,
 				62CD32561157E57C0063B0A7 /* CustomEvent.cpp */,
 				62CD32571157E57C0063B0A7 /* CustomEvent.h */,
@@ -20706,13 +20887,13 @@
 				BC60D9090D2A17CE00B9918F /* EventException.h */,
 				BC60D90A0D2A17CE00B9918F /* EventException.idl */,
 				97665011144FAA4200F6BB51 /* EventFactory.h */,
-				BC9A6142146859D9006057FD /* EventFactory.in */,
 				935FBC4409BA00B900E230B1 /* EventListener.h */,
 				85AFA7410AAF298400E84305 /* EventListener.idl */,
 				AD4495F1141FC08900541EDF /* EventListenerMap.cpp */,
 				AD4495F2141FC08900541EDF /* EventListenerMap.h */,
 				939885C108B7E3D100E707C4 /* EventNames.cpp */,
 				939885C208B7E3D100E707C4 /* EventNames.h */,
+				BC9A6142146859D9006057FD /* EventNames.in */,
 				8F6756191288B17B0047ACA3 /* EventQueue.h */,
 				CE5CB1B314EDAB6F00BB2795 /* EventSender.h */,
 				E12EDBE90B308E0B002704B6 /* EventTarget.cpp */,
@@ -20827,6 +21008,8 @@
 				D23CA56B0AB0EB8D005108A5 /* RangeException.h */,
 				D23CA5480AB0E983005108A5 /* RangeException.idl */,
 				A84D827B11D333ED00972990 /* RawDataDocumentParser.h */,
+				8ABAFB9D14F5107500A4984B /* RegionNodeList.cpp */,
+				8ABAFB9E14F5107500A4984B /* RegionNodeList.h */,
 				85031B350A44EFC700F992E0 /* RegisteredEventListener.cpp */,
 				85031B360A44EFC700F992E0 /* RegisteredEventListener.h */,
 				A76E5F7E135E0DCF00A69837 /* RenderedDocumentMarker.h */,
@@ -20851,6 +21034,8 @@
 				A6D169611346B49B000EB770 /* ShadowRoot.cpp */,
 				A6D169631346B4C1000EB770 /* ShadowRoot.h */,
 				A7DB418114CE1F0A00A2E316 /* ShadowRoot.idl */,
+				57CF4C8414F7597A00ECFF14 /* ShadowTree.cpp */,
+				57CF4C8514F7597A00ECFF14 /* ShadowTree.h */,
 				D01A27AB10C9BFD800026A42 /* SpaceSplitString.cpp */,
 				D01A27AC10C9BFD800026A42 /* SpaceSplitString.h */,
 				CEA3949A11D45CDA003094CF /* StaticHashSetNodeList.cpp */,
@@ -21222,7 +21407,7 @@
 			isa = PBXHeadersBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				B5B5DC6A119BB3D5002A8790 /* AbstractDatabase.h in Headers */,
+				97BC69DB1505F076001B74AC /* AbstractDatabase.h in Headers */,
 				41E1B1D10FF5986900576B3B /* AbstractWorker.h in Headers */,
 				29A8122E0FBB9C1D00510293 /* AccessibilityARIAGridCell.h in Headers */,
 				29A812330FBB9C1D00510293 /* AccessibilityARIAGridRow.h in Headers */,
@@ -21272,7 +21457,6 @@
 				512DD8F80D91E6AF000F89EE /* ArchiveResourceCollection.h in Headers */,
 				BCFB2F77097A2E1A00BA703D /* Arena.h in Headers */,
 				FD5686CA13AC180200B69C68 /* AsyncAudioDecoder.h in Headers */,
-				2EF1BFF7121CB0BD00C27627 /* AsyncFileStream.h in Headers */,
 				89D08DA012228451001241DF /* AsyncFileSystem.h in Headers */,
 				89D08DA112228451001241DF /* AsyncFileSystemCallbacks.h in Headers */,
 				976D6C77122B8A3D001FD1F7 /* AsyncFileWriter.h in Headers */,
@@ -21329,6 +21513,7 @@
 				B2C3DA220D006C1D00EF6F26 /* Base64.h in Headers */,
 				379E61CA126CA5C400B63E8D /* BaseButtonInputType.h in Headers */,
 				379E61CC126CA5C400B63E8D /* BaseCheckableInputType.h in Headers */,
+				C33EE5C514FB49610002095A /* BaseClickableWithKeyInputType.h in Headers */,
 				F59C96001255B23F000623C0 /* BaseDateAndTimeInputType.h in Headers */,
 				F55B3DAE1251F12D003EF269 /* BaseTextInputType.h in Headers */,
 				BC9462D8107A7B4C00857193 /* BeforeLoadEvent.h in Headers */,
@@ -21395,7 +21580,7 @@
 				49484FCB102CF23C00187DD3 /* CanvasRenderingContext2D.h in Headers */,
 				49484FCE102CF23C00187DD3 /* CanvasStyle.h in Headers */,
 				6550B69E099DF0270090D781 /* CDATASection.h in Headers */,
-				514185EE0CD65F0400763C99 /* ChangeVersionWrapper.h in Headers */,
+				97BC69DD1505F076001B74AC /* ChangeVersionWrapper.h in Headers */,
 				6550B6A0099DF0270090D781 /* CharacterData.h in Headers */,
 				00022E6913CE1BBA00282D5B /* CharacterReferenceParserInlineMethods.h in Headers */,
 				B2C3DA2A0D006C1D00EF6F26 /* CharsetData.h in Headers */,
@@ -21414,7 +21599,7 @@
 				4B8AF4AA0B1CE02B00687690 /* ClipboardAccessPolicy.h in Headers */,
 				85031B400A44EFC700F992E0 /* ClipboardEvent.h in Headers */,
 				93F199E708245E59001E9ABC /* ClipboardMac.h in Headers */,
-				51FB54F5113E364200821176 /* CloseEvent.h in Headers */,
+				97AABD1314FA09D5007457AE /* CloseEvent.h in Headers */,
 				C0C054CB1118C8E400CE2636 /* CodeGenerator.pm in Headers */,
 				BC5EB5DF0E81B9AB00B25965 /* CollapsedBorderValue.h in Headers */,
 				93C442000F813AE100C1A634 /* CollectionType.h in Headers */,
@@ -21444,6 +21629,7 @@
 				57B791A614C6A62900F202D1 /* ContentSelectorQuery.h in Headers */,
 				41D015CA0F4B5C71004A662F /* ContentType.h in Headers */,
 				370D6EDB138454550044103E /* ContentTypeParser.h in Headers */,
+				97627B8E14FB3CEE002CDCA1 /* ContextDestructionObserver.h in Headers */,
 				93B6A0E60B0BCA5C00F5027A /* ContextMenu.h in Headers */,
 				065AD4F50B0C2EDA005A2B1D /* ContextMenuClient.h in Headers */,
 				065AD4F70B0C2EDA005A2B1D /* ContextMenuController.h in Headers */,
@@ -21541,15 +21727,16 @@
 				50D40612147D49DE00D30BB5 /* CustomFilterShader.h in Headers */,
 				A8CB413E0E8633FD0032C4F0 /* DashArray.h in Headers */,
 				A80E6D0B0A1989CA007FB8C5 /* DashboardRegion.h in Headers */,
-				5196116B0CAC56570010A80C /* Database.h in Headers */,
-				51A45B560CAD7FD7000D2BE9 /* DatabaseAuthorizer.h in Headers */,
-				B5D3601A112F8B560048DEA8 /* DatabaseCallback.h in Headers */,
-				5116D9770CF177BD00C2B84D /* DatabaseDetails.h in Headers */,
-				B523CF0B1182675400EBB29C /* DatabaseSync.h in Headers */,
-				519611EA0CAC749C0010A80C /* DatabaseTask.h in Headers */,
-				519611780CAC56A80010A80C /* DatabaseThread.h in Headers */,
-				1AD51A140CB59CD300953D11 /* DatabaseTracker.h in Headers */,
-				51FAFE340CECBF2D00BB3F24 /* DatabaseTrackerClient.h in Headers */,
+				97BC6A211505F081001B74AC /* Database.h in Headers */,
+				97BC6A241505F081001B74AC /* DatabaseAuthorizer.h in Headers */,
+				97BC6A251505F081001B74AC /* DatabaseCallback.h in Headers */,
+				97BC6A281505F081001B74AC /* DatabaseContext.h in Headers */,
+				97BC6A291505F081001B74AC /* DatabaseDetails.h in Headers */,
+				97BC6A2B1505F081001B74AC /* DatabaseSync.h in Headers */,
+				97BC6A2E1505F081001B74AC /* DatabaseTask.h in Headers */,
+				97BC6A301505F081001B74AC /* DatabaseThread.h in Headers */,
+				97BC6A321505F081001B74AC /* DatabaseTracker.h in Headers */,
+				97BC6A331505F081001B74AC /* DatabaseTrackerClient.h in Headers */,
 				BC22746F0E83664500E7F975 /* DataRef.h in Headers */,
 				BC64641C11D7F416006455B0 /* DatasetDOMStringMap.h in Headers */,
 				81AC5999131636E60009A7E0 /* DataTransferItem.h in Headers */,
@@ -22206,8 +22393,9 @@
 				85C7F5E70AAFBAFB004014DD /* DOMWheelEvent.h in Headers */,
 				85989DD10ACC8BBD00A0BC51 /* DOMWheelEventInternal.h in Headers */,
 				1403B99709EB13AF00797C7F /* DOMWindow.h in Headers */,
+				9712A5AE15004EDA0048AF10 /* DOMWindowIndexedDatabase.h in Headers */,
 				97D2AD0414B823A60093DF32 /* DOMWindowProperty.h in Headers */,
-				A8F457A114BC1A94000CEA59 /* DOMWindowSQLDatabase.h in Headers */,
+				97BC6A351505F081001B74AC /* DOMWindowSQLDatabase.h in Headers */,
 				F35AE5AC14925F5B004D5776 /* DOMWrapperVisitor.h in Headers */,
 				BC53DA2E1143121E000D817E /* DOMWrapperWorld.h in Headers */,
 				1A1D13800A5325520064BF5F /* DOMXPath.h in Headers */,
@@ -22287,6 +22475,7 @@
 				9767CE0C145ABC13005E64DB /* ExceptionInterfaces.h in Headers */,
 				6E67D2A91280E8BD008758F7 /* Extensions3D.h in Headers */,
 				6E67D2A71280E8A4008758F7 /* Extensions3DOpenGL.h in Headers */,
+				7728694F14F8882500F484DC /* EXTTextureFilterAnisotropic.h in Headers */,
 				A75E8B890E1DE2D6007F2481 /* FEBlend.h in Headers */,
 				A75E8B8B0E1DE2D6007F2481 /* FEColorMatrix.h in Headers */,
 				A75E8B8D0E1DE2D6007F2481 /* FEComponentTransfer.h in Headers */,
@@ -22327,7 +22516,6 @@
 				2EDF369D122C94B4002F7D4E /* FileReaderSync.h in Headers */,
 				2EF1BFEB121C9F4200C27627 /* FileStream.h in Headers */,
 				2EF1BFF9121CB0CE00C27627 /* FileStreamClient.h in Headers */,
-				976D6C8C122B8A3D001FD1F7 /* FileStreamProxy.h in Headers */,
 				514B3F730C722047000530DF /* FileSystem.h in Headers */,
 				89878563122CA064003AABDA /* FileSystemCallback.h in Headers */,
 				89878565122CA064003AABDA /* FileSystemCallbacks.h in Headers */,
@@ -22579,31 +22767,47 @@
 				513F14540AB634C400094DDF /* IconLoader.h in Headers */,
 				51E1ECC10C91C90400DC255B /* IconRecord.h in Headers */,
 				45BAC2B01360BBAB005DA258 /* IconURL.h in Headers */,
-				C585A6CD11D4FB3D004C3E4B /* IDBAny.h in Headers */,
+				9712A5B115004EDA0048AF10 /* IDBAny.h in Headers */,
+				9712A5B315004EDA0048AF10 /* IDBBackingStore.h in Headers */,
 				C585A66311D4FAC5004C3E4B /* IDBBindingUtilities.h in Headers */,
-				C585A6CF11D4FB3D004C3E4B /* IDBCallbacks.h in Headers */,
-				81A7325E1210189B00FC0D9E /* IDBCursor.h in Headers */,
-				81A73278121019E100FC0D9E /* IDBCursorBackendImpl.h in Headers */,
-				81BE209911F4AB8D00915DFA /* IDBCursorBackendInterface.h in Headers */,
-				C585A6D811D4FB3D004C3E4B /* IDBDatabase.h in Headers */,
-				B61762621203490800EF9114 /* IDBDatabaseBackendImpl.h in Headers */,
-				B61762541203374F00EF9114 /* IDBDatabaseBackendInterface.h in Headers */,
-				C585A6D111D4FB3D004C3E4B /* IDBDatabaseError.h in Headers */,
-				C585A6D311D4FB3D004C3E4B /* IDBDatabaseException.h in Headers */,
-				C585A6FE11D4FB3D004C3E4B /* IDBFactory.h in Headers */,
-				C585A6FC11D4FB3D004C3E4B /* IDBFactoryBackendImpl.h in Headers */,
-				C585A6FA11D4FB3D004C3E4B /* IDBFactoryBackendInterface.h in Headers */,
-				C572EE0B1201C736007D8F82 /* IDBIndex.h in Headers */,
-				C572EE0E1201C736007D8F82 /* IDBIndexBackendImpl.h in Headers */,
-				C572EE0F1201C736007D8F82 /* IDBIndexBackendInterface.h in Headers */,
-				C585A6E711D4FB3D004C3E4B /* IDBKey.h in Headers */,
-				C585A6EA11D4FB3D004C3E4B /* IDBKeyRange.h in Headers */,
-				C585A6ED11D4FB3D004C3E4B /* IDBObjectStore.h in Headers */,
-				C585A6EF11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.h in Headers */,
-				C585A6F111D4FB3D004C3E4B /* IDBObjectStoreBackendInterface.h in Headers */,
-				C585A6F411D4FB3D004C3E4B /* IDBRequest.h in Headers */,
-				EB49DB8F14F46E8B002299D9 /* IDBTracing.h in Headers */,
-				B656626B120B115A006EA85C /* IDBTransaction.h in Headers */,
+				9712A5B415004EDA0048AF10 /* IDBCallbacks.h in Headers */,
+				9712A5B615004EDA0048AF10 /* IDBCursor.h in Headers */,
+				9712A5B915004EDA0048AF10 /* IDBCursorBackendImpl.h in Headers */,
+				9712A5BA15004EDA0048AF10 /* IDBCursorBackendInterface.h in Headers */,
+				9712A5BC15004EDA0048AF10 /* IDBCursorWithValue.h in Headers */,
+				9712A5BF15004EDA0048AF10 /* IDBDatabase.h in Headers */,
+				9712A5C215004EDA0048AF10 /* IDBDatabaseBackendImpl.h in Headers */,
+				9712A5C315004EDA0048AF10 /* IDBDatabaseBackendInterface.h in Headers */,
+				9712A5C415004EDA0048AF10 /* IDBDatabaseCallbacks.h in Headers */,
+				9712A5C615004EDA0048AF10 /* IDBDatabaseCallbacksImpl.h in Headers */,
+				9712A5C715004EDA0048AF10 /* IDBDatabaseError.h in Headers */,
+				9712A5CA15004EDA0048AF10 /* IDBDatabaseException.h in Headers */,
+				9712A5CD15004EDA0048AF10 /* IDBEventDispatcher.h in Headers */,
+				9712A5CF15004EDA0048AF10 /* IDBFactory.h in Headers */,
+				9712A5D215004EDA0048AF10 /* IDBFactoryBackendImpl.h in Headers */,
+				9712A5D415004EDA0048AF10 /* IDBFactoryBackendInterface.h in Headers */,
+				9712A5D615004EDA0048AF10 /* IDBIndex.h in Headers */,
+				9712A5D915004EDA0048AF10 /* IDBIndexBackendImpl.h in Headers */,
+				9712A5DA15004EDA0048AF10 /* IDBIndexBackendInterface.h in Headers */,
+				9712A5DC15004EDA0048AF10 /* IDBKey.h in Headers */,
+				9712A5DF15004EDA0048AF10 /* IDBKeyPath.h in Headers */,
+				9712A5E115004EDA0048AF10 /* IDBKeyPathBackendImpl.h in Headers */,
+				9712A5E315004EDA0048AF10 /* IDBKeyRange.h in Headers */,
+				9712A5E615004EDA0048AF10 /* IDBLevelDBBackingStore.h in Headers */,
+				9712A5E815004EDA0048AF10 /* IDBLevelDBCoding.h in Headers */,
+				9712A5EA15004EDA0048AF10 /* IDBObjectStore.h in Headers */,
+				9712A5ED15004EDA0048AF10 /* IDBObjectStoreBackendImpl.h in Headers */,
+				9712A5EE15004EDA0048AF10 /* IDBObjectStoreBackendInterface.h in Headers */,
+				9712A5F015004EDA0048AF10 /* IDBPendingTransactionMonitor.h in Headers */,
+				9712A5F215004EDA0048AF10 /* IDBRequest.h in Headers */,
+				9712A5F415004EDA0048AF10 /* IDBTracing.h in Headers */,
+				9712A5F615004EDA0048AF10 /* IDBTransaction.h in Headers */,
+				9712A5F915004EDA0048AF10 /* IDBTransactionBackendImpl.h in Headers */,
+				9712A5FA15004EDA0048AF10 /* IDBTransactionBackendInterface.h in Headers */,
+				9712A5FB15004EDA0048AF10 /* IDBTransactionCallbacks.h in Headers */,
+				9712A5FD15004EDA0048AF10 /* IDBTransactionCoordinator.h in Headers */,
+				9712A5FF15004EDA0048AF10 /* IDBVersionChangeEvent.h in Headers */,
+				9712A60215004EDA0048AF10 /* IDBVersionChangeRequest.h in Headers */,
 				1A71D57C0F33819000F9CE4E /* IdentifierRep.h in Headers */,
 				5913A24213D49EBA00F5B05C /* IdentifiersFactory.h in Headers */,
 				49E911C50EF86D47009D0CAF /* IdentityTransformOperation.h in Headers */,
@@ -22816,6 +23020,7 @@
 				E0FEF372B37C53EAC1C1FBEE /* JSEventSource.h in Headers */,
 				BC60901F0E91B8EC000C68B5 /* JSEventTarget.h in Headers */,
 				3314ACEC10892086000F0E56 /* JSExceptionBase.h in Headers */,
+				7728698414FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.h in Headers */,
 				BC00F0150E0A189500FD04E3 /* JSFile.h in Headers */,
 				893C47B81238A099002B3D86 /* JSFileCallback.h in Headers */,
 				898785B1122CA2A7003AABDA /* JSFileEntry.h in Headers */,
@@ -23229,6 +23434,7 @@
 				521D46F811AEC9B100514613 /* KillRing.h in Headers */,
 				6593923809AE4346002C531F /* KURL.h in Headers */,
 				BCBD21AB0E417AD400A070F2 /* KURLHash.h in Headers */,
+				26A5034E14F0983600AA730D /* KURLWTFURLImpl.h in Headers */,
 				A456FA2711AD4A830020B420 /* LabelsNodeList.h in Headers */,
 				85EC9AFB0A71A2C600EEEAED /* Language.h in Headers */,
 				2917B5621473496C0052C9D0 /* LayerFlushScheduler.h in Headers */,
@@ -23264,8 +23470,6 @@
 				A5732B0D136A16C4005C8D7C /* LocalizedDate.h in Headers */,
 				F5142C69123F12B000F5BD4C /* LocalizedNumber.h in Headers */,
 				935207BE09BD410A00F2038D /* LocalizedStrings.h in Headers */,
-				511F23180DC160DA004F0032 /* StorageTask.h in Headers */,
-				511F231A0DC160DA004F0032 /* StorageThread.h in Headers */,
 				BCE1C41B0D982980003B02F2 /* Location.h in Headers */,
 				A8239E0109B3CF8A00B60641 /* Logging.h in Headers */,
 				FD31603912B0267600C1A359 /* LowPass2FilterNode.h in Headers */,
@@ -23344,7 +23548,6 @@
 				E12719C70EEEC16800F61213 /* NavigatorBase.h in Headers */,
 				9711460414EF009A00674FD9 /* NavigatorGeolocation.h in Headers */,
 				97E4A12614F4C5D400870E43 /* NavigatorRegisterProtocolHandler.h in Headers */,
-				97CC3AE314E8E4A200894988 /* NavigatorSupplement.h in Headers */,
 				8A309C9F123950BE00CB9204 /* NestingLevelIncrementer.h in Headers */,
 				656D37430ADBA5DE00A4554D /* NetscapePlugInStreamLoader.h in Headers */,
 				628D214C12131ED10055DCFC /* NetworkingContext.h in Headers */,
@@ -23366,7 +23569,7 @@
 				3390CA560FFC157B00921962 /* NotificationCenter.h in Headers */,
 				3390CA580FFC157B00921962 /* NotificationContents.h in Headers */,
 				3128CA6B147331630074C72A /* NotificationController.h in Headers */,
-				33503C9A10179A74003B47E1 /* NotificationPresenter.h in Headers */,
+				33503C9A10179A74003B47E1 /* NotificationClient.h in Headers */,
 				98EB1F951313FE0500D0E1EA /* NotImplemented.h in Headers */,
 				1A569D0B0D7E2B82007C3983 /* NP_jsobject.h in Headers */,
 				1A927FD21416A15B003A83C8 /* npapi.h in Headers */,
@@ -23394,8 +23597,8 @@
 				F4EAF4AF10C742B1009100D3 /* OpenTypeSanitizer.h in Headers */,
 				2E2445F71395893A004B6C19 /* OperationNotAllowedException.h in Headers */,
 				0014628B103CD1DE000B20DB /* OriginAccessEntry.h in Headers */,
-				51A9267D0D53F0570063ECC2 /* OriginQuotaManager.h in Headers */,
-				51A9267F0D53F0570063ECC2 /* OriginUsageRecord.h in Headers */,
+				97BC6A381505F081001B74AC /* OriginQuotaManager.h in Headers */,
+				97BC6A3A1505F081001B74AC /* OriginUsageRecord.h in Headers */,
 				BC5EB5DD0E81B8DD00B25965 /* OutlineValue.h in Headers */,
 				1A0D57370A5C77FE007EDD4C /* OverflowEvent.h in Headers */,
 				3774ABA50FA21EB400AD7DE9 /* OverlapTestRequestClient.h in Headers */,
@@ -23404,11 +23607,11 @@
 				F3820893147D35F90010BC06 /* PageConsoleAgent.h in Headers */,
 				F34742DD134362F000531BC2 /* PageDebuggerAgent.h in Headers */,
 				9302B0BF0D79F82C00C7EE83 /* PageGroup.h in Headers */,
+				9712A60515004EDA0048AF10 /* PageGroupIndexedDatabase.h in Headers */,
 				7A674BDC0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h in Headers */,
 				F3820895147D35F90010BC06 /* PageRuntimeAgent.h in Headers */,
 				F34742E51343633C00531BC2 /* PageScriptDebugServer.h in Headers */,
 				371E65CC13661EDC00BEEDB0 /* PageSerializer.h in Headers */,
-				A71E083814E3CEAF006A4619 /* PageSupplement.h in Headers */,
 				E1284AE110447D4500EAEB52 /* PageTransitionEvent.h in Headers */,
 				51E1ECC30C91C90400DC255B /* PageURLRecord.h in Headers */,
 				FFD5B97B135CC97800D5E92A /* PageVisibilityState.h in Headers */,
@@ -23419,7 +23622,6 @@
 				BC76AC130DD7AD5C00415F34 /* ParserUtilities.h in Headers */,
 				F55B3DCA1251F12D003EF269 /* PasswordInputType.h in Headers */,
 				4B2708C70AF19EE40065127F /* Pasteboard.h in Headers */,
-				A7D3C5240B576B4B002CA450 /* PasteboardHelper.h in Headers */,
 				C598905714E9C28000E8D18B /* PasteboardStrategy.h in Headers */,
 				B27535800B053814002CE64F /* Path.h in Headers */,
 				A88DD4870B4629A300C02990 /* PathTraversalState.h in Headers */,
@@ -23501,6 +23703,7 @@
 				FD31603E12B0267600C1A359 /* RealtimeAnalyserNode.h in Headers */,
 				BC4368E80C226E32005EFB5F /* Rect.h in Headers */,
 				BCAB418213E356E800D8AAF3 /* Region.h in Headers */,
+				8ABAFBA014F5107500A4984B /* RegionNodeList.h in Headers */,
 				85031B4C0A44EFC700F992E0 /* RegisteredEventListener.h in Headers */,
 				B2C3DA2D0D006C1D00EF6F26 /* RegularExpression.h in Headers */,
 				93309E01099E64920056E581 /* RemoveCSSPropertyCommand.h in Headers */,
@@ -23518,7 +23721,6 @@
 				BCE4413412F748E2009B84B8 /* RenderCombineText.h in Headers */,
 				9392F1420AD185F400691BD4 /* RenderCounter.h in Headers */,
 				BCEA486E097D93020094C9E4 /* RenderDeprecatedFlexibleBox.h in Headers */,
-				D302754812A5FE84004BD828 /* RenderDetails.h in Headers */,
 				D302754A12A5FE84004BD828 /* RenderDetailsMarker.h in Headers */,
 				A76E5F7F135E0DCF00A69837 /* RenderedDocumentMarker.h in Headers */,
 				9B32CDA913DF7FA900F34D13 /* RenderedPosition.h in Headers */,
@@ -23580,7 +23782,6 @@
 				AB247A6D0AFD6383003FA5FD /* RenderSlider.h in Headers */,
 				BC8C8FAE0DDCD31B00B592F4 /* RenderStyle.h in Headers */,
 				BC5EB6680E81CB7100B25965 /* RenderStyleConstants.h in Headers */,
-				D302754E12A5FEAB004BD828 /* RenderSummary.h in Headers */,
 				436708C112D9CA4B00044234 /* RenderSVGBlock.h in Headers */,
 				436708C312D9CA4B00044234 /* RenderSVGContainer.h in Headers */,
 				43C092BC12D9E4EE00A989C3 /* RenderSVGForeignObject.h in Headers */,
@@ -23605,7 +23806,6 @@
 				436708E112D9CA4B00044234 /* RenderSVGResourceRadialGradient.h in Headers */,
 				436708E312D9CA4B00044234 /* RenderSVGResourceSolidColor.h in Headers */,
 				436708E512D9CA4B00044234 /* RenderSVGRoot.h in Headers */,
-				436708E712D9CA4B00044234 /* RenderSVGShadowTreeRootContainer.h in Headers */,
 				A10BB58B1484E3B300B2E87A /* RenderSVGShape.h in Headers */,
 				0854B0191255E4E600B9CDD0 /* RenderSVGText.h in Headers */,
 				0854B01B1255E4E600B9CDD0 /* RenderSVGTextPath.h in Headers */,
@@ -23708,6 +23908,7 @@
 				BCAE1FA712939DB7004CB026 /* ScrollAnimatorMac.h in Headers */,
 				93F199B808245E59001E9ABC /* Scrollbar.h in Headers */,
 				BC8B854B0E7C7F5600AB6984 /* ScrollbarTheme.h in Headers */,
+				C6B31B2E14F841FB0089F23F /* ScrollbarThemeClient.h in Headers */,
 				BC14028B0E83680800319717 /* ScrollbarThemeComposite.h in Headers */,
 				BC8B853E0E7C7F1100AB6984 /* ScrollbarThemeMac.h in Headers */,
 				0FE71406142170B800DB33BA /* ScrollbarThemeMock.h in Headers */,
@@ -23741,7 +23942,7 @@
 				0F3DD45012F5EA1B000D9190 /* ShadowBlur.h in Headers */,
 				BC5EB8C40E82031B00B25965 /* ShadowData.h in Headers */,
 				A6D169641346B4C1000EB770 /* ShadowRoot.h in Headers */,
-				572E92FC14E540580087FFBA /* ShadowRootList.h in Headers */,
+				57CF4C8714F7597A00ECFF14 /* ShadowTree.h in Headers */,
 				A80E6CE80A1989CA007FB8C5 /* ShadowValue.h in Headers */,
 				B2AFFC940D00A5DF0030074D /* ShapeArabic.h in Headers */,
 				1A4A954E0B4EDCCB002D8C3C /* SharedBuffer.h in Headers */,
@@ -23782,26 +23983,26 @@
 				93309E14099E64920056E581 /* SplitTextNodeCommand.h in Headers */,
 				93309E16099E64920056E581 /* SplitTextNodeContainingElementCommand.h in Headers */,
 				84730D931248F0B300D3A9C9 /* SpotLightSource.h in Headers */,
-				245D80A313280E40003492A6 /* SQLCallbackWrapper.h in Headers */,
-				51EC92590CE90DB400F90308 /* SQLError.h in Headers */,
-				B56EBA8511C9FF8100B04477 /* SQLException.h in Headers */,
+				97BC6A3B1505F081001B74AC /* SQLCallbackWrapper.h in Headers */,
+				97BC6A3C1505F081001B74AC /* SQLError.h in Headers */,
+				97BC6A3F1505F081001B74AC /* SQLException.h in Headers */,
 				1A22464A0CC98DDB00C05240 /* SQLiteDatabase.h in Headers */,
 				B5A684220FFABE9800D24689 /* SQLiteFileSystem.h in Headers */,
 				1A22464C0CC98DDB00C05240 /* SQLiteStatement.h in Headers */,
 				1A22464E0CC98DDB00C05240 /* SQLiteTransaction.h in Headers */,
-				519611740CAC56570010A80C /* SQLResultSet.h in Headers */,
-				1AFE117E0CBFFB36003017FA /* SQLResultSetRowList.h in Headers */,
-				515B03990CD1642A00B7EA9C /* SQLStatement.h in Headers */,
-				1A7CCB190CD9469A00B7B64E /* SQLStatementCallback.h in Headers */,
-				1A7CCB1A0CD9469A00B7B64E /* SQLStatementErrorCallback.h in Headers */,
-				B550B52611DC68A800923885 /* SQLStatementSync.h in Headers */,
-				1A7CCB240CD946FD00B7B64E /* SQLTransaction.h in Headers */,
-				1A7CCB1B0CD9469A00B7B64E /* SQLTransactionCallback.h in Headers */,
-				B51BF6F1102C9E590002C15A /* SQLTransactionClient.h in Headers */,
-				B5C1123C102B6C4600096578 /* SQLTransactionCoordinator.h in Headers */,
-				1A7CCB1C0CD9469A00B7B64E /* SQLTransactionErrorCallback.h in Headers */,
-				B523CF081182675400EBB29C /* SQLTransactionSync.h in Headers */,
-				B523CF061182675400EBB29C /* SQLTransactionSyncCallback.h in Headers */,
+				97BC6A421505F081001B74AC /* SQLResultSet.h in Headers */,
+				97BC6A451505F081001B74AC /* SQLResultSetRowList.h in Headers */,
+				97BC6A481505F081001B74AC /* SQLStatement.h in Headers */,
+				97BC6A491505F081001B74AC /* SQLStatementCallback.h in Headers */,
+				97BC6A4B1505F081001B74AC /* SQLStatementErrorCallback.h in Headers */,
+				97BC6A4E1505F081001B74AC /* SQLStatementSync.h in Headers */,
+				97BC6A501505F081001B74AC /* SQLTransaction.h in Headers */,
+				97BC6A521505F081001B74AC /* SQLTransactionCallback.h in Headers */,
+				97BC6A551505F081001B74AC /* SQLTransactionClient.h in Headers */,
+				97BC6A571505F081001B74AC /* SQLTransactionCoordinator.h in Headers */,
+				97BC6A581505F081001B74AC /* SQLTransactionErrorCallback.h in Headers */,
+				97BC6A5B1505F081001B74AC /* SQLTransactionSync.h in Headers */,
+				97BC6A5D1505F081001B74AC /* SQLTransactionSyncCallback.h in Headers */,
 				1A2E6E5A0CC55213004A2062 /* SQLValue.h in Headers */,
 				93F1996308245E59001E9ABC /* SSLKeyGenerator.h in Headers */,
 				CEA3949D11D45CDA003094CF /* StaticHashSetNodeList.h in Headers */,
@@ -23820,6 +24021,8 @@
 				C50D0E830FF4272900AC2644 /* StorageNamespace.h in Headers */,
 				C55E38BF10040D5D00A56BDB /* StorageNamespaceImpl.h in Headers */,
 				C5102D940FD9AA2D00FAFF04 /* StorageSyncManager.h in Headers */,
+				511F23180DC160DA004F0032 /* StorageTask.h in Headers */,
+				511F231A0DC160DA004F0032 /* StorageThread.h in Headers */,
 				3AB02D2A12D4F91600FBB694 /* StorageTracker.h in Headers */,
 				3AC3680012EF7A09006A3D6F /* StorageTrackerClient.h in Headers */,
 				81AC6C36131C57D30009A7E0 /* StringCallback.h in Headers */,
@@ -23840,6 +24043,7 @@
 				5317612313C516690026E454 /* StyleFlexibleBoxData.h in Headers */,
 				BCEF444A0E6745E0001C1287 /* StyleGeneratedImage.h in Headers */,
 				A10DC76B14747BAB005E2471 /* StyleGridData.h in Headers */,
+				A110DB9B14F5DF7700A03B93 /* StyleGridItemData.h in Headers */,
 				BCEF43CF0E673DA1001C1287 /* StyleImage.h in Headers */,
 				BC2273040E82F1E600E7F975 /* StyleInheritedData.h in Headers */,
 				BC5EB72A0E81DE8100B25965 /* StyleMarqueeData.h in Headers */,
@@ -23849,6 +24053,7 @@
 				BC2272E40E82EE9B00E7F975 /* StyleRareInheritedData.h in Headers */,
 				BC2272BD0E82EAAE00E7F975 /* StyleRareNonInheritedData.h in Headers */,
 				BC2272870E82E70700E7F975 /* StyleReflection.h in Headers */,
+				E4BBED4D14FCDBA1003F0B98 /* StyleRule.h in Headers */,
 				3138A9E51474434600B0ED12 /* StyleShader.h in Headers */,
 				A8EA800C0A19516E00A8EF5F /* StyleSheet.h in Headers */,
 				A8EA800A0A19516E00A8EF5F /* StyleSheetList.h in Headers */,
@@ -23862,6 +24067,7 @@
 				1A8F6B020DB53006001DB794 /* SubstituteResource.h in Headers */,
 				93B2D8160F9920D2006AE6B2 /* SuddenTermination.h in Headers */,
 				97C078501165D5BE003A32EF /* SuffixTree.h in Headers */,
+				97627B9814FB5424002CDCA1 /* Supplementable.h in Headers */,
 				087558C613B4A57D00F49307 /* SurrogatePairAwareTextIterator.h in Headers */,
 				62C1217D11AB9E77003C462C /* SuspendableTimer.h in Headers */,
 				B22279740D00BF220071B782 /* SVGAElement.h in Headers */,
@@ -24044,13 +24250,13 @@
 				BC22747B0E8366E200E7F975 /* SVGRenderStyleDefs.h in Headers */,
 				436708F212D9CA4B00044234 /* SVGRenderSupport.h in Headers */,
 				436708F412D9CA4B00044234 /* SVGRenderTreeAsText.h in Headers */,
+				197B180C1506353200E4ADA8 /* SVGRenderingContext.h in Headers */,
 				436708F612D9CA4B00044234 /* SVGResources.h in Headers */,
 				436708F812D9CA4B00044234 /* SVGResourcesCache.h in Headers */,
 				436708FA12D9CA4B00044234 /* SVGResourcesCycleSolver.h in Headers */,
 				0854B0231255E4E600B9CDD0 /* SVGRootInlineBox.h in Headers */,
 				B2227AA30D00BF220071B782 /* SVGScriptElement.h in Headers */,
 				B2227AA60D00BF220071B782 /* SVGSetElement.h in Headers */,
-				436708FC12D9CA4B00044234 /* SVGShadowTreeElements.h in Headers */,
 				E4AFD0100DAF335500F5F55C /* SVGSMILElement.h in Headers */,
 				0880F70E1282B46D00948505 /* SVGStaticListPropertyTearOff.h in Headers */,
 				0813A4EA1284132600992511 /* SVGStaticPropertyTearOff.h in Headers */,
@@ -24150,8 +24356,8 @@
 				976D6C95122B8A3D001FD1F7 /* ThreadableBlobRegistry.h in Headers */,
 				0B90561B0F2578BF0095FF6A /* ThreadableLoader.h in Headers */,
 				0B90561C0F2578BF0095FF6A /* ThreadableLoaderClient.h in Headers */,
-				5112247410CFB8D8008099D7 /* ThreadableWebSocketChannel.h in Headers */,
-				5112247610CFB8E8008099D7 /* ThreadableWebSocketChannelClientWrapper.h in Headers */,
+				97AABD1714FA09D5007457AE /* ThreadableWebSocketChannel.h in Headers */,
+				97AABD1914FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.h in Headers */,
 				51DF6D7E0B92A16D00C2DC85 /* ThreadCheck.h in Headers */,
 				E1FF57A30F01255B00891EBB /* ThreadGlobalData.h in Headers */,
 				185BCF290F3279CE000EA262 /* ThreadTimers.h in Headers */,
@@ -24219,6 +24425,7 @@
 				37F818FD0D657606005E1F05 /* WebCoreURLResponse.h in Headers */,
 				93F199F008245E59001E9ABC /* WebCoreView.h in Headers */,
 				BC6DADEF0A195FDF00E5CD14 /* WebFontCache.h in Headers */,
+				CD127DEE14F3098400E84779 /* WebCoreFullScreenWindow.h in Headers */,
 				A7D20F6D107F438B00A80392 /* WebGLActiveInfo.h in Headers */,
 				49C7B9C91042D32F0009D447 /* WebGLBuffer.h in Headers */,
 				6E3FAE8F14733FDB00E42306 /* WebGLCompressedTextureS3TC.h in Headers */,
@@ -24262,16 +24469,17 @@
 				1CAF34810A6C405200ABE06E /* WebScriptObject.h in Headers */,
 				1A569D1B0D7E2B82007C3983 /* WebScriptObject.h in Headers */,
 				1CAF34830A6C405200ABE06E /* WebScriptObjectPrivate.h in Headers */,
-				518A34C21026C831001B6896 /* WebSocket.h in Headers */,
-				510D4A4F103177A20049EA54 /* WebSocketChannel.h in Headers */,
-				510D4A50103177A20049EA54 /* WebSocketChannelClient.h in Headers */,
-				4AE02ABE14E8A9D200BC3BA7 /* WebSocketDeflater.h in Headers */,
-				4A957F0714E241300049DBFB /* WebSocketExtensionDispatcher.h in Headers */,
-				4ADE25FA14E3BB4C004C2213 /* WebSocketExtensionProcessor.h in Headers */,
-				4A4A234614F1E1440046FBF1 /* WebSocketFrame.h in Headers */,
-				51ABAE451043AB4A008C5260 /* WebSocketHandshake.h in Headers */,
-				7637C543112E7B7E003D6CDC /* WebSocketHandshakeRequest.h in Headers */,
-				767F99C011A119560080C51D /* WebSocketHandshakeResponse.h in Headers */,
+				97AABD1B14FA09D5007457AE /* WebSocket.h in Headers */,
+				97AABD1E14FA09D5007457AE /* WebSocketChannel.h in Headers */,
+				97AABD1F14FA09D5007457AE /* WebSocketChannelClient.h in Headers */,
+				4A38BF5114FE1C0900612512 /* WebSocketDeflateFramer.h in Headers */,
+				97AABD2114FA09D5007457AE /* WebSocketDeflater.h in Headers */,
+				97AABD2314FA09D5007457AE /* WebSocketExtensionDispatcher.h in Headers */,
+				97AABD2414FA09D5007457AE /* WebSocketExtensionProcessor.h in Headers */,
+				97AABD2514FA09D5007457AE /* WebSocketFrame.h in Headers */,
+				97AABD2714FA09D5007457AE /* WebSocketHandshake.h in Headers */,
+				97AABD2914FA09D5007457AE /* WebSocketHandshakeRequest.h in Headers */,
+				97AABD2B14FA09D5007457AE /* WebSocketHandshakeResponse.h in Headers */,
 				0F580FA31496939100FB5BD8 /* WebTileCacheLayer.h in Headers */,
 				0FCF332D0F2B9A25004B6795 /* WebTiledLayer.h in Headers */,
 				CD82030A1395AB6A00F956C6 /* WebVideoFullscreenController.h in Headers */,
@@ -24292,7 +24500,9 @@
 				2E4346460F546A8200B0F1BA /* Worker.h in Headers */,
 				F3820897147D35F90010BC06 /* WorkerConsoleAgent.h in Headers */,
 				2E4346490F546A8200B0F1BA /* WorkerContext.h in Headers */,
+				9712A612150090CE0048AF10 /* WorkerContextIndexedDatabase.h in Headers */,
 				2E43464B0F546A8200B0F1BA /* WorkerContextProxy.h in Headers */,
+				97BC6A601505F081001B74AC /* WorkerContextSQLDatabase.h in Headers */,
 				F34742E11343631F00531BC2 /* WorkerDebuggerAgent.h in Headers */,
 				A3E2643114748991005A8588 /* WorkerEventQueue.h in Headers */,
 				F36E07A51358A8BE00AACBC9 /* WorkerInspectorController.h in Headers */,
@@ -24310,7 +24520,7 @@
 				2EA768040FE7126400AB9C8A /* WorkerScriptLoaderClient.h in Headers */,
 				2E4346550F546A8200B0F1BA /* WorkerThread.h in Headers */,
 				0B9056F90F2685F30095FF6A /* WorkerThreadableLoader.h in Headers */,
-				5112247A10CFB8FF008099D7 /* WorkerThreadableWebSocketChannel.h in Headers */,
+				97AABD2D14FA09D5007457AE /* WorkerThreadableWebSocketChannel.h in Headers */,
 				93309E24099E64920056E581 /* WrapContentsInDummySpanCommand.h in Headers */,
 				9BAF3B2412C1A39800014BF1 /* WritingDirection.h in Headers */,
 				6565820209D1508D000E61D7 /* XLinkNames.h in Headers */,
@@ -24353,6 +24563,9 @@
 				E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */,
 				977E2E0F12F0FC9C00C13379 /* XSSAuditor.h in Headers */,
 				FD537353137B651800008DCE /* ZeroPole.h in Headers */,
+				E1CDE9221501916900862CC5 /* AsyncFileStream.h in Headers */,
+				450CEBF115073BBE002BB149 /* LabelableElement.h in Headers */,
+				C5B4C24D1509236C00A6EF37 /* WebCoreNSURLExtras.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -24504,6 +24717,7 @@
 				85136CA80AED665900F90A3D /* westResizeCursor.png in Resources */,
 				1AB1AE7A0C051FDE00139F4F /* zoomInCursor.png in Resources */,
 				1AB1AE7B0C051FDE00139F4F /* zoomOutCursor.png in Resources */,
+				2D9F0E1314FF1CBF00BA0FF7 /* linearSRGB.icc in Resources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -24680,7 +24894,7 @@
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 			shellPath = /bin/sh;
-			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore\"\n\n/bin/ln -sfh \"${SRCROOT}\" WebCore\nexport WebCore=\"WebCore\"\n\nif [ ! $CC ]; then\n    case $TARGET_GCC_VERSION in\n        (GCC_42)\n            export CC=\"${DT_TOOLCHAIN_DIR}/usr/bin/gcc-4.2\";;\n        (LLVM_GCC_42)\n            export CC=\"${DT_TOOLCHAIN_DIR}/usr/bin/llvm-gcc-4.2\";;\n        (LLVM_COMPILER)\n            export CC=\"${DT_TOOLCHAIN_DIR}/usr/bin/clang\";;\n    esac\nfi\n\nif [ \"${ACTION}\" = \"build\" -o \"${ACTION}\" = \"install\" -o \"${ACTION}\" = \"installhdrs\" ]; then\n    make  --no-builtin-rules -f \"WebCore/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.availcpu`\nfi\n";
+			shellScript = "mkdir -p \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore\"\ncd \"${BUILT_PRODUCTS_DIR}/DerivedSources/WebCore\"\n\n/bin/ln -sfh \"${SRCROOT}\" WebCore\nexport WebCore=\"WebCore\"\n\nif [ ! $CC ]; then\n    case $TARGET_GCC_VERSION in\n        (GCC_42)\n            export CC=\"`xcrun -find gcc-4.2`\";;\n        (LLVM_GCC_42)\n            export CC=\"`xcrun -find llvm-gcc-4.2`\";;\n        (LLVM_COMPILER)\n            export CC=\"`xcrun -find clang`\";;\n    esac\nfi\n\nif [ \"${ACTION}\" = \"build\" -o \"${ACTION}\" = \"install\" -o \"${ACTION}\" = \"installhdrs\" ]; then\n    make  --no-builtin-rules -f \"WebCore/DerivedSources.make\" -j `/usr/sbin/sysctl -n hw.availcpu`\nfi\n";
 		};
 /* End PBXShellScriptBuildPhase section */
 
@@ -24710,7 +24924,7 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				B5B5DC69119BB3D5002A8790 /* AbstractDatabase.cpp in Sources */,
+				97BC69DA1505F076001B74AC /* AbstractDatabase.cpp in Sources */,
 				41E1B1D00FF5986900576B3B /* AbstractWorker.cpp in Sources */,
 				0F29C16E1300C2E2002D794E /* AccessibilityAllInOne.cpp in Sources */,
 				76CDD2F21103DA6600680521 /* AccessibilityMenuList.cpp in Sources */,
@@ -24782,6 +24996,7 @@
 				B2C3DA210D006C1D00EF6F26 /* Base64.cpp in Sources */,
 				379E61C9126CA5C300B63E8D /* BaseButtonInputType.cpp in Sources */,
 				379E61CB126CA5C400B63E8D /* BaseCheckableInputType.cpp in Sources */,
+				C33EE5C414FB49610002095A /* BaseClickableWithKeyInputType.cpp in Sources */,
 				F59C95FF1255B23F000623C0 /* BaseDateAndTimeInputType.cpp in Sources */,
 				F55B3DAD1251F12D003EF269 /* BaseTextInputType.cpp in Sources */,
 				AB23A32709BBA7D00067CC53 /* BeforeTextInsertedEvent.cpp in Sources */,
@@ -24833,7 +25048,7 @@
 				49484FCA102CF23C00187DD3 /* CanvasRenderingContext2D.cpp in Sources */,
 				49484FCD102CF23C00187DD3 /* CanvasStyle.cpp in Sources */,
 				6550B69D099DF0270090D781 /* CDATASection.cpp in Sources */,
-				514185EF0CD65F0400763C99 /* ChangeVersionWrapper.cpp in Sources */,
+				97BC69DC1505F076001B74AC /* ChangeVersionWrapper.cpp in Sources */,
 				6550B69F099DF0270090D781 /* CharacterData.cpp in Sources */,
 				9326DC0C09DAD5D600AFC847 /* CharsetData.cpp in Sources */,
 				F55B3DB11251F12D003EF269 /* CheckboxInputType.cpp in Sources */,
@@ -24874,6 +25089,7 @@
 				57B791A514C6A62900F202D1 /* ContentSelectorQuery.cpp in Sources */,
 				41D015CB0F4B5C71004A662F /* ContentType.cpp in Sources */,
 				370D6EDA138454550044103E /* ContentTypeParser.cpp in Sources */,
+				97627B8D14FB3CEE002CDCA1 /* ContextDestructionObserver.cpp in Sources */,
 				065AD4F60B0C2EDA005A2B1D /* ContextMenuController.cpp in Sources */,
 				06027CB30B1CC03D00884B2D /* ContextMenuItemMac.mm in Sources */,
 				93B6A0EA0B0BCA8400F5027A /* ContextMenuMac.mm in Sources */,
@@ -24956,12 +25172,13 @@
 				50CC0A3914C6F5B10017AB51 /* CustomFilterOperation.cpp in Sources */,
 				503D0CAA14B5B08700F32F57 /* CustomFilterProgram.cpp in Sources */,
 				50D40611147D49DE00D30BB5 /* CustomFilterShader.cpp in Sources */,
-				5196116A0CAC56570010A80C /* Database.cpp in Sources */,
-				51A45B570CAD7FD7000D2BE9 /* DatabaseAuthorizer.cpp in Sources */,
-				B523CF0A1182675400EBB29C /* DatabaseSync.cpp in Sources */,
-				519611EB0CAC749C0010A80C /* DatabaseTask.cpp in Sources */,
-				5196116D0CAC56570010A80C /* DatabaseThread.cpp in Sources */,
-				1AD51A150CB59CD300953D11 /* DatabaseTracker.cpp in Sources */,
+				97BC6A201505F081001B74AC /* Database.cpp in Sources */,
+				97BC6A231505F081001B74AC /* DatabaseAuthorizer.cpp in Sources */,
+				97BC6A271505F081001B74AC /* DatabaseContext.cpp in Sources */,
+				97BC6A2A1505F081001B74AC /* DatabaseSync.cpp in Sources */,
+				97BC6A2D1505F081001B74AC /* DatabaseTask.cpp in Sources */,
+				97BC6A2F1505F081001B74AC /* DatabaseThread.cpp in Sources */,
+				97BC6A311505F081001B74AC /* DatabaseTracker.cpp in Sources */,
 				BC64641D11D7F416006455B0 /* DatasetDOMStringMap.cpp in Sources */,
 				815E6167132587AA00B622B0 /* DataTransferItem.cpp in Sources */,
 				2E97CCEA12939CB800C5C8FF /* DataView.cpp in Sources */,
@@ -25319,8 +25536,9 @@
 				31C0FF4D0E4CEFDD007D6FE5 /* DOMWebKitTransitionEvent.mm in Sources */,
 				85C7F5E80AAFBAFB004014DD /* DOMWheelEvent.mm in Sources */,
 				1403B99809EB13AF00797C7F /* DOMWindow.cpp in Sources */,
+				9712A5AD15004EDA0048AF10 /* DOMWindowIndexedDatabase.cpp in Sources */,
 				97D2AD0314B823A60093DF32 /* DOMWindowProperty.cpp in Sources */,
-				A8F457A014BC1A88000CEA59 /* DOMWindowSQLDatabase.cpp in Sources */,
+				97BC6A341505F081001B74AC /* DOMWindowSQLDatabase.cpp in Sources */,
 				BC53DA481143134D000D817E /* DOMWrapperWorld.cpp in Sources */,
 				1A1D13810A5325520064BF5F /* DOMXPath.mm in Sources */,
 				85E9E0A20AB3A0C700069CD0 /* DOMXPathExpression.mm in Sources */,
@@ -25374,6 +25592,7 @@
 				A7CACDB113CE875C00BBBE3F /* ExceptionCodePlaceholder.cpp in Sources */,
 				148AFDA60AF58360008CC700 /* ExceptionHandlers.mm in Sources */,
 				6E67D2A61280E8A4008758F7 /* Extensions3DOpenGL.cpp in Sources */,
+				7728694E14F8882500F484DC /* EXTTextureFilterAnisotropic.cpp in Sources */,
 				A75E8B880E1DE2D6007F2481 /* FEBlend.cpp in Sources */,
 				A75E8B8A0E1DE2D6007F2481 /* FEColorMatrix.cpp in Sources */,
 				A75E8B8C0E1DE2D6007F2481 /* FEComponentTransfer.cpp in Sources */,
@@ -25410,7 +25629,6 @@
 				2E75841D12779ADA0062628B /* FileReaderLoader.cpp in Sources */,
 				2EDF369C122C94B4002F7D4E /* FileReaderSync.cpp in Sources */,
 				2EF1BFEA121C9F4200C27627 /* FileStream.cpp in Sources */,
-				976D6C8B122B8A3D001FD1F7 /* FileStreamProxy.cpp in Sources */,
 				C57FEDE11212EE9C0097BE65 /* FileSystem.cpp in Sources */,
 				89878564122CA064003AABDA /* FileSystemCallbacks.cpp in Sources */,
 				5160306C0CC4362300C8AC25 /* FileSystemCF.cpp in Sources */,
@@ -25639,24 +25857,36 @@
 				B275358E0B053A66002CE64F /* IconMac.mm in Sources */,
 				51E1ECC00C91C90400DC255B /* IconRecord.cpp in Sources */,
 				45099C411370A7800058D513 /* IconURL.cpp in Sources */,
-				C585A6CC11D4FB3D004C3E4B /* IDBAny.cpp in Sources */,
+				9712A5B015004EDA0048AF10 /* IDBAny.cpp in Sources */,
 				C585A66211D4FAC5004C3E4B /* IDBBindingUtilities.cpp in Sources */,
-				81A73260121018A400FC0D9E /* IDBCursor.cpp in Sources */,
-				81BE209811F4AB8D00915DFA /* IDBCursorBackendImpl.cpp in Sources */,
-				B691C1F91206D4A00025D980 /* IDBDatabase.cpp in Sources */,
-				C585A6D511D4FB3D004C3E4B /* IDBDatabaseBackendImpl.cpp in Sources */,
-				978D07B2145A0EBD0096908D /* IDBDatabaseException.cpp in Sources */,
-				C585A6FD11D4FB3D004C3E4B /* IDBFactory.cpp in Sources */,
-				C585A6FB11D4FB3D004C3E4B /* IDBFactoryBackendImpl.cpp in Sources */,
-				C585A6F911D4FB3D004C3E4B /* IDBFactoryBackendInterface.cpp in Sources */,
-				C572EE0A1201C736007D8F82 /* IDBIndex.cpp in Sources */,
-				C572EE0D1201C736007D8F82 /* IDBIndexBackendImpl.cpp in Sources */,
-				C585A6E611D4FB3D004C3E4B /* IDBKey.cpp in Sources */,
-				C585A6E911D4FB3D004C3E4B /* IDBKeyRange.cpp in Sources */,
-				C585A6F011D4FB3D004C3E4B /* IDBObjectStore.cpp in Sources */,
-				C585A6EE11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.cpp in Sources */,
-				C585A6F311D4FB3D004C3E4B /* IDBRequest.cpp in Sources */,
-				B656626A120B115A006EA85C /* IDBTransaction.cpp in Sources */,
+				9712A5B515004EDA0048AF10 /* IDBCursor.cpp in Sources */,
+				9712A5B815004EDA0048AF10 /* IDBCursorBackendImpl.cpp in Sources */,
+				9712A5BB15004EDA0048AF10 /* IDBCursorWithValue.cpp in Sources */,
+				9712A5BE15004EDA0048AF10 /* IDBDatabase.cpp in Sources */,
+				9712A5C115004EDA0048AF10 /* IDBDatabaseBackendImpl.cpp in Sources */,
+				9712A5C515004EDA0048AF10 /* IDBDatabaseCallbacksImpl.cpp in Sources */,
+				9712A5C915004EDA0048AF10 /* IDBDatabaseException.cpp in Sources */,
+				9712A5CC15004EDA0048AF10 /* IDBEventDispatcher.cpp in Sources */,
+				9712A5CE15004EDA0048AF10 /* IDBFactory.cpp in Sources */,
+				9712A5D115004EDA0048AF10 /* IDBFactoryBackendImpl.cpp in Sources */,
+				9712A5D315004EDA0048AF10 /* IDBFactoryBackendInterface.cpp in Sources */,
+				9712A5D515004EDA0048AF10 /* IDBIndex.cpp in Sources */,
+				9712A5D815004EDA0048AF10 /* IDBIndexBackendImpl.cpp in Sources */,
+				9712A5DB15004EDA0048AF10 /* IDBKey.cpp in Sources */,
+				9712A5DE15004EDA0048AF10 /* IDBKeyPath.cpp in Sources */,
+				9712A5E015004EDA0048AF10 /* IDBKeyPathBackendImpl.cpp in Sources */,
+				9712A5E215004EDA0048AF10 /* IDBKeyRange.cpp in Sources */,
+				9712A5E515004EDA0048AF10 /* IDBLevelDBBackingStore.cpp in Sources */,
+				9712A5E715004EDA0048AF10 /* IDBLevelDBCoding.cpp in Sources */,
+				9712A5E915004EDA0048AF10 /* IDBObjectStore.cpp in Sources */,
+				9712A5EC15004EDA0048AF10 /* IDBObjectStoreBackendImpl.cpp in Sources */,
+				9712A5EF15004EDA0048AF10 /* IDBPendingTransactionMonitor.cpp in Sources */,
+				9712A5F115004EDA0048AF10 /* IDBRequest.cpp in Sources */,
+				9712A5F515004EDA0048AF10 /* IDBTransaction.cpp in Sources */,
+				9712A5F815004EDA0048AF10 /* IDBTransactionBackendImpl.cpp in Sources */,
+				9712A5FC15004EDA0048AF10 /* IDBTransactionCoordinator.cpp in Sources */,
+				9712A5FE15004EDA0048AF10 /* IDBVersionChangeEvent.cpp in Sources */,
+				9712A60115004EDA0048AF10 /* IDBVersionChangeRequest.cpp in Sources */,
 				1A71D57B0F33819000F9CE4E /* IdentifierRep.cpp in Sources */,
 				5913A24113D49EBA00F5B05C /* IdentifiersFactory.cpp in Sources */,
 				B275356F0B053814002CE64F /* Image.cpp in Sources */,
@@ -25902,6 +26132,7 @@
 				E0FEF372B47C53EAC1C1FBEE /* JSEventSource.cpp in Sources */,
 				BC6090200E91B8EC000C68B5 /* JSEventTarget.cpp in Sources */,
 				3314ACEB10892086000F0E56 /* JSExceptionBase.cpp in Sources */,
+				7728698314FD9ADA00F484DC /* JSEXTTextureFilterAnisotropic.cpp in Sources */,
 				BC00F0140E0A189500FD04E3 /* JSFile.cpp in Sources */,
 				893C47B71238A099002B3D86 /* JSFileCallback.cpp in Sources */,
 				898785B0122CA2A7003AABDA /* JSFileEntry.cpp in Sources */,
@@ -26401,6 +26632,7 @@
 				6593923709AE4346002C531F /* KURL.cpp in Sources */,
 				1A98956B0AA78F80005EF5EF /* KURLCFNet.cpp in Sources */,
 				6593923A09AE435C002C531F /* KURLMac.mm in Sources */,
+				26A5035A14F0A2BC00AA730D /* KURLWTFURL.cpp in Sources */,
 				A456FA2611AD4A830020B420 /* LabelsNodeList.cpp in Sources */,
 				E18772F1126E2629003DD586 /* Language.cpp in Sources */,
 				9352084509BD43B900F2038D /* Language.mm in Sources */,
@@ -26428,9 +26660,7 @@
 				A5732B0F136A1715005C8D7C /* LocalizedDateNone.cpp in Sources */,
 				F5CC42DC12F801CA00D5F7E3 /* LocalizedNumberMac.mm in Sources */,
 				C046E1AC1208A9FE00BA2CF7 /* LocalizedStrings.cpp in Sources */,
-				BC25B52A131C6D3900180E10 /* LocalizedStringsMac.mm in Sources */,
-				511F23170DC160DA004F0032 /* StorageTask.cpp in Sources */,
-				511F23190DC160DA004F0032 /* StorageThread.cpp in Sources */,
+				BC25B52A131C6D3900180E10 /* LocalizedStringsMac.cpp in Sources */,
 				BCE1C41C0D982981003B02F2 /* Location.cpp in Sources */,
 				A8239E0009B3CF8A00B60641 /* Logging.cpp in Sources */,
 				1402645E0AFDC19B005919E2 /* LoggingMac.mm in Sources */,
@@ -26502,7 +26732,6 @@
 				E12719CA0EEEC21300F61213 /* NavigatorBase.cpp in Sources */,
 				9711460314EF009A00674FD9 /* NavigatorGeolocation.cpp in Sources */,
 				97E4A12714F4C5D700870E43 /* NavigatorRegisterProtocolHandler.cpp in Sources */,
-				97CC3AE214E8E4A200894988 /* NavigatorSupplement.cpp in Sources */,
 				5D874F130D161D3200796C3B /* NetscapePlugInStreamLoader.cpp in Sources */,
 				59C27F05138D28C10079B7E2 /* NetworkResourcesData.cpp in Sources */,
 				1A7FA61B0DDA3BBE0028F8A5 /* NetworkStateNotifier.cpp in Sources */,
@@ -26537,20 +26766,20 @@
 				F4EAF4AE10C742B1009100D3 /* OpenTypeSanitizer.cpp in Sources */,
 				978D07B8145A0F1B0096908D /* OperationNotAllowedException.cpp in Sources */,
 				0014628A103CD1DE000B20DB /* OriginAccessEntry.cpp in Sources */,
-				51A9267C0D53F0570063ECC2 /* OriginQuotaManager.cpp in Sources */,
-				51A9267E0D53F0570063ECC2 /* OriginUsageRecord.cpp in Sources */,
+				97BC6A371505F081001B74AC /* OriginQuotaManager.cpp in Sources */,
+				97BC6A391505F081001B74AC /* OriginUsageRecord.cpp in Sources */,
 				1A0D57360A5C77FE007EDD4C /* OverflowEvent.cpp in Sources */,
 				65FEA86909833ADE00BED4AB /* Page.cpp in Sources */,
 				1477E7760BF4134A00152872 /* PageCache.cpp in Sources */,
 				F3820892147D35F90010BC06 /* PageConsoleAgent.cpp in Sources */,
 				F34742DC134362F000531BC2 /* PageDebuggerAgent.cpp in Sources */,
 				9302B0BD0D79F82900C7EE83 /* PageGroup.cpp in Sources */,
+				9712A60415004EDA0048AF10 /* PageGroupIndexedDatabase.cpp in Sources */,
 				7A674BDB0F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp in Sources */,
 				1C26497C0D7E24EC00BD10F2 /* PageMac.cpp in Sources */,
 				F3820894147D35F90010BC06 /* PageRuntimeAgent.cpp in Sources */,
 				F34742E41343633C00531BC2 /* PageScriptDebugServer.cpp in Sources */,
 				371E65CE13661EED00BEEDB0 /* PageSerializer.cpp in Sources */,
-				A71E083714E3CEAF006A4619 /* PageSupplement.cpp in Sources */,
 				E1284AEA10447DEE00EAEB52 /* PageTransitionEvent.cpp in Sources */,
 				51E1ECC20C91C90400DC255B /* PageURLRecord.cpp in Sources */,
 				FFD5B97A135CC97800D5E92A /* PageVisibilityState.cpp in Sources */,
@@ -26612,6 +26841,7 @@
 				FD31603B12B0267600C1A359 /* RealtimeAnalyser.cpp in Sources */,
 				FD31603D12B0267600C1A359 /* RealtimeAnalyserNode.cpp in Sources */,
 				BCAB418113E356E800D8AAF3 /* Region.cpp in Sources */,
+				8ABAFB9F14F5107500A4984B /* RegionNodeList.cpp in Sources */,
 				85031B4B0A44EFC700F992E0 /* RegisteredEventListener.cpp in Sources */,
 				B2C3DA2C0D006C1D00EF6F26 /* RegularExpression.cpp in Sources */,
 				93309E00099E64920056E581 /* RemoveCSSPropertyCommand.cpp in Sources */,
@@ -26629,7 +26859,6 @@
 				BCE4413312F748E2009B84B8 /* RenderCombineText.cpp in Sources */,
 				9392F1440AD185FE00691BD4 /* RenderCounter.cpp in Sources */,
 				BCEA486D097D93020094C9E4 /* RenderDeprecatedFlexibleBox.cpp in Sources */,
-				D302754712A5FE84004BD828 /* RenderDetails.cpp in Sources */,
 				D302754912A5FE84004BD828 /* RenderDetailsMarker.cpp in Sources */,
 				9B32CDAA13DF7FA900F34D13 /* RenderedPosition.cpp in Sources */,
 				0F5B7A5410F65D7A00376302 /* RenderEmbeddedObject.cpp in Sources */,
@@ -26687,7 +26916,6 @@
 				BC3BE9A50E9C239600835588 /* RenderScrollbarTheme.cpp in Sources */,
 				AB247A6C0AFD6383003FA5FD /* RenderSlider.cpp in Sources */,
 				BC8C8FAD0DDCD31B00B592F4 /* RenderStyle.cpp in Sources */,
-				D302754D12A5FEAB004BD828 /* RenderSummary.cpp in Sources */,
 				0F4E57171313276200CF85AF /* RenderSVGAllInOne.cpp in Sources */,
 				A8DF4AEC0980C42C0052981B /* RenderTable.cpp in Sources */,
 				6ED878C4147493F4004C3597 /* RenderTableCaption.cpp in Sources */,
@@ -26815,7 +27043,7 @@
 				0F3DD44F12F5EA1B000D9190 /* ShadowBlur.cpp in Sources */,
 				BC5EB8C30E82031B00B25965 /* ShadowData.cpp in Sources */,
 				A6D169621346B49B000EB770 /* ShadowRoot.cpp in Sources */,
-				572E92FB14E540580087FFBA /* ShadowRootList.cpp in Sources */,
+				57CF4C8614F7597A00ECFF14 /* ShadowTree.cpp in Sources */,
 				A80E6CF40A1989CA007FB8C5 /* ShadowValue.cpp in Sources */,
 				B2AFFC930D00A5DF0030074D /* ShapeArabic.c in Sources */,
 				1A4A954D0B4EDCCB002D8C3C /* SharedBuffer.cpp in Sources */,
@@ -26857,20 +27085,20 @@
 				93309E13099E64920056E581 /* SplitTextNodeCommand.cpp in Sources */,
 				93309E15099E64920056E581 /* SplitTextNodeContainingElementCommand.cpp in Sources */,
 				A1E1154813015C5D0054AC8C /* SpotLightSource.cpp in Sources */,
-				978D07B4145A0ECD0096908D /* SQLException.cpp in Sources */,
+				97BC6A3E1505F081001B74AC /* SQLException.cpp in Sources */,
 				1A2E6E7A0CC556D5004A2062 /* SQLiteAuthorizer.cpp in Sources */,
 				1A2246490CC98DDB00C05240 /* SQLiteDatabase.cpp in Sources */,
 				B5A684240FFABEAA00D24689 /* SQLiteFileSystem.cpp in Sources */,
 				1A22464B0CC98DDB00C05240 /* SQLiteStatement.cpp in Sources */,
 				1A22464D0CC98DDB00C05240 /* SQLiteTransaction.cpp in Sources */,
-				519611730CAC56570010A80C /* SQLResultSet.cpp in Sources */,
-				1AFE117D0CBFFB36003017FA /* SQLResultSetRowList.cpp in Sources */,
-				515B039A0CD1642A00B7EA9C /* SQLStatement.cpp in Sources */,
-				B550B52511DC68A800923885 /* SQLStatementSync.cpp in Sources */,
-				1ABFE7530CD968D000FE4834 /* SQLTransaction.cpp in Sources */,
-				B51BF6F0102C9E590002C15A /* SQLTransactionClient.cpp in Sources */,
-				B5C1123B102B6C4600096578 /* SQLTransactionCoordinator.cpp in Sources */,
-				B523CF091182675400EBB29C /* SQLTransactionSync.cpp in Sources */,
+				97BC6A411505F081001B74AC /* SQLResultSet.cpp in Sources */,
+				97BC6A441505F081001B74AC /* SQLResultSetRowList.cpp in Sources */,
+				97BC6A471505F081001B74AC /* SQLStatement.cpp in Sources */,
+				97BC6A4D1505F081001B74AC /* SQLStatementSync.cpp in Sources */,
+				97BC6A4F1505F081001B74AC /* SQLTransaction.cpp in Sources */,
+				97BC6A541505F081001B74AC /* SQLTransactionClient.cpp in Sources */,
+				97BC6A561505F081001B74AC /* SQLTransactionCoordinator.cpp in Sources */,
+				97BC6A5A1505F081001B74AC /* SQLTransactionSync.cpp in Sources */,
 				1A2E6E590CC55213004A2062 /* SQLValue.cpp in Sources */,
 				93F19AE608245E59001E9ABC /* SSLKeyGeneratorMac.cpp in Sources */,
 				CEA3949C11D45CDA003094CF /* StaticHashSetNodeList.cpp in Sources */,
@@ -26886,6 +27114,8 @@
 				C50D0E820FF4272900AC2644 /* StorageNamespace.cpp in Sources */,
 				C55E38C010040D5D00A56BDB /* StorageNamespaceImpl.cpp in Sources */,
 				C5102D950FD9AA2D00FAFF04 /* StorageSyncManager.cpp in Sources */,
+				511F23170DC160DA004F0032 /* StorageTask.cpp in Sources */,
+				511F23190DC160DA004F0032 /* StorageThread.cpp in Sources */,
 				3AB02D2B12D4F91600FBB694 /* StorageTracker.cpp in Sources */,
 				B2C3DA300D006C1D00EF6F26 /* String.cpp in Sources */,
 				8102C5881325BB1100DDE67A /* StringCallback.cpp in Sources */,
@@ -26905,6 +27135,7 @@
 				5317612213C516690026E454 /* StyleFlexibleBoxData.cpp in Sources */,
 				BCEF447D0E674806001C1287 /* StyleGeneratedImage.cpp in Sources */,
 				A10DC76A14747BAB005E2471 /* StyleGridData.cpp in Sources */,
+				A110DB9D14F5DF8700A03B93 /* StyleGridItemData.cpp in Sources */,
 				BC2273030E82F1E600E7F975 /* StyleInheritedData.cpp in Sources */,
 				BC5EB7290E81DE8100B25965 /* StyleMarqueeData.cpp in Sources */,
 				0FF50271102BA96A0066F39A /* StyleMedia.cpp in Sources */,
@@ -26912,6 +27143,7 @@
 				A80E6DFB0A199067007FB8C5 /* StylePropertySet.cpp in Sources */,
 				BC2272E30E82EE9B00E7F975 /* StyleRareInheritedData.cpp in Sources */,
 				BC2272BC0E82EAAE00E7F975 /* StyleRareNonInheritedData.cpp in Sources */,
+				E4BBED4C14FCDBA1003F0B98 /* StyleRule.cpp in Sources */,
 				A8EA800D0A19516E00A8EF5F /* StyleSheet.cpp in Sources */,
 				A8EA800B0A19516E00A8EF5F /* StyleSheetList.cpp in Sources */,
 				BC5EB5E70E81BFEF00B25965 /* StyleSurroundData.cpp in Sources */,
@@ -27131,8 +27363,8 @@
 				BCE659E90EA92FFA007E4533 /* ThemeMac.mm in Sources */,
 				976D6C94122B8A3D001FD1F7 /* ThreadableBlobRegistry.cpp in Sources */,
 				0B90561E0F257E930095FF6A /* ThreadableLoader.cpp in Sources */,
-				5112247210CFB8C6008099D7 /* ThreadableWebSocketChannel.cpp in Sources */,
-				510F079B11FEE9C000B8EE49 /* ThreadableWebSocketChannelClientWrapper.cpp in Sources */,
+				97AABD1614FA09D5007457AE /* ThreadableWebSocketChannel.cpp in Sources */,
+				97AABD1814FA09D5007457AE /* ThreadableWebSocketChannelClientWrapper.cpp in Sources */,
 				51DF6D800B92A18E00C2DC85 /* ThreadCheck.mm in Sources */,
 				E1FF57A60F01256B00891EBB /* ThreadGlobalData.cpp in Sources */,
 				185BCF280F3279CE000EA262 /* ThreadTimers.cpp in Sources */,
@@ -27183,6 +27415,7 @@
 				37F818FE0D657606005E1F05 /* WebCoreURLResponse.mm in Sources */,
 				93F19B0708245E59001E9ABC /* WebCoreView.m in Sources */,
 				BC6DADFA0A19602B00E5CD14 /* WebFontCache.mm in Sources */,
+				CD127DED14F3097D00E84779 /* WebCoreFullScreenWindow.mm in Sources */,
 				49C7B9C81042D32F0009D447 /* WebGLBuffer.cpp in Sources */,
 				6E3FAE8E14733FDB00E42306 /* WebGLCompressedTextureS3TC.cpp in Sources */,
 				6E4E91AE10F7FB3100A2779C /* WebGLContextAttributes.cpp in Sources */,
@@ -27223,13 +27456,14 @@
 				0FCF332E0F2B9A25004B6795 /* WebLayer.mm in Sources */,
 				E1A3162E134BC32D007C9A4F /* WebNSAttributedStringExtras.mm in Sources */,
 				1CAF34820A6C405200ABE06E /* WebScriptObject.mm in Sources */,
-				518A34C11026C831001B6896 /* WebSocket.cpp in Sources */,
-				510D4A4E103177A20049EA54 /* WebSocketChannel.cpp in Sources */,
-				4AE02ABD14E8A9D200BC3BA7 /* WebSocketDeflater.cpp in Sources */,
-				4A957F0614E2412A0049DBFB /* WebSocketExtensionDispatcher.cpp in Sources */,
-				51ABAE441043AB4A008C5260 /* WebSocketHandshake.cpp in Sources */,
-				7637C541112E7B74003D6CDC /* WebSocketHandshakeRequest.cpp in Sources */,
-				767F99BE11A1194A0080C51D /* WebSocketHandshakeResponse.cpp in Sources */,
+				97AABD1A14FA09D5007457AE /* WebSocket.cpp in Sources */,
+				97AABD1D14FA09D5007457AE /* WebSocketChannel.cpp in Sources */,
+				4A38BF5014FE1C0900612512 /* WebSocketDeflateFramer.cpp in Sources */,
+				97AABD2014FA09D5007457AE /* WebSocketDeflater.cpp in Sources */,
+				97AABD2214FA09D5007457AE /* WebSocketExtensionDispatcher.cpp in Sources */,
+				97AABD2614FA09D5007457AE /* WebSocketHandshake.cpp in Sources */,
+				97AABD2814FA09D5007457AE /* WebSocketHandshakeRequest.cpp in Sources */,
+				97AABD2A14FA09D5007457AE /* WebSocketHandshakeResponse.cpp in Sources */,
 				0F580FA41496939100FB5BD8 /* WebTileCacheLayer.mm in Sources */,
 				0FCF332C0F2B9A25004B6795 /* WebTiledLayer.mm in Sources */,
 				1AA7161E149BF2FA0016EC19 /* WebTileLayer.mm in Sources */,
@@ -27249,6 +27483,8 @@
 				2E4346450F546A8200B0F1BA /* Worker.cpp in Sources */,
 				F3820896147D35F90010BC06 /* WorkerConsoleAgent.cpp in Sources */,
 				2E4346480F546A8200B0F1BA /* WorkerContext.cpp in Sources */,
+				9712A611150090CE0048AF10 /* WorkerContextIndexedDatabase.cpp in Sources */,
+				97BC6A5F1505F081001B74AC /* WorkerContextSQLDatabase.cpp in Sources */,
 				F34742E01343631F00531BC2 /* WorkerDebuggerAgent.cpp in Sources */,
 				A3E2643014748991005A8588 /* WorkerEventQueue.cpp in Sources */,
 				F36E07A41358A8BE00AACBC9 /* WorkerInspectorController.cpp in Sources */,
@@ -27262,7 +27498,7 @@
 				A7D6B34A0F61104500B79FD1 /* WorkerScriptLoader.cpp in Sources */,
 				2E4346540F546A8200B0F1BA /* WorkerThread.cpp in Sources */,
 				0B9056F80F2685F30095FF6A /* WorkerThreadableLoader.cpp in Sources */,
-				5112247810CFB8F4008099D7 /* WorkerThreadableWebSocketChannel.cpp in Sources */,
+				97AABD2C14FA09D5007457AE /* WorkerThreadableWebSocketChannel.cpp in Sources */,
 				93309E23099E64920056E581 /* WrapContentsInDummySpanCommand.cpp in Sources */,
 				A833C7CC0A2CF07400D57664 /* XLinkNames.cpp in Sources */,
 				00D0464A13C4D14500326FCC /* XMLCharacterReferenceParser.cpp in Sources */,
@@ -27304,6 +27540,10 @@
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
 				977E2E0E12F0FC9C00C13379 /* XSSAuditor.cpp in Sources */,
 				FD537352137B651800008DCE /* ZeroPole.cpp in Sources */,
+				E1CDE92015018ED000862CC5 /* AsyncFileStream.cpp in Sources */,
+				450CEBF015073BBE002BB149 /* LabelableElement.cpp in Sources */,
+				C5B4C24E1509236C00A6EF37 /* WebCoreNSURLExtras.mm in Sources */,
+				9B2B7AC11509850A008932CC /* MicroDataItemValue.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/Source/WebCore/WebCorePrefix.h b/Source/WebCore/WebCorePrefix.h
index 142c6abfc..75fe70de2 100644
--- a/Source/WebCore/WebCorePrefix.h
+++ b/Source/WebCore/WebCorePrefix.h
@@ -99,18 +99,16 @@
 
 #include <type_traits>
 
+namespace WebCore {
+    class TimerHeapReference;
+}
+
 _LIBCPP_BEGIN_NAMESPACE_STD
 
-template <class _Tp>
 inline _LIBCPP_INLINE_VISIBILITY
-typename enable_if
-<
-    !is_convertible<_Tp, __rv<_Tp> >::value,
-    const _Tp&
->::type
-move(const _Tp& __t)
+const WebCore::TimerHeapReference& move(const WebCore::TimerHeapReference& t)
 {
-    return __t;
+    return t;
 }
 
 _LIBCPP_END_NAMESPACE_STD
diff --git a/Source/WebCore/accessibility/AccessibilitySlider.cpp b/Source/WebCore/accessibility/AccessibilitySlider.cpp
index e53ee20a7..9751e7826 100644
--- a/Source/WebCore/accessibility/AccessibilitySlider.cpp
+++ b/Source/WebCore/accessibility/AccessibilitySlider.cpp
@@ -65,6 +65,7 @@ AccessibilityOrientation AccessibilitySlider::orientation() const
     case SliderThumbHorizontalPart:
     case SliderHorizontalPart:
     case MediaSliderPart:
+    case MediaFullScreenVolumeSliderPart:
         return AccessibilityOrientationHorizontal;
     
     case SliderThumbVerticalPart: 
diff --git a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
index 6bc4c63eb..edd72236c 100644
--- a/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
+++ b/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapper.mm
@@ -44,6 +44,7 @@
 #import "AccessibilityTableRow.h"
 #import "Chrome.h"
 #import "ColorMac.h"
+#import "ContextMenuController.h"
 #import "Frame.h"
 #import "FrameLoaderClient.h"
 #import "FrameSelection.h"
@@ -2614,14 +2615,7 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     Page* page = frame->page();
     if (!page)
         return;
-
-    // Simulate a click in the middle of the object.
-    IntPoint clickPoint = m_object->clickPoint();
-    
-    PlatformMouseEvent mouseEvent(clickPoint, clickPoint, RightButton, PlatformEvent::MousePressed, 1, false, false, false, false, currentTime());
-    bool handled = frame->eventHandler()->sendContextMenuEvent(mouseEvent);
-    if (handled)
-        page->chrome()->showContextMenu();
+    page->contextMenuController()->showContextMenuAt(frame, m_object->clickPoint());
 }
 
 - (void)accessibilityPerformAction:(NSString*)action
diff --git a/Source/WebCore/bindings/generic/ActiveDOMCallback.cpp b/Source/WebCore/bindings/generic/ActiveDOMCallback.cpp
index c2041d3df..da840d949 100644
--- a/Source/WebCore/bindings/generic/ActiveDOMCallback.cpp
+++ b/Source/WebCore/bindings/generic/ActiveDOMCallback.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010. 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -33,111 +33,39 @@
 
 #include "ActiveDOMObject.h"
 #include "ScriptExecutionContext.h"
-#include <wtf/PassOwnPtr.h>
-#include <wtf/ThreadingPrimitives.h>
 
-namespace WebCore {
-
-static void destroyOnContextThread(PassOwnPtr<ActiveDOMObjectCallbackImpl>);
-
-class DestroyOnContextThreadTask : public ScriptExecutionContext::Task {
-public:
-    static PassOwnPtr<DestroyOnContextThreadTask> create(PassOwnPtr<ActiveDOMObjectCallbackImpl> impl)
-    {
-        return adoptPtr(new DestroyOnContextThreadTask(impl));
-    }
-
-    virtual void performTask(ScriptExecutionContext*)
-    {
-        destroyOnContextThread(m_impl.release());
-    }
-
-private:
-    DestroyOnContextThreadTask(PassOwnPtr<ActiveDOMObjectCallbackImpl> impl)
-        : m_impl(impl)
-    {
-    }
-
-    OwnPtr<ActiveDOMObjectCallbackImpl> m_impl;
-};
-
-class ActiveDOMObjectCallbackImpl : public ActiveDOMObject {
-public:
-    ActiveDOMObjectCallbackImpl(ScriptExecutionContext* context)
-        : ActiveDOMObject(context, this)
-        , m_suspended(false)
-        , m_stopped(false)
-    {
-    }
-
-    virtual void contextDestroyed()
-    {
-        MutexLocker locker(m_mutex);
-        ActiveDOMObject::contextDestroyed();
-    }
-    virtual bool canSuspend() const { return false; }
-    virtual void suspend(ReasonForSuspension)
-    {
-        MutexLocker locker(m_mutex);
-        m_suspended = true;
-    }
-    virtual void resume()
-    {
-        MutexLocker locker(m_mutex);
-        m_suspended = false;
-    }
-    virtual void stop()
-    {
-        MutexLocker locker(m_mutex);
-        m_stopped = true;
-    }
-    bool canInvokeCallback()
-    {
-        MutexLocker locker(m_mutex);
-        return (!m_suspended && !m_stopped);
-    }
-    ScriptExecutionContext* scriptExecutionContext()
-    {
-        MutexLocker locker(m_mutex);
-        return ActiveDOMObject::scriptExecutionContext();
-    }
-    Mutex& mutex() { return m_mutex; }
+#if ENABLE(WORKERS)
+#include "WorkerContext.h"
+#endif
 
-private:
-    Mutex m_mutex;
-    bool m_suspended;
-    bool m_stopped;
-};
-
-static void destroyOnContextThread(PassOwnPtr<ActiveDOMObjectCallbackImpl> impl)
-{
-    OwnPtr<ActiveDOMObjectCallbackImpl> implOwnPtr = impl;
-
-    ScriptExecutionContext* context = implOwnPtr->scriptExecutionContext();
-    MutexLocker locker(implOwnPtr->mutex());
-    if (context && !context->isContextThread())
-        context->postTask(DestroyOnContextThreadTask::create(implOwnPtr.release()));
-}
+namespace WebCore {
 
 ActiveDOMCallback::ActiveDOMCallback(ScriptExecutionContext* context)
-    : m_impl(adoptPtr(new ActiveDOMObjectCallbackImpl(context)))
+    : ContextDestructionObserver(context)
 {
-    m_impl->suspendIfNeeded();
 }
 
 ActiveDOMCallback::~ActiveDOMCallback()
 {
-    destroyOnContextThread(m_impl.release());
 }
 
 bool ActiveDOMCallback::canInvokeCallback() const
 {
-    return m_impl->canInvokeCallback();
+    ScriptExecutionContext* context = scriptExecutionContext();
+    return context && !context->activeDOMObjectsAreSuspended() && !context->activeDOMObjectsAreStopped();
 }
 
-ScriptExecutionContext* ActiveDOMCallback::scriptExecutionContext() const
+bool ActiveDOMCallback::isScriptControllerTerminating() const
 {
-    return m_impl->scriptExecutionContext();
+#if ENABLE(WORKERS)
+    ScriptExecutionContext* context = scriptExecutionContext();
+    if (context && context->isWorkerContext()) {
+        WorkerScriptController* scriptController = static_cast<WorkerContext*>(context)->script();
+        if (!scriptController || scriptController->isExecutionForbidden() || scriptController->isExecutionTerminating())
+            return true;
+    }
+#endif
+    return false;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/generic/ActiveDOMCallback.h b/Source/WebCore/bindings/generic/ActiveDOMCallback.h
index 2fe99ab53..af3e1f6f2 100644
--- a/Source/WebCore/bindings/generic/ActiveDOMCallback.h
+++ b/Source/WebCore/bindings/generic/ActiveDOMCallback.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -31,26 +31,27 @@
 #ifndef ActiveDOMCallback_h
 #define ActiveDOMCallback_h
 
+#include "ContextDestructionObserver.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
-class ActiveDOMObjectCallbackImpl;
 class ScriptExecutionContext;
 
-// A class that allows callbacks to behave like ActiveDOMObjects, and also
-// be destroyed on the context thread or any other thread.
-class ActiveDOMCallback {
+// A base class that prevents binding callbacks from executing when
+// active dom objects are stopped or suspended, and is used by the
+// generated callback v8 bindings code to avoid erroneously CRASH()'ing
+// after script execution on a worker has been scheduled to terminate.
+//
+// Should only be created, used, and destroyed on the script execution
+// context thread.
+class ActiveDOMCallback : public ContextDestructionObserver {
 public:
     ActiveDOMCallback(ScriptExecutionContext* context);
-    ~ActiveDOMCallback();
+    virtual ~ActiveDOMCallback();
 
     bool canInvokeCallback() const;
-    ScriptExecutionContext* scriptExecutionContext() const;
-
-private:
-    // The ActiveDOMObject part of the callback.
-    OwnPtr<ActiveDOMObjectCallbackImpl> m_impl;
+    bool isScriptControllerTerminating() const;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
index 8fad2c5d7..15f94d4d9 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.cpp
@@ -56,6 +56,10 @@ bool RuntimeEnabledFeatures::isDeviceMotionEnabled = true;
 bool RuntimeEnabledFeatures::isDeviceOrientationEnabled = true;
 bool RuntimeEnabledFeatures::isSpeechInputEnabled = true;
 
+#if ENABLE(SCRIPTED_SPEECH)
+bool RuntimeEnabledFeatures::isScriptedSpeechEnabled = false;
+#endif
+
 #if ENABLE(MEDIA_STREAM)
 bool RuntimeEnabledFeatures::isMediaStreamEnabled = true;
 #endif
@@ -181,6 +185,11 @@ bool RuntimeEnabledFeatures::isMediaSourceEnabled = false;
 #endif
 
 #if ENABLE(SHADOW_DOM)
+void RuntimeEnabledFeatures::setMultipleShadowSubtreesEnabled(bool isEnabled)
+{
+    isMultipleShadowSubtreesEnabled = isEnabled;
+}
+
 bool RuntimeEnabledFeatures::isShadowDOMEnabled = false;
 bool RuntimeEnabledFeatures::isMultipleShadowSubtreesEnabled = false;
 #endif
diff --git a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
index 36065c82a..ee38d04e2 100644
--- a/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
+++ b/Source/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -147,6 +147,16 @@ public:
     static bool webkitSpeechEnabled() { return isSpeechInputEnabled; }
     static bool webkitGrammarEnabled() { return isSpeechInputEnabled; }
 
+#if ENABLE(SCRIPTED_SPEECH)
+    static void setScriptedSpeechEnabled(bool isEnabled) { isScriptedSpeechEnabled = isEnabled; }
+    static bool scriptedSpeechEnabled() { return isScriptedSpeechEnabled; }
+    static bool webkitSpeechRecognitionEnabled() { return isScriptedSpeechEnabled; }
+    static bool webkitSpeechRecognitionErrorEnabled() { return isScriptedSpeechEnabled; }
+    static bool webkitSpeechRecognitionEventEnabled() { return isScriptedSpeechEnabled; }
+    static bool webkitSpeechGrammarEnabled() { return isScriptedSpeechEnabled; }
+    static bool webkitSpeechGrammarListEnabled() { return isScriptedSpeechEnabled; }
+#endif
+
 #if ENABLE(XHR_RESPONSE_BLOB)
     static bool xhrResponseBlobEnabled() { return isXHRResponseBlobEnabled; }
     static void setXHRResponseBlobEnabled(bool isEnabled) { isXHRResponseBlobEnabled = isEnabled; }
@@ -196,7 +206,7 @@ public:
     static void setShadowDOMEnabled(bool isEnabled) { isShadowDOMEnabled = isEnabled; }
 
     static bool multipleShadowSubtreesEnabled() { return isMultipleShadowSubtreesEnabled; }
-    static void setMultipleShadowSubtreesEnabled(bool isEnabled) { isMultipleShadowSubtreesEnabled = isEnabled; }
+    static void setMultipleShadowSubtreesEnabled(bool isEnabled);
 #endif
 
 #if ENABLE(STYLE_SCOPED)
@@ -221,6 +231,9 @@ private:
     static bool isDeviceMotionEnabled;
     static bool isDeviceOrientationEnabled;
     static bool isSpeechInputEnabled;
+#if ENABLE(SCRIPTED_SPEECH)
+    static bool isScriptedSpeechEnabled;
+#endif
 #if ENABLE(XHR_RESPONSE_BLOB)
     static bool isXHRResponseBlobEnabled;
 #endif
diff --git a/Source/WebCore/bindings/js/JSAudioContextCustom.cpp b/Source/WebCore/bindings/js/JSAudioContextCustom.cpp
index f8fab6266..64e44e63f 100644
--- a/Source/WebCore/bindings/js/JSAudioContextCustom.cpp
+++ b/Source/WebCore/bindings/js/JSAudioContextCustom.cpp
@@ -101,7 +101,7 @@ EncodedJSValue JSC_HOST_CALL JSAudioContextConstructor::constructJSAudioContext(
     if (!audioContext.get())
         return throwVMError(exec, createReferenceError(exec, "Error creating AudioContext"));
 
-    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), audioContext.get())));
+    return JSValue::encode(CREATE_DOM_WRAPPER(exec, jsConstructor->globalObject(), AudioContext, audioContext.get()));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 8518cde35..aaa117170 100644
--- a/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -58,6 +58,12 @@ void JSCSSStyleDeclaration::visitChildren(JSCell* cell, SlotVisitor& visitor)
     visitor.addOpaqueRoot(root(thisObject->impl()));
 }
 
+class CSSPropertyInfo {
+public:
+    int propertyID;
+    bool hadPixelOrPosPrefix;
+};
+
 enum PropertyNamePrefix
 {
     PropertyNamePrefixNone,
@@ -161,16 +167,23 @@ static inline void writeEpubPrefix(char*& buffer)
     *buffer++ = '-';
 }
 
-static int cssPropertyIDForJSCSSPropertyName(const Identifier& propertyName, bool* hadPixelOrPosPrefix = 0)
+static CSSPropertyInfo cssPropertyIDForJSCSSPropertyName(const Identifier& propertyName)
 {
-    if (hadPixelOrPosPrefix)
-        *hadPixelOrPosPrefix = false;
+    CSSPropertyInfo propertyInfo = {0, false};
+    bool hadPixelOrPosPrefix = false;
 
     unsigned length = propertyName.length();
     if (!length)
-        return 0;
+        return propertyInfo;
 
     StringImpl* propertyNameString = propertyName.impl();
+    String stringForCache = String(propertyNameString);
+    typedef HashMap<String, CSSPropertyInfo> CSSPropertyInfoMap;
+    DEFINE_STATIC_LOCAL(CSSPropertyInfoMap, propertyInfoCache, ());
+    propertyInfo = propertyInfoCache.get(stringForCache);
+    if (propertyInfo.propertyID)
+        return propertyInfo;
+
     const size_t bufferSize = maxCSSPropertyNameLength + 1;
     char buffer[bufferSize];
     char* bufferPtr = buffer;
@@ -183,20 +196,18 @@ static int cssPropertyIDForJSCSSPropertyName(const Identifier& propertyName, boo
     switch (getCSSPropertyNamePrefix(*propertyNameString)) {
     case PropertyNamePrefixNone:
         if (isASCIIUpper((*propertyNameString)[0]))
-            return 0;
+            return propertyInfo;
         break;
     case PropertyNamePrefixCSS:
         i += 3;
         break;
     case PropertyNamePrefixPixel:
         i += 5;
-        if (hadPixelOrPosPrefix)
-            *hadPixelOrPosPrefix = true;
+        hadPixelOrPosPrefix = true;
         break;
     case PropertyNamePrefixPos:
         i += 3;
-        if (hadPixelOrPosPrefix)
-            *hadPixelOrPosPrefix = true;
+        hadPixelOrPosPrefix = true;
         break;
     case PropertyNamePrefixApple:
     case PropertyNamePrefixKHTML:
@@ -220,17 +231,17 @@ static int cssPropertyIDForJSCSSPropertyName(const Identifier& propertyName, boo
     size_t bufferSizeLeft = stringEnd - bufferPtr;
     size_t propertySizeLeft = length - i;
     if (propertySizeLeft > bufferSizeLeft)
-        return 0;
+        return propertyInfo;
 
     for (; i < length; ++i) {
         UChar c = (*propertyNameString)[i];
         if (!c || c >= 0x7F)
-            return 0; // illegal character
+            return propertyInfo; // illegal character
         if (isASCIIUpper(c)) {
             size_t bufferSizeLeft = stringEnd - bufferPtr;
             size_t propertySizeLeft = length - i + 1;
             if (propertySizeLeft > bufferSizeLeft)
-                return 0;
+                return propertyInfo;
             *bufferPtr++ = '-';
             *bufferPtr++ = toASCIILower(c);
         } else
@@ -246,54 +257,97 @@ static int cssPropertyIDForJSCSSPropertyName(const Identifier& propertyName, boo
 #endif
 
     const Property* hashTableEntry = findProperty(name, outputLength);
-    return hashTableEntry ? hashTableEntry->id : 0;
-}
-
-static bool isCSSPropertyName(const Identifier& propertyIdentifier)
-{
-    return cssPropertyIDForJSCSSPropertyName(propertyIdentifier);
+    int propertyID = hashTableEntry ? hashTableEntry->id : 0;
+    if (propertyID) {
+        propertyInfo.hadPixelOrPosPrefix = hadPixelOrPosPrefix;
+        propertyInfo.propertyID = propertyID;
+        propertyInfoCache.add(stringForCache, propertyInfo);
+    }
+    return propertyInfo;
 }
 
-bool JSCSSStyleDeclaration::canGetItemsForName(ExecState*, CSSStyleDeclaration*, const Identifier& propertyName)
+static inline JSValue getPropertyValueFallback(ExecState* exec, JSCSSStyleDeclaration* thisObj, unsigned index)
 {
-    return isCSSPropertyName(propertyName);
+    // If the property is a shorthand property (such as "padding"),
+    // it can only be accessed using getPropertyValue.
+    return jsString(exec, thisObj->impl()->getPropertyValueInternal(static_cast<CSSPropertyID>(index)));
 }
 
-JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+static inline JSValue cssPropertyGetterPixelOrPosPrefix(ExecState* exec, JSCSSStyleDeclaration* thisObj, unsigned propertyID)
 {
-    JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slotBase));
-
     // Set up pixelOrPos boolean to handle the fact that
     // pixelTop returns "CSS Top" as number value in unit pixels
     // posTop returns "CSS top" as number value in unit pixels _if_ its a
     // positioned element. if it is not a positioned element, return 0
     // from MSIE documentation FIXME: IMPLEMENT THAT (Dirk)
-    bool pixelOrPos;
-    int cssPropertyID = cssPropertyIDForJSCSSPropertyName(propertyName, &pixelOrPos);
-    RefPtr<CSSValue> v = thisObj->impl()->getPropertyCSSValueInternal(static_cast<CSSPropertyID>(cssPropertyID));
+    RefPtr<CSSValue> v = thisObj->impl()->getPropertyCSSValueInternal(static_cast<CSSPropertyID>(propertyID));
     if (v) {
-        if (pixelOrPos && v->isPrimitiveValue())
+        if (v->isPrimitiveValue())
             return jsNumber(static_pointer_cast<CSSPrimitiveValue>(v)->getFloatValue(CSSPrimitiveValue::CSS_PX));
         return jsStringOrNull(exec, v->cssText());
     }
 
-    // If the property is a shorthand property (such as "padding"), 
-    // it can only be accessed using getPropertyValue.
-    return jsString(exec, thisObj->impl()->getPropertyValueInternal(static_cast<CSSPropertyID>(cssPropertyID)));
+    return getPropertyValueFallback(exec, thisObj, propertyID);
+}
+
+static JSValue cssPropertyGetterPixelOrPosPrefixCallback(ExecState* exec, JSValue slotBase, unsigned propertyID)
+{
+    return cssPropertyGetterPixelOrPosPrefix(exec, static_cast<JSCSSStyleDeclaration*>(asObject(slotBase)), propertyID);
+}
+
+static inline JSValue cssPropertyGetter(ExecState* exec, JSCSSStyleDeclaration* thisObj, unsigned propertyID)
+{
+    RefPtr<CSSValue> v = thisObj->impl()->getPropertyCSSValueInternal(static_cast<CSSPropertyID>(propertyID));
+    if (v)
+        return jsStringOrNull(exec, v->cssText());
+
+    return getPropertyValueFallback(exec, thisObj, propertyID);
+}
+
+static JSValue cssPropertyGetterCallback(ExecState* exec, JSValue slotBase, unsigned propertyID)
+{
+    return cssPropertyGetter(exec, static_cast<JSCSSStyleDeclaration*>(asObject(slotBase)), propertyID);
+}
+
+bool JSCSSStyleDeclaration::getOwnPropertySlotDelegate(ExecState*, const Identifier& propertyIdentifier, PropertySlot& slot)
+{
+    CSSPropertyInfo propertyInfo = cssPropertyIDForJSCSSPropertyName(propertyIdentifier);
+    if (!propertyInfo.propertyID)
+        return false;
+
+    if (propertyInfo.hadPixelOrPosPrefix)
+        slot.setCustomIndex(this, static_cast<unsigned>(propertyInfo.propertyID), cssPropertyGetterPixelOrPosPrefixCallback);
+    else
+        slot.setCustomIndex(this, static_cast<unsigned>(propertyInfo.propertyID), cssPropertyGetterCallback);
+    return true;
+}
+
+bool JSCSSStyleDeclaration::getOwnPropertyDescriptorDelegate(JSC::ExecState* exec, const JSC::Identifier& propertyIdentifier, JSC::PropertyDescriptor& descriptor)
+{
+    CSSPropertyInfo propertyInfo = cssPropertyIDForJSCSSPropertyName(propertyIdentifier);
+    if (!propertyInfo.propertyID)
+        return false;
+
+    JSValue value;
+    if (propertyInfo.hadPixelOrPosPrefix)
+        value = cssPropertyGetterPixelOrPosPrefix(exec, this, propertyInfo.propertyID);
+    else
+        value = cssPropertyGetter(exec, this, propertyInfo.propertyID);
+    descriptor.setDescriptor(value, ReadOnly | DontDelete | DontEnum);
+    return true;
 }
 
 bool JSCSSStyleDeclaration::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
-    bool pixelOrPos;
-    int cssPropertyID = cssPropertyIDForJSCSSPropertyName(propertyName, &pixelOrPos);
-    if (!cssPropertyID)
+    CSSPropertyInfo propertyInfo = cssPropertyIDForJSCSSPropertyName(propertyName);
+    if (!propertyInfo.propertyID)
         return false;
 
     String propValue = valueToStringWithNullCheck(exec, value);
-    if (pixelOrPos)
+    if (propertyInfo.hadPixelOrPosPrefix)
         propValue += "px";
     ExceptionCode ec = 0;
-    impl()->setPropertyInternal(static_cast<CSSPropertyID>(cssPropertyID), propValue, false, ec);
+    impl()->setPropertyInternal(static_cast<CSSPropertyID>(propertyInfo.propertyID), propValue, false, ec);
     setDOMException(exec, ec);
     return true;
 }
diff --git a/Source/WebCore/bindings/js/JSCallbackData.cpp b/Source/WebCore/bindings/js/JSCallbackData.cpp
index 332437561..1c0c452d9 100644
--- a/Source/WebCore/bindings/js/JSCallbackData.cpp
+++ b/Source/WebCore/bindings/js/JSCallbackData.cpp
@@ -65,16 +65,14 @@ JSValue JSCallbackData::invokeCallback(MarkedArgumentBuffer& args, bool* raisedE
         return JSValue();
 
     globalObject()->globalData().timeoutChecker.start();
+    InspectorInstrumentationCookie cookie = JSMainThreadExecState::instrumentFunctionCall(context, callType, callData);
 
     bool contextIsDocument = context->isDocument();
-    JSValue result;
-    if (contextIsDocument) {
-        Frame* frame = static_cast<JSDOMWindow*>(globalObject())->impl()->frame();
-        Page* page = frame ? frame->page() : 0;
-        result = JSMainThreadExecState::instrumentedCall(page, exec, function, callType, callData, callback(), args);
-    } else
-        result = JSC::call(exec, function, callType, callData, callback(), args);
+    JSValue result = contextIsDocument
+        ? JSMainThreadExecState::call(exec, function, callType, callData, callback(), args)
+        : JSC::call(exec, function, callType, callData, callback(), args);
 
+    InspectorInstrumentation::didCallFunction(cookie);
     globalObject()->globalData().timeoutChecker.stop();
 
     if (contextIsDocument)
diff --git a/Source/WebCore/bindings/js/JSClipboardCustom.cpp b/Source/WebCore/bindings/js/JSClipboardCustom.cpp
index 3532c7859..8cfd65a29 100644
--- a/Source/WebCore/bindings/js/JSClipboardCustom.cpp
+++ b/Source/WebCore/bindings/js/JSClipboardCustom.cpp
@@ -48,6 +48,21 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+JSValue JSClipboard::types(ExecState* exec) const
+{
+    Clipboard* clipboard = impl();
+
+    HashSet<String> types = clipboard->types();
+    if (types.isEmpty())
+        return jsNull();
+
+    MarkedArgumentBuffer list;
+    HashSet<String>::const_iterator end = types.end();
+    for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it)
+        list.append(jsString(exec, stringToUString(*it)));
+    return constructArray(exec, globalObject(), list);
+}
+
 JSValue JSClipboard::clearData(ExecState* exec)
 {
     Clipboard* clipboard = impl();
@@ -66,22 +81,6 @@ JSValue JSClipboard::clearData(ExecState* exec)
     return throwError(exec, createSyntaxError(exec, "clearData: Invalid number of arguments"));
 }
 
-JSValue JSClipboard::getData(ExecState* exec)
-{
-    // FIXME: It does not match the rest of the JS bindings to throw on invalid number of arguments.
-    if (exec->argumentCount() != 1)
-        return throwError(exec, createSyntaxError(exec, "getData: Invalid number of arguments"));
-
-    Clipboard* clipboard = impl();
-
-    bool success;
-    String result = clipboard->getData(ustringToString(exec->argument(0).toString(exec)->value(exec)), success);
-    if (!success)
-        return jsUndefined();
-
-    return jsString(exec, result);
-}
-
 JSValue JSClipboard::setDragImage(ExecState* exec)
 {
     Clipboard* clipboard = impl();
diff --git a/Source/WebCore/bindings/js/JSDOMBinding.cpp b/Source/WebCore/bindings/js/JSDOMBinding.cpp
index 13580aec8..0050a7315 100644
--- a/Source/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/Source/WebCore/bindings/js/JSDOMBinding.cpp
@@ -161,9 +161,8 @@ void reportException(ExecState* exec, JSValue exception)
         errorMessage = stringToUString(exceptionBase->message() + ": "  + exceptionBase->description());
 
     ScriptExecutionContext* scriptExecutionContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
-    ASSERT(scriptExecutionContext);
 
-    // Crash data indicates null-dereference crashes at this point in the Safari 4 Public Beta.
+    // scriptExecutionContext can be null when the relevant global object is a stale inner window object.
     // It's harmless to return here without reporting the exception to the log and the debugger in this case.
     if (!scriptExecutionContext)
         return;
diff --git a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 0ba259e76..be551bf96 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -404,30 +404,6 @@ bool JSDOMWindow::defineOwnProperty(JSC::JSObject* object, JSC::ExecState* exec,
 
 // Custom Attributes
 
-JSValue JSDOMWindow::history(ExecState* exec) const
-{
-    History* history = impl()->history();
-    if (JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), history))
-        return wrapper;
-
-    JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
-    JSHistory* jsHistory = JSHistory::create(getDOMStructure<JSHistory>(exec, window), window, history);
-    cacheWrapper(currentWorld(exec), history, jsHistory);
-    return jsHistory;
-}
-
-JSValue JSDOMWindow::location(ExecState* exec) const
-{
-    Location* location = impl()->location();
-    if (JSDOMWrapper* wrapper = getCachedWrapper(currentWorld(exec), location))
-        return wrapper;
-
-    JSDOMWindow* window = const_cast<JSDOMWindow*>(this);
-    JSLocation* jsLocation = JSLocation::create(getDOMStructure<JSLocation>(exec, window), window, location);
-    cacheWrapper(currentWorld(exec), location, jsLocation);
-    return jsLocation;
-}
-
 void JSDOMWindow::setLocation(ExecState* exec, JSValue value)
 {
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -568,6 +544,7 @@ JSValue JSDOMWindow::showModalDialog(ExecState* exec)
 static JSValue handlePostMessage(DOMWindow* impl, ExecState* exec, bool doTransfer)
 {
     MessagePortArray messagePorts;
+    ArrayBufferArray arrayBuffers;
 
     // This function has variable arguments and can be:
     // Per current spec:
@@ -582,13 +559,14 @@ static JSValue handlePostMessage(DOMWindow* impl, ExecState* exec, bool doTransf
             targetOriginArgIndex = 2;
             transferablesArgIndex = 1;
         }
-        fillMessagePortArray(exec, exec->argument(transferablesArgIndex), messagePorts);
+        fillMessagePortArray(exec, exec->argument(transferablesArgIndex), messagePorts, arrayBuffers);
     }
     if (exec->hadException())
         return jsUndefined();
 
-    RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, exec->argument(0), 
-                                                                         doTransfer ? &messagePorts : 0);
+    RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, exec->argument(0),
+                                                                         doTransfer ? &messagePorts : 0,
+                                                                         doTransfer ? &arrayBuffers : 0);
 
     if (exec->hadException())
         return jsUndefined();
diff --git a/Source/WebCore/bindings/js/JSDOMWindowWebAudioCustom.cpp b/Source/WebCore/bindings/js/JSDOMWindowWebAudioCustom.cpp
index 8d8c711ad..013140e87 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowWebAudioCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowWebAudioCustom.cpp
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/Source/WebCore/bindings/js/JSDOMWindowWebSocketCustom.cpp b/Source/WebCore/bindings/js/JSDOMWindowWebSocketCustom.cpp
index 3ee6f2c7b..ce001048b 100644
--- a/Source/WebCore/bindings/js/JSDOMWindowWebSocketCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDOMWindowWebSocketCustom.cpp
@@ -1,4 +1,5 @@
 /*
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
diff --git a/Source/WebCore/bindings/js/JSDictionary.cpp b/Source/WebCore/bindings/js/JSDictionary.cpp
index bd06216cf..d7913fa16 100644
--- a/Source/WebCore/bindings/js/JSDictionary.cpp
+++ b/Source/WebCore/bindings/js/JSDictionary.cpp
@@ -103,7 +103,7 @@ void JSDictionary::convertValue(ExecState* exec, JSValue value, ScriptValue& res
 
 void JSDictionary::convertValue(ExecState* exec, JSValue value, RefPtr<SerializedScriptValue>& result)
 {
-    result = SerializedScriptValue::create(exec, value, 0);
+    result = SerializedScriptValue::create(exec, value, 0, 0);
 }
 
 void JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<DOMWindow>& result)
@@ -128,7 +128,8 @@ void JSDictionary::convertValue(ExecState*, JSValue value, RefPtr<Storage>& resu
 
 void JSDictionary::convertValue(ExecState* exec, JSValue value, MessagePortArray& result)
 {
-    fillMessagePortArray(exec, value, result);
+    ArrayBufferArray arrayBuffers;
+    fillMessagePortArray(exec, value, result, arrayBuffers);
 }
 
 #if ENABLE(VIDEO_TRACK)
diff --git a/Source/WebCore/bindings/js/JSDocumentCustom.cpp b/Source/WebCore/bindings/js/JSDocumentCustom.cpp
index 466caf2d3..8377a0912 100644
--- a/Source/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/Source/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -119,7 +119,7 @@ JSValue JSDocument::createTouchList(ExecState* exec)
 {
     RefPtr<TouchList> touchList = TouchList::create();
 
-    for (int i = 0; i < exec->argumentCount(); i++)
+    for (size_t i = 0; i < exec->argumentCount(); i++)
         touchList->append(toTouch(exec->argument(i)));
 
     return toJS(exec, globalObject(), touchList.release());
diff --git a/Source/WebCore/bindings/js/JSEventListener.cpp b/Source/WebCore/bindings/js/JSEventListener.cpp
index 6de073b05..58369005f 100644
--- a/Source/WebCore/bindings/js/JSEventListener.cpp
+++ b/Source/WebCore/bindings/js/JSEventListener.cpp
@@ -45,12 +45,16 @@ JSEventListener::JSEventListener(JSObject* function, JSObject* wrapper, bool isA
         m_jsFunction.setMayBeNull(*m_isolatedWorld->globalData(), wrapper, function);
     else
         ASSERT(!function);
-    InspectorCounters::incrementCounter(InspectorCounters::JSEventListenerCounter);
+#if ENABLE(INSPECTOR)
+    ThreadLocalInspectorCounters::current().incrementCounter(ThreadLocalInspectorCounters::JSEventListenerCounter);
+#endif
 }
 
 JSEventListener::~JSEventListener()
 {
-    InspectorCounters::decrementCounter(InspectorCounters::JSEventListenerCounter);
+#if ENABLE(INSPECTOR)
+    ThreadLocalInspectorCounters::current().decrementCounter(ThreadLocalInspectorCounters::JSEventListenerCounter);
+#endif
 }
 
 JSObject* JSEventListener::initializeJSFunction(ScriptExecutionContext*) const
@@ -121,10 +125,14 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
         DynamicGlobalObjectScope globalObjectScope(globalData, globalData.dynamicGlobalObject ? globalData.dynamicGlobalObject : globalObject);
 
         globalData.timeoutChecker.start();
+        InspectorInstrumentationCookie cookie = JSMainThreadExecState::instrumentFunctionCall(scriptExecutionContext, callType, callData);
+
         JSValue thisValue = handleEventFunction == jsFunction ? toJS(exec, globalObject, event->currentTarget()) : jsFunction;
         JSValue retval = scriptExecutionContext->isDocument()
-            ? JSMainThreadExecState::instrumentedCall(frame ? frame->page() : 0, exec, handleEventFunction, callType, callData, thisValue, args)
+            ? JSMainThreadExecState::call(exec, handleEventFunction, callType, callData, thisValue, args)
             : JSC::call(exec, handleEventFunction, callType, callData, thisValue, args);
+
+        InspectorInstrumentation::didCallFunction(cookie);
         globalData.timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
diff --git a/Source/WebCore/bindings/js/JSHistoryCustom.cpp b/Source/WebCore/bindings/js/JSHistoryCustom.cpp
index 480658b51..e72c25889 100644
--- a/Source/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/Source/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -180,7 +180,7 @@ JSValue JSHistory::state(ExecState *exec) const
 
 JSValue JSHistory::pushState(ExecState* exec)
 {
-    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, exec->argument(0), 0);
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, exec->argument(0), 0, 0);
     if (exec->hadException())
         return jsUndefined();
 
@@ -206,7 +206,7 @@ JSValue JSHistory::pushState(ExecState* exec)
 
 JSValue JSHistory::replaceState(ExecState* exec)
 {
-    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, exec->argument(0), 0);
+    RefPtr<SerializedScriptValue> historyState = SerializedScriptValue::create(exec, exec->argument(0), 0, 0);
     if (exec->hadException())
         return jsUndefined();
 
diff --git a/Source/WebCore/bindings/js/JSMainThreadExecState.h b/Source/WebCore/bindings/js/JSMainThreadExecState.h
index 5e4c4e2dc..14886f5e1 100644
--- a/Source/WebCore/bindings/js/JSMainThreadExecState.h
+++ b/Source/WebCore/bindings/js/JSMainThreadExecState.h
@@ -36,7 +36,7 @@
 
 namespace WebCore {
 
-class Page;
+class ScriptExecutionContext;
 
 class JSMainThreadExecState {
     WTF_MAKE_NONCOPYABLE(JSMainThreadExecState);
@@ -56,28 +56,19 @@ public:
         return JSC::call(exec, functionObject, callType, callData, thisValue, args);
     };
 
-    static JSC::JSValue instrumentedCall(Page* page, JSC::ExecState* exec, JSC::JSValue functionObject, JSC::CallType callType, const JSC::CallData& callData, JSC::JSValue thisValue, const JSC::ArgList& args)
+    static inline InspectorInstrumentationCookie instrumentFunctionCall(ScriptExecutionContext* context, JSC::CallType callType, const JSC::CallData& callData)
     {
-        InspectorInstrumentationCookie cookie;
-        if (InspectorInstrumentation::hasFrontends()) {
-            String resourceName;
-            int lineNumber = 1;
-
-            if (callType == JSC::CallTypeJS) {
-                resourceName = ustringToString(callData.js.functionExecutable->sourceURL());
-                lineNumber = callData.js.functionExecutable->lineNo();
-            } else
-                resourceName = "undefined";
-
-            cookie = InspectorInstrumentation::willCallFunction(page, resourceName, lineNumber);
-        }
-
-        JSC::JSValue value = call(exec, functionObject, callType, callData, thisValue, args);
-
-        InspectorInstrumentation::didCallFunction(cookie);
-
-        return value;
-    };
+        if (!InspectorInstrumentation::hasFrontends())
+            return InspectorInstrumentationCookie();
+        String resourceName;
+        int lineNumber = 1;
+        if (callType == JSC::CallTypeJS) {
+            resourceName = ustringToString(callData.js.functionExecutable->sourceURL());
+            lineNumber = callData.js.functionExecutable->lineNo();
+        } else
+            resourceName = "undefined";
+        return InspectorInstrumentation::willCallFunction(context, resourceName, lineNumber);
+    }
 
     static JSC::JSValue evaluate(JSC::ExecState* exec, JSC::ScopeChainNode* chain, const JSC::SourceCode& source, JSC::JSValue thisValue, JSC::JSValue* exception)
     {
diff --git a/Source/WebCore/bindings/js/JSMessageEventCustom.cpp b/Source/WebCore/bindings/js/JSMessageEventCustom.cpp
index 64b989cb2..64fcef88a 100644
--- a/Source/WebCore/bindings/js/JSMessageEventCustom.cpp
+++ b/Source/WebCore/bindings/js/JSMessageEventCustom.cpp
@@ -109,9 +109,11 @@ static JSC::JSValue handleInitMessageEvent(JSMessageEvent* jsEvent, JSC::ExecSta
     const UString& lastEventIdArg = exec->argument(5).toString(exec)->value(exec);
     DOMWindow* sourceArg = toDOMWindow(exec->argument(6));
     OwnPtr<MessagePortArray> messagePorts;
+    OwnPtr<ArrayBufferArray> arrayBuffers;
     if (!exec->argument(7).isUndefinedOrNull()) {
         messagePorts = adoptPtr(new MessagePortArray);
-        fillMessagePortArray(exec, exec->argument(7), *messagePorts);
+        arrayBuffers = adoptPtr(new ArrayBufferArray);
+        fillMessagePortArray(exec, exec->argument(7), *messagePorts, *arrayBuffers);
         if (exec->hadException())
             return jsUndefined();
     }
diff --git a/Source/WebCore/bindings/js/JSMessagePortCustom.cpp b/Source/WebCore/bindings/js/JSMessagePortCustom.cpp
index 711166b41..76a8c0f48 100644
--- a/Source/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/Source/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -30,6 +30,7 @@
 #include "Event.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
+#include "JSArrayBuffer.h"
 #include "JSDOMGlobalObject.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
@@ -67,12 +68,13 @@ JSC::JSValue JSMessagePort::webkitPostMessage(JSC::ExecState* exec)
     return handlePostMessage(exec, impl());
 }
 
-void fillMessagePortArray(JSC::ExecState* exec, JSC::JSValue value, MessagePortArray& portArray)
+void fillMessagePortArray(JSC::ExecState* exec, JSC::JSValue value, MessagePortArray& portArray, ArrayBufferArray& arrayBuffers)
 {
     // Convert from the passed-in JS array-like object to a MessagePortArray.
     // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec.
     if (value.isUndefinedOrNull()) {
         portArray.resize(0);
+        arrayBuffers.resize(0);
         return;
     }
 
@@ -94,11 +96,17 @@ void fillMessagePortArray(JSC::ExecState* exec, JSC::JSValue value, MessagePortA
 
         // Validation of Objects implementing an interface, per WebIDL spec 4.1.15.
         RefPtr<MessagePort> port = toMessagePort(value);
-        if (!port) {
-            throwTypeError(exec);
-            return;
+        if (port)
+            portArray.append(port.release());
+        else {
+            RefPtr<ArrayBuffer> arrayBuffer = toArrayBuffer(value);
+            if (arrayBuffer)
+                arrayBuffers.append(arrayBuffer);
+            else {
+                throwTypeError(exec);
+                return;
+            }
         }
-        portArray.append(port.release());
     }
 }
 
diff --git a/Source/WebCore/bindings/js/JSMessagePortCustom.h b/Source/WebCore/bindings/js/JSMessagePortCustom.h
index 5a9e04b6d..e76e76d2a 100644
--- a/Source/WebCore/bindings/js/JSMessagePortCustom.h
+++ b/Source/WebCore/bindings/js/JSMessagePortCustom.h
@@ -42,15 +42,16 @@ namespace WebCore {
     // Helper function which pulls the values out of a JS sequence and into a MessagePortArray.
     // Also validates the elements per sections 4.1.13 and 4.1.15 of the WebIDL spec and section 8.3.3 of the HTML5 spec.
     // May generate an exception via the passed ExecState.
-    void fillMessagePortArray(JSC::ExecState*, JSC::JSValue, MessagePortArray&);
+    void fillMessagePortArray(JSC::ExecState*, JSC::JSValue, MessagePortArray&, ArrayBufferArray&);
 
     // Helper function to convert from JS postMessage arguments to WebCore postMessage arguments.
     template <typename T>
     inline JSC::JSValue handlePostMessage(JSC::ExecState* exec, T* impl)
     {
         MessagePortArray portArray;
-        fillMessagePortArray(exec, exec->argument(1), portArray);
-        RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, exec->argument(0), &portArray);
+        ArrayBufferArray arrayBufferArray;
+        fillMessagePortArray(exec, exec->argument(1), portArray, arrayBufferArray);
+        RefPtr<SerializedScriptValue> message = SerializedScriptValue::create(exec, exec->argument(0), &portArray, &arrayBufferArray);
         if (exec->hadException())
             return JSC::jsUndefined();
 
diff --git a/Source/WebCore/bindings/js/JSNodeCustom.cpp b/Source/WebCore/bindings/js/JSNodeCustom.cpp
index 7cdd5fce7..7d00c099d 100644
--- a/Source/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/Source/WebCore/bindings/js/JSNodeCustom.cpp
@@ -116,7 +116,7 @@ static inline bool isReachableFromDOM(JSNode* jsNode, Node* node, SlotVisitor& v
         }
     #if ENABLE(VIDEO)
         else if (node->hasTagName(audioTag)) {
-            if (!static_cast<HTMLAudioElement*>(node)->paused())
+            if (!static_cast<HTMLAudioElement*>(node)->hasPendingActivity())
                 return true;
         }
     #endif
diff --git a/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp b/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
index 0bfa63afb..6d71e5e13 100644
--- a/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
+++ b/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
@@ -29,9 +29,11 @@
 
 #include "JSWebGLRenderingContext.h"
 
+#include "EXTTextureFilterAnisotropic.h"
 #include "ExceptionCode.h"
 #include "HTMLCanvasElement.h"
 #include "HTMLImageElement.h"
+#include "JSEXTTextureFilterAnisotropic.h"
 #include "JSFloat32Array.h"
 #include "JSHTMLCanvasElement.h"
 #include "JSHTMLImageElement.h"
@@ -188,6 +190,8 @@ static JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, WebGLExten
     switch (extension->getName()) {
     case WebGLExtension::WebKitWebGLLoseContextName:
         return toJS(exec, globalObject, static_cast<WebGLLoseContext*>(extension));
+    case WebGLExtension::EXTTextureFilterAnisotropicName:
+        return toJS(exec, globalObject, static_cast<EXTTextureFilterAnisotropic*>(extension));
     case WebGLExtension::OESStandardDerivativesName:
         return toJS(exec, globalObject, static_cast<OESStandardDerivatives*>(extension));
     case WebGLExtension::OESTextureFloatName:
diff --git a/Source/WebCore/bindings/js/ScriptProfiler.cpp b/Source/WebCore/bindings/js/ScriptProfiler.cpp
index a63fe4d9e..790739b21 100644
--- a/Source/WebCore/bindings/js/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/js/ScriptProfiler.cpp
@@ -30,9 +30,13 @@
 
 #include "ScriptProfiler.h"
 
+#include "Frame.h"
 #include "GCController.h"
 #include "JSDOMBinding.h"
+#include "JSDOMWindow.h"
+#include "Page.h"
 #include "ScriptObject.h"
+#include "ScriptState.h"
 #include <profiler/Profiler.h>
 
 namespace WebCore {
@@ -52,12 +56,38 @@ void ScriptProfiler::start(ScriptState* state, const String& title)
     JSC::Profiler::profiler()->startProfiling(state, stringToUString(title));
 }
 
+void ScriptProfiler::startForPage(Page* inspectedPage, const String& title)
+{
+    JSC::ExecState* scriptState = toJSDOMWindow(inspectedPage->mainFrame(), debuggerWorld())->globalExec();
+    start(scriptState, title);
+}
+
+#if ENABLE(WORKERS)
+void ScriptProfiler::startForWorkerContext(WorkerContext* context, const String& title)
+{
+    start(scriptStateFromWorkerContext(context), title);
+}
+#endif
+
 PassRefPtr<ScriptProfile> ScriptProfiler::stop(ScriptState* state, const String& title)
 {
     RefPtr<JSC::Profile> profile = JSC::Profiler::profiler()->stopProfiling(state, stringToUString(title));
     return ScriptProfile::create(profile);
 }
 
+PassRefPtr<ScriptProfile> ScriptProfiler::stopForPage(Page* inspectedPage, const String& title)
+{
+    JSC::ExecState* scriptState = toJSDOMWindow(inspectedPage->mainFrame(), debuggerWorld())->globalExec();
+    return stop(scriptState, title);
+}
+
+#if ENABLE(WORKERS)
+PassRefPtr<ScriptProfile> ScriptProfiler::stopForWorkerContext(WorkerContext* context, const String& title)
+{
+    return stop(scriptStateFromWorkerContext(context), title);
+}
+#endif
+
 } // namespace WebCore
 
 #endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/Source/WebCore/bindings/js/ScriptProfiler.h b/Source/WebCore/bindings/js/ScriptProfiler.h
index a21eada4c..efed031a7 100644
--- a/Source/WebCore/bindings/js/ScriptProfiler.h
+++ b/Source/WebCore/bindings/js/ScriptProfiler.h
@@ -37,7 +37,9 @@
 namespace WebCore {
 
 class DOMWrapperVisitor;
+class Page;
 class ScriptObject;
+class WorkerContext;
 
 class ScriptProfiler {
     WTF_MAKE_NONCOPYABLE(ScriptProfiler);
@@ -54,7 +56,15 @@ public:
     static void collectGarbage();
     static ScriptObject objectByHeapObjectId(unsigned id);
     static void start(ScriptState* state, const String& title);
+    static void startForPage(Page*, const String& title);
+#if ENABLE(WORKERS)
+    static void startForWorkerContext(WorkerContext*, const String& title);
+#endif
     static PassRefPtr<ScriptProfile> stop(ScriptState* state, const String& title);
+    static PassRefPtr<ScriptProfile> stopForPage(Page*, const String& title);
+#if ENABLE(WORKERS)
+    static PassRefPtr<ScriptProfile> stopForWorkerContext(WorkerContext*, const String& title);
+#endif
     static PassRefPtr<ScriptHeapSnapshot> takeHeapSnapshot(const String&, HeapSnapshotProgress*) { return 0; }
     static bool causesRecompilation() { return true; }
     static bool isSampling() { return false; }
diff --git a/Source/WebCore/bindings/js/ScriptState.cpp b/Source/WebCore/bindings/js/ScriptState.cpp
index e823c6e3a..eb66bdcfa 100644
--- a/Source/WebCore/bindings/js/ScriptState.cpp
+++ b/Source/WebCore/bindings/js/ScriptState.cpp
@@ -71,6 +71,14 @@ DOMWindow* domWindowFromScriptState(ScriptState* scriptState)
     return static_cast<JSDOMWindowBase*>(globalObject)->impl();
 }
 
+ScriptExecutionContext* scriptExecutionContextFromScriptState(ScriptState* scriptState)
+{
+    JSC::JSGlobalObject* globalObject = scriptState->lexicalGlobalObject();
+    if (!globalObject->inherits(&JSDOMGlobalObject::s_info))
+        return 0;
+    return static_cast<JSDOMGlobalObject*>(globalObject)->scriptExecutionContext();
+}
+
 bool evalEnabled(ScriptState* scriptState)
 {
     JSC::JSGlobalObject* globalObject = scriptState->lexicalGlobalObject();
diff --git a/Source/WebCore/bindings/js/ScriptState.h b/Source/WebCore/bindings/js/ScriptState.h
index 58f36f599..45ace2ba4 100644
--- a/Source/WebCore/bindings/js/ScriptState.h
+++ b/Source/WebCore/bindings/js/ScriptState.h
@@ -46,6 +46,7 @@ class DOMWrapperWorld;
 class Frame;
 class Node;
 class Page;
+class ScriptExecutionContext;
 class WorkerContext;
 
 // The idea is to expose "state-like" methods (hadException, and any other
@@ -65,6 +66,7 @@ private:
 };
 
 DOMWindow* domWindowFromScriptState(ScriptState*);
+ScriptExecutionContext* scriptExecutionContextFromScriptState(ScriptState*);
 
 bool evalEnabled(ScriptState*);
 void setEvalEnabled(ScriptState*, bool);
diff --git a/Source/WebCore/bindings/js/ScriptValue.cpp b/Source/WebCore/bindings/js/ScriptValue.cpp
index 7272a1029..f75851f39 100644
--- a/Source/WebCore/bindings/js/ScriptValue.cpp
+++ b/Source/WebCore/bindings/js/ScriptValue.cpp
@@ -102,7 +102,7 @@ bool ScriptValue::isFunction() const
 
 PassRefPtr<SerializedScriptValue> ScriptValue::serialize(ScriptState* scriptState, SerializationErrorMode throwExceptions)
 {
-    return SerializedScriptValue::create(scriptState, jsValue(), 0, throwExceptions);
+    return SerializedScriptValue::create(scriptState, jsValue(), 0, 0, throwExceptions);
 }
 
 ScriptValue ScriptValue::deserialize(ScriptState* scriptState, SerializedScriptValue* value, SerializationErrorMode throwExceptions)
diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.cpp b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
index 77cd65b3a..7c586aa67 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.cpp
+++ b/Source/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -61,6 +61,7 @@
 #include <runtime/PropertyNameArray.h>
 #include <runtime/RegExp.h>
 #include <runtime/RegExpObject.h>
+#include <wtf/ArrayBuffer.h>
 #include <wtf/ByteArray.h>
 #include <wtf/HashTraits.h>
 #include <wtf/Vector.h>
@@ -105,6 +106,7 @@ enum SerializationTag {
     MessagePortReferenceTag = 20,
     ArrayBufferTag = 21,
     ArrayBufferViewTag = 22,
+    ArrayBufferTransferTag = 23,
     ErrorTag = 255
 };
 
@@ -191,6 +193,7 @@ static const unsigned int StringPoolTag = 0xFFFFFFFE;
  *    | MessagePortReferenceTag <value:uint32_t>
  *    | ArrayBuffer
  *    | ArrayBufferViewTag ArrayBufferViewSubtag <byteOffset:uint32_t> <byteLenght:uint32_t> (ArrayBuffer | ObjectReference)
+ *    | ArrayBufferTransferTag <value:uint32_t>
  *
  * String :-
  *      EmptyStringTag
@@ -315,9 +318,11 @@ template <typename T> static bool writeLittleEndian(Vector<uint8_t>& buffer, con
 
 class CloneSerializer : CloneBase {
 public:
-    static SerializationReturnCode serialize(ExecState* exec, JSValue value, MessagePortArray* messagePorts, Vector<uint8_t>& out)
+    static SerializationReturnCode serialize(ExecState* exec, JSValue value,
+                                             MessagePortArray* messagePorts, ArrayBufferArray* arrayBuffers,
+                                             Vector<uint8_t>& out)
     {
-        CloneSerializer serializer(exec, messagePorts, out);
+        CloneSerializer serializer(exec, messagePorts, arrayBuffers, out);
         return serializer.serialize(value);
     }
 
@@ -346,19 +351,29 @@ public:
     }
 
 private:
-    CloneSerializer(ExecState* exec, MessagePortArray* messagePorts, Vector<uint8_t>& out)
+    typedef HashMap<JSObject*, uint32_t> ObjectPool;
+
+    CloneSerializer(ExecState* exec, MessagePortArray* messagePorts, ArrayBufferArray* arrayBuffers, Vector<uint8_t>& out)
         : CloneBase(exec)
         , m_buffer(out)
         , m_emptyIdentifier(exec, UString("", 0))
     {
         write(CurrentVersion);
-        if (messagePorts) {
-            JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject());
-            for (size_t i = 0; i < messagePorts->size(); i++) {
-                JSC::JSValue value = toJS(exec, globalObject, messagePorts->at(i).get());
-                if (value.getObject())
-                    m_transferredMessagePorts.add(value.getObject(), i);
-            }
+        fillTransferMap(messagePorts, m_transferredMessagePorts);
+        fillTransferMap(arrayBuffers, m_transferredArrayBuffers);
+    }
+
+    template <class T>
+    void fillTransferMap(Vector<RefPtr<T>, 1>* input, ObjectPool& result)
+    {
+        if (!input)
+            return;
+        JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(m_exec->lexicalGlobalObject());
+        for (size_t i = 0; i < input->size(); i++) {
+            JSC::JSValue value = toJS(m_exec, globalObject, input->at(i).get());
+            JSC::JSObject* obj = value.getObject();
+            if (obj && !result.contains(obj))
+                result.add(obj, i);
         }
     }
 
@@ -475,7 +490,7 @@ private:
         }
     }
 
-    bool dumpArrayBufferView(JSObject* obj)
+    bool dumpArrayBufferView(JSObject* obj, SerializationReturnCode& code)
     {
         write(ArrayBufferViewTag);
         if (obj->inherits(&JSDataView::s_info))
@@ -505,11 +520,15 @@ private:
         write(static_cast<uint32_t>(arrayBufferView->byteOffset()));
         write(static_cast<uint32_t>(arrayBufferView->byteLength()));
         RefPtr<ArrayBuffer> arrayBuffer = arrayBufferView->buffer();
+        if (!arrayBuffer) {
+            code = ValidationError;
+            return true;
+        }
         JSValue bufferObj = toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_exec->lexicalGlobalObject()), arrayBuffer.get());
-        return dumpIfTerminal(bufferObj);
+        return dumpIfTerminal(bufferObj, code);
     }
 
-    bool dumpIfTerminal(JSValue value)
+    bool dumpIfTerminal(JSValue value, SerializationReturnCode& code)
     {
         if (!value.isCell()) {
             dumpImmediate(value);
@@ -596,17 +615,26 @@ private:
                 ObjectPool::iterator index = m_transferredMessagePorts.find(obj);
                 if (index != m_transferredMessagePorts.end()) {
                     write(MessagePortReferenceTag);
-                    uint32_t i = index->second;
-                    write(i);
+                    write(index->second);
                     return true;
                 }
                 return false;
             }
             if (obj->inherits(&JSArrayBuffer::s_info)) {
+                RefPtr<ArrayBuffer> arrayBuffer = toArrayBuffer(obj);
+                if (arrayBuffer->isNeutered()) {
+                    code = ValidationError;
+                    return true;
+                }
+                ObjectPool::iterator index = m_transferredArrayBuffers.find(obj);
+                if (index != m_transferredArrayBuffers.end()) {
+                    write(ArrayBufferTransferTag);
+                    write(index->second);
+                    return true;
+                }
                 if (!startObjectInternal(obj)) // handle duplicates
                     return true;
                 write(ArrayBufferTag);
-                RefPtr<ArrayBuffer> arrayBuffer = toArrayBuffer(obj);
                 write(arrayBuffer->byteLength());
                 write(static_cast<const uint8_t *>(arrayBuffer->data()), arrayBuffer->byteLength());
                 return true;
@@ -614,7 +642,7 @@ private:
             if (obj->inherits(&JSArrayBufferView::s_info)) {
                 if (!startObjectInternal(obj))
                     return true;
-                return dumpArrayBufferView(obj);
+                return dumpArrayBufferView(obj, code);
             }
 
             CallData unusedData;
@@ -749,9 +777,9 @@ private:
     }
 
     Vector<uint8_t>& m_buffer;
-    typedef HashMap<JSObject*, uint32_t> ObjectPool;
     ObjectPool m_objectPool;
     ObjectPool m_transferredMessagePorts;
+    ObjectPool m_transferredArrayBuffers;
     typedef HashMap<RefPtr<StringImpl>, uint32_t, IdentifierRepHash> StringConstantPool;
     StringConstantPool m_constantPool;
     Identifier m_emptyIdentifier;
@@ -814,7 +842,10 @@ SerializationReturnCode CloneSerializer::serialize(JSValue in)
                 }
 
                 write(index);
-                if (dumpIfTerminal(inValue)) {
+                SerializationReturnCode terminalCode = SuccessfullyCompleted;
+                if (dumpIfTerminal(inValue, terminalCode)) {
+                    if (terminalCode != SuccessfullyCompleted)
+                        return terminalCode;
                     indexStack.last()++;
                     goto arrayStartVisitMember;
                 }
@@ -871,10 +902,13 @@ SerializationReturnCode CloneSerializer::serialize(JSValue in)
                 if (shouldTerminate())
                     return ExistingExceptionError;
 
-                if (!dumpIfTerminal(inValue)) {
+                SerializationReturnCode terminalCode = SuccessfullyCompleted;
+                if (!dumpIfTerminal(inValue, terminalCode)) {
                     stateStack.append(ObjectEndVisitMember);
                     goto stateUnknown;
                 }
+                if (terminalCode != SuccessfullyCompleted)
+                    return terminalCode;
                 // fallthrough
             }
             case ObjectEndVisitMember: {
@@ -885,13 +919,18 @@ SerializationReturnCode CloneSerializer::serialize(JSValue in)
                 goto objectStartVisitMember;
             }
             stateUnknown:
-            case StateUnknown:
-                if (dumpIfTerminal(inValue))
+            case StateUnknown: {
+                SerializationReturnCode terminalCode = SuccessfullyCompleted;
+                if (dumpIfTerminal(inValue, terminalCode)) {
+                    if (terminalCode != SuccessfullyCompleted)
+                        return terminalCode;
                     break;
+                }
 
                 if (isArray(inValue))
                     goto arrayStartState;
                 goto objectStartState;
+            }
         }
         if (stateStack.isEmpty())
             break;
@@ -911,6 +950,8 @@ SerializationReturnCode CloneSerializer::serialize(JSValue in)
     return SuccessfullyCompleted;
 }
 
+typedef Vector<WTF::ArrayBufferContents> ArrayBufferContentsArray;
+
 class CloneDeserializer : CloneBase {
 public:
     static String deserializeString(const Vector<uint8_t>& buffer)
@@ -932,12 +973,13 @@ public:
         return String(str.impl());
     }
 
-    static DeserializationResult deserialize(ExecState* exec, JSGlobalObject* globalObject, MessagePortArray* messagePorts,
+    static DeserializationResult deserialize(ExecState* exec, JSGlobalObject* globalObject,
+                                             MessagePortArray* messagePorts, ArrayBufferContentsArray* arrayBufferContentsArray,
                                              const Vector<uint8_t>& buffer)
     {
         if (!buffer.size())
             return make_pair(jsNull(), UnspecifiedError);
-        CloneDeserializer deserializer(exec, globalObject, messagePorts, buffer);
+        CloneDeserializer deserializer(exec, globalObject, messagePorts, arrayBufferContentsArray, buffer);
         if (!deserializer.isValid())
             return make_pair(JSValue(), ValidationError);
         return deserializer.deserialize();
@@ -982,7 +1024,9 @@ private:
         size_t m_index;
     };
 
-    CloneDeserializer(ExecState* exec, JSGlobalObject* globalObject, MessagePortArray* messagePorts, const Vector<uint8_t>& buffer)
+    CloneDeserializer(ExecState* exec, JSGlobalObject* globalObject, 
+                      MessagePortArray* messagePorts, ArrayBufferContentsArray* arrayBufferContents,
+                      const Vector<uint8_t>& buffer)
         : CloneBase(exec)
         , m_globalObject(globalObject)
         , m_isDOMGlobalObject(globalObject->inherits(&JSDOMGlobalObject::s_info))
@@ -990,6 +1034,8 @@ private:
         , m_end(buffer.data() + buffer.size())
         , m_version(0xFFFFFFFF)
         , m_messagePorts(messagePorts)
+        , m_arrayBufferContents(arrayBufferContents)
+        , m_arrayBuffers(arrayBufferContents ? arrayBufferContents->size() : 0)
     {
         if (!read(m_version))
             m_version = 0xFFFFFFFF;
@@ -1186,10 +1232,7 @@ private:
 
     void putProperty(JSArray* array, unsigned index, JSValue value)
     {
-        if (array->canSetIndex(index))
-            array->setIndex(m_exec->globalData(), index, value);
-        else
-            array->methodTable()->putByIndex(array, m_exec, index, value);
+        array->putDirectIndex(m_exec, index, value, false);
     }
 
     void putProperty(JSObject* object, const Identifier& property, JSValue value)
@@ -1432,6 +1475,19 @@ private:
             m_gcBuffer.append(result);
             return result;
         }
+        case ArrayBufferTransferTag: {
+            uint32_t index;
+            bool indexSuccessfullyRead = read(index);
+            if (!indexSuccessfullyRead || index >= m_arrayBuffers.size()) {
+                fail();
+                return JSValue();
+            }
+
+            if (!m_arrayBuffers[index])
+                m_arrayBuffers[index] = ArrayBuffer::create(m_arrayBufferContents->at(index));
+
+            return getJSValue(m_arrayBuffers[index].get());
+        }
         case ArrayBufferViewTag: {
             JSValue arrayBufferView;
             if (!readArrayBufferView(arrayBufferView)) {
@@ -1454,6 +1510,8 @@ private:
     unsigned m_version;
     Vector<CachedString> m_constantPool;
     MessagePortArray* m_messagePorts;
+    ArrayBufferContentsArray* m_arrayBufferContents;
+    ArrayBufferArray m_arrayBuffers;
 };
 
 DeserializationResult CloneDeserializer::deserialize()
@@ -1603,17 +1661,61 @@ SerializedScriptValue::SerializedScriptValue(Vector<uint8_t>& buffer)
     m_data.swap(buffer);
 }
 
-PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(ExecState* exec, JSValue value, MessagePortArray* messagePorts, SerializationErrorMode throwExceptions)
+SerializedScriptValue::SerializedScriptValue(Vector<uint8_t>& buffer, PassOwnPtr<ArrayBufferContentsArray> arrayBufferContentsArray)
+    : m_arrayBufferContentsArray(arrayBufferContentsArray)
+{
+    m_data.swap(buffer);
+}
+
+PassOwnPtr<SerializedScriptValue::ArrayBufferContentsArray> SerializedScriptValue::transferArrayBuffers(
+    ArrayBufferArray& arrayBuffers, SerializationReturnCode& code)
+{
+    for (size_t i = 0; i < arrayBuffers.size(); i++) {
+        if (arrayBuffers[i]->isNeutered()) {
+            code = ValidationError;
+            return nullptr;
+        }
+    }
+
+    OwnPtr<ArrayBufferContentsArray> contents = adoptPtr(new ArrayBufferContentsArray(arrayBuffers.size()));
+
+    HashSet<WTF::ArrayBuffer*> visited;
+    for (size_t i = 0; i < arrayBuffers.size(); i++) {
+        Vector<RefPtr<ArrayBufferView> > neuteredViews;
+
+        if (visited.contains(arrayBuffers[i].get()))
+            continue;
+        visited.add(arrayBuffers[i].get());
+
+        bool result = arrayBuffers[i]->transfer(contents->at(i), neuteredViews);
+        if (!result) {
+            code = ValidationError;
+            return nullptr;
+        }
+    }
+    return contents.release();
+}
+
+
+PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(ExecState* exec, JSValue value,
+                                                                MessagePortArray* messagePorts, ArrayBufferArray* arrayBuffers,
+                                                                SerializationErrorMode throwExceptions)
 {
     Vector<uint8_t> buffer;
-    SerializationReturnCode code = CloneSerializer::serialize(exec, value, messagePorts, buffer);
+    SerializationReturnCode code = CloneSerializer::serialize(exec, value, messagePorts, arrayBuffers, buffer);
+
+    OwnPtr<ArrayBufferContentsArray> arrayBufferContentsArray;
+
+    if (arrayBuffers && serializationDidCompleteSuccessfully(code))
+        arrayBufferContentsArray = transferArrayBuffers(*arrayBuffers, code);
+
     if (throwExceptions == Throwing)
         maybeThrowExceptionIfSerializationFailed(exec, code);
 
     if (!serializationDidCompleteSuccessfully(code))
         return 0;
-        
-    return adoptRef(new SerializedScriptValue(buffer));
+
+    return adoptRef(new SerializedScriptValue(buffer, arrayBufferContentsArray.release()));
 }
 
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::create()
@@ -1631,12 +1733,13 @@ PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(const String& st
 }
 
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(JSContextRef originContext, JSValueRef apiValue, 
-                                                                MessagePortArray* messagePorts, JSValueRef* exception)
+                                                                MessagePortArray* messagePorts, ArrayBufferArray* arrayBuffers,
+                                                                JSValueRef* exception)
 {
     ExecState* exec = toJS(originContext);
     APIEntryShim entryShim(exec);
     JSValue value = toJS(exec, apiValue);
-    RefPtr<SerializedScriptValue> serializedValue = SerializedScriptValue::create(exec, value, messagePorts);
+    RefPtr<SerializedScriptValue> serializedValue = SerializedScriptValue::create(exec, value, messagePorts, arrayBuffers);
     if (exec->hadException()) {
         if (exception)
             *exception = toRef(exec, exec->exception());
@@ -1650,7 +1753,7 @@ PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(JSContextRef ori
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::create(JSContextRef originContext, JSValueRef apiValue,
                                                                 JSValueRef* exception)
 {
-    return create(originContext, apiValue, 0, exception);
+    return create(originContext, apiValue, 0, 0, exception);
 }
 
 String SerializedScriptValue::toString()
@@ -1658,10 +1761,11 @@ String SerializedScriptValue::toString()
     return CloneDeserializer::deserializeString(m_data);
 }
 
-JSValue SerializedScriptValue::deserialize(ExecState* exec, JSGlobalObject* globalObject, 
+JSValue SerializedScriptValue::deserialize(ExecState* exec, JSGlobalObject* globalObject,
                                            MessagePortArray* messagePorts, SerializationErrorMode throwExceptions)
 {
-    DeserializationResult result = CloneDeserializer::deserialize(exec, globalObject, messagePorts, m_data);
+    DeserializationResult result = CloneDeserializer::deserialize(exec, globalObject, messagePorts,
+                                                                  m_arrayBufferContentsArray.get(), m_data);
     if (throwExceptions == Throwing)
         maybeThrowExceptionIfSerializationFailed(exec, result.second);
     return result.first;
diff --git a/Source/WebCore/bindings/js/SerializedScriptValue.h b/Source/WebCore/bindings/js/SerializedScriptValue.h
index 75ce694b2..3f8da5e8f 100644
--- a/Source/WebCore/bindings/js/SerializedScriptValue.h
+++ b/Source/WebCore/bindings/js/SerializedScriptValue.h
@@ -30,6 +30,7 @@
 #include "ScriptState.h"
 #include <heap/Strong.h>
 #include <runtime/JSValue.h>
+#include <wtf/ArrayBuffer.h>
 #include <wtf/Forward.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -41,6 +42,7 @@ namespace WebCore {
 
 class MessagePort;
 typedef Vector<RefPtr<MessagePort>, 1> MessagePortArray;
+typedef Vector<RefPtr<WTF::ArrayBuffer>, 1> ArrayBufferArray;
  
 enum SerializationReturnCode {
     SuccessfullyCompleted,
@@ -58,8 +60,9 @@ class SharedBuffer;
 
 class SerializedScriptValue : public RefCounted<SerializedScriptValue> {
 public:
-    static PassRefPtr<SerializedScriptValue> create(JSC::ExecState*, JSC::JSValue, MessagePortArray*, SerializationErrorMode = Throwing);
-    static PassRefPtr<SerializedScriptValue> create(JSContextRef, JSValueRef, MessagePortArray*,  JSValueRef* exception);
+    static PassRefPtr<SerializedScriptValue> create(JSC::ExecState*, JSC::JSValue, MessagePortArray*, ArrayBufferArray*,
+                                                    SerializationErrorMode = Throwing);
+    static PassRefPtr<SerializedScriptValue> create(JSContextRef, JSValueRef, MessagePortArray*, ArrayBufferArray*, JSValueRef* exception);
     static PassRefPtr<SerializedScriptValue> create(JSContextRef, JSValueRef, JSValueRef* exception);
 
     static PassRefPtr<SerializedScriptValue> create(const String&);
@@ -88,11 +91,15 @@ public:
     ~SerializedScriptValue();
 
 private:
+    typedef Vector<WTF::ArrayBufferContents> ArrayBufferContentsArray;
     static void maybeThrowExceptionIfSerializationFailed(JSC::ExecState*, SerializationReturnCode);
     static bool serializationDidCompleteSuccessfully(SerializationReturnCode);
+    static PassOwnPtr<ArrayBufferContentsArray> transferArrayBuffers(ArrayBufferArray&, SerializationReturnCode&);
     
     SerializedScriptValue(Vector<unsigned char>&);
+    SerializedScriptValue(Vector<unsigned char>&, PassOwnPtr<ArrayBufferContentsArray>);
     Vector<unsigned char> m_data;
+    OwnPtr<ArrayBufferContentsArray> m_arrayBufferContentsArray;
 };
 
 }
diff --git a/Source/WebCore/bindings/js/WorkerScriptController.cpp b/Source/WebCore/bindings/js/WorkerScriptController.cpp
index 2c60ffff0..6cff92b22 100644
--- a/Source/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/js/WorkerScriptController.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- * Copyright (C) 2011 Google Inc. All Rights Reserved.
+ * Copyright (C) 2011, 2012 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -162,9 +162,20 @@ void WorkerScriptController::setException(ScriptValue exception)
 
 void WorkerScriptController::scheduleExecutionTermination()
 {
+    // The mutex provides a memory barrier to ensure that once
+    // termination is scheduled, isExecutionTerminating will
+    // accurately reflect that state when called from another thread.
+    MutexLocker locker(m_scheduledTerminationMutex);
     m_globalData->terminator.terminateSoon();
 }
 
+bool WorkerScriptController::isExecutionTerminating() const
+{
+    // See comments in scheduleExecutionTermination regarding mutex usage.
+    MutexLocker locker(m_scheduledTerminationMutex);
+    return m_globalData->terminator.shouldTerminate();
+}
+
 void WorkerScriptController::forbidExecution()
 {
     ASSERT(m_workerContext->isContextThread());
diff --git a/Source/WebCore/bindings/js/WorkerScriptController.h b/Source/WebCore/bindings/js/WorkerScriptController.h
index 6985ee894..59727f6dc 100644
--- a/Source/WebCore/bindings/js/WorkerScriptController.h
+++ b/Source/WebCore/bindings/js/WorkerScriptController.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2012 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -67,6 +68,7 @@ namespace WebCore {
         // forbidExecution()/isExecutionForbidden() to guard against reentry into JS.
         // Can be called from any thread.
         void scheduleExecutionTermination();
+        bool isExecutionTerminating() const;
 
         // Called on Worker thread when JS exits with termination exception caused by forbidExecution() request,
         // or by Worker thread termination code to prevent future entry into JS.
@@ -89,6 +91,7 @@ namespace WebCore {
         WorkerContext* m_workerContext;
         JSC::Strong<JSWorkerContext> m_workerContextWrapper;
         bool m_executionForbidden;
+        mutable Mutex m_scheduledTerminationMutex;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/objc/DOM.mm b/Source/WebCore/bindings/objc/DOM.mm
index 780634acb..7bd99a148 100644
--- a/Source/WebCore/bindings/objc/DOM.mm
+++ b/Source/WebCore/bindings/objc/DOM.mm
@@ -264,7 +264,7 @@ static NSArray *kit(const Vector<IntRect>& rects)
 - (NSString *)description
 {
     if (!_internal)
-        return [NSString stringWithFormat:@"<%@: null>", [[self class] description], self];
+        return [NSString stringWithFormat:@"<%@: null>", [[self class] description]];
 
     NSString *value = [self nodeValue];
     if (value)
diff --git a/Source/WebCore/bindings/objc/WebScriptObject.mm b/Source/WebCore/bindings/objc/WebScriptObject.mm
index 7a41315ab..d0df7bf57 100644
--- a/Source/WebCore/bindings/objc/WebScriptObject.mm
+++ b/Source/WebCore/bindings/objc/WebScriptObject.mm
@@ -486,7 +486,7 @@ static void getListFromNSArray(ExecState *exec, NSArray *array, RootObject* root
     ASSERT(!exec->hadException());
 
     JSLock lock(SilenceAssertionsOnly);
-    [self _imp]->methodTable()->putByIndex([self _imp], exec, index, convertObjcValueToValue(exec, &value, ObjcObjectType, [self _rootObject]));
+    [self _imp]->methodTable()->putByIndex([self _imp], exec, index, convertObjcValueToValue(exec, &value, ObjcObjectType, [self _rootObject]), false);
 
     if (exec->hadException()) {
         addExceptionToConsole(exec);
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm b/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
index efe755290..5a1c2b93f 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorCPP.pm
@@ -197,7 +197,7 @@ sub ShouldSkipType
     # FIXME: We don't generate bindings for SVG related interfaces yet
     return 1 if $typeInfo->signature->name =~ /getSVGDocument/;
 
-    return 1 if $typeInfo->signature->name =~ /Constructor/;
+    return 1 if $typeInfo->signature->type =~ /Constructor$/;
     
     # FIXME: This is typically used to add script execution state arguments to the method.
     # These functions will not compile with the C++ bindings as is, so disable them
@@ -494,8 +494,11 @@ sub GenerateHeader
                 AddForwardDeclarationsForType($type, 1);
             }
 
+            my $conditionalString = GenerateConditionalString($function->signature);
+            push(@headerFunctions, "#if ${conditionalString}\n") if $conditionalString;
             push(@headerFunctions, "    ");
             push(@headerFunctions, $functionDeclaration);
+            push(@headerFunctions, "#endif\n") if $conditionalString;
         }
 
         if (@headerFunctions > 0) {
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 2aa9f5977..99ca0be11 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -776,7 +776,7 @@ sub GenerateHeader
     # Getters
     if ($hasSetter) {
         push(@headerContent, "    static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
-        push(@headerContent, "    static void putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::JSValue);\n") if $dataNode->extendedAttributes->{"CustomIndexedSetter"};
+        push(@headerContent, "    static void putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::JSValue, bool shouldThrow);\n") if $dataNode->extendedAttributes->{"CustomIndexedSetter"};
         push(@headerContent, "    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);\n") if $dataNode->extendedAttributes->{"CustomNamedSetter"};
     }
 
@@ -844,9 +844,12 @@ sub GenerateHeader
             $numCustomAttributes++ if ($attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCustomGetter"});
             $numCustomAttributes++ if ($attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCustomSetter"});
             if ($attribute->signature->extendedAttributes->{"CachedAttribute"}) {
+                my $conditionalString = GenerateConditionalString($attribute->signature);
+                push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
                 push(@headerContent, "    JSC::WriteBarrier<JSC::Unknown> m_" . $attribute->signature->name . ";\n");
                 $numCachedAttributes++;
                 $needsMarkChildren = 1;
+                push(@headerContent, "#endif\n") if $conditionalString;
             }
         }
     }
@@ -861,12 +864,17 @@ sub GenerateHeader
         push(@headerContent, "\n    // Custom attributes\n");
 
         foreach my $attribute (@{$dataNode->attributes}) {
+            my $conditionalString = GenerateConditionalString($attribute->signature);
             if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCustom"} || $attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCustomGetter"}) {
+                push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
                 my $methodName = $codeGenerator->WK_lcfirst($attribute->signature->name);
                 push(@headerContent, "    JSC::JSValue " . $methodName . "(JSC::ExecState*) const;\n");
+                push(@headerContent, "#endif\n") if $conditionalString;
             }
             if (($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCustom"} || $attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCustomSetter"}) && $attribute->type !~ /^readonly/) {
+                push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
                 push(@headerContent, "    void set" . $codeGenerator->WK_ucfirst($attribute->signature->name) . "(JSC::ExecState*, JSC::JSValue);\n");
+                push(@headerContent, "#endif\n") if $conditionalString;
             }
         }
     }
@@ -880,8 +888,11 @@ sub GenerateHeader
         foreach my $function (@{$dataNode->functions}) {
             next unless $function->signature->extendedAttributes->{"Custom"} or $function->signature->extendedAttributes->{"JSCustom"};
             next if $function->{overloads} && $function->{overloadIndex} != 1;
+            my $conditionalString = GenerateConditionalString($function->signature);
+            push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             my $functionImplementationName = $function->signature->extendedAttributes->{"ImplementedAs"} || $codeGenerator->WK_lcfirst($function->signature->name);
-            push(@headerContent, "    JSC::JSValue " . $functionImplementationName . "(JSC::ExecState*);\n");
+            push(@headerContent, "    " . ($function->isStatic ? "static " : "") . "JSC::JSValue " . $functionImplementationName . "(JSC::ExecState*);\n");
+            push(@headerContent, "#endif\n") if $conditionalString;
         }
     }
 
@@ -1067,20 +1078,26 @@ sub GenerateHeader
         push(@headerContent,"// Functions\n\n");
         foreach my $function (@{$dataNode->functions}) {
             next if $function->{overloadIndex} && $function->{overloadIndex} > 1;
+            my $conditionalString = GenerateConditionalString($function->signature);
+            push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             my $functionName = GetFunctionName($className, $function);
             push(@headerContent, "JSC::EncodedJSValue JSC_HOST_CALL ${functionName}(JSC::ExecState*);\n");
+            push(@headerContent, "#endif\n") if $conditionalString;
         }
     }
 
     if ($numAttributes > 0 || !$dataNode->extendedAttributes->{"OmitConstructor"}) {
         push(@headerContent,"// Attributes\n\n");
         foreach my $attribute (@{$dataNode->attributes}) {
+            my $conditionalString = GenerateConditionalString($attribute->signature);
+            push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
             push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);\n");
             unless ($attribute->type =~ /readonly/) {
                 my $setter = "setJS" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
                 push(@headerContent, "void ${setter}(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);\n");
             }
+            push(@headerContent, "#endif\n") if $conditionalString;
         }
         
         if (!$dataNode->extendedAttributes->{"OmitConstructor"}) {
@@ -1097,14 +1114,11 @@ sub GenerateHeader
     if ($numConstants > 0) {
         push(@headerContent,"// Constants\n\n");
         foreach my $constant (@{$dataNode->constants}) {
+            my $conditionalString = GenerateConditionalString($constant);
+            push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($constant->name);
-            my $conditional = $constant->extendedAttributes->{"Conditional"};
-            if ($conditional) {
-                my $conditionalString = $codeGenerator->GenerateConditionalStringFromAttributeValue($conditional);
-                push(@headerContent, "#if ${conditionalString}\n");
-            }
             push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);\n");
-            push(@headerContent, "#endif\n") if $conditional;
+            push(@headerContent, "#endif\n") if $conditionalString;
         }
     }
 
@@ -1841,7 +1855,7 @@ sub GenerateImplementation
             }
 
             if ($dataNode->extendedAttributes->{"CustomIndexedSetter"}) {
-                push(@implContent, "void ${className}::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value)\n");
+                push(@implContent, "void ${className}::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool)\n");
                 push(@implContent, "{\n");
                 push(@implContent, "    ${className}* thisObject = jsCast<${className}*>(cell);\n");
                 push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);\n");
@@ -2063,63 +2077,79 @@ sub GenerateImplementation
 
             $implIncludes{"<runtime/Error.h>"} = 1;
 
-            if ($interfaceName eq "DOMWindow") {
-                push(@implContent, "    $className* castedThis = toJSDOMWindow(exec->hostThisValue().toThisObject(exec));\n");
-                push(@implContent, "    if (!castedThis)\n");
-                push(@implContent, "        return throwVMTypeError(exec);\n");
-            } elsif ($dataNode->extendedAttributes->{"IsWorkerContext"}) {
-                push(@implContent, "    $className* castedThis = to${className}(exec->hostThisValue().toThisObject(exec));\n");
-                push(@implContent, "    if (!castedThis)\n");
-                push(@implContent, "        return throwVMTypeError(exec);\n");
-            } elsif (!$function->isStatic) {
-                push(@implContent, "    JSValue thisValue = exec->hostThisValue();\n");
-                push(@implContent, "    if (!thisValue.inherits(&${className}::s_info))\n");
-                push(@implContent, "        return throwVMTypeError(exec);\n");
-                push(@implContent, "    $className* castedThis = static_cast<$className*>(asObject(thisValue));\n");
-            }
-
-            push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(castedThis, &${className}::s_info);\n") unless ($function->isStatic);
+            if ($function->isStatic) {
+                if ($isCustom) {
+                    GenerateArgumentsCountCheck(\@implContent, $function, $dataNode);
+                    push(@implContent, "    return JSValue::encode(${className}::" . $functionImplementationName . "(exec));\n");
+                } else {
+                    GenerateArgumentsCountCheck(\@implContent, $function, $dataNode);
 
-            if ($dataNode->extendedAttributes->{"CheckSecurity"} and
-                !$function->signature->extendedAttributes->{"DoNotCheckSecurity"} and
-                !$function->isStatic) {
-                push(@implContent, "    if (!castedThis->allowsAccessFrom(exec))\n");
-                push(@implContent, "        return JSValue::encode(jsUndefined());\n");
-            }
+                    if (@{$function->raisesExceptions}) {
+                        push(@implContent, "    ExceptionCode ec = 0;\n");
+                    }
 
-            if ($isCustom) {
-                push(@implContent, "    return JSValue::encode(castedThis->" . $functionImplementationName . "(exec));\n") unless ($function->isStatic);
+                    my $numParameters = @{$function->parameters};
+                    my ($functionString, $dummy) = GenerateParametersCheck(\@implContent, $function, $dataNode, $numParameters, $implClassName, $functionImplementationName, $svgPropertyType, $svgPropertyOrListPropertyType, $svgListPropertyType);
+                    GenerateImplementationFunctionCall($function, $functionString, "    ", $svgPropertyType, $implClassName);
+                }
             } else {
-                push(@implContent, "    $implType* impl = static_cast<$implType*>(castedThis->impl());\n") unless ($function->isStatic);
-                if ($svgPropertyType and !$function->isStatic) {
-                    push(@implContent, "    if (impl->role() == AnimValRole) {\n");
-                    push(@implContent, "        setDOMException(exec, NO_MODIFICATION_ALLOWED_ERR);\n");
-                    push(@implContent, "        return JSValue::encode(jsUndefined());\n");
-                    push(@implContent, "    }\n");
-                    push(@implContent, "    $svgPropertyType& podImpl = impl->propertyReference();\n");
-                    $implIncludes{"ExceptionCode.h"} = 1;
+                if ($interfaceName eq "DOMWindow") {
+                    push(@implContent, "    $className* castedThis = toJSDOMWindow(exec->hostThisValue().toThisObject(exec));\n");
+                    push(@implContent, "    if (!castedThis)\n");
+                    push(@implContent, "        return throwVMTypeError(exec);\n");
+                } elsif ($dataNode->extendedAttributes->{"IsWorkerContext"}) {
+                    push(@implContent, "    $className* castedThis = to${className}(exec->hostThisValue().toThisObject(exec));\n");
+                    push(@implContent, "    if (!castedThis)\n");
+                    push(@implContent, "        return throwVMTypeError(exec);\n");
+                } else {
+                    push(@implContent, "    JSValue thisValue = exec->hostThisValue();\n");
+                    push(@implContent, "    if (!thisValue.inherits(&${className}::s_info))\n");
+                    push(@implContent, "        return throwVMTypeError(exec);\n");
+                    push(@implContent, "    $className* castedThis = static_cast<$className*>(asObject(thisValue));\n");
                 }
 
-                GenerateArgumentsCountCheck(\@implContent, $function, $dataNode);
-
-                if (@{$function->raisesExceptions}) {
-                    push(@implContent, "    ExceptionCode ec = 0;\n");
-                }
+                push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(castedThis, &${className}::s_info);\n");
 
-                if ($function->signature->extendedAttributes->{"CheckSecurityForNode"} and !$function->isStatic) {
-                    push(@implContent, "    if (!shouldAllowAccessToNode(exec, impl->" . $function->signature->name . "(" . (@{$function->raisesExceptions} ? "ec" : "") .")))\n");
+                if ($dataNode->extendedAttributes->{"CheckSecurity"} and
+                    !$function->signature->extendedAttributes->{"DoNotCheckSecurity"}) {
+                    push(@implContent, "    if (!castedThis->allowsAccessFrom(exec))\n");
                     push(@implContent, "        return JSValue::encode(jsUndefined());\n");
-                    $implIncludes{"JSDOMBinding.h"} = 1;
                 }
 
-                if ($function->signature->name eq "addEventListener") {
-                    push(@implContent, GenerateEventListenerCall($className, "add"));
-                } elsif ($function->signature->name eq "removeEventListener") {
-                    push(@implContent, GenerateEventListenerCall($className, "remove"));
+                if ($isCustom) {
+                    push(@implContent, "    return JSValue::encode(castedThis->" . $functionImplementationName . "(exec));\n");
                 } else {
-                    my $numParameters = @{$function->parameters};
-                    my ($functionString, $dummy) = GenerateParametersCheck(\@implContent, $function, $dataNode, $numParameters, $implClassName, $functionImplementationName, $svgPropertyType, $svgPropertyOrListPropertyType, $svgListPropertyType);
-                    GenerateImplementationFunctionCall($function, $functionString, "    ", $svgPropertyType, $implClassName);
+                    push(@implContent, "    $implType* impl = static_cast<$implType*>(castedThis->impl());\n");
+                    if ($svgPropertyType) {
+                        push(@implContent, "    if (impl->role() == AnimValRole) {\n");
+                        push(@implContent, "        setDOMException(exec, NO_MODIFICATION_ALLOWED_ERR);\n");
+                        push(@implContent, "        return JSValue::encode(jsUndefined());\n");
+                        push(@implContent, "    }\n");
+                        push(@implContent, "    $svgPropertyType& podImpl = impl->propertyReference();\n");
+                        $implIncludes{"ExceptionCode.h"} = 1;
+                    }
+
+                    GenerateArgumentsCountCheck(\@implContent, $function, $dataNode);
+
+                    if (@{$function->raisesExceptions}) {
+                        push(@implContent, "    ExceptionCode ec = 0;\n");
+                    }
+
+                    if ($function->signature->extendedAttributes->{"CheckSecurityForNode"}) {
+                        push(@implContent, "    if (!shouldAllowAccessToNode(exec, impl->" . $function->signature->name . "(" . (@{$function->raisesExceptions} ? "ec" : "") .")))\n");
+                        push(@implContent, "        return JSValue::encode(jsUndefined());\n");
+                        $implIncludes{"JSDOMBinding.h"} = 1;
+                    }
+
+                    if ($function->signature->name eq "addEventListener") {
+                        push(@implContent, GenerateEventListenerCall($className, "add"));
+                    } elsif ($function->signature->name eq "removeEventListener") {
+                        push(@implContent, GenerateEventListenerCall($className, "remove"));
+                    } else {
+                        my $numParameters = @{$function->parameters};
+                        my ($functionString, $dummy) = GenerateParametersCheck(\@implContent, $function, $dataNode, $numParameters, $implClassName, $functionImplementationName, $svgPropertyType, $svgPropertyOrListPropertyType, $svgListPropertyType);
+                        GenerateImplementationFunctionCall($function, $functionString, "    ", $svgPropertyType, $implClassName);
+                    }
                 }
             }
 
@@ -2224,6 +2254,20 @@ sub GenerateImplementation
         }
     }
 
+    if ($interfaceName eq "HTMLPropertiesCollection") {
+        if ($dataNode->extendedAttributes->{"NamedGetter"}) {
+            push(@implContent, "bool ${className}::canGetItemsForName(ExecState*, $implClassName* collection, const Identifier& propertyName)\n");
+            push(@implContent, "{\n");
+            push(@implContent, "    return collection->hasNamedItem(identifierToAtomicString(propertyName));\n");
+            push(@implContent, "}\n\n");
+            push(@implContent, "JSValue ${className}::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)\n");
+            push(@implContent, "{\n");
+            push(@implContent, "    ${className}* thisObj = static_cast<$className*>(asObject(slotBase));\n");
+            push(@implContent, "    return toJS(exec, thisObj->globalObject(), static_cast<$implClassName*>(thisObj->impl())->namedItem(identifierToAtomicString(propertyName)));\n");
+            push(@implContent, "}\n\n");
+        }
+    }
+
     if ((!$hasParent && !$dataNode->extendedAttributes->{"JSCustomIsReachable"})|| $dataNode->extendedAttributes->{"JSGenerateIsReachable"} || $dataNode->extendedAttributes->{"ActiveDOMObject"}) {
         push(@implContent, "static inline bool isObservable(JS${implClassName}* js${implClassName})\n");
         push(@implContent, "{\n");
@@ -3368,7 +3412,7 @@ sub GenerateConstructorDefinition
     if (!defined $numberOfConstructorParameters) {
         if (IsConstructorTemplate($dataNode, "Event")) {
             $numberOfConstructorParameters = 2;
-        } elsif ($dataNode->extendedAttributes->{"Constructor"} and !$dataNode->extendedAttributes->{"CustomConstructor"} and !$dataNode->extendedAttributes->{"JSCustomConstructor"}) {
+        } elsif ($dataNode->extendedAttributes->{"Constructor"}) {
             $numberOfConstructorParameters = @{$dataNode->constructor->parameters};
         }
     }
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index 3978481bc..4543414ed 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -920,6 +920,13 @@ sub GenerateHeader
                 AddForwardDeclarationsForType($type, $public) unless $public and $needsDeprecatedVersion;
             }
 
+            my $functionConditionalString = GenerateConditionalString($function->signature);
+            if ($functionConditionalString) {
+                push(@headerFunctions, "#if ${functionConditionalString}\n") if $public;
+                push(@privateHeaderFunctions, "#if ${functionConditionalString}\n") unless $public;
+                push(@deprecatedHeaderFunctions, "#if ${functionConditionalString}\n") if $needsDeprecatedVersion;
+            }
+
             push(@headerFunctions, $functionDeclaration) if $public;
             push(@privateHeaderFunctions, $functionDeclaration) unless $public;
 
@@ -948,6 +955,12 @@ sub GenerateHeader
 
                 delete $publicInterfaces{$publicInterfaceKey};
             }
+
+            if ($functionConditionalString) {
+                push(@headerFunctions, "#endif\n") if $public;
+                push(@privateHeaderFunctions, "#endif\n") unless $public;
+                push(@deprecatedHeaderFunctions, "#endif\n") if $needsDeprecatedVersion;
+            }
         }
 
         if (@headerFunctions > 0) {
diff --git a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 8c46f8c42..a5dabdfd5 100644
--- a/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/Source/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -3,7 +3,7 @@
 # Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
 # Copyright (C) 2006 Apple Computer, Inc.
-# Copyright (C) 2007, 2008, 2009 Google Inc.
+# Copyright (C) 2007, 2008, 2009, 2012 Google Inc.
 # Copyright (C) 2009 Cameron McCormack <cam@mcc.id.au>
 # Copyright (C) Research In Motion Limited 2010. All rights reserved.
 # Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
@@ -365,9 +365,12 @@ END
         my $attrExt = $function->signature->extendedAttributes;
 
         if (($attrExt->{"Custom"} || $attrExt->{"V8Custom"}) && !$attrExt->{"ImplementedBy"} && $function->{overloadIndex} == 1) {
+            my $conditionalString = GenerateConditionalString($function->signature);
+            push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             push(@headerContent, <<END);
     static v8::Handle<v8::Value> ${name}Callback(const v8::Arguments&);
 END
+            push(@headerContent, "#endif // ${conditionalString}\n") if $conditionalString;
         }
 
         if ($attrExt->{"V8EnabledAtRuntime"}) {
@@ -384,19 +387,24 @@ END
     foreach my $attribute (@{$dataNode->attributes}) {
         my $name = $attribute->signature->name;
         my $attrExt = $attribute->signature->extendedAttributes;
+        my $conditionalString = GenerateConditionalString($attribute->signature);
         if (($attrExt->{"V8CustomGetter"} || $attrExt->{"CustomGetter"} ||
              $attrExt->{"V8Custom"} || $attrExt->{"Custom"}) &&
             !$attrExt->{"ImplementedBy"}) {
+            push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             push(@headerContent, <<END);
     static v8::Handle<v8::Value> ${name}AccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo&);
 END
+            push(@headerContent, "#endif // ${conditionalString}\n") if $conditionalString;
         }
         if (($attrExt->{"V8CustomSetter"} || $attrExt->{"CustomSetter"} ||
              $attrExt->{"V8Custom"} || $attrExt->{"Custom"}) &&
             !$attrExt->{"ImplementedBy"}) {
+            push(@headerContent, "#if ${conditionalString}\n") if $conditionalString;
             push(@headerContent, <<END);
     static void ${name}AccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value>, const v8::AccessorInfo&);
 END
+            push(@headerContent, "#endif // ${conditionalString}\n") if $conditionalString;
         }
         if ($attrExt->{"V8EnabledAtRuntime"}) {
             push(@enabledAtRuntime, $attribute);
@@ -447,7 +455,9 @@ END
 }
 END
 
-    if (!($dataNode->extendedAttributes->{"CustomToJSObject"} or $dataNode->extendedAttributes->{"V8CustomToJSObject"})) {
+    if ($interfaceName eq 'Element') {
+        # Do not generate toV8() for performance optimization.
+    } elsif (!($dataNode->extendedAttributes->{"CustomToJSObject"} or $dataNode->extendedAttributes->{"V8CustomToJSObject"})) {
         push(@headerContent, <<END);
 
 inline v8::Handle<v8::Value> toV8(${nativeType}* impl${forceNewObjectParameter})
@@ -2988,7 +2998,8 @@ END
                 my $paramName = $param->name;
                 push(@implContent, "    v8::Handle<v8::Value> ${paramName}Handle = " . NativeToJSValue($param, $paramName) . ";\n");
                 push(@implContent, "    if (${paramName}Handle.IsEmpty()) {\n");
-                push(@implContent, "        CRASH();\n");
+                push(@implContent, "        if (!isScriptControllerTerminating())\n");
+                push(@implContent, "            CRASH();\n");
                 push(@implContent, "        return true;\n");
                 push(@implContent, "    }\n");
                 push(@args, "        ${paramName}Handle");
@@ -3029,21 +3040,28 @@ sub GenerateToV8Converters
 v8::Handle<v8::Object> ${className}::wrapSlow(${nativeType}* impl)
 {
     v8::Handle<v8::Object> wrapper;
-    V8Proxy* proxy = 0;
 END
 
+    my $proxyInit;
     if (IsNodeSubType($dataNode)) {
-        push(@implContent, <<END);
-    if (impl->document()) {
-        proxy = V8Proxy::retrieve(impl->document()->frame());
-        if (proxy && static_cast<Node*>(impl->document()) == static_cast<Node*>(impl)) {
-            if (proxy->windowShell()->context().IsEmpty() && proxy->windowShell()->initContextIfNeeded()) {
-                // initContextIfNeeded may have created a wrapper for the object, retry from the start.
-                return ${className}::wrap(impl);
-            }
+        $proxyInit = "V8Proxy::retrieve(impl->document()->frame())";
+        # DocumentType nodes are the only nodes that may have a NULL document.
+        if ($interfaceName eq "DocumentType") {
+            $proxyInit = "impl->document() ? $proxyInit : 0";
         }
+    } else {
+        $proxyInit = "0";
     }
+    push(@implContent, <<END);
+    V8Proxy* proxy = $proxyInit;
+END
 
+    if (IsSubType($dataNode, "Document")) {
+        push(@implContent, <<END);
+    if (proxy && proxy->windowShell()->context().IsEmpty() && proxy->windowShell()->initContextIfNeeded()) {
+        // initContextIfNeeded may have created a wrapper for the object, retry from the start.
+        return ${className}::wrap(impl);
+    }
 END
     }
 
@@ -3085,7 +3103,7 @@ END
     }
 
     push(@implContent, <<END);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 END
     push(@implContent, "\n    impl->ref();\n") if IsRefPtrType($interfaceName);
diff --git a/Source/WebCore/bindings/scripts/IDLParser.pm b/Source/WebCore/bindings/scripts/IDLParser.pm
index 52671a335..4d126db84 100644
--- a/Source/WebCore/bindings/scripts/IDLParser.pm
+++ b/Source/WebCore/bindings/scripts/IDLParser.pm
@@ -326,6 +326,7 @@ sub ParseInterface
         my @interfaceMethods = split(/;/, $interfaceData);
 
         foreach my $line (@interfaceMethods) {
+            next if $line =~ /^\s*$/;
             if ($line =~ /\Wattribute\W/) {
                 $line =~ /$IDLStructure::interfaceAttributeSelector/;
 
@@ -361,11 +362,11 @@ sub ParseInterface
                 $setterException =~ s/\s+//g;
                 @{$newDataNode->getterExceptions} = split(/,/, $getterException);
                 @{$newDataNode->setterExceptions} = split(/,/, $setterException);
-            } elsif (($line !~ s/^\s*$//g) and ($line !~ /^\s*const/)) {
+            } elsif ($line !~ /^\s*($IDLStructure::extendedAttributeSyntax )?const\s+/) {
                 $line =~ /$IDLStructure::interfaceMethodSelector/ or die "Parsing error!\nSource:\n$line\n)";
 
-                my $isStatic = defined($1);
-                my $methodExtendedAttributes = (defined($2) ? $2 : " "); chop($methodExtendedAttributes);
+                my $methodExtendedAttributes = (defined($1) ? $1 : " "); chop($methodExtendedAttributes);
+                my $isStatic = defined($2);
                 my $methodType = (defined($3) ? $3 : die("Parsing error!\nSource:\n$line\n)"));
                 my $methodName = (defined($4) ? $4 : die("Parsing error!\nSource:\n$line\n)"));
                 my $methodSignature = (defined($5) ? $5 : die("Parsing error!\nSource:\n$line\n)"));
@@ -393,7 +394,7 @@ sub ParseInterface
 
                 my $arrayRef = $dataNode->functions;
                 push(@$arrayRef, $newDataNode);
-            } elsif ($line =~ /^\s*const/) {
+            } else {
                 $line =~ /$IDLStructure::constantSelector/;
                 my $constExtendedAttributes = (defined($1) ? $1 : " "); chop($constExtendedAttributes);
                 my $constType = (defined($2) ? $2 : die("Parsing error!\nSource:\n$line\n)"));
diff --git a/Source/WebCore/bindings/scripts/IDLStructure.pm b/Source/WebCore/bindings/scripts/IDLStructure.pm
index add0474d0..63f4090e9 100644
--- a/Source/WebCore/bindings/scripts/IDLStructure.pm
+++ b/Source/WebCore/bindings/scripts/IDLStructure.pm
@@ -96,7 +96,7 @@ our $extendedAttributeSyntax = qr/\[[^\[\]]*(?:(??{$IDLStructure::extendedAttrib
 # Regular expression based IDL 'syntactical tokenizer' used in the IDLParser
 our $moduleSelector = 'module\s*(' . $idlId . '*)\s*{';
 our $moduleNSSelector = 'module\s*(' . $idlId . '*)\s*\[ns\s*(' . $idlIdNs . '*)\s*(' . $idlIdNs . '*)\]\s*;';
-our $constantSelector = 'const\s*(' . $extendedAttributeSyntax . ' )?' . $supportedTypes . '\s*(' . $idlType . '*)\s*=\s*(' . $constValue . ')';
+our $constantSelector = '(' . $extendedAttributeSyntax . ' )?const\s+' . $supportedTypes . '\s*(' . $idlType . '*)\s*=\s*(' . $constValue . ')';
 our $raisesSelector = 'raises\s*\((' . $idlIdNsList . '*)\s*\)';
 our $getterRaisesSelector = '\bgetter\s+raises\s*\((' . $idlIdNsList . '*)\s*\)';
 our $setterRaisesSelector = '\bsetter\s+raises\s*\((' . $idlIdNsList . '*)\s*\)';
@@ -104,7 +104,7 @@ our $setterRaisesSelector = '\bsetter\s+raises\s*\((' . $idlIdNsList . '*)\s*\)'
 our $typeNamespaceSelector = '((?:' . $idlId . '*::)*)\s*(' . $idlDataType . '*)';
 
 our $interfaceSelector = 'interface\s*((?:' . $extendedAttributeSyntax . ' )?)(' . $idlIdNs . '*)\s*(?::(\s*[^{]*))?{([-a-zA-Z0-9_"=\s(),;:\[\]&\|]*)';
-our $interfaceMethodSelector = '\s*(static\s+)?((?:' . $extendedAttributeSyntax . ' )?)' . $supportedTypes . '\s*(' . $idlIdNs . '*)\s*\(\s*([a-zA-Z0-9:\s,=\[\]]*)';
+our $interfaceMethodSelector = '\s*((?:' . $extendedAttributeSyntax . ' )?)(static\s+)?' . $supportedTypes . '\s*(' . $idlIdNs . '*)\s*\(\s*([a-zA-Z0-9:\s,=\[\]]*)';
 our $interfaceParameterSelector = '(in|out)\s*((?:' . $extendedAttributeSyntax . ' )?)' . $supportedTypes . '\s*(' . $idlIdNs . '*)';
 
 our $interfaceAttributeSelector = '\s*(readonly attribute|attribute)\s*(' . $extendedAttributeSyntax . ' )?' . $supportedTypes . '\s*(' . $idlType . '*)';
diff --git a/Source/WebCore/bindings/scripts/resolve-supplemental.pl b/Source/WebCore/bindings/scripts/preprocess-idls.pl
index 168b349dc..168b349dc 100644
--- a/Source/WebCore/bindings/scripts/resolve-supplemental.pl
+++ b/Source/WebCore/bindings/scripts/preprocess-idls.pl
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.h b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.h
index 280460bbd..ca5588402 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestInterface.h
@@ -64,8 +64,12 @@ public:
     void setSupplementalNode(const WebDOMNode&);
 #endif
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
     void supplementalMethod1();
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
     void supplementalMethod4();
+#endif
 
     WebCore::TestInterface* impl() const;
 
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
index ac076486f..9d63fdde7 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
@@ -541,60 +541,6 @@ void WebDOMTestObj::setConditionalAttr3(int newConditionalAttr3)
 }
 
 #endif
-#if ENABLE(Condition1)
-WebDOMTestObjectAConstructor WebDOMTestObj::conditionalAttr4() const
-{
-    if (!impl())
-        return WebDOMTestObjectAConstructor();
-
-    return toWebKit(WTF::getPtr(impl()->conditionalAttr4()));
-}
-
-void WebDOMTestObj::setConditionalAttr4(const WebDOMTestObjectAConstructor& newConditionalAttr4)
-{
-    if (!impl())
-        return;
-
-    impl()->setConditionalAttr4(toWebCore(newConditionalAttr4));
-}
-
-#endif
-#if ENABLE(Condition1) && ENABLE(Condition2)
-WebDOMTestObjectBConstructor WebDOMTestObj::conditionalAttr5() const
-{
-    if (!impl())
-        return WebDOMTestObjectBConstructor();
-
-    return toWebKit(WTF::getPtr(impl()->conditionalAttr5()));
-}
-
-void WebDOMTestObj::setConditionalAttr5(const WebDOMTestObjectBConstructor& newConditionalAttr5)
-{
-    if (!impl())
-        return;
-
-    impl()->setConditionalAttr5(toWebCore(newConditionalAttr5));
-}
-
-#endif
-#if ENABLE(Condition1) || ENABLE(Condition2)
-WebDOMTestObjectCConstructor WebDOMTestObj::conditionalAttr6() const
-{
-    if (!impl())
-        return WebDOMTestObjectCConstructor();
-
-    return toWebKit(WTF::getPtr(impl()->conditionalAttr6()));
-}
-
-void WebDOMTestObj::setConditionalAttr6(const WebDOMTestObjectCConstructor& newConditionalAttr6)
-{
-    if (!impl())
-        return;
-
-    impl()->setConditionalAttr6(toWebCore(newConditionalAttr6));
-}
-
-#endif
 WebDOMDocument WebDOMTestObj::contentDocument() const
 {
     if (!impl())
diff --git a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
index 5d90fd261..8c72f2333 100644
--- a/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
@@ -37,9 +37,6 @@ class WebDOMOptionsObject;
 class WebDOMSVGPoint;
 class WebDOMString;
 class WebDOMTestObj;
-class WebDOMTestObjectAConstructor;
-class WebDOMTestObjectBConstructor;
-class WebDOMTestObjectCConstructor;
 class WebDOMa;
 class WebDOMb;
 class WebDOMbool;
@@ -132,18 +129,6 @@ public:
     int conditionalAttr3() const;
     void setConditionalAttr3(int);
 #endif
-#if ENABLE(Condition1)
-    WebDOMTestObjectAConstructor conditionalAttr4() const;
-    void setConditionalAttr4(const WebDOMTestObjectAConstructor&);
-#endif
-#if ENABLE(Condition1) && ENABLE(Condition2)
-    WebDOMTestObjectBConstructor conditionalAttr5() const;
-    void setConditionalAttr5(const WebDOMTestObjectBConstructor&);
-#endif
-#if ENABLE(Condition1) || ENABLE(Condition2)
-    WebDOMTestObjectCConstructor conditionalAttr6() const;
-    void setConditionalAttr6(const WebDOMTestObjectCConstructor&);
-#endif
     WebDOMDocument contentDocument() const;
     WebDOMSVGPoint mutablePoint() const;
     void setMutablePoint(const WebDOMSVGPoint&);
@@ -175,13 +160,23 @@ public:
     void methodWithOptionalString(const WebDOMString& str);
     void methodWithOptionalStringIsUndefined(const WebDOMString& str);
     void methodWithOptionalStringIsNullString(const WebDOMString& str);
+#if ENABLE(Condition1)
     WebDOMString conditionalMethod1();
+#endif
+#if ENABLE(Condition1) && ENABLE(Condition2)
     void conditionalMethod2();
+#endif
+#if ENABLE(Condition1) || ENABLE(Condition2)
     void conditionalMethod3();
+#endif
     void classMethod();
     int classMethodWithOptional(int arg);
+#if ENABLE(Condition1)
     void overloadedMethod1(int arg);
+#endif
+#if ENABLE(Condition1)
     void overloadedMethod1(const WebDOMString& type);
+#endif
     void convert1(const WebDOMa& );
     void convert2(const WebDOMb& );
     void convert3(const WebDOMc& );
diff --git a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
index a73ebf1c7..e6b5ac23c 100644
--- a/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
@@ -104,7 +104,7 @@ webkit_dom_test_interface_supplemental_method4(WebKitDOMTestInterface* self)
     g_return_if_fail(self);
     WebCore::JSMainThreadNullState state;
     WebCore::TestInterface * item = WebKit::core(self);
-    TestSupplemental::supplementalMethod4(item);
+    WebCore::TestSupplemental::supplementalMethod4(item);
 #endif /* ENABLE(Condition11) || ENABLE(Condition12) */
 }
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
index 67220b7af..9ce2b68f3 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.cpp
@@ -65,6 +65,7 @@ void JSFloat64ArrayConstructor::finishCreation(ExecState* exec, JSDOMGlobalObjec
     Base::finishCreation(exec->globalData());
     ASSERT(inherits(&s_info));
     putDirect(exec->globalData(), exec->propertyNames().prototype, JSFloat64ArrayPrototype::self(exec, globalObject), DontDelete | ReadOnly);
+    putDirect(exec->globalData(), exec->propertyNames().length, jsNumber(123), ReadOnly | DontDelete | DontEnum);
 }
 
 bool JSFloat64ArrayConstructor::getOwnPropertySlot(JSCell* cell, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -199,7 +200,7 @@ void JSFloat64Array::put(JSCell* cell, ExecState* exec, const Identifier& proper
     Base::put(thisObject, exec, propertyName, value, slot);
 }
 
-void JSFloat64Array::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value)
+void JSFloat64Array::putByIndex(JSCell* cell, ExecState* exec, unsigned propertyName, JSValue value, bool)
 {
     JSFloat64Array* thisObject = jsCast<JSFloat64Array*>(cell);
     ASSERT_GC_OBJECT_INHERITS(thisObject, &s_info);
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.h b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.h
index ab2ec07a2..3a3b7cd8b 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSFloat64Array.h
@@ -43,7 +43,7 @@ public:
     static bool getOwnPropertyDescriptor(JSC::JSObject*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertyDescriptor&);
     static bool getOwnPropertySlotByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     static void put(JSC::JSCell*, JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
-    static void putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::JSValue);
+    static void putByIndex(JSC::JSCell*, JSC::ExecState*, unsigned propertyName, JSC::JSValue, bool shouldThrow);
     static const JSC::ClassInfo s_info;
 
     static JSC::Structure* createStructure(JSC::JSGlobalData& globalData, JSC::JSGlobalObject* globalObject, JSC::JSValue prototype)
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
index a0ce24452..d16bcbd29 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.h
@@ -58,11 +58,17 @@ public:
     static JSC::JSValue getConstructor(JSC::ExecState*, JSC::JSGlobalObject*);
 
     // Custom attributes
+#if ENABLE(Condition11) || ENABLE(Condition12)
     JSC::JSValue supplementalStr3(JSC::ExecState*) const;
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
     void setSupplementalStr3(JSC::ExecState*, JSC::JSValue);
+#endif
 
     // Custom functions
+#if ENABLE(Condition11) || ENABLE(Condition12)
     JSC::JSValue supplementalMethod3(JSC::ExecState*);
+#endif
     TestInterface* impl() const { return m_impl; }
     void releaseImpl() { m_impl->deref(); m_impl = 0; }
 
@@ -149,19 +155,35 @@ protected:
 
 // Functions
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
 JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod1(JSC::ExecState*);
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod2(JSC::ExecState*);
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfacePrototypeFunctionSupplementalMethod3(JSC::ExecState*);
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 JSC::EncodedJSValue JSC_HOST_CALL jsTestInterfaceConstructorFunctionSupplementalMethod4(JSC::ExecState*);
+#endif
 // Attributes
 
+#if ENABLE(Condition11) || ENABLE(Condition12)
 JSC::JSValue jsTestInterfaceSupplementalStr1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 JSC::JSValue jsTestInterfaceSupplementalStr2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestInterfaceSupplementalStr2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 JSC::JSValue jsTestInterfaceSupplementalStr3(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestInterfaceSupplementalStr3(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 JSC::JSValue jsTestInterfaceSupplementalNode(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestInterfaceSupplementalNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
 JSC::JSValue jsTestInterfaceConstructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 // Constants
 
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
index 97dcc8f2f..11a20df92 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
@@ -163,6 +163,7 @@ static const HashTableValue JSTestObjConstructorTableValues[] =
     { "CONST_JAVASCRIPT", DontDelete | ReadOnly, (intptr_t)static_cast<PropertySlot::GetValueFunc>(jsTestObjCONST_JAVASCRIPT), (intptr_t)0, NoIntrinsic },
     { "classMethod", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjConstructorFunctionClassMethod), (intptr_t)0, NoIntrinsic },
     { "classMethodWithOptional", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjConstructorFunctionClassMethodWithOptional), (intptr_t)1, NoIntrinsic },
+    { "classMethod2", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjConstructorFunctionClassMethod2), (intptr_t)1, NoIntrinsic },
 #if ENABLE(Condition1)
     { "overloadedMethod1", DontDelete | JSC::Function, (intptr_t)static_cast<NativeFunction>(jsTestObjConstructorFunctionOverloadedMethod1), (intptr_t)1, NoIntrinsic },
 #endif
@@ -2082,6 +2083,13 @@ EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethodWithOptional
     return JSValue::encode(result);
 }
 
+EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethod2(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return throwVMError(exec, createTypeError(exec, "Not enough arguments"));
+    return JSValue::encode(JSTestObj::classMethod2(exec));
+}
+
 #if ENABLE(Condition1)
 static EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionOverloadedMethod11(ExecState* exec)
 {
diff --git a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
index cb9dafb6d..28419eca1 100644
--- a/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/JS/JSTestObj.h
@@ -65,6 +65,7 @@ public:
     // Custom functions
     JSC::JSValue customMethod(JSC::ExecState*);
     JSC::JSValue customMethodWithArgs(JSC::ExecState*);
+    static JSC::JSValue classMethod2(JSC::ExecState*);
     TestObj* impl() const { return m_impl; }
     void releaseImpl() { m_impl->deref(); m_impl = 0; }
 
@@ -184,13 +185,22 @@ JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithOptionalSt
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackArg(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithNonCallbackArgAndCallbackArg(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithCallbackAndOptionalArg(JSC::ExecState*);
+#if ENABLE(Condition1)
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConditionalMethod1(JSC::ExecState*);
+#endif
+#if ENABLE(Condition1) && ENABLE(Condition2)
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConditionalMethod2(JSC::ExecState*);
+#endif
+#if ENABLE(Condition1) || ENABLE(Condition2)
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConditionalMethod3(JSC::ExecState*);
+#endif
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionOverloadedMethod(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethod(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethodWithOptional(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionClassMethod2(JSC::ExecState*);
+#if ENABLE(Condition1)
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjConstructorFunctionOverloadedMethod1(JSC::ExecState*);
+#endif
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithUnsignedLongArray(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionGetSVGDocument(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionConvert1(JSC::ExecState*);
@@ -269,18 +279,30 @@ JSC::JSValue jsTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribut
 void setJSTestObjWithScriptExecutionContextAndScriptStateWithSpacesAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 JSC::JSValue jsTestObjWithScriptArgumentsAndCallStackAttribute(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjWithScriptArgumentsAndCallStackAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#if ENABLE(Condition1)
 JSC::JSValue jsTestObjConditionalAttr1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjConditionalAttr1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
+#if ENABLE(Condition1) && ENABLE(Condition2)
 JSC::JSValue jsTestObjConditionalAttr2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjConditionalAttr2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
+#if ENABLE(Condition1) || ENABLE(Condition2)
 JSC::JSValue jsTestObjConditionalAttr3(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjConditionalAttr3(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
+#if ENABLE(Condition1)
 JSC::JSValue jsTestObjConditionalAttr4Constructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjConditionalAttr4Constructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
+#if ENABLE(Condition1) && ENABLE(Condition2)
 JSC::JSValue jsTestObjConditionalAttr5Constructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjConditionalAttr5Constructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
+#if ENABLE(Condition1) || ENABLE(Condition2)
 JSC::JSValue jsTestObjConditionalAttr6Constructor(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 void setJSTestObjConditionalAttr6Constructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+#endif
 JSC::JSValue jsTestObjCachedAttribute1(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 JSC::JSValue jsTestObjCachedAttribute2(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
 JSC::JSValue jsTestObjContentDocument(JSC::ExecState*, JSC::JSValue, const JSC::Identifier&);
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.h b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.h
index 7e3b1c402..b86f999d0 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.h
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestInterface.h
@@ -58,10 +58,18 @@ enum {
 - (DOMNode *)supplementalNode;
 - (void)setSupplementalNode:(DOMNode *)newSupplementalNode;
 #endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 - (void)supplementalMethod1;
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 - (DOMTestObj *)supplementalMethod2:(NSString *)strArg objArg:(DOMTestObj *)objArg;
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 - (void)supplementalMethod3;
+#endif
+#if ENABLE(Condition11) || ENABLE(Condition12)
 - (void)supplementalMethod4;
+#endif
 @end
 
 #endif
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
index 295741e67..aebc39fb3 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
@@ -195,13 +195,24 @@ enum {
 - (void)methodWithOptionalString:(NSString *)str;
 - (void)methodWithOptionalStringIsUndefined:(NSString *)str;
 - (void)methodWithOptionalStringIsNullString:(NSString *)str;
+#if ENABLE(Condition1)
 - (NSString *)conditionalMethod1;
+#endif
+#if ENABLE(Condition1) && ENABLE(Condition2)
 - (void)conditionalMethod2;
+#endif
+#if ENABLE(Condition1) || ENABLE(Condition2)
 - (void)conditionalMethod3;
+#endif
 - (void)classMethod;
 - (int)classMethodWithOptional:(int)arg;
+- (void)classMethod2:(int)arg;
+#if ENABLE(Condition1)
 - (void)overloadedMethod1:(int)arg;
+#endif
+#if ENABLE(Condition1)
 - (void)overloadedMethod1:(NSString *)type;
+#endif
 - (DOMSVGDocument *)getSVGDocument;
 - (void)convert1:(DOMa *);
 - (void)convert2:(DOMb *);
diff --git a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
index 38f9c6bec..abd3b9cc5 100644
--- a/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
+++ b/Source/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
@@ -932,6 +932,12 @@
     return IMPL->classMethodWithOptional(arg);
 }
 
+- (void)classMethod2:(int)arg
+{
+    WebCore::JSMainThreadNullState state;
+    IMPL->classMethod2(arg);
+}
+
 
 #if ENABLE(Condition1)
 - (void)overloadedMethod1:(int)arg
diff --git a/Source/WebCore/bindings/scripts/test/TestObj.idl b/Source/WebCore/bindings/scripts/test/TestObj.idl
index 171fda48c..fd5dbf930 100644
--- a/Source/WebCore/bindings/scripts/test/TestObj.idl
+++ b/Source/WebCore/bindings/scripts/test/TestObj.idl
@@ -151,7 +151,7 @@ module test {
         attribute [Conditional=Condition1&Condition2] TestObjectBConstructor conditionalAttr5;
         attribute [Conditional=Condition1|Condition2] TestObjectCConstructor conditionalAttr6;
 
-        const [Conditional=Condition1] unsigned short CONDITIONAL_CONST = 0;
+        [Conditional=Condition1] const unsigned short CONDITIONAL_CONST = 0;
 
 #if defined(TESTING_V8) || defined(TESTING_JS)
         readonly attribute [CachedAttribute] any cachedAttribute1;
@@ -172,11 +172,11 @@ module test {
         // Class methods within JavaScript (like what's used for IDBKeyRange).
         static void classMethod();
         static long classMethodWithOptional(in [Optional] long arg);
+        [Custom] static void classMethod2(in long arg);
 
         // Static method with conditional on overloaded methods
-
-        static [Conditional=Condition1] void overloadedMethod1(in long arg);
-        static [Conditional=Condition1] void overloadedMethod1(in DOMString type);
+        [Conditional=Condition1] static void overloadedMethod1(in long arg);
+        [Conditional=Condition1] static void overloadedMethod1(in DOMString type);
 
 #if defined(TESTING_V8)
         // 'V8EnabledAtRuntime' methods and attributes.
@@ -234,6 +234,6 @@ module test {
         const unsigned short CONST_VALUE_12 = 0x01;
         const unsigned short CONST_VALUE_13 = 0X20;
         const unsigned short CONST_VALUE_14 = 0x1abc;
-        const [Reflect=CONST_IMPL] unsigned short CONST_JAVASCRIPT = 15;
+        [Reflect=CONST_IMPL] const unsigned short CONST_JAVASCRIPT = 15;
     };
 }
diff --git a/Source/WebCore/bindings/scripts/test/TestSupplemental.idl b/Source/WebCore/bindings/scripts/test/TestSupplemental.idl
index 0d7e96169..60514124b 100644
--- a/Source/WebCore/bindings/scripts/test/TestSupplemental.idl
+++ b/Source/WebCore/bindings/scripts/test/TestSupplemental.idl
@@ -44,6 +44,6 @@ module test {
         static void supplementalMethod4();
 
         const unsigned short SUPPLEMENTALCONSTANT1 = 1;
-        const [Reflect=CONST_IMPL] unsigned short SUPPLEMENTALCONSTANT2 = 2;
+        [Reflect=CONST_IMPL] const unsigned short SUPPLEMENTALCONSTANT2 = 2;
     };
 }
diff --git a/Source/WebCore/bindings/scripts/test/TestTypedArray.idl b/Source/WebCore/bindings/scripts/test/TestTypedArray.idl
index cf5306d42..e816b3860 100644
--- a/Source/WebCore/bindings/scripts/test/TestTypedArray.idl
+++ b/Source/WebCore/bindings/scripts/test/TestTypedArray.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=123,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
index 0a0f628b4..bdc6028be 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8Float64Array.cpp
@@ -125,7 +125,7 @@ v8::Handle<v8::Object> V8Float64Array::wrapSlow(Float64Array* impl)
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
index dc73c2690..ffc97e462 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestActiveDOMObject.cpp
@@ -179,7 +179,7 @@ v8::Handle<v8::Object> V8TestActiveDOMObject::wrapSlow(TestActiveDOMObject* impl
     // Exit the node's context if it was entered.
     if (!context.IsEmpty())
         context->Exit();
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
index 8577a93e8..3a17f7a3b 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCallback.cpp
@@ -87,7 +87,8 @@ bool V8TestCallback::callbackWithClass1Param(Class1* class1Param)
 
     v8::Handle<v8::Value> class1ParamHandle = toV8(class1Param);
     if (class1ParamHandle.IsEmpty()) {
-        CRASH();
+        if (!isScriptControllerTerminating())
+            CRASH();
         return true;
     }
 
@@ -114,12 +115,14 @@ bool V8TestCallback::callbackWithClass2Param(Class2* class2Param, const String&
 
     v8::Handle<v8::Value> class2ParamHandle = toV8(class2Param);
     if (class2ParamHandle.IsEmpty()) {
-        CRASH();
+        if (!isScriptControllerTerminating())
+            CRASH();
         return true;
     }
     v8::Handle<v8::Value> strArgHandle = v8String(strArg);
     if (strArgHandle.IsEmpty()) {
-        CRASH();
+        if (!isScriptControllerTerminating())
+            CRASH();
         return true;
     }
 
@@ -147,7 +150,8 @@ bool V8TestCallback::callbackWithStringList(RefPtr<DOMStringList> listParam)
 
     v8::Handle<v8::Value> listParamHandle = toV8(listParam);
     if (listParamHandle.IsEmpty()) {
-        CRASH();
+        if (!isScriptControllerTerminating())
+            CRASH();
         return true;
     }
 
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
index 699eb4b93..cbff6d4e7 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestCustomNamedGetter.cpp
@@ -115,7 +115,7 @@ v8::Handle<v8::Object> V8TestCustomNamedGetter::wrapSlow(TestCustomNamedGetter*
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
index d561eb491..7c06e34e6 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventConstructor.cpp
@@ -150,7 +150,7 @@ v8::Handle<v8::Object> V8TestEventConstructor::wrapSlow(TestEventConstructor* im
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
index be0113383..1e6fbfa53 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestEventTarget.cpp
@@ -178,7 +178,7 @@ v8::Handle<v8::Object> V8TestEventTarget::wrapSlow(TestEventTarget* impl)
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
index a347626f1..a2c551860 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestInterface.cpp
@@ -311,7 +311,7 @@ v8::Handle<v8::Object> V8TestInterface::wrapSlow(TestInterface* impl)
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
index 1fa12d4eb..934f66839 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestMediaQueryListListener.cpp
@@ -115,7 +115,7 @@ v8::Handle<v8::Object> V8TestMediaQueryListListener::wrapSlow(TestMediaQueryList
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
index 8e6f61dff..5abce0e7d 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestNamedConstructor.cpp
@@ -160,7 +160,7 @@ v8::Handle<v8::Object> V8TestNamedConstructor::wrapSlow(TestNamedConstructor* im
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index 4a2029a22..530bbedc4 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -2011,6 +2011,7 @@ static v8::Persistent<v8::FunctionTemplate> ConfigureV8TestObjTemplate(v8::Persi
     proto->Set(v8::String::New("methodThatRequiresAllArgsAndThrows"), v8::FunctionTemplate::New(TestObjInternal::methodThatRequiresAllArgsAndThrowsCallback, v8::Handle<v8::Value>(), methodThatRequiresAllArgsAndThrowsSignature));
     desc->Set(v8::String::New("classMethod"), v8::FunctionTemplate::New(TestObjInternal::classMethodCallback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
     desc->Set(v8::String::New("classMethodWithOptional"), v8::FunctionTemplate::New(TestObjInternal::classMethodWithOptionalCallback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
+    desc->Set(v8::String::New("classMethod2"), v8::FunctionTemplate::New(V8TestObj::classMethod2Callback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
 #if ENABLE(Condition1)
     desc->Set(v8::String::New("overloadedMethod1"), v8::FunctionTemplate::New(TestObjInternal::overloadedMethod1Callback, v8::Handle<v8::Value>(), v8::Local<v8::Signature>()));
 #endif // ENABLE(Condition1)
@@ -2093,7 +2094,7 @@ v8::Handle<v8::Object> V8TestObj::wrapSlow(TestObj* impl)
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.h b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.h
index cdeae3ed3..e59dab8c9 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.h
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.h
@@ -45,6 +45,7 @@ public:
     static WrapperTypeInfo info;
     static v8::Handle<v8::Value> customMethodCallback(const v8::Arguments&);
     static v8::Handle<v8::Value> customMethodWithArgsCallback(const v8::Arguments&);
+    static v8::Handle<v8::Value> classMethod2Callback(const v8::Arguments&);
     static v8::Handle<v8::Value> constructorCallback(const v8::Arguments&);
     static v8::Handle<v8::Value> customAttrAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo&);
     static void customAttrAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value>, const v8::AccessorInfo&);
diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
index aaf298e3c..f329ab0f3 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp
@@ -197,7 +197,7 @@ v8::Handle<v8::Object> V8TestSerializedScriptValueInterface::wrapSlow(TestSerial
     v8::Handle<v8::Object> wrapper;
     V8Proxy* proxy = 0;
     wrapper = V8DOMWrapper::instantiateV8Object(proxy, &info, impl);
-    if (wrapper.IsEmpty())
+    if (UNLIKELY(wrapper.IsEmpty()))
         return wrapper;
 
     impl->ref();
diff --git a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
index b4ee695fb..9e6b12848 100644
--- a/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
+++ b/Source/WebCore/bindings/v8/IDBBindingUtilities.cpp
@@ -151,7 +151,7 @@ v8::Handle<v8::Value> ensureNthValueOnKeyPath(v8::Handle<v8::Value>& rootValue,
 PassRefPtr<IDBKey> createIDBKeyFromSerializedValueAndKeyPath(PassRefPtr<SerializedScriptValue> value, const Vector<String>& keyPath)
 {
     IDB_TRACE("createIDBKeyFromSerializedValueAndKeyPath");
-    V8LocalContext localContext;
+    V8AuxiliaryContext context;
     v8::Handle<v8::Value> v8Value(value->deserialize());
     v8::Handle<v8::Value> v8Key(getNthValueOnKeyPath(v8Value, keyPath, keyPath.size()));
     if (v8Key.IsEmpty())
@@ -162,7 +162,7 @@ PassRefPtr<IDBKey> createIDBKeyFromSerializedValueAndKeyPath(PassRefPtr<Serializ
 PassRefPtr<SerializedScriptValue> injectIDBKeyIntoSerializedValue(PassRefPtr<IDBKey> key, PassRefPtr<SerializedScriptValue> value, const Vector<String>& keyPath)
 {
     IDB_TRACE("injectIDBKeyIntoSerializedValue");
-    V8LocalContext localContext;
+    V8AuxiliaryContext context;
     if (!keyPath.size())
         return 0;
 
diff --git a/Source/WebCore/bindings/v8/OptionsObject.cpp b/Source/WebCore/bindings/v8/OptionsObject.cpp
index f8db97e5a..e8c7dd9cc 100644
--- a/Source/WebCore/bindings/v8/OptionsObject.cpp
+++ b/Source/WebCore/bindings/v8/OptionsObject.cpp
@@ -43,6 +43,15 @@
 #include "V8TextTrack.h"
 #endif
 
+#if ENABLE(SCRIPTED_SPEECH)
+#include "SpeechRecognitionError.h"
+#include "SpeechRecognitionResult.h"
+#include "SpeechRecognitionResultList.h"
+#include "V8SpeechRecognitionError.h"
+#include "V8SpeechRecognitionResult.h"
+#include "V8SpeechRecognitionResultList.h"
+#endif
+
 namespace WebCore {
 
 OptionsObject::OptionsObject()
@@ -168,6 +177,19 @@ bool OptionsObject::get(const String& key, unsigned short& value) const
     return true;
 }
 
+bool OptionsObject::get(const String& key, short& value) const
+{
+    v8::Local<v8::Value> v8Value;
+    if (!getKey(key, v8Value))
+        return false;
+
+    v8::Local<v8::Int32> v8Int32 = v8Value->ToInt32();
+    if (v8Int32.IsEmpty())
+        return false;
+    value = static_cast<short>(v8Int32->Value());
+    return true;
+}
+
 bool OptionsObject::get(const String& key, unsigned& value) const
 {
     v8::Local<v8::Value> v8Value;
@@ -293,4 +315,58 @@ bool OptionsObject::get(const String& key, RefPtr<TrackBase>& value) const
 }
 #endif
 
+#if ENABLE(SCRIPTED_SPEECH)
+bool OptionsObject::get(const String& key, RefPtr<SpeechRecognitionError>& value) const
+{
+    v8::Local<v8::Value> v8Value;
+    if (!getKey(key, v8Value))
+        return false;
+
+    SpeechRecognitionError* source = 0;
+    if (v8Value->IsObject()) {
+        v8::Handle<v8::Object> wrapper = v8::Handle<v8::Object>::Cast(v8Value);
+        v8::Handle<v8::Object> speechRecognitionError = V8DOMWrapper::lookupDOMWrapper(V8SpeechRecognitionError::GetTemplate(), wrapper);
+        if (!speechRecognitionError.IsEmpty())
+            source = V8SpeechRecognitionError::toNative(speechRecognitionError);
+    }
+    value = source;
+    return true;
+}
+
+bool OptionsObject::get(const String& key, RefPtr<SpeechRecognitionResult>& value) const
+{
+    v8::Local<v8::Value> v8Value;
+    if (!getKey(key, v8Value))
+        return false;
+
+    SpeechRecognitionResult* source = 0;
+    if (v8Value->IsObject()) {
+        v8::Handle<v8::Object> wrapper = v8::Handle<v8::Object>::Cast(v8Value);
+        v8::Handle<v8::Object> speechRecognitionResult = V8DOMWrapper::lookupDOMWrapper(V8SpeechRecognitionResult::GetTemplate(), wrapper);
+        if (!speechRecognitionResult.IsEmpty())
+            source = V8SpeechRecognitionResult::toNative(speechRecognitionResult);
+    }
+    value = source;
+    return true;
+}
+
+bool OptionsObject::get(const String& key, RefPtr<SpeechRecognitionResultList>& value) const
+{
+    v8::Local<v8::Value> v8Value;
+    if (!getKey(key, v8Value))
+        return false;
+
+    SpeechRecognitionResultList* source = 0;
+    if (v8Value->IsObject()) {
+        v8::Handle<v8::Object> wrapper = v8::Handle<v8::Object>::Cast(v8Value);
+        v8::Handle<v8::Object> speechRecognitionResultList = V8DOMWrapper::lookupDOMWrapper(V8SpeechRecognitionResultList::GetTemplate(), wrapper);
+        if (!speechRecognitionResultList.IsEmpty())
+            source = V8SpeechRecognitionResultList::toNative(speechRecognitionResultList);
+    }
+    value = source;
+    return true;
+}
+
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/OptionsObject.h b/Source/WebCore/bindings/v8/OptionsObject.h
index 2c7e80a07..326037816 100644
--- a/Source/WebCore/bindings/v8/OptionsObject.h
+++ b/Source/WebCore/bindings/v8/OptionsObject.h
@@ -40,6 +40,9 @@ class DOMWindow;
 class IDBKeyRange;
 class Storage;
 class TrackBase;
+class SpeechRecognitionError;
+class SpeechRecognitionResult;
+class SpeechRecognitionResultList;
 
 class OptionsObject {
 public:
@@ -57,6 +60,7 @@ public:
     bool get(const String&, double&) const;
     bool get(const String&, String&) const;
     bool get(const String&, ScriptValue&) const;
+    bool get(const String&, short&) const;
     bool get(const String&, unsigned short&) const;
     bool get(const String&, unsigned&) const;
     bool get(const String&, unsigned long long&) const;
@@ -66,6 +70,11 @@ public:
 #if ENABLE(VIDEO_TRACK)
     bool get(const String&, RefPtr<TrackBase>&) const;
 #endif
+#if ENABLE(SCRIPTED_SPEECH)
+    bool get(const String&, RefPtr<SpeechRecognitionError>&) const;
+    bool get(const String&, RefPtr<SpeechRecognitionResult>&) const;
+    bool get(const String&, RefPtr<SpeechRecognitionResultList>&) const;
+#endif
     bool get(const String&, HashSet<AtomicString>&) const;
 
     bool getWithUndefinedOrNullCheck(const String&, String&) const;
diff --git a/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp b/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp
index 9edda78f4..6097eca5c 100644
--- a/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp
+++ b/Source/WebCore/bindings/v8/RetainedDOMInfo.cpp
@@ -58,7 +58,7 @@ bool RetainedDOMInfo::IsEquivalent(v8::RetainedObjectInfo* other)
 
 intptr_t RetainedDOMInfo::GetHash()
 {
-    return reinterpret_cast<intptr_t>(m_root);
+    return PtrHash<void*>::hash(m_root);
 }
     
 const char* RetainedDOMInfo::GetGroupLabel()
diff --git a/Source/WebCore/bindings/v8/ScheduledAction.cpp b/Source/WebCore/bindings/v8/ScheduledAction.cpp
index f76b58d1c..c4060476b 100644
--- a/Source/WebCore/bindings/v8/ScheduledAction.cpp
+++ b/Source/WebCore/bindings/v8/ScheduledAction.cpp
@@ -41,6 +41,7 @@
 
 #include "V8Binding.h"
 #include "V8Proxy.h"
+#include "V8RecursionScope.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
 #include "WorkerThread.h"
@@ -141,7 +142,8 @@ void ScheduledAction::execute(WorkerContext* workerContext)
 {
     // In a Worker, the execution should always happen on a worker thread.
     ASSERT(workerContext->thread()->threadID() == currentThread());
-  
+
+    V8RecursionScope recursionScope(workerContext);
     WorkerScriptController* scriptController = workerContext->script();
 
     if (!m_function.IsEmpty() && m_function->IsFunction()) {
diff --git a/Source/WebCore/bindings/v8/ScriptEventListener.cpp b/Source/WebCore/bindings/v8/ScriptEventListener.cpp
index 34b028cbd..d5b50839a 100644
--- a/Source/WebCore/bindings/v8/ScriptEventListener.cpp
+++ b/Source/WebCore/bindings/v8/ScriptEventListener.cpp
@@ -42,6 +42,13 @@
 
 namespace WebCore {
 
+static const String& eventParameterName(bool isSVGEvent)
+{
+    DEFINE_STATIC_LOCAL(const String, eventString, ("event"));
+    DEFINE_STATIC_LOCAL(const String, evtString, ("evt"));
+    return isSVGEvent ? evtString : eventString;
+}
+
 PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node* node, Attribute* attr)
 {
     ASSERT(node);
@@ -57,12 +64,11 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Node* node, Attribu
         ScriptController* scriptController = frame->script();
         if (!scriptController->canExecuteScripts(AboutToExecuteScript))
             return 0;
-
         position = scriptController->eventHandlerPosition();
         sourceURL = node->document()->url().string();
     }
 
-    return V8LazyEventListener::create(attr->localName().string(), node->isSVGElement(), attr->value(), sourceURL, position, WorldContextHandle(UseMainWorld));
+    return V8LazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), sourceURL, position, node, WorldContextHandle(UseMainWorld));
 }
 
 PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
@@ -80,7 +86,8 @@ PassRefPtr<V8LazyEventListener> createAttributeEventListener(Frame* frame, Attri
 
     TextPosition position = scriptController->eventHandlerPosition();
     String sourceURL = frame->document()->url().string();
-    return V8LazyEventListener::create(attr->localName().string(), frame->document()->isSVGDocument(), attr->value(), sourceURL, position, WorldContextHandle(UseMainWorld));
+
+    return V8LazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), sourceURL, position, 0, WorldContextHandle(UseMainWorld));
 }
 
 String eventListenerHandlerBody(Document* document, EventListener* listener)
diff --git a/Source/WebCore/bindings/v8/ScriptGCEvent.cpp b/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
index 04c5e0f4f..539eae6d1 100644
--- a/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
+++ b/Source/WebCore/bindings/v8/ScriptGCEvent.cpp
@@ -90,13 +90,13 @@ size_t ScriptGCEvent::getUsedHeapSize()
 
 void ScriptGCEvent::gcPrologueCallback(v8::GCType type, v8::GCCallbackFlags flags)
 {
-    s_startTime = WTF::currentTimeMS();
+    s_startTime = WTF::monotonicallyIncreasingTime();
     s_usedHeapSize = getUsedHeapSize();
 }
 
 void ScriptGCEvent::gcEpilogueCallback(v8::GCType type, v8::GCCallbackFlags flags)
 {
-    double endTime = WTF::currentTimeMS();
+    double endTime = WTF::monotonicallyIncreasingTime();
     size_t collectedBytes = s_usedHeapSize - getUsedHeapSize();
     GCEventListeners listeners(eventListeners());
     for (GCEventListeners::iterator i = listeners.begin(); i != listeners.end(); ++i)
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.cpp b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
index a7f65faf2..567693742 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.cpp
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.cpp
@@ -49,6 +49,18 @@ void ScriptProfiler::start(ScriptState* state, const String& title)
     v8::CpuProfiler::StartProfiling(v8String(title));
 }
 
+void ScriptProfiler::startForPage(Page*, const String& title)
+{
+    return start(0, title);
+}
+
+#if ENABLE(WORKERS)
+void ScriptProfiler::startForWorkerContext(WorkerContext*, const String& title)
+{
+    return start(0, title);
+}
+#endif
+
 PassRefPtr<ScriptProfile> ScriptProfiler::stop(ScriptState* state, const String& title)
 {
     v8::HandleScope hs;
@@ -58,6 +70,20 @@ PassRefPtr<ScriptProfile> ScriptProfiler::stop(ScriptState* state, const String&
     return profile ? ScriptProfile::create(profile) : 0;
 }
 
+PassRefPtr<ScriptProfile> ScriptProfiler::stopForPage(Page*, const String& title)
+{
+    // Use null script state to avoid filtering by context security token.
+    // All functions from all iframes should be visible from Inspector UI.
+    return stop(0, title);
+}
+
+#if ENABLE(WORKERS)
+PassRefPtr<ScriptProfile> ScriptProfiler::stopForWorkerContext(WorkerContext*, const String& title)
+{
+    return stop(0, title);
+}
+#endif
+
 void ScriptProfiler::collectGarbage()
 {
     v8::V8::LowMemoryNotification();
diff --git a/Source/WebCore/bindings/v8/ScriptProfiler.h b/Source/WebCore/bindings/v8/ScriptProfiler.h
index 8e8a16144..5d3b968a2 100644
--- a/Source/WebCore/bindings/v8/ScriptProfiler.h
+++ b/Source/WebCore/bindings/v8/ScriptProfiler.h
@@ -41,7 +41,9 @@
 namespace WebCore {
 
 class DOMWrapperVisitor;
+class Page;
 class ScriptObject;
+class WorkerContext;
 
 class ScriptProfiler {
     WTF_MAKE_NONCOPYABLE(ScriptProfiler);
@@ -58,7 +60,15 @@ public:
     static void collectGarbage();
     static ScriptObject objectByHeapObjectId(unsigned id);
     static void start(ScriptState* state, const String& title);
+    static void startForPage(Page*, const String& title);
+#if ENABLE(WORKERS)
+    static void startForWorkerContext(WorkerContext*, const String& title);
+#endif
     static PassRefPtr<ScriptProfile> stop(ScriptState* state, const String& title);
+    static PassRefPtr<ScriptProfile> stopForPage(Page*, const String& title);
+#if ENABLE(WORKERS)
+    static PassRefPtr<ScriptProfile> stopForWorkerContext(WorkerContext*, const String& title);
+#endif
     static PassRefPtr<ScriptHeapSnapshot> takeHeapSnapshot(const String& title, HeapSnapshotProgress*);
     static bool causesRecompilation() { return false; }
     static bool isSampling() { return true; }
diff --git a/Source/WebCore/bindings/v8/ScriptState.cpp b/Source/WebCore/bindings/v8/ScriptState.cpp
index b03f160fb..c19fb9892 100644
--- a/Source/WebCore/bindings/v8/ScriptState.cpp
+++ b/Source/WebCore/bindings/v8/ScriptState.cpp
@@ -37,7 +37,7 @@
 #include "ScriptController.h"
 #include "V8DOMWindow.h"
 #include "V8HiddenPropertyName.h"
-
+#include "V8WorkerContext.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
 #include "WorkerScriptController.h"
@@ -68,6 +68,22 @@ DOMWindow* ScriptState::domWindow() const
     return V8DOMWindow::toNative(v8RealGlobal);
 }
 
+ScriptExecutionContext* ScriptState::scriptExecutionContext() const
+{
+    v8::HandleScope handleScope;
+
+    v8::Handle<v8::Object> global = m_context->Global();
+    v8::Handle<v8::Object> v8RealGlobal = v8::Handle<v8::Object>::Cast(global->GetPrototype());
+    if (V8DOMWrapper::isWrapperOfType(v8RealGlobal, &V8DOMWindow::info))
+        return V8DOMWindow::toNative(v8RealGlobal)->scriptExecutionContext();
+#if ENABLE(WORKERS)
+    global = V8DOMWrapper::lookupDOMWrapper(V8WorkerContext::GetTemplate(), global);
+    if (!global.IsEmpty())
+        return V8WorkerContext::toNative(global)->scriptExecutionContext();
+#endif
+    return 0;
+}
+
 ScriptState* ScriptState::forContext(v8::Local<v8::Context> context)
 {
     v8::Context::Scope contextScope(context);
@@ -109,6 +125,11 @@ DOMWindow* domWindowFromScriptState(ScriptState* scriptState)
     return scriptState->domWindow();
 }
 
+ScriptExecutionContext* scriptExecutionContextFromScriptState(ScriptState* scriptState)
+{
+    return scriptState->scriptExecutionContext();
+}
+
 bool evalEnabled(ScriptState* scriptState)
 {
     v8::HandleScope handleScope;
diff --git a/Source/WebCore/bindings/v8/ScriptState.h b/Source/WebCore/bindings/v8/ScriptState.h
index e338c3f65..009886a17 100644
--- a/Source/WebCore/bindings/v8/ScriptState.h
+++ b/Source/WebCore/bindings/v8/ScriptState.h
@@ -42,6 +42,7 @@ class DOMWrapperWorld;
 class Frame;
 class Node;
 class Page;
+class ScriptExecutionContext;
 class WorkerContext;
 
 class ScriptState {
@@ -60,6 +61,7 @@ public:
     }
 
     DOMWindow* domWindow() const;
+    ScriptExecutionContext* scriptExecutionContext() const;
 
     static ScriptState* forContext(v8::Local<v8::Context>);
     static ScriptState* current();
@@ -108,6 +110,7 @@ private:
 };
 
 DOMWindow* domWindowFromScriptState(ScriptState*);
+ScriptExecutionContext* scriptExecutionContextFromScriptState(ScriptState*);
 
 bool evalEnabled(ScriptState*);
 void setEvalEnabled(ScriptState*, bool);
diff --git a/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp b/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
index 9c56440c4..17a0379ef 100644
--- a/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8AbstractEventListener.cpp
@@ -34,6 +34,7 @@
 #include "DateExtension.h"
 #include "Document.h"
 #include "Event.h"
+#include "EventNames.h"
 #include "Frame.h"
 #include "InspectorCounters.h"
 #include "V8Binding.h"
@@ -58,7 +59,9 @@ V8AbstractEventListener::V8AbstractEventListener(bool isAttribute, const WorldCo
     , m_isAttribute(isAttribute)
     , m_worldContext(worldContext)
 {
-    InspectorCounters::incrementCounter(InspectorCounters::JSEventListenerCounter);
+#if ENABLE(INSPECTOR)
+    ThreadLocalInspectorCounters::current().incrementCounter(ThreadLocalInspectorCounters::JSEventListenerCounter);
+#endif
 }
 
 V8AbstractEventListener::~V8AbstractEventListener()
@@ -69,7 +72,9 @@ V8AbstractEventListener::~V8AbstractEventListener()
         V8EventListenerList::clearWrapper(listener, m_isAttribute);
     }
     disposeListenerObject();
-    InspectorCounters::decrementCounter(InspectorCounters::JSEventListenerCounter);
+#if ENABLE(INSPECTOR)
+    ThreadLocalInspectorCounters::current().decrementCounter(ThreadLocalInspectorCounters::JSEventListenerCounter);
+#endif
 }
 
 void V8AbstractEventListener::handleEvent(ScriptExecutionContext* context, Event* event)
@@ -136,7 +141,7 @@ void V8AbstractEventListener::invokeEventHandler(ScriptExecutionContext* context
     v8::Local<v8::Value> returnValue;
 
     // In beforeunload/unload handlers, we want to avoid sleeps which do tight loops of calling Date.getTime().
-    if (event->type() == "beforeunload" || event->type() == "unload")
+    if (event->type() == eventNames().beforeunloadEvent || event->type() == eventNames().unloadEvent)
         DateExtension::get()->setAllowSleep(false);
 
     {
@@ -173,7 +178,7 @@ void V8AbstractEventListener::invokeEventHandler(ScriptExecutionContext* context
         tryCatch.Reset();
     }
 
-    if (event->type() == "beforeunload" || event->type() == "unload")
+    if (event->type() == eventNames().beforeunloadEvent || event->type() == eventNames().unloadEvent)
         DateExtension::get()->setAllowSleep(true);
 
     ASSERT(!V8Proxy::handleOutOfMemory() || returnValue.IsEmpty());
diff --git a/Source/WebCore/bindings/v8/V8Binding.cpp b/Source/WebCore/bindings/v8/V8Binding.cpp
index 4fd672f45..2ae94e4c1 100644
--- a/Source/WebCore/bindings/v8/V8Binding.cpp
+++ b/Source/WebCore/bindings/v8/V8Binding.cpp
@@ -210,7 +210,7 @@ int toInt32(v8::Handle<v8::Value> value, bool& ok)
 {
     ok = true;
     
-    // Fast case.  The value is already a 32-bit integer.
+    // Fast case. The value is already a 32-bit integer.
     if (value->IsInt32())
         return value->Int32Value();
     
@@ -243,11 +243,10 @@ uint32_t toUInt32(v8::Handle<v8::Value> value, bool& ok)
 {
     ok = true;
 
-    // FIXME: there is currently no Value::IsUint32(). This code does
-    // some contortions to avoid silently converting out-of-range
-    // values to uint32_t.
+    // Fast case. The value is already a 32-bit unsigned integer.
+    if (value->IsUint32())
+        return value->Uint32Value();
 
-    // Fast case.  The value is already a 32-bit positive integer.
     if (value->IsInt32()) {
         int32_t result = value->Int32Value();
         if (result >= 0)
@@ -275,93 +274,7 @@ uint32_t toUInt32(v8::Handle<v8::Value> value, bool& ok)
         return 0;
     }
 
-    // FIXME: v8::Uint32::Value is not defined!
-    // http://code.google.com/p/v8/issues/detail?id=624
-    v8::Local<v8::Int32> intValue = value->ToInt32();
-    if (intValue.IsEmpty()) {
-        ok = false;
-        return 0;
-    }
-
-    return static_cast<uint32_t>(intValue->Value());
-}
-
-String toWebCoreString(const v8::Arguments& args, int index) {
-    return v8ValueToWebCoreString(args[index]);
-}
-
-    
-String toWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
-{
-    if (value->IsNull()) 
-        return String();
-    return v8ValueToWebCoreString(value);
-}
-
-AtomicString toAtomicWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
-{
-    if (value->IsNull())
-        return AtomicString();
-    return v8ValueToAtomicWebCoreString(value);
-}
-
-String toWebCoreStringWithNullOrUndefinedCheck(v8::Handle<v8::Value> value)
-{
-    if (value->IsNull() || value->IsUndefined())
-        return String();
-    return toWebCoreString(value);
-}
-
-bool isUndefinedOrNull(v8::Handle<v8::Value> value)
-{
-    return value->IsNull() || value->IsUndefined();
-}
-
-bool isHostObject(v8::Handle<v8::Object> object)
-{
-    // If the object has any internal fields, then we won't be able to serialize or deserialize
-    // them; conveniently, this is also a quick way to detect DOM wrapper objects, because
-    // the mechanism for these relies on data stored in these fields. We should
-    // catch external array data and external pixel data as a special case (noting that CanvasPixelArrays
-    // can't be serialized without being wrapped by ImageData according to the standard).
-    return object->InternalFieldCount() || object->HasIndexedPropertiesInPixelData() || object->HasIndexedPropertiesInExternalArrayData();
-}
-
-v8::Handle<v8::Boolean> v8Boolean(bool value)
-{
-    return value ? v8::True() : v8::False();
-}
-
-v8::Handle<v8::String> v8UndetectableString(const String& str)
-{
-    return v8::String::NewUndetectable(fromWebCoreString(str), str.length());
-}
-
-v8::Handle<v8::Value> v8StringOrNull(const String& str)
-{
-    return str.isNull() ? v8::Handle<v8::Value>(v8::Null()) : v8::Handle<v8::Value>(v8String(str));
-}
-
-v8::Handle<v8::Value> v8StringOrUndefined(const String& str)
-{
-    return str.isNull() ? v8::Handle<v8::Value>(v8::Undefined()) : v8::Handle<v8::Value>(v8String(str));
-}
-
-v8::Handle<v8::Value> v8StringOrFalse(const String& str)
-{
-    return str.isNull() ? v8::Handle<v8::Value>(v8::False()) : v8::Handle<v8::Value>(v8String(str));
-}
-
-double toWebCoreDate(v8::Handle<v8::Value> object)
-{
-    return (object->IsDate() || object->IsNumber()) ? object->NumberValue() : std::numeric_limits<double>::quiet_NaN();
-}
-
-v8::Handle<v8::Value> v8DateOrNull(double value)
-{
-    if (isfinite(value))
-        return v8::Date::New(value);
-    return v8::Null();
+    return uintValue->Value();
 }
 
 template <class S> struct StringTraits
diff --git a/Source/WebCore/bindings/v8/V8Binding.h b/Source/WebCore/bindings/v8/V8Binding.h
index 0bb5e936b..d0092f980 100644
--- a/Source/WebCore/bindings/v8/V8Binding.h
+++ b/Source/WebCore/bindings/v8/V8Binding.h
@@ -129,6 +129,7 @@ namespace WebCore {
         DOMDataList& allStores() { return m_domDataList; }
 
         V8HiddenPropertyName* hiddenPropertyName() { return &m_hiddenPropertyName; }
+        v8::Persistent<v8::Context>& auxiliaryContext() { return m_auxiliaryContext; }
 
         void registerDOMDataStore(DOMDataStore* domDataStore) 
         {
@@ -169,6 +170,7 @@ namespace WebCore {
         DOMDataStore* m_domDataStore;
 
         V8HiddenPropertyName m_hiddenPropertyName;
+        v8::Persistent<v8::Context> m_auxiliaryContext;
 
         bool m_constructorMode;
         friend class ConstructorMode;
@@ -327,7 +329,10 @@ namespace WebCore {
         return v8ValueToWebCoreString(object);
     }
 
-    String toWebCoreString(const v8::Arguments&, int index);
+    inline String toWebCoreString(const v8::Arguments& args, int index)
+    {
+        return v8ValueToWebCoreString(args[index]);
+    }
 
     // The string returned by this function is still owned by the argument
     // and will be deallocated when the argument is deallocated.
@@ -336,27 +341,62 @@ namespace WebCore {
         return reinterpret_cast<const uint16_t*>(str.characters());
     }
 
-    bool isUndefinedOrNull(v8::Handle<v8::Value> value);
+    inline bool isUndefinedOrNull(v8::Handle<v8::Value> value)
+    {
+        return value->IsNull() || value->IsUndefined();
+    }
 
     // Returns true if the provided object is to be considered a 'host object', as used in the
     // HTML5 structured clone algorithm.
-    bool isHostObject(v8::Handle<v8::Object>);
+    inline bool isHostObject(v8::Handle<v8::Object> object)
+    {
+        // If the object has any internal fields, then we won't be able to serialize or deserialize
+        // them; conveniently, this is also a quick way to detect DOM wrapper objects, because
+        // the mechanism for these relies on data stored in these fields. We should
+        // catch external array data and external pixel data as a special case (noting that CanvasPixelArrays
+        // can't be serialized without being wrapped by ImageData according to the standard).
+        return object->InternalFieldCount() || object->HasIndexedPropertiesInPixelData() || object->HasIndexedPropertiesInExternalArrayData();
+    }
 
-    v8::Handle<v8::Boolean> v8Boolean(bool value);
+    inline v8::Handle<v8::Boolean> v8Boolean(bool value)
+    {
+        return value ? v8::True() : v8::False();
+    }
 
-    String toWebCoreStringWithNullCheck(v8::Handle<v8::Value> value);
+    inline String toWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
+    {
+        return value->IsNull() ? String() : v8ValueToWebCoreString(value);
+    }
 
-    AtomicString toAtomicWebCoreStringWithNullCheck(v8::Handle<v8::Value> value);
+    inline AtomicString toAtomicWebCoreStringWithNullCheck(v8::Handle<v8::Value> value)
+    {
+        return value->IsNull() ? AtomicString() : v8ValueToAtomicWebCoreString(value);
+    }
 
-    String toWebCoreStringWithNullOrUndefinedCheck(v8::Handle<v8::Value> value);
+    inline String toWebCoreStringWithNullOrUndefinedCheck(v8::Handle<v8::Value> value)
+    {
+        return (value->IsNull() || value->IsUndefined()) ? String() : toWebCoreString(value);
+    }
 
-    v8::Handle<v8::String> v8UndetectableString(const String& str);
+    inline v8::Handle<v8::String> v8UndetectableString(const String& str)
+    {
+        return v8::String::NewUndetectable(fromWebCoreString(str), str.length());
+    }
 
-    v8::Handle<v8::Value> v8StringOrNull(const String& str);
+    inline v8::Handle<v8::Value> v8StringOrNull(const String& str)
+    {
+        return str.isNull() ? v8::Handle<v8::Value>(v8::Null()) : v8::Handle<v8::Value>(v8String(str));
+    }
 
-    v8::Handle<v8::Value> v8StringOrUndefined(const String& str);
+    inline v8::Handle<v8::Value> v8StringOrUndefined(const String& str)
+    {
+        return str.isNull() ? v8::Handle<v8::Value>(v8::Undefined()) : v8::Handle<v8::Value>(v8String(str));
+    }
 
-    v8::Handle<v8::Value> v8StringOrFalse(const String& str);
+    inline v8::Handle<v8::Value> v8StringOrFalse(const String& str)
+    {
+        return str.isNull() ? v8::Handle<v8::Value>(v8::False()) : v8::Handle<v8::Value>(v8String(str));
+    }
 
     template <class T> v8::Handle<v8::Value> v8NumberArray(const Vector<T>& values)
     {
@@ -367,9 +407,15 @@ namespace WebCore {
         return result;
     }
 
-    double toWebCoreDate(v8::Handle<v8::Value> object);
+    inline double toWebCoreDate(v8::Handle<v8::Value> object)
+    {
+        return (object->IsDate() || object->IsNumber()) ? object->NumberValue() : std::numeric_limits<double>::quiet_NaN();
+    }
 
-    v8::Handle<v8::Value> v8DateOrNull(double value);
+    inline v8::Handle<v8::Value> v8DateOrNull(double value)
+    {
+        return isfinite(value) ? v8::Date::New(value) : v8::Handle<v8::Value>(v8::Null());
+    }
 
     v8::Persistent<v8::FunctionTemplate> createRawTemplate();
 
diff --git a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
index 8d16a1037..8c02201f7 100644
--- a/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
+++ b/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp
@@ -339,7 +339,7 @@ bool V8DOMWindowShell::initContextIfNeeded()
 
     setSecurityToken();
 
-    m_frame->loader()->client()->didCreateScriptContext(m_context, 0);
+    m_frame->loader()->client()->didCreateScriptContext(m_context, 0, 0);
 
     // FIXME: This is wrong. We should actually do this for the proper world once
     // we do isolated worlds the WebCore way.
diff --git a/Source/WebCore/bindings/v8/V8GCController.cpp b/Source/WebCore/bindings/v8/V8GCController.cpp
index 826eb3a94..540312432 100644
--- a/Source/WebCore/bindings/v8/V8GCController.cpp
+++ b/Source/WebCore/bindings/v8/V8GCController.cpp
@@ -210,7 +210,7 @@ public:
 
     virtual intptr_t GetHash()
     {
-        return reinterpret_cast<intptr_t>(m_object);
+        return PtrHash<void*>::hash(m_object);
     }
     
     virtual const char* GetLabel()
diff --git a/Source/WebCore/bindings/v8/V8HiddenPropertyName.cpp b/Source/WebCore/bindings/v8/V8HiddenPropertyName.cpp
index 93ac75178..901fa5e44 100644
--- a/Source/WebCore/bindings/v8/V8HiddenPropertyName.cpp
+++ b/Source/WebCore/bindings/v8/V8HiddenPropertyName.cpp
@@ -33,6 +33,7 @@
 
 #include "V8Binding.h"
 #include <string.h>
+#include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -40,24 +41,24 @@ namespace WebCore {
 #define V8_AS_STRING(x) V8_AS_STRING_IMPL(x)
 #define V8_AS_STRING_IMPL(x) #x
 
-#define V8_DEFINE_PROPERTY(name) \
+#define V8_HIDDEN_PROPERTY_PREFIX "WebCore::HiddenProperty::"
+
+#define V8_DEFINE_HIDDEN_PROPERTY(name) \
 v8::Handle<v8::String> V8HiddenPropertyName::name() \
 { \
     V8HiddenPropertyName* hiddenPropertyName = V8BindingPerIsolateData::current()->hiddenPropertyName(); \
     if (hiddenPropertyName->m_##name.IsEmpty()) { \
-        hiddenPropertyName->m_##name = createString("WebCore::HiddenProperty::" V8_AS_STRING(name)); \
+        hiddenPropertyName->m_##name = createString(V8_HIDDEN_PROPERTY_PREFIX V8_AS_STRING(name)); \
     } \
     return hiddenPropertyName->m_##name; \
 }
 
-V8_HIDDEN_PROPERTIES(V8_DEFINE_PROPERTY);
-
-static const char hiddenReferenceNamePrefix[] = "WebCore::HiddenReference::";
+V8_HIDDEN_PROPERTIES(V8_DEFINE_HIDDEN_PROPERTY);
 
 v8::Handle<v8::String> V8HiddenPropertyName::hiddenReferenceName(const char* name)
 {
     Vector<char, 64> prefixedName;
-    prefixedName.append(hiddenReferenceNamePrefix, sizeof(hiddenReferenceNamePrefix) - 1);
+    prefixedName.append(V8_HIDDEN_PROPERTY_PREFIX, sizeof(V8_HIDDEN_PROPERTY_PREFIX) - 1);
     ASSERT(name && strlen(name));
     prefixedName.append(name, strlen(name));
     return v8::String::NewSymbol(prefixedName.data(), static_cast<int>(prefixedName.size()));
diff --git a/Source/WebCore/bindings/v8/V8HiddenPropertyName.h b/Source/WebCore/bindings/v8/V8HiddenPropertyName.h
index c8f53527f..ef025d39f 100644
--- a/Source/WebCore/bindings/v8/V8HiddenPropertyName.h
+++ b/Source/WebCore/bindings/v8/V8HiddenPropertyName.h
@@ -44,8 +44,10 @@ namespace WebCore {
     V(sleepFunction) \
     V(toStringString) \
     V(event) \
-    V(state)
-
+    V(state) \
+    V(domStringMap) \
+    V(domTokenList) \
+    V(ownerNode)
 
     class V8HiddenPropertyName {
     public:
diff --git a/Source/WebCore/bindings/v8/V8IsolatedContext.cpp b/Source/WebCore/bindings/v8/V8IsolatedContext.cpp
index 9e57dd5b6..ba7505cf9 100644
--- a/Source/WebCore/bindings/v8/V8IsolatedContext.cpp
+++ b/Source/WebCore/bindings/v8/V8IsolatedContext.cpp
@@ -75,7 +75,7 @@ V8IsolatedContext::V8IsolatedContext(V8Proxy* proxy, int extensionGroup, int wor
     //        changes.
     m_context->get()->UseDefaultSecurityToken();
 
-    m_frame->loader()->client()->didCreateScriptContext(context(), m_world->id());
+    m_frame->loader()->client()->didCreateScriptContext(context(), extensionGroup, m_world->id());
 }
 
 void V8IsolatedContext::destroy()
diff --git a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp b/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
index 9775d32a2..d2eaef1e5 100644
--- a/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8LazyEventListener.cpp
@@ -32,9 +32,17 @@
 #include "V8LazyEventListener.h"
 
 #include "ContentSecurityPolicy.h"
+#include "Document.h"
 #include "Frame.h"
+#include "HTMLElement.h"
+#include "HTMLFormElement.h"
+#include "Node.h"
 #include "V8Binding.h"
+#include "V8DOMWrapper.h"
+#include "V8Document.h"
+#include "V8HTMLFormElement.h"
 #include "V8HiddenPropertyName.h"
+#include "V8Node.h"
 #include "V8Proxy.h"
 #include "WorldContextHandle.h"
 
@@ -42,14 +50,29 @@
 
 namespace WebCore {
 
-V8LazyEventListener::V8LazyEventListener(const String& functionName, bool isSVGEvent, const String& code, const String sourceURL, const TextPosition& position, const WorldContextHandle& worldContext)
+V8LazyEventListener::V8LazyEventListener(const AtomicString& functionName, const AtomicString& eventParameterName, const String& code, const String sourceURL, const TextPosition& position, PassRefPtr<Node> node, const WorldContextHandle& worldContext)
     : V8AbstractEventListener(true, worldContext)
     , m_functionName(functionName)
-    , m_isSVGEvent(isSVGEvent)
+    , m_eventParameterName(eventParameterName)
     , m_code(code)
     , m_sourceURL(sourceURL)
+    , m_node(node)
+    , m_formElement(0)
     , m_position(position)
 {
+    if (m_node && m_node->isHTMLElement())
+        m_formElement = static_cast<HTMLElement*>(m_node.get())->form();
+}
+
+template<typename T>
+v8::Handle<v8::Object> toObjectWrapper(T* domObject)
+{
+    if (!domObject)
+        return v8::Object::New();
+    v8::Handle<v8::Value> value = toV8(domObject);
+    if (value.IsEmpty())
+        return v8::Object::New();
+    return value.As<v8::Object>();
 }
 
 v8::Local<v8::Value> V8LazyEventListener::callListenerFunction(ScriptExecutionContext* context, v8::Handle<v8::Value> jsEvent, Event* event)
@@ -58,7 +81,7 @@ v8::Local<v8::Value> V8LazyEventListener::callListenerFunction(ScriptExecutionCo
     if (listenerObject.IsEmpty())
         return v8::Local<v8::Value>();
 
-    v8::Local<v8::Function> handlerFunction = v8::Local<v8::Function>::Cast(listenerObject);
+    v8::Local<v8::Function> handlerFunction = listenerObject.As<v8::Function>();
     v8::Local<v8::Object> receiver = getReceiverObject(event);
     if (handlerFunction.IsEmpty() || receiver.IsEmpty())
         return v8::Local<v8::Value>();
@@ -104,8 +127,6 @@ void V8LazyEventListener::prepareListenerObject(ScriptExecutionContext* context)
 
     v8::Context::Scope scope(v8Context);
 
-    // FIXME: cache the wrapper function.
-
     // Nodes other than the document object, when executing inline event
     // handlers push document, form, and the target node on the scope chain.
     // We do this by using 'with' statement.
@@ -115,60 +136,81 @@ void V8LazyEventListener::prepareListenerObject(ScriptExecutionContext* context)
     //
     // Don't use new lines so that lines in the modified handler
     // have the same numbers as in the original code.
-    // FIXME: What about m_eventParameterName from JSLazyEventListener?
-    // FIXME: This approach is a giant hack! What if m_code escapes to run
-    //        arbitrary script?
-    String code = "(function (evt) {" \
-            "with (this.ownerDocument ? this.ownerDocument : {}) {" \
-            "with (this.form ? this.form : {}) {" \
-            "with (this) {" \
-            "return (function(evt){";
+    // FIXME: V8 does not allow us to programmatically create object environments so
+    //        we have to do this hack! What if m_code escapes to run arbitrary script?
+    //
+    String code = "(function() {" \
+        "with (arguments[2]) {" \
+        "with (arguments[1]) {" \
+        "with (arguments[0]) {";
+    code.append("return function(");
+    code.append(m_eventParameterName);
+    code.append(") {");
     code.append(m_code);
     // Insert '\n' otherwise //-style comments could break the handler.
-    code.append(  "\n}).call(this, evt);}}}})");
+    code.append("\n};}}}})");
     v8::Handle<v8::String> codeExternalString = v8ExternalString(code);
+
     v8::Handle<v8::Script> script = V8Proxy::compileScript(codeExternalString, m_sourceURL, m_position);
-    if (!script.IsEmpty()) {
-        // Call v8::Script::Run() directly to avoid an erroneous call to V8RecursionScope::didLeaveScriptContext().
-        // FIXME: Remove this code when we stop doing the 'with' hack above.
-        v8::Local<v8::Value> value = script->Run();
-        if (!value.IsEmpty()) {
-            ASSERT(value->IsFunction());
-
-            v8::Local<v8::Function> wrappedFunction = v8::Local<v8::Function>::Cast(value);
-
-            // Change the toString function on the wrapper function to avoid it
-            // returning the source for the actual wrapper function. Instead it
-            // returns source for a clean wrapper function with the event
-            // argument wrapping the event source code. The reason for this is
-            // that some web sites use toString on event functions and eval the
-            // source returned (sometimes a RegExp is applied as well) for some
-            // other use. That fails miserably if the actual wrapper source is
-            // returned.
-            v8::Persistent<v8::FunctionTemplate>& toStringTemplate =
-                V8BindingPerIsolateData::current()->lazyEventListenerToStringTemplate();
-            if (toStringTemplate.IsEmpty())
-                toStringTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8LazyEventListenerToString));
-            v8::Local<v8::Function> toStringFunction;
-            if (!toStringTemplate.IsEmpty())
-                toStringFunction = toStringTemplate->GetFunction();
-            if (!toStringFunction.IsEmpty()) {
-                String toStringResult = "function ";
-                toStringResult.append(m_functionName);
-                toStringResult.append("(");
-                toStringResult.append(m_isSVGEvent ? "evt" : "event");
-                toStringResult.append(") {\n  ");
-                toStringResult.append(m_code);
-                toStringResult.append("\n}");
-                wrappedFunction->SetHiddenValue(V8HiddenPropertyName::toStringString(), v8ExternalString(toStringResult));
-                wrappedFunction->Set(v8::String::New("toString"), toStringFunction);
-            }
-
-            wrappedFunction->SetName(v8::String::New(fromWebCoreString(m_functionName), m_functionName.length()));
-
-            setListenerObject(wrappedFunction);
-        }
+    if (script.IsEmpty())
+        return;
+
+    // Call v8::Script::Run() directly to avoid an erroneous call to V8RecursionScope::didLeaveScriptContext().
+    // FIXME: Remove this code when we stop doing the 'with' hack above.
+    v8::Local<v8::Value> value = script->Run();
+    if (value.IsEmpty())
+        return;
+
+    // Call the outer function to get the inner function.
+    ASSERT(value->IsFunction());
+    v8::Local<v8::Function> intermediateFunction = value.As<v8::Function>();
+
+    v8::Handle<v8::Object> nodeWrapper = toObjectWrapper<Node>(m_node.get());
+    v8::Handle<v8::Object> formWrapper = toObjectWrapper<HTMLFormElement>(m_formElement.get());
+    v8::Handle<v8::Object> documentWrapper = toObjectWrapper<Document>(m_node ? m_node->ownerDocument() : 0);
+
+    m_node.clear();
+    m_formElement.clear();
+
+    v8::Handle<v8::Value> parameters[3] = { nodeWrapper, formWrapper, documentWrapper };
+
+    // Use Call directly to avoid an erroneous call to V8RecursionScope::didLeaveScriptContext().
+    // FIXME: Remove this code when we stop doing the 'with' hack above.
+    v8::Local<v8::Value> innerValue = intermediateFunction->Call(v8Context->Global(), 3, parameters);
+
+    ASSERT(innerValue->IsFunction());
+    v8::Local<v8::Function> wrappedFunction = innerValue.As<v8::Function>();
+
+    // Change the toString function on the wrapper function to avoid it
+    // returning the source for the actual wrapper function. Instead it
+    // returns source for a clean wrapper function with the event
+    // argument wrapping the event source code. The reason for this is
+    // that some web sites use toString on event functions and eval the
+    // source returned (sometimes a RegExp is applied as well) for some
+    // other use. That fails miserably if the actual wrapper source is
+    // returned.
+    v8::Persistent<v8::FunctionTemplate>& toStringTemplate =
+        V8BindingPerIsolateData::current()->lazyEventListenerToStringTemplate();
+    if (toStringTemplate.IsEmpty())
+        toStringTemplate = v8::Persistent<v8::FunctionTemplate>::New(v8::FunctionTemplate::New(V8LazyEventListenerToString));
+    v8::Local<v8::Function> toStringFunction;
+    if (!toStringTemplate.IsEmpty())
+        toStringFunction = toStringTemplate->GetFunction();
+    if (!toStringFunction.IsEmpty()) {
+        String toStringResult = "function ";
+        toStringResult.append(m_functionName);
+        toStringResult.append("(");
+        toStringResult.append(m_eventParameterName);
+        toStringResult.append(") {\n  ");
+        toStringResult.append(m_code);
+        toStringResult.append("\n}");
+        wrappedFunction->SetHiddenValue(V8HiddenPropertyName::toStringString(), v8ExternalString(toStringResult));
+        wrappedFunction->Set(v8::String::New("toString"), toStringFunction);
     }
+
+    wrappedFunction->SetName(v8::String::New(fromWebCoreString(m_functionName), m_functionName.length()));
+
+    setListenerObject(wrappedFunction);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/V8LazyEventListener.h b/Source/WebCore/bindings/v8/V8LazyEventListener.h
index 4d364888a..1fb565add 100644
--- a/Source/WebCore/bindings/v8/V8LazyEventListener.h
+++ b/Source/WebCore/bindings/v8/V8LazyEventListener.h
@@ -41,14 +41,16 @@ namespace WebCore {
 
     class Event;
     class Frame;
+    class HTMLFormElement;
+    class Node;
 
     // V8LazyEventListener is a wrapper for a JavaScript code string that is compiled and evaluated when an event is fired.
-    // A V8LazyEventListener is always a HTML event handler.
+    // A V8LazyEventListener is either a HTML or SVG event handler.
     class V8LazyEventListener : public V8AbstractEventListener {
     public:
-        static PassRefPtr<V8LazyEventListener> create(const String& functionName, bool isSVGEvent, const String& code, const String& sourceURL, const TextPosition& position, const WorldContextHandle& worldContext)
+        static PassRefPtr<V8LazyEventListener> create(const AtomicString& functionName, const AtomicString& eventParameterName, const String& code, const String& sourceURL, const TextPosition& position, PassRefPtr<Node> node, const WorldContextHandle& worldContext)
         {
-            return adoptRef(new V8LazyEventListener(functionName, isSVGEvent, code, sourceURL, position, worldContext));
+            return adoptRef(new V8LazyEventListener(functionName, eventParameterName, code, sourceURL, position, node, worldContext));
         }
 
         virtual bool isLazy() const { return true; }
@@ -57,7 +59,7 @@ namespace WebCore {
         virtual void prepareListenerObject(ScriptExecutionContext*);
 
     private:
-        V8LazyEventListener(const String& functionName, bool isSVGEvent, const String& code, const String sourceURL, const TextPosition&, const WorldContextHandle&);
+        V8LazyEventListener(const AtomicString& functionName, const AtomicString& eventParameterName, const String& code, const String sourceURL, const TextPosition&, PassRefPtr<Node>, const WorldContextHandle&);
 
         virtual v8::Local<v8::Value> callListenerFunction(ScriptExecutionContext*, v8::Handle<v8::Value> jsEvent, Event*);
 
@@ -67,10 +69,12 @@ namespace WebCore {
         // SVGUseElement::transferEventListenersToShadowTree
         virtual bool wasCreatedFromMarkup() const { return true; }
 
-        String m_functionName;
-        bool m_isSVGEvent;
+        AtomicString m_functionName;
+        AtomicString m_eventParameterName;
         String m_code;
         String m_sourceURL;
+        RefPtr<Node> m_node;
+        RefPtr<HTMLFormElement> m_formElement;
         TextPosition m_position;
     };
 
diff --git a/Source/WebCore/bindings/v8/V8Proxy.cpp b/Source/WebCore/bindings/v8/V8Proxy.cpp
index e3dc00b3f..d8a7d466f 100644
--- a/Source/WebCore/bindings/v8/V8Proxy.cpp
+++ b/Source/WebCore/bindings/v8/V8Proxy.cpp
@@ -414,8 +414,10 @@ v8::Local<v8::Value> V8Proxy::instrumentedCallFunction(Frame* frame, v8::Handle<
     if (V8RecursionScope::recursionLevel() >= kMaxRecursionDepth)
         return handleMaxRecursionDepthExceeded();
 
+    ScriptExecutionContext* context = frame ? frame->document() : 0;
+
     InspectorInstrumentationCookie cookie;
-    if (InspectorInstrumentation::hasFrontends() && frame) {
+    if (InspectorInstrumentation::hasFrontends() && context) {
         String resourceName("undefined");
         int lineNumber = 1;
         v8::ScriptOrigin origin = function->GetScriptOrigin();
@@ -423,7 +425,7 @@ v8::Local<v8::Value> V8Proxy::instrumentedCallFunction(Frame* frame, v8::Handle<
             resourceName = toWebCoreString(origin.ResourceName());
             lineNumber = function->GetScriptLineNumber() + 1;
         }
-        cookie = InspectorInstrumentation::willCallFunction(frame->page(), resourceName, lineNumber);
+        cookie = InspectorInstrumentation::willCallFunction(context, resourceName, lineNumber);
     }
 
     v8::Local<v8::Value> result;
@@ -431,7 +433,7 @@ v8::Local<v8::Value> V8Proxy::instrumentedCallFunction(Frame* frame, v8::Handle<
 #if PLATFORM(CHROMIUM)
         TRACE_EVENT0("v8", "v8.callFunction");
 #endif
-        V8RecursionScope recursionScope(frame ? frame->document() : 0);
+        V8RecursionScope recursionScope(context);
         result = function->Call(receiver, argc, args);
     }
 
diff --git a/Source/WebCore/bindings/v8/V8Utilities.cpp b/Source/WebCore/bindings/v8/V8Utilities.cpp
index a5cf6d93c..f30a47c53 100644
--- a/Source/WebCore/bindings/v8/V8Utilities.cpp
+++ b/Source/WebCore/bindings/v8/V8Utilities.cpp
@@ -53,18 +53,22 @@
 
 namespace WebCore {
 
-V8LocalContext::V8LocalContext()
-    : m_context(v8::Context::New())
+V8AuxiliaryContext::V8AuxiliaryContext()
 {
-    V8BindingPerIsolateData::ensureInitialized(v8::Isolate::GetCurrent());
-    m_context->Enter();
+    auxiliaryContext()->Enter();
 }
 
+V8AuxiliaryContext::~V8AuxiliaryContext()
+{
+    auxiliaryContext()->Exit();
+}
 
-V8LocalContext::~V8LocalContext()
+v8::Persistent<v8::Context>& V8AuxiliaryContext::auxiliaryContext()
 {
-    m_context->Exit();
-    m_context.Dispose();
+    v8::Persistent<v8::Context>& context = V8BindingPerIsolateData::current()->auxiliaryContext();
+    if (context.IsEmpty())
+        context = v8::Context::New();
+    return context;
 }
 
 // Use an array to hold dependents. It works like a ref-counted scheme.
diff --git a/Source/WebCore/bindings/v8/V8Utilities.h b/Source/WebCore/bindings/v8/V8Utilities.h
index 9956fa53e..bf7577534 100644
--- a/Source/WebCore/bindings/v8/V8Utilities.h
+++ b/Source/WebCore/bindings/v8/V8Utilities.h
@@ -70,13 +70,13 @@ namespace WebCore {
 
     typedef unsigned CallbackAllowedValueFlags;
 
-    class V8LocalContext {
+    class V8AuxiliaryContext {
     public:
-        V8LocalContext();
-        virtual ~V8LocalContext();
+        V8AuxiliaryContext();
+        virtual ~V8AuxiliaryContext();
     private:
         v8::HandleScope m_handleScope;
-        v8::Persistent<v8::Context> m_context;
+        static v8::Persistent<v8::Context>& auxiliaryContext();
     };
 
     typedef WTF::Vector<RefPtr<MessagePort>, 1> MessagePortArray;
diff --git a/Source/WebCore/bindings/v8/V8WorkerContextErrorHandler.cpp b/Source/WebCore/bindings/v8/V8WorkerContextErrorHandler.cpp
index d02278ed4..b9bdecd4b 100644
--- a/Source/WebCore/bindings/v8/V8WorkerContextErrorHandler.cpp
+++ b/Source/WebCore/bindings/v8/V8WorkerContextErrorHandler.cpp
@@ -37,6 +37,7 @@
 #include "EventNames.h"
 #include "ErrorEvent.h"
 #include "V8Binding.h"
+#include "V8RecursionScope.h"
 
 namespace WebCore {
 
@@ -55,6 +56,7 @@ v8::Local<v8::Value> V8WorkerContextErrorHandler::callListenerFunction(ScriptExe
         v8::Local<v8::Function> callFunction = v8::Local<v8::Function>::Cast(listener);
         v8::Local<v8::Object> thisValue = v8::Context::GetCurrent()->Global();
         v8::Handle<v8::Value> parameters[3] = { v8String(errorEvent->message()), v8String(errorEvent->filename()), v8::Integer::New(errorEvent->lineno()) };
+        V8RecursionScope recursionScope(context);
         returnValue = callFunction->Call(thisValue, 3, parameters);
     }
     return returnValue;
diff --git a/Source/WebCore/bindings/v8/V8WorkerContextEventListener.cpp b/Source/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
index 30b986586..0bc84d3c3 100644
--- a/Source/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
+++ b/Source/WebCore/bindings/v8/V8WorkerContextEventListener.cpp
@@ -34,9 +34,11 @@
 
 #include "V8WorkerContextEventListener.h"
 
+#include "InspectorInstrumentation.h"
 #include "V8Binding.h"
 #include "V8DOMWrapper.h"
 #include "V8Event.h"
+#include "V8RecursionScope.h"
 #include "WorkerContext.h"
 #include "WorkerContextExecutionProxy.h"
 
@@ -89,12 +91,27 @@ v8::Local<v8::Value> V8WorkerContextEventListener::callListenerFunction(ScriptEx
     if (handlerFunction.IsEmpty() || receiver.IsEmpty())
         return v8::Local<v8::Value>();
 
+    InspectorInstrumentationCookie cookie;
+    if (InspectorInstrumentation::hasFrontends()) {
+        String resourceName("undefined");
+        int lineNumber = 1;
+        v8::ScriptOrigin origin = handlerFunction->GetScriptOrigin();
+        if (!origin.ResourceName().IsEmpty()) {
+            resourceName = toWebCoreString(origin.ResourceName());
+            lineNumber = handlerFunction->GetScriptLineNumber() + 1;
+        }
+        cookie = InspectorInstrumentation::willCallFunction(context, resourceName, lineNumber);
+    }
+
     v8::Handle<v8::Value> parameters[1] = { jsEvent };
+    V8RecursionScope recursionScope(context);
     v8::Local<v8::Value> result = handlerFunction->Call(receiver, 1, parameters);
 
     if (WorkerContextExecutionProxy* proxy = workerProxy(context))
         proxy->trackEvent(event);
 
+    InspectorInstrumentation::didCallFunction(cookie);
+
     return result;
 }
 
diff --git a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
index d2840bd08..51be5ca83 100644
--- a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -44,6 +44,7 @@
 #include "V8DOMMap.h"
 #include "V8DedicatedWorkerContext.h"
 #include "V8Proxy.h"
+#include "V8RecursionScope.h"
 #include "V8SharedWorkerContext.h"
 #include "Worker.h"
 #include "WorkerContext.h"
@@ -81,7 +82,6 @@ static void v8MessageHandler(v8::Handle<v8::Message> message, v8::Handle<v8::Val
 
 WorkerContextExecutionProxy::WorkerContextExecutionProxy(WorkerContext* workerContext)
     : m_workerContext(workerContext)
-    , m_recursion(0)
 {
     initIsolate();
 }
@@ -234,7 +234,7 @@ v8::Local<v8::Value> WorkerContextExecutionProxy::runScript(v8::Handle<v8::Scrip
         return v8::Local<v8::Value>();
 
     // Compute the source string and prevent against infinite recursion.
-    if (m_recursion >= kMaxRecursionDepth) {
+    if (V8RecursionScope::recursionLevel() >= kMaxRecursionDepth) {
         v8::Local<v8::String> code = v8ExternalString("throw RangeError('Recursion too deep')");
         script = V8Proxy::compileScript(code, "", TextPosition::minimumPosition());
     }
@@ -248,9 +248,8 @@ v8::Local<v8::Value> WorkerContextExecutionProxy::runScript(v8::Handle<v8::Scrip
     // Run the script and keep track of the current recursion depth.
     v8::Local<v8::Value> result;
     {
-        m_recursion++;
+        V8RecursionScope recursionScope(m_workerContext);
         result = script->Run();
-        m_recursion--;
     }
 
     // Handle V8 internal error situation (Out-of-memory).
diff --git a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h
index 7d4d70ce6..e6c160544 100644
--- a/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h
+++ b/Source/WebCore/bindings/v8/WorkerContextExecutionProxy.h
@@ -86,7 +86,6 @@ namespace WebCore {
 
         WorkerContext* m_workerContext;
         v8::Persistent<v8::Context> m_context;
-        int m_recursion;
 
         Vector<Event*> m_events;
     };
diff --git a/Source/WebCore/bindings/v8/WorkerScriptController.cpp b/Source/WebCore/bindings/v8/WorkerScriptController.cpp
index 9c827c3e5..433c3288a 100644
--- a/Source/WebCore/bindings/v8/WorkerScriptController.cpp
+++ b/Source/WebCore/bindings/v8/WorkerScriptController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -53,6 +53,7 @@ WorkerScriptController::WorkerScriptController(WorkerContext* workerContext)
     : m_workerContext(workerContext)
     , m_isolate(v8::Isolate::New())
     , m_executionForbidden(false)
+    , m_executionScheduledToTerminate(false)
 {
     V8BindingPerIsolateData* data = V8BindingPerIsolateData::create(m_isolate);
     data->allStores().append(&m_DOMDataStore);
@@ -92,9 +93,23 @@ void WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode, Script
 
 void WorkerScriptController::scheduleExecutionTermination()
 {
+    // The mutex provides a memory barrier to ensure that once
+    // termination is scheduled, isExecutionTerminating will
+    // accurately reflect that state when called from another thread.
+    {
+        MutexLocker locker(m_scheduledTerminationMutex);
+        m_executionScheduledToTerminate = true;
+    }
     v8::V8::TerminateExecution(m_isolate);
 }
 
+bool WorkerScriptController::isExecutionTerminating() const
+{
+    // See comments in scheduleExecutionTermination regarding mutex usage.
+    MutexLocker locker(m_scheduledTerminationMutex);
+    return m_executionScheduledToTerminate;
+}
+
 void WorkerScriptController::forbidExecution()
 {
     ASSERT(m_workerContext->isContextThread());
diff --git a/Source/WebCore/bindings/v8/WorkerScriptController.h b/Source/WebCore/bindings/v8/WorkerScriptController.h
index b581e4143..5f6f3eeb1 100644
--- a/Source/WebCore/bindings/v8/WorkerScriptController.h
+++ b/Source/WebCore/bindings/v8/WorkerScriptController.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2009, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -66,6 +66,7 @@ namespace WebCore {
         // forbidExecution()/isExecutionForbidden() to guard against reentry into JS.
         // Can be called from any thread.
         void scheduleExecutionTermination();
+        bool isExecutionTerminating() const;
 
         // Called on Worker thread when JS exits with termination exception caused by forbidExecution() request,
         // or by Worker thread termination code to prevent future entry into JS.
@@ -83,6 +84,8 @@ namespace WebCore {
         v8::Isolate* m_isolate;
         ScopedDOMDataStore m_DOMDataStore;
         bool m_executionForbidden;
+        bool m_executionScheduledToTerminate;
+        mutable Mutex m_scheduledTerminationMutex;
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp b/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
index 51d6f2c72..b33661064 100644
--- a/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8ClipboardCustom.cpp
@@ -44,6 +44,24 @@
 
 namespace WebCore {
 
+v8::Handle<v8::Value> V8Clipboard::typesAccessorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info)
+{
+    INC_STATS("DOM.Clipboard.types()");
+    Clipboard* clipboard = V8Clipboard::toNative(info.Holder());
+
+    HashSet<String> types = clipboard->types();
+    if (types.isEmpty())
+        return v8::Null();
+
+    v8::Local<v8::Array> result = v8::Array::New(types.size());
+    HashSet<String>::const_iterator end = types.end();
+    int index = 0;
+    for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it, ++index)
+        result->Set(v8::Integer::New(index), v8String(*it));
+
+    return result;
+}
+
 v8::Handle<v8::Value> V8Clipboard::clearDataCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.Clipboard.clearData()");
@@ -62,22 +80,6 @@ v8::Handle<v8::Value> V8Clipboard::clearDataCallback(const v8::Arguments& args)
     return v8::Undefined();
 }
 
-v8::Handle<v8::Value> V8Clipboard::getDataCallback(const v8::Arguments& args)
-{
-    INC_STATS("DOM.Clipboard.getData()");
-    Clipboard* clipboard = V8Clipboard::toNative(args.Holder());
-
-    if (args.Length() != 1)
-        return throwError("getData: Invalid number of arguments", V8Proxy::SyntaxError);
-
-    bool success;
-    String result = clipboard->getData(toWebCoreString(args[0]), success);
-    if (success)
-        return v8String(result);
-
-    return v8::Undefined();
-}
-
 v8::Handle<v8::Value> V8Clipboard::setDragImageCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.Clipboard.setDragImage()");
diff --git a/Source/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp b/Source/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp
index a6d2c8bf2..9ee27fb72 100644
--- a/Source/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2009, Google Inc. All rights reserved.
+ * Copyright (c) 2009, 2012 Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -59,7 +59,8 @@ bool V8SQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLEr
     v8::Handle<v8::Value> transactionHandle = toV8(transaction);
     v8::Handle<v8::Value> errorHandle = toV8(error);
     if (transactionHandle.IsEmpty() || errorHandle.IsEmpty()) {
-        CRASH();
+        if (!isScriptControllerTerminating())
+            CRASH();
         return true;
     }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
index 2799ae2c8..ddf22a746 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMStringMapCustom.cpp
@@ -94,7 +94,7 @@ v8::Handle<v8::Value> toV8(DOMStringMap* impl)
     if (!wrapper.IsEmpty() && element) {
         v8::Handle<v8::Value> elementValue = toV8(element);
         if (!elementValue.IsEmpty() && elementValue->IsObject())
-            V8DOMWrapper::setNamedHiddenReference(elementValue.As<v8::Object>(), "domStringMap", wrapper);
+            elementValue.As<v8::Object>()->SetHiddenValue(V8HiddenPropertyName::domStringMap(), wrapper);
     }
     return wrapper;
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8DOMTokenListCustom.cpp b/Source/WebCore/bindings/v8/custom/V8DOMTokenListCustom.cpp
index 08051abd5..a23da4810 100644
--- a/Source/WebCore/bindings/v8/custom/V8DOMTokenListCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8DOMTokenListCustom.cpp
@@ -48,7 +48,7 @@ v8::Handle<v8::Value> toV8(DOMTokenList* impl)
     if (!wrapper.IsEmpty() && element) {
         v8::Handle<v8::Value> elementValue = toV8(element);
         if (!elementValue.IsEmpty() && elementValue->IsObject())
-            V8DOMWrapper::setNamedHiddenReference(elementValue.As<v8::Object>(), "domTokenList", wrapper);
+            elementValue.As<v8::Object>()->SetHiddenValue(V8HiddenPropertyName::domTokenList(), wrapper);
     }
     return wrapper;
 }
diff --git a/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp b/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp
index 6f4878e6f..585593089 100644
--- a/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8MutationCallbackCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -70,7 +70,8 @@ bool V8MutationCallback::handleEvent(MutationRecordArray* mutations, WebKitMutat
 
     v8::Handle<v8::Value> observerHandle = toV8(observer);
     if (observerHandle.IsEmpty()) {
-        CRASH();
+        if (!isScriptControllerTerminating())
+            CRASH();
         return true;
     }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
index 4782dcc32..f303128e0 100644
--- a/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NamedNodeMapCustom.cpp
@@ -79,7 +79,7 @@ v8::Handle<v8::Value> toV8(NamedNodeMap* impl)
     // Add a hidden reference from named node map to its owner node.
     Element* element = impl->element();
     if (!wrapper.IsEmpty() && element)
-        V8DOMWrapper::setNamedHiddenReference(wrapper, "ownerNode", toV8(element));
+        wrapper->SetHiddenValue(V8HiddenPropertyName::ownerNode(), toV8(element));
     return wrapper;
 }
 
diff --git a/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp b/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
index 449031558..242711344 100644
--- a/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp
@@ -48,12 +48,17 @@
 #include "V8Entity.h"
 #include "V8EntityReference.h"
 #include "V8EventListener.h"
+#include "V8HTMLElement.h"
 #include "V8Node.h"
 #include "V8Notation.h"
 #include "V8ProcessingInstruction.h"
 #include "V8Proxy.h"
 #include "V8Text.h"
 
+#if ENABLE(SVG)
+#include "V8SVGElement.h"
+#endif
+
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
@@ -143,7 +148,13 @@ v8::Handle<v8::Value> toV8Slow(Node* impl, bool forceNewObject)
     }
     switch (impl->nodeType()) {
     case Node::ELEMENT_NODE:
-        return toV8(static_cast<Element*>(impl), forceNewObject);
+        if (impl->isHTMLElement())
+            return toV8(toHTMLElement(impl), forceNewObject);
+#if ENABLE(SVG)
+        if (impl->isSVGElement())
+            return toV8(static_cast<SVGElement*>(impl), forceNewObject);
+#endif
+        return V8Element::wrap(static_cast<Element*>(impl), forceNewObject);
     case Node::ATTRIBUTE_NODE:
         return toV8(static_cast<Attr*>(impl), forceNewObject);
     case Node::TEXT_NODE:
diff --git a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
index c07868858..7dcedbe25 100644
--- a/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
+++ b/Source/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
@@ -39,6 +39,7 @@
 #include "V8ArrayBufferView.h"
 #include "V8Binding.h"
 #include "V8BindingMacros.h"
+#include "V8EXTTextureFilterAnisotropic.h"
 #include "V8Float32Array.h"
 #include "V8HTMLCanvasElement.h"
 #include "V8HTMLImageElement.h"
@@ -175,6 +176,10 @@ static v8::Handle<v8::Value> toV8Object(WebGLExtension* extension, v8::Handle<v8
         extensionObject = toV8(static_cast<WebGLLoseContext*>(extension));
         referenceName = "webKitWebGLLoseContextName";
         break;
+    case WebGLExtension::EXTTextureFilterAnisotropicName:
+        extensionObject = toV8(static_cast<EXTTextureFilterAnisotropic*>(extension));
+        referenceName = "extTextureFilterAnisotropicName";
+        break;
     case WebGLExtension::OESStandardDerivativesName:
         extensionObject = toV8(static_cast<OESStandardDerivatives*>(extension));
         referenceName = "oesStandardDerivativesName";
diff --git a/Source/WebCore/bridge/NP_jsobject.cpp b/Source/WebCore/bridge/NP_jsobject.cpp
index 771a4b3a3..2cbe923f5 100644
--- a/Source/WebCore/bridge/NP_jsobject.cpp
+++ b/Source/WebCore/bridge/NP_jsobject.cpp
@@ -339,7 +339,7 @@ bool _NPN_SetProperty(NPP, NPObject* o, NPIdentifier propertyName, const NPVaria
             PutPropertySlot slot;
             obj->imp->methodTable()->put(obj->imp, exec, identifierFromNPIdentifier(exec, i->string()), convertNPVariantToValue(exec, variant, rootObject), slot);
         } else
-            obj->imp->methodTable()->putByIndex(obj->imp, exec, i->number(), convertNPVariantToValue(exec, variant, rootObject));
+            obj->imp->methodTable()->putByIndex(obj->imp, exec, i->number(), convertNPVariantToValue(exec, variant, rootObject), false);
         exec->clearException();
         return true;
     }
diff --git a/Source/WebCore/bridge/jni/jni_jsobject.mm b/Source/WebCore/bridge/jni/jni_jsobject.mm
index a5cb9ee88..e0b5dbd2e 100644
--- a/Source/WebCore/bridge/jni/jni_jsobject.mm
+++ b/Source/WebCore/bridge/jni/jni_jsobject.mm
@@ -393,7 +393,7 @@ void JavaJSObject::setSlot(jint index, jobject value) const
 
     ExecState* exec = rootObject->globalObject()->globalExec();
     JSLock lock(SilenceAssertionsOnly);
-    _imp->methodTable()->putByIndex(_imp, exec, (unsigned)index, convertJObjectToValue(exec, value));
+    _imp->methodTable()->putByIndex(_imp, exec, (unsigned)index, convertJObjectToValue(exec, value), false);
 }
 
 
diff --git a/Source/WebCore/bridge/objc/objc_instance.mm b/Source/WebCore/bridge/objc/objc_instance.mm
index efbcfe20c..60dc229e8 100644
--- a/Source/WebCore/bridge/objc/objc_instance.mm
+++ b/Source/WebCore/bridge/objc/objc_instance.mm
@@ -170,7 +170,7 @@ Bindings::Class* ObjcInstance::getClass() const
     if (!_instance)
         return 0;
     if (!_class)
-        _class = ObjcClass::classForIsA(_instance->isa);
+        _class = ObjcClass::classForIsA(object_getClass(_instance.get()));
     return static_cast<Bindings::Class*>(_class);
 }
 
diff --git a/Source/WebCore/bridge/runtime_array.cpp b/Source/WebCore/bridge/runtime_array.cpp
index 7ded67307..c15c7cb39 100644
--- a/Source/WebCore/bridge/runtime_array.cpp
+++ b/Source/WebCore/bridge/runtime_array.cpp
@@ -157,7 +157,7 @@ void RuntimeArray::put(JSCell* cell, ExecState* exec, const Identifier& property
     JSObject::put(thisObject, exec, propertyName, value, slot);
 }
 
-void RuntimeArray::putByIndex(JSCell* cell, ExecState* exec, unsigned index, JSValue value)
+void RuntimeArray::putByIndex(JSCell* cell, ExecState* exec, unsigned index, JSValue value, bool)
 {
     RuntimeArray* thisObject = jsCast<RuntimeArray*>(cell);
     if (index >= thisObject->getLength()) {
diff --git a/Source/WebCore/bridge/runtime_array.h b/Source/WebCore/bridge/runtime_array.h
index a0d98ce7c..c7bee5282 100644
--- a/Source/WebCore/bridge/runtime_array.h
+++ b/Source/WebCore/bridge/runtime_array.h
@@ -55,7 +55,7 @@ public:
     static bool getOwnPropertySlotByIndex(JSCell*, ExecState*, unsigned, PropertySlot&);
     static bool getOwnPropertyDescriptor(JSObject*, ExecState*, const Identifier&, PropertyDescriptor&);
     static void put(JSCell*, ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
-    static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue);
+    static void putByIndex(JSCell*, ExecState*, unsigned propertyName, JSValue, bool shouldThrow);
     
     static bool deleteProperty(JSCell*, ExecState*, const Identifier &propertyName);
     static bool deletePropertyByIndex(JSCell*, ExecState*, unsigned propertyName);
diff --git a/Source/WebCore/css/CSSCalculationValue.cpp b/Source/WebCore/css/CSSCalculationValue.cpp
index 87fa73782..7828c6542 100755
--- a/Source/WebCore/css/CSSCalculationValue.cpp
+++ b/Source/WebCore/css/CSSCalculationValue.cpp
@@ -114,6 +114,25 @@ public:
         return m_value->cssText();
     }
 
+    virtual PassOwnPtr<CalcExpressionNode> toCalcValue(RenderStyle* style, RenderStyle* rootStyle, double zoom) const
+    {
+        switch (m_category) {
+        case CalcNumber:
+            return adoptPtr(new CalcExpressionNumber(m_value->getFloatValue()));
+        case CalcLength:
+            return adoptPtr(new CalcExpressionNumber(m_value->computeLength<float>(style, rootStyle, zoom)));
+        case CalcPercent:
+        case CalcPercentLength:
+            return adoptPtr(new CalcExpressionLength(CSSStyleSelector::convertToFloatLength(m_value.get(), style, rootStyle, zoom)));
+        // Only types that could be part of a Length expression can be converted
+        // to a CalcExpressionNode. CalcPercentNumber makes no sense as a Length.
+        case CalcPercentNumber:
+        case CalcOther:
+            ASSERT_NOT_REACHED();
+        }
+        return nullptr;
+    }
+
     virtual double doubleValue() const
     {
         switch (m_category) {
@@ -208,6 +227,17 @@ public:
         return !doubleValue();
     }
 
+    virtual PassOwnPtr<CalcExpressionNode> toCalcValue(RenderStyle* style, RenderStyle* rootStyle, double zoom) const
+    {
+        OwnPtr<CalcExpressionNode> left(m_leftSide->toCalcValue(style, rootStyle, zoom));
+        if (!left)
+            return nullptr;
+        OwnPtr<CalcExpressionNode> right(m_rightSide->toCalcValue(style, rootStyle, zoom));
+        if (!right)
+            return nullptr;
+        return adoptPtr(new CalcExpressionBinaryOperation(left.release(), right.release(), m_operator));
+    }
+
     virtual double doubleValue() const 
     {
         return evaluate(m_leftSide->doubleValue(), m_rightSide->doubleValue());
diff --git a/Source/WebCore/css/CSSCalculationValue.h b/Source/WebCore/css/CSSCalculationValue.h
index 7c3667125..ac9be46d3 100755
--- a/Source/WebCore/css/CSSCalculationValue.h
+++ b/Source/WebCore/css/CSSCalculationValue.h
@@ -43,7 +43,7 @@ namespace WebCore {
 class CSSParserValueList;
 class CSSValueList;
 class RenderStyle;
-class CalcValue;
+class CalculationValue;
 class CalcExpressionNode;
 
 enum CalculationCategory {
@@ -58,8 +58,9 @@ enum CalculationCategory {
 class CSSCalcExpressionNode : public RefCounted<CSSCalcExpressionNode> {
 public:
     
-    virtual ~CSSCalcExpressionNode() = 0;  
+    virtual ~CSSCalcExpressionNode() = 0;
     virtual bool isZero() const = 0;
+    virtual PassOwnPtr<CalcExpressionNode> toCalcValue(RenderStyle*, RenderStyle* rootStyle, double zoom = 1.0) const = 0;    
     virtual double doubleValue() const = 0;
     virtual double computeLengthPx(RenderStyle* currentStyle, RenderStyle* rootStyle, double multiplier = 1.0, bool computingFontSize = false) const = 0;
     
@@ -80,7 +81,12 @@ protected:
 class CSSCalcValue : public CSSValue {
 public:
     static PassRefPtr<CSSCalcValue> create(CSSParserString name, CSSParserValueList*, CalculationPermittedValueRange);
+    static PassRefPtr<CSSCalcValue> create(CalculationValue*);
 
+    PassRefPtr<CalculationValue> toCalcValue(RenderStyle* style, RenderStyle* rootStyle, double zoom = 1.0) const
+    {
+        return CalculationValue::create(m_expression->toCalcValue(style, rootStyle, zoom), m_nonNegative ? CalculationRangeNonNegative : CalculationRangeAll);
+    }
     CalculationCategory category() const { return m_expression->category(); }
     bool isInt() const { return m_expression->isInteger(); }    
     double doubleValue() const;
diff --git a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
index 04f72c86e..6c497f6ba 100644
--- a/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/Source/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -232,6 +232,9 @@ static const int computedProperties[] = {
 #if ENABLE(CSS_GRID_LAYOUT)
     CSSPropertyWebkitGridColumns,
     CSSPropertyWebkitGridRows,
+
+    CSSPropertyWebkitGridColumn,
+    CSSPropertyWebkitGridRow,
 #endif
     CSSPropertyWebkitHighlight,
     CSSPropertyWebkitHyphenateCharacter,
@@ -913,6 +916,15 @@ static PassRefPtr<CSSValue> valueForGridTrackList(const Vector<Length>& trackLen
         list->append(valueForGridTrackBreadth(trackLengths[i], style, cssValuePool));
     return list.release();
 }
+
+static PassRefPtr<CSSValue> valueForGridPosition(const Length& position, CSSValuePool* cssValuePool)
+{
+    if (position.isAuto())
+        return cssValuePool->createIdentifierValue(CSSValueAuto);
+
+    ASSERT(position.isFixed());
+    return cssValuePool->createValue(position.value(), CSSPrimitiveValue::CSS_NUMBER);
+}
 #endif
 
 static PassRefPtr<CSSValue> getDelayValue(const AnimationList* animList, CSSValuePool* cssValuePool)
@@ -1116,6 +1128,31 @@ static PassRefPtr<CSSPrimitiveValue> valueForFamily(const AtomicString& family,
     return cssValuePool->createValue(family.string(), CSSPrimitiveValue::CSS_STRING);
 }
 
+static PassRefPtr<CSSValue> renderUnicodeBidiFlagsToCSSValue(EUnicodeBidi unicodeBidi, CSSValuePool* cssValuePool)
+{
+    switch (unicodeBidi) {
+    case UBNormal:
+        return cssValuePool->createIdentifierValue(CSSValueNormal);
+    case Embed:
+        return cssValuePool->createIdentifierValue(CSSValueEmbed);
+    case Plaintext:
+        return cssValuePool->createIdentifierValue(CSSValueWebkitPlaintext);
+    case Override:
+        return cssValuePool->createIdentifierValue(CSSValueBidiOverride);
+    case Isolate:
+        return cssValuePool->createIdentifierValue(CSSValueWebkitIsolate);
+    case OverrideIsolate:
+    {
+        RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
+        list->append(cssValuePool->createIdentifierValue(CSSValueBidiOverride));
+        list->append(cssValuePool->createIdentifierValue(CSSValueWebkitIsolate));
+        return list;
+    }
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
 static PassRefPtr<CSSValue> renderTextDecorationFlagsToCSSValue(int textDecoration, CSSValuePool* cssValuePool)
 {
     RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
@@ -1304,6 +1341,13 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
     if (!style)
         return 0;
 
+    if (renderer) {
+        if (m_pseudoElementSpecifier == AFTER)
+            renderer = renderer->afterPseudoElementRenderer();
+        else if (m_pseudoElementSpecifier == BEFORE)
+            renderer = renderer->beforePseudoElementRenderer();
+    }
+
     CSSValuePool* cssValuePool = node->document()->cssValuePool().get();
 
     propertyID = CSSProperty::resolveDirectionAwareProperty(propertyID, style->direction(), style->writingMode());
@@ -1648,6 +1692,11 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyWebkitGridRows: {
             return valueForGridTrackList(style->gridRows(), style.get(), cssValuePool);
         }
+
+        case CSSPropertyWebkitGridColumn:
+            return valueForGridPosition(style->gridItemColumn(), cssValuePool);
+        case CSSPropertyWebkitGridRow:
+            return valueForGridPosition(style->gridItemRow(), cssValuePool);
 #endif
         case CSSPropertyHeight:
             if (renderer) {
@@ -1792,19 +1841,19 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return cssValuePool->createValue(style->overflowY());
         case CSSPropertyPaddingTop:
             if (renderer && renderer->isBox())
-                return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingTop(false), style.get(), cssValuePool);
+                return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingTop(ExcludeIntrinsicPadding), style.get(), cssValuePool);
             return zoomAdjustedPixelValueForLength(style->paddingTop(), style.get(), cssValuePool);
         case CSSPropertyPaddingRight:
             if (renderer && renderer->isBox())
-                return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingRight(false), style.get(), cssValuePool);
+                return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingRight(ExcludeIntrinsicPadding), style.get(), cssValuePool);
             return zoomAdjustedPixelValueForLength(style->paddingRight(), style.get(), cssValuePool);
         case CSSPropertyPaddingBottom:
             if (renderer && renderer->isBox())
-                return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingBottom(false), style.get(), cssValuePool);
+                return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingBottom(ExcludeIntrinsicPadding), style.get(), cssValuePool);
             return zoomAdjustedPixelValueForLength(style->paddingBottom(), style.get(), cssValuePool);
         case CSSPropertyPaddingLeft:
             if (renderer && renderer->isBox())
-                return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingLeft(false), style.get(), cssValuePool);
+                return zoomAdjustedPixelValue(toRenderBox(renderer)->paddingLeft(ExcludeIntrinsicPadding), style.get(), cssValuePool);
             return zoomAdjustedPixelValueForLength(style->paddingLeft(), style.get(), cssValuePool);
         case CSSPropertyPageBreakAfter:
             return cssValuePool->createValue(style->pageBreakAfter());
@@ -1880,7 +1929,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyTop:
             return getPositionOffsetValue(style.get(), CSSPropertyTop, cssValuePool);
         case CSSPropertyUnicodeBidi:
-            return cssValuePool->createValue(style->unicodeBidi());
+            return renderUnicodeBidiFlagsToCSSValue(style->unicodeBidi(), cssValuePool);
         case CSSPropertyVerticalAlign:
             switch (style->verticalAlign()) {
                 case BASELINE:
@@ -2250,7 +2299,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return counterToCSSValue(style.get(), propertyID, cssValuePool);
         case CSSPropertyWebkitFlowInto:
             if (style->flowThread().isNull())
-                return cssValuePool->createIdentifierValue(CSSValueAuto);
+                return cssValuePool->createIdentifierValue(CSSValueNone);
             return cssValuePool->createValue(style->flowThread(), CSSPrimitiveValue::CSS_STRING);
         case CSSPropertyWebkitFlowFrom:
             if (style->regionThread().isNull())
diff --git a/Source/WebCore/css/CSSCrossfadeValue.h b/Source/WebCore/css/CSSCrossfadeValue.h
index be6066037..fb4c2e0d7 100644
--- a/Source/WebCore/css/CSSCrossfadeValue.h
+++ b/Source/WebCore/css/CSSCrossfadeValue.h
@@ -27,6 +27,7 @@
 #define CSSCrossfadeValue_h
 
 #include "CachedImage.h"
+#include "CachedResourceHandle.h"
 #include "CSSImageGeneratorValue.h"
 #include "CSSPrimitiveValue.h"
 #include "Image.h"
@@ -89,8 +90,8 @@ private:
     RefPtr<CSSValue> m_toValue;
     RefPtr<CSSPrimitiveValue> m_percentageValue;
 
-    CachedImage* m_cachedFromImage;
-    CachedImage* m_cachedToImage;
+    CachedResourceHandle<CachedImage> m_cachedFromImage;
+    CachedResourceHandle<CachedImage> m_cachedToImage;
 
     RefPtr<Image> m_generatedImage;
 
diff --git a/Source/WebCore/css/CSSGrammar.y b/Source/WebCore/css/CSSGrammar.y
index a57edf3d1..1eef6b1e1 100644
--- a/Source/WebCore/css/CSSGrammar.y
+++ b/Source/WebCore/css/CSSGrammar.y
@@ -326,9 +326,9 @@ webkit_value:
         CSSParser* p = static_cast<CSSParser*>(parser);
         if ($4) {
             p->m_valueList = p->sinkFloatingValueList($4);
-            int oldParsedProperties = p->m_numParsedProperties;
+            int oldParsedProperties = p->m_parsedProperties.size();
             if (!p->parseValue(p->m_id, p->m_important))
-                p->rollbackLastProperties(p->m_numParsedProperties - oldParsedProperties);
+                p->rollbackLastProperties(p->m_parsedProperties.size() - oldParsedProperties);
             p->m_valueList = nullptr;
         }
     }
@@ -1300,10 +1300,10 @@ declaration:
         bool isPropertyParsed = false;
         if ($1 && $4) {
             p->m_valueList = p->sinkFloatingValueList($4);
-            int oldParsedProperties = p->m_numParsedProperties;
+            int oldParsedProperties = p->m_parsedProperties.size();
             $$ = p->parseValue($1, $5);
             if (!$$)
-                p->rollbackLastProperties(p->m_numParsedProperties - oldParsedProperties);
+                p->rollbackLastProperties(p->m_parsedProperties.size() - oldParsedProperties);
             else
                 isPropertyParsed = true;
             p->m_valueList = nullptr;
diff --git a/Source/WebCore/css/CSSImportRule.cpp b/Source/WebCore/css/CSSImportRule.cpp
index 7e210a82c..20d7706b3 100644
--- a/Source/WebCore/css/CSSImportRule.cpp
+++ b/Source/WebCore/css/CSSImportRule.cpp
@@ -103,8 +103,10 @@ void CSSImportRule::setCSSStyleSheet(const String& href, const KURL& baseURL, co
 
     m_loading = false;
 
-    if (parent)
+    if (parent) {
+        parent->notifyLoadedSheet(sheet);
         parent->checkLoaded();
+    }
 }
 
 bool CSSImportRule::isLoading() const
diff --git a/Source/WebCore/css/CSSPageRule.cpp b/Source/WebCore/css/CSSPageRule.cpp
index d067e46c5..3858d3a54 100644
--- a/Source/WebCore/css/CSSPageRule.cpp
+++ b/Source/WebCore/css/CSSPageRule.cpp
@@ -30,10 +30,9 @@
 
 namespace WebCore {
 
-CSSPageRule::CSSPageRule(CSSStyleSheet* parent, int sourceLine)
+CSSPageRule::CSSPageRule(CSSStyleSheet* parent)
     : CSSRule(parent, CSSRule::PAGE_RULE)
 {
-    setSourceLine(sourceLine);
 }
 
 CSSPageRule::~CSSPageRule()
diff --git a/Source/WebCore/css/CSSPageRule.h b/Source/WebCore/css/CSSPageRule.h
index 7b09665b3..c837274fd 100644
--- a/Source/WebCore/css/CSSPageRule.h
+++ b/Source/WebCore/css/CSSPageRule.h
@@ -35,9 +35,9 @@ class CSSSelectorList;
 
 class CSSPageRule : public CSSRule {
 public:
-    static PassRefPtr<CSSPageRule> create(CSSStyleSheet* parent, int sourceLine)
+    static PassRefPtr<CSSPageRule> create(CSSStyleSheet* parent)
     {
-        return adoptRef(new CSSPageRule(parent, sourceLine));
+        return adoptRef(new CSSPageRule(parent));
     }
     ~CSSPageRule();
 
@@ -55,7 +55,7 @@ public:
     void setDeclaration(PassRefPtr<StylePropertySet> style) { m_style = style; }
 
 private:
-    CSSPageRule(CSSStyleSheet* parent, int sourceLine);
+    CSSPageRule(CSSStyleSheet* parent);
 
     RefPtr<StylePropertySet> m_style;
     CSSSelectorList m_selectorList;
diff --git a/Source/WebCore/css/CSSParser.cpp b/Source/WebCore/css/CSSParser.cpp
index 52a80418d..3dc4bc912 100644
--- a/Source/WebCore/css/CSSParser.cpp
+++ b/Source/WebCore/css/CSSParser.cpp
@@ -74,6 +74,7 @@
 #include "Settings.h"
 #include "ShadowValue.h"
 #include "StylePropertySet.h"
+#include "StyleRule.h"
 #if ENABLE(CSS_FILTERS)
 #include "WebKitCSSFilterValue.h"
 #endif
@@ -177,17 +178,11 @@ inline void CSSParser::ensureCSSValuePool()
         m_cssValuePool = CSSValuePool::create();
 }
 
-// FIXME: Can m_parsedProperties just be a Vector?
-    
 CSSParser::CSSParser(bool strictParsing)
     : m_strict(strictParsing)
     , m_important(false)
     , m_id(0)
     , m_styleSheet(0)
-    , m_parsedProperties(static_cast<CSSProperty**>(fastMalloc(32 * sizeof(CSSProperty*))))
-    , m_numParsedProperties(0)
-    , m_maxParsedProperties(32)
-    , m_numParsedPropertiesBeforeMarginBox(INVALID_NUM_PARSED_PROPERTIES)
     , m_inParseShorthand(0)
     , m_currentShorthand(0)
     , m_implicitShorthand(false)
@@ -217,7 +212,6 @@ CSSParser::CSSParser(bool strictParsing)
 CSSParser::~CSSParser()
 {
     clearProperties();
-    fastFree(m_parsedProperties);
 
     fastDeleteAllValues(m_floatingSelectors);
     deleteAllValues(m_floatingSelectorVectors);
@@ -519,9 +513,9 @@ bool CSSParser::parseValue(StylePropertySet* declaration, int propertyId, const
     bool ok = false;
     if (m_hasFontFaceOnlyValues)
         deleteFontFaceOnlyValues();
-    if (m_numParsedProperties) {
+    if (!m_parsedProperties.isEmpty()) {
         ok = true;
-        declaration->addParsedProperties(m_parsedProperties, m_numParsedProperties);
+        declaration->addParsedProperties(m_parsedProperties.data(), m_parsedProperties.size());
         clearProperties();
     }
 
@@ -542,7 +536,7 @@ bool CSSParser::parseColor(RGBA32& color, const String& string, bool strict)
     if (!parser.parseColor(string))
         return false;
 
-    CSSValue* value = parser.m_parsedProperties[0]->value();
+    CSSValue* value = parser.m_parsedProperties.first().value();
     if (!value->isPrimitiveValue())
         return false;
 
@@ -564,7 +558,7 @@ bool CSSParser::parseColor(const String& string)
     cssyyparse(this);
     m_rule = 0;
 
-    return (m_numParsedProperties && m_parsedProperties[0]->m_id == CSSPropertyColor);
+    return !m_parsedProperties.isEmpty() && m_parsedProperties.first().id() == CSSPropertyColor;
 }
 
 bool CSSParser::parseSystemColor(RGBA32& color, const String& string, Document* document)
@@ -620,9 +614,9 @@ bool CSSParser::parseDeclaration(StylePropertySet* declaration, const String& st
     bool ok = false;
     if (m_hasFontFaceOnlyValues)
         deleteFontFaceOnlyValues();
-    if (m_numParsedProperties) {
+    if (!m_parsedProperties.isEmpty()) {
         ok = true;
-        declaration->addParsedProperties(m_parsedProperties, m_numParsedProperties);
+        declaration->addParsedProperties(m_parsedProperties.data(), m_parsedProperties.size());
         clearProperties();
     }
 
@@ -666,31 +660,19 @@ bool CSSParser::parseMediaQuery(MediaList* queries, const String& string)
 
 void CSSParser::addProperty(int propId, PassRefPtr<CSSValue> value, bool important, bool implicit)
 {
-    OwnPtr<CSSProperty> prop(adoptPtr(new CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand || implicit)));
-    if (m_numParsedProperties >= m_maxParsedProperties) {
-        if (m_numParsedProperties > (UINT_MAX / sizeof(CSSProperty*)) - 32)
-            CRASH();  // Avoid inconsistencies with rollbackLastProperties.
-        m_maxParsedProperties += 32;
-        m_parsedProperties = static_cast<CSSProperty**>(fastRealloc(m_parsedProperties,
-            m_maxParsedProperties * sizeof(CSSProperty*)));
-    }
-    m_parsedProperties[m_numParsedProperties++] = prop.leakPtr();
+    m_parsedProperties.append(CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand || implicit));
 }
 
 void CSSParser::rollbackLastProperties(int num)
 {
     ASSERT(num >= 0);
-    ASSERT(m_numParsedProperties >= static_cast<unsigned>(num));
-
-    for (int i = 0; i < num; ++i)
-        delete m_parsedProperties[--m_numParsedProperties];
+    ASSERT(m_parsedProperties.size() >= static_cast<unsigned>(num));
+    m_parsedProperties.shrink(m_parsedProperties.size() - num);
 }
 
 void CSSParser::clearProperties()
 {
-    for (unsigned i = 0; i < m_numParsedProperties; i++)
-        delete m_parsedProperties[i];
-    m_numParsedProperties = 0;
+    m_parsedProperties.clear();
     m_numParsedPropertiesBeforeMarginBox = INVALID_NUM_PARSED_PROPERTIES;
     m_hasFontFaceOnlyValues = false;
 }
@@ -967,13 +949,30 @@ bool CSSParser::parseValue(int propId, bool important)
         else
             return parseQuotes(propId, important);
         break;
-    case CSSPropertyUnicodeBidi: // normal | embed | bidi-override | isolate | plaintext | inherit
+    case CSSPropertyUnicodeBidi: // normal | embed | (bidi-override || isolate) | plaintext | inherit
         if (id == CSSValueNormal
             || id == CSSValueEmbed
-            || id == CSSValueBidiOverride
-            || id == CSSValueWebkitIsolate
             || id == CSSValueWebkitPlaintext)
             validPrimitive = true;
+        else {
+            RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
+            bool isValid = true;
+            while (isValid && value) {
+                switch (value->id) {
+                case CSSValueBidiOverride:
+                case CSSValueWebkitIsolate:
+                    list->append(cssValuePool()->createIdentifierValue(value->id));
+                    break;
+                default:
+                    isValid = false;
+                }
+                value = m_valueList->next();
+            }
+            if (list->length() && isValid) {
+                parsedValue = list.release();
+                m_valueList->next();
+            }
+        }
         break;
 
     case CSSPropertyPosition:             // static | relative | absolute | fixed | inherit
@@ -1054,7 +1053,7 @@ bool CSSParser::parseValue(int propId, bool important)
         ShorthandScope scope(this, propId);
         if (num != 1 || !parseValue(CSSPropertyOverflowX, important))
             return false;
-        CSSValue* value = m_parsedProperties[m_numParsedProperties - 1]->value();
+        CSSValue* value = m_parsedProperties.last().value();
         addProperty(CSSPropertyOverflowY, value, important);
         return true;
     }
@@ -1148,7 +1147,7 @@ bool CSSParser::parseValue(int propId, bool important)
             ShorthandScope scope(this, CSSPropertyBorderSpacing);
             if (!parseValue(properties[0], important))
                 return false;
-            CSSValue* value = m_parsedProperties[m_numParsedProperties-1]->value();
+            CSSValue* value = m_parsedProperties.last().value();
             addProperty(properties[1], value, important);
             return true;
         }
@@ -1882,6 +1881,11 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitGridColumns:
     case CSSPropertyWebkitGridRows:
         return parseGridTrackList(propId, important);
+
+    case CSSPropertyWebkitGridColumn:
+    case CSSPropertyWebkitGridRow:
+        validPrimitive = id == CSSValueAuto || validUnit(value, FInteger, m_strict);
+        break;
 #endif
     case CSSPropertyWebkitMarginCollapse: {
         const int properties[2] = { CSSPropertyWebkitMarginBeforeCollapse,
@@ -1890,7 +1894,7 @@ bool CSSParser::parseValue(int propId, bool important)
             ShorthandScope scope(this, CSSPropertyWebkitMarginCollapse);
             if (!parseValue(properties[0], important))
                 return false;
-            CSSValue* value = m_parsedProperties[m_numParsedProperties-1]->value();
+            CSSValue* value = m_parsedProperties.last().value();
             addProperty(properties[1], value, important);
             return true;
         }
@@ -2568,10 +2572,12 @@ bool CSSParser::parseAnimationShorthand(bool important)
     RefPtr<CSSValue> values[numProperties];
 
     int i;
+    int initialParsedPropertyIndex = 0;
     while (m_valueList->current()) {
         CSSParserValue* val = m_valueList->current();
         if (val->unit == CSSParserValue::Operator && val->iValue == ',') {
             // We hit the end.  Fill in all remaining values with the initial value.
+            initialParsedPropertyIndex = 0;
             m_valueList->next();
             for (i = 0; i < numProperties; ++i) {
                 if (!parsedProperty[i])
@@ -2583,11 +2589,12 @@ bool CSSParser::parseAnimationShorthand(bool important)
         }
 
         bool found = false;
-        for (i = 0; !found && i < numProperties; ++i) {
+        for (i = initialParsedPropertyIndex; !found && i < numProperties; ++i) {
             if (!parsedProperty[i]) {
                 RefPtr<CSSValue> val;
                 if (parseAnimationProperty(properties[i], val)) {
                     parsedProperty[i] = found = true;
+                    initialParsedPropertyIndex = 1;
                     addAnimationValue(values[i], val.release());
                 }
             }
@@ -2728,7 +2735,7 @@ bool CSSParser::parse4Values(int propId, const int *properties,  bool important)
         case 1: {
             if (!parseValue(properties[0], important))
                 return false;
-            CSSValue *value = m_parsedProperties[m_numParsedProperties-1]->value();
+            CSSValue *value = m_parsedProperties.last().value();
             ImplicitScope implicitScope(this, PropertyImplicit);
             addProperty(properties[1], value, important);
             addProperty(properties[2], value, important);
@@ -2738,17 +2745,17 @@ bool CSSParser::parse4Values(int propId, const int *properties,  bool important)
         case 2: {
             if (!parseValue(properties[0], important) || !parseValue(properties[1], important))
                 return false;
-            CSSValue *value = m_parsedProperties[m_numParsedProperties-2]->value();
+            CSSValue *value = m_parsedProperties[m_parsedProperties.size() - 2].value();
             ImplicitScope implicitScope(this, PropertyImplicit);
             addProperty(properties[2], value, important);
-            value = m_parsedProperties[m_numParsedProperties-2]->value();
+            value = m_parsedProperties[m_parsedProperties.size() - 2].value();
             addProperty(properties[3], value, important);
             break;
         }
         case 3: {
             if (!parseValue(properties[0], important) || !parseValue(properties[1], important) || !parseValue(properties[2], important))
                 return false;
-            CSSValue *value = m_parsedProperties[m_numParsedProperties-2]->value();
+            CSSValue *value = m_parsedProperties[m_parsedProperties.size() - 2].value();
             ImplicitScope implicitScope(this, PropertyImplicit);
             addProperty(properties[3], value, important);
             break;
@@ -7065,13 +7072,11 @@ PassRefPtr<CSSValueList> CSSParser::parseFilter()
 
 static bool validFlowName(const String& flowName)
 {
-    if (equalIgnoringCase(flowName, "auto")
-        || equalIgnoringCase(flowName, "default")
-        || equalIgnoringCase(flowName, "inherit")
-        || equalIgnoringCase(flowName, "initial")
-        || equalIgnoringCase(flowName, "none"))
-        return false;
-    return true;
+    return !(equalIgnoringCase(flowName, "auto")
+            || equalIgnoringCase(flowName, "default")
+            || equalIgnoringCase(flowName, "inherit")
+            || equalIgnoringCase(flowName, "initial")
+            || equalIgnoringCase(flowName, "none"));
 }
 
 bool CSSParser::cssRegionsEnabled() const
@@ -7082,7 +7087,23 @@ bool CSSParser::cssRegionsEnabled() const
     return false;
 }
 
-// auto | <ident>
+bool CSSParser::parseFlowThread(const String& flowName, Document* doc)
+{
+    ASSERT(doc);
+    ASSERT(doc->cssRegionsEnabled());
+
+    RefPtr<CSSStyleSheet> dummyStyleSheet = CSSStyleSheet::create(doc);
+    setStyleSheet(dummyStyleSheet.get());
+
+    setupParser("@-webkit-decls{-webkit-flow-into:", flowName, "}");
+    cssyyparse(this);
+
+    m_rule = 0;
+
+    return ((m_parsedProperties.size() == 1) && (m_parsedProperties.first().id() == CSSPropertyWebkitFlowInto));
+}
+
+// none | <ident>
 bool CSSParser::parseFlowThread(int propId, bool important)
 {
     ASSERT(propId == CSSPropertyWebkitFlowInto);
@@ -7098,7 +7119,7 @@ bool CSSParser::parseFlowThread(int propId, bool important)
     if (value->unit != CSSPrimitiveValue::CSS_IDENT)
         return false;
 
-    if (value->id == CSSValueAuto) {
+    if (value->id == CSSValueNone) {
         addProperty(propId, cssValuePool()->createIdentifierValue(value->id), important);
         return true;
     }
@@ -7109,7 +7130,7 @@ bool CSSParser::parseFlowThread(int propId, bool important)
             return false;
         addProperty(propId, cssValuePool()->createValue(inputProperty, CSSPrimitiveValue::CSS_STRING), important);
     } else
-        addProperty(propId, cssValuePool()->createIdentifierValue(CSSValueAuto), important);
+        addProperty(propId, cssValuePool()->createIdentifierValue(CSSValueNone), important);
 
     return true;
 }
@@ -8821,10 +8842,10 @@ CSSRule* CSSParser::createStyleRule(Vector<OwnPtr<CSSParserSelector> >* selector
     if (selectors) {
         m_allowImportRules = m_allowNamespaceDeclarations = false;
         RefPtr<CSSStyleRule> rule = CSSStyleRule::create(m_styleSheet, m_lastSelectorLineNumber);
-        rule->adoptSelectorVector(*selectors);
+        rule->styleRule()->adoptSelectorVector(*selectors);
         if (m_hasFontFaceOnlyValues)
             deleteFontFaceOnlyValues();
-        rule->setDeclaration(StylePropertySet::create(m_parsedProperties, m_numParsedProperties, m_strict));
+        rule->styleRule()->setProperties(StylePropertySet::create(m_parsedProperties.data(), m_parsedProperties.size(), m_strict));
         result = rule.get();
         m_parsedRules.append(rule.release());
         if (m_ruleRangeMap) {
@@ -8846,14 +8867,13 @@ CSSRule* CSSParser::createStyleRule(Vector<OwnPtr<CSSParserSelector> >* selector
 CSSRule* CSSParser::createFontFaceRule()
 {
     m_allowImportRules = m_allowNamespaceDeclarations = false;
-    for (unsigned i = 0; i < m_numParsedProperties; ++i) {
-        CSSProperty* property = m_parsedProperties[i];
-        int id = property->id();
-        if (id == CSSPropertyFontVariant && property->value()->isPrimitiveValue()) {
-            RefPtr<CSSValue> value = property->m_value.release();
-            property->m_value = CSSValueList::createCommaSeparated();
-            static_cast<CSSValueList*>(property->value())->append(value.release());
-        } else if (id == CSSPropertyFontFamily && (!property->value()->isValueList() || static_cast<CSSValueList*>(property->value())->length() != 1)) {
+    for (unsigned i = 0; i < m_parsedProperties.size(); ++i) {
+        CSSProperty& property = m_parsedProperties[i];
+        if (property.id() == CSSPropertyFontVariant && property.value()->isPrimitiveValue()) {
+            RefPtr<CSSValue> value = property.m_value.release();
+            property.m_value = CSSValueList::createCommaSeparated();
+            static_cast<CSSValueList*>(property.value())->append(value.release());
+        } else if (property.id() == CSSPropertyFontFamily && (!property.value()->isValueList() || static_cast<CSSValueList*>(property.value())->length() != 1)) {
             // Unlike font-family property, font-family descriptor in @font-face rule
             // has to be a value list with exactly one family name. It cannot have a
             // have 'initial' value and cannot 'inherit' from parent.
@@ -8863,7 +8883,7 @@ CSSRule* CSSParser::createFontFaceRule()
         }
     }
     RefPtr<CSSFontFaceRule> rule = CSSFontFaceRule::create(m_styleSheet);
-    rule->setDeclaration(StylePropertySet::create(m_parsedProperties, m_numParsedProperties, m_strict));
+    rule->setDeclaration(StylePropertySet::create(m_parsedProperties.data(), m_parsedProperties.size(), m_strict));
     clearProperties();
     CSSFontFaceRule* result = rule.get();
     m_parsedRules.append(rule.release());
@@ -8930,11 +8950,11 @@ CSSRule* CSSParser::createPageRule(PassOwnPtr<CSSParserSelector> pageSelector)
     m_allowImportRules = m_allowNamespaceDeclarations = false;
     CSSPageRule* pageRule = 0;
     if (pageSelector) {
-        RefPtr<CSSPageRule> rule = CSSPageRule::create(m_styleSheet, m_lastSelectorLineNumber);
+        RefPtr<CSSPageRule> rule = CSSPageRule::create(m_styleSheet);
         Vector<OwnPtr<CSSParserSelector> > selectorVector;
         selectorVector.append(pageSelector);
         rule->adoptSelectorVector(selectorVector);
-        rule->setDeclaration(StylePropertySet::create(m_parsedProperties, m_numParsedProperties, m_strict));
+        rule->setDeclaration(StylePropertySet::create(m_parsedProperties.data(), m_parsedProperties.size(), m_strict));
         pageRule = rule.get();
         m_parsedRules.append(rule.release());
     }
@@ -8967,7 +8987,7 @@ CSSRule* CSSParser::createMarginAtRule(CSSSelector::MarginBoxType /* marginBox *
 {
     // FIXME: Implement margin at-rule here, using:
     //        - marginBox: margin box
-    //        - m_parsedProperties: properties at [m_numParsedPropertiesBeforeMarginBox, m_numParsedProperties) are for this at-rule.
+    //        - m_parsedProperties: properties at [m_numParsedPropertiesBeforeMarginBox, m_parsedProperties.size()] are for this at-rule.
     // Don't forget to also update the action for page symbol in CSSGrammar.y such that margin at-rule data is cleared if page_selector is invalid.
 
     endDeclarationsForMarginBox();
@@ -8976,32 +8996,26 @@ CSSRule* CSSParser::createMarginAtRule(CSSSelector::MarginBoxType /* marginBox *
 
 void CSSParser::startDeclarationsForMarginBox()
 {
-    m_numParsedPropertiesBeforeMarginBox = m_numParsedProperties;
+    m_numParsedPropertiesBeforeMarginBox = m_parsedProperties.size();
 }
 
 void CSSParser::endDeclarationsForMarginBox()
 {
-    ASSERT(m_numParsedPropertiesBeforeMarginBox != INVALID_NUM_PARSED_PROPERTIES);
-    rollbackLastProperties(m_numParsedProperties - m_numParsedPropertiesBeforeMarginBox);
+    rollbackLastProperties(m_parsedProperties.size() - m_numParsedPropertiesBeforeMarginBox);
     m_numParsedPropertiesBeforeMarginBox = INVALID_NUM_PARSED_PROPERTIES;
 }
 
 void CSSParser::deleteFontFaceOnlyValues()
 {
     ASSERT(m_hasFontFaceOnlyValues);
-    int deletedProperties = 0;
-
-    for (unsigned i = 0; i < m_numParsedProperties; ++i) {
-        CSSProperty* property = m_parsedProperties[i];
-        int id = property->id();
-        if (id == CSSPropertyFontVariant && property->value()->isValueList()) {
-            delete property;
-            deletedProperties++;
-        } else if (deletedProperties)
-            m_parsedProperties[i - deletedProperties] = m_parsedProperties[i];
+    for (unsigned i = 0; i < m_parsedProperties.size();) {
+        CSSProperty& property = m_parsedProperties[i];
+        if (property.id() == CSSPropertyFontVariant && property.value()->isValueList()) {
+            m_parsedProperties.remove(i);
+            continue;
+        }
+        ++i;
     }
-
-    m_numParsedProperties -= deletedProperties;
 }
 
 WebKitCSSKeyframeRule* CSSParser::createKeyframeRule(CSSParserValueList* keys)
@@ -9018,7 +9032,7 @@ WebKitCSSKeyframeRule* CSSParser::createKeyframeRule(CSSParserValueList* keys)
 
     RefPtr<WebKitCSSKeyframeRule> keyframe = WebKitCSSKeyframeRule::create(m_styleSheet);
     keyframe->setKeyText(keyString);
-    keyframe->setDeclaration(StylePropertySet::create(m_parsedProperties, m_numParsedProperties, m_strict));
+    keyframe->setDeclaration(StylePropertySet::create(m_parsedProperties.data(), m_parsedProperties.size(), m_strict));
 
     clearProperties();
 
diff --git a/Source/WebCore/css/CSSParser.h b/Source/WebCore/css/CSSParser.h
index 5d766be88..45c5a4425 100644
--- a/Source/WebCore/css/CSSParser.h
+++ b/Source/WebCore/css/CSSParser.h
@@ -26,6 +26,7 @@
 #include "CSSCalculationValue.h"
 #include "CSSGradientValue.h"
 #include "CSSParserValues.h"
+#include "CSSProperty.h"
 #include "CSSPropertySourceData.h"
 #include "CSSSelector.h"
 #include "Color.h"
@@ -83,7 +84,7 @@ public:
 
     void addProperty(int propId, PassRefPtr<CSSValue>, bool important, bool implicit = false);
     void rollbackLastProperties(int num);
-    bool hasProperties() const { return m_numParsedProperties > 0; }
+    bool hasProperties() const { return !m_parsedProperties.isEmpty(); }
 
     bool parseValue(int propId, bool important);
     bool parseShorthand(int propId, const int* properties, int numProperties, bool important);
@@ -215,6 +216,7 @@ public:
     bool parseFontFeatureSettings(bool important);
 
     bool cssRegionsEnabled() const;
+    bool parseFlowThread(const String& flowName, Document*);
     bool parseFlowThread(int propId, bool important);
     bool parseRegionThread(int propId, bool important);
 
@@ -283,12 +285,10 @@ public:
     RefPtr<WebKitCSSKeyframeRule> m_keyframe;
     OwnPtr<MediaQuery> m_mediaQuery;
     OwnPtr<CSSParserValueList> m_valueList;
-    CSSProperty** m_parsedProperties;
+    Vector<CSSProperty, 256> m_parsedProperties;
     CSSSelectorList* m_selectorListForParseSelector;
 
     RefPtr<CSSValuePool> m_cssValuePool;
-    unsigned m_numParsedProperties;
-    unsigned m_maxParsedProperties;
     unsigned m_numParsedPropertiesBeforeMarginBox;
 
     int m_inParseShorthand;
diff --git a/Source/WebCore/css/CSSPrimitiveValue.cpp b/Source/WebCore/css/CSSPrimitiveValue.cpp
index fc14e8206..9d213dcdd 100644
--- a/Source/WebCore/css/CSSPrimitiveValue.cpp
+++ b/Source/WebCore/css/CSSPrimitiveValue.cpp
@@ -266,6 +266,7 @@ CSSPrimitiveValue::CSSPrimitiveValue(const Length& length)
             ASSERT(isfinite(length.percent()));
             m_value.num = length.percent();
             break;
+        case Calculated:
         case Relative:
         case Undefined:
             ASSERT_NOT_REACHED();
@@ -429,33 +430,26 @@ template<> double CSSPrimitiveValue::computeLength(RenderStyle* style, RenderSty
 
 double CSSPrimitiveValue::computeLengthDouble(RenderStyle* style, RenderStyle* rootStyle, float multiplier, bool computingFontSize)
 {
-    unsigned short type = primitiveType();
+    double factor;
 
-    // We do not apply the zoom factor when we are computing the value of the font-size property.  The zooming
-    // for font sizes is much more complicated, since we have to worry about enforcing the minimum font size preference
-    // as well as enforcing the implicit "smart minimum."  In addition the CSS property text-size-adjust is used to
-    // prevent text from zooming at all.  Therefore we will not apply the zoom here if we are computing font-size.
-    bool applyZoomMultiplier = !computingFontSize;
-
-    double factor = 1.0;
-    switch (type) {
+    switch (primitiveType()) {
         case CSS_EMS:
-            applyZoomMultiplier = false;
             factor = computingFontSize ? style->fontDescription().specifiedSize() : style->fontDescription().computedSize();
             break;
         case CSS_EXS:
             // FIXME: We have a bug right now where the zoom will be applied twice to EX units.
             // We really need to compute EX using fontMetrics for the original specifiedSize and not use
             // our actual constructed rendering font.
-            applyZoomMultiplier = false;
             factor = style->fontMetrics().xHeight();
             break;
         case CSS_REMS:
-            applyZoomMultiplier = false;
             if (rootStyle)
                 factor = computingFontSize ? rootStyle->fontDescription().specifiedSize() : rootStyle->fontDescription().computedSize();
+            else
+                factor = 1.0;
             break;
         case CSS_PX:
+            factor = 1.0;
             break;
         case CSS_CM:
             factor = cssPixelsPerInch / 2.54; // (2.54 cm/in)
@@ -489,15 +483,19 @@ double CSSPrimitiveValue::computeLengthDouble(RenderStyle* style, RenderStyle* r
     else
         computedValue = getDoubleValue();
     
+    // We do not apply the zoom factor when we are computing the value of the font-size property. The zooming
+    // for font sizes is much more complicated, since we have to worry about enforcing the minimum font size preference
+    // as well as enforcing the implicit "smart minimum." In addition the CSS property text-size-adjust is used to
+    // prevent text from zooming at all. Therefore we will not apply the zoom here if we are computing font-size.
     double result = computedValue * factor;
-    if (!applyZoomMultiplier || multiplier == 1.0f)
+    if (computingFontSize || isFontRelativeLength())
         return result;
 
     // Any original result that was >= 1 should not be allowed to fall below 1.  This keeps border lines from
     // vanishing.
     double zoomedResult = result * multiplier;
-    if (result >= 1.0)
-        zoomedResult = max(1.0, zoomedResult);
+    if (zoomedResult < 1.0 && result >= 1.0)
+        return 1.0;
     return zoomedResult;
 }
 
diff --git a/Source/WebCore/css/CSSPrimitiveValueMappings.h b/Source/WebCore/css/CSSPrimitiveValueMappings.h
index 73491c30d..7d88cec32 100644
--- a/Source/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/Source/WebCore/css/CSSPrimitiveValueMappings.h
@@ -417,6 +417,12 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case MediaControlsFullscreenBackgroundPart:
             m_value.ident = CSSValueMediaControlsFullscreenBackground;
             break;
+        case MediaFullScreenVolumeSliderPart:
+            m_value.ident = CSSValueMediaFullscreenVolumeSlider;
+            break;
+        case MediaFullScreenVolumeSliderThumbPart:
+            m_value.ident = CSSValueMediaFullscreenVolumeSliderThumb;
+            break;
         case MediaCurrentTimePart:
             m_value.ident = CSSValueMediaCurrentTimeDisplay;
             break;
@@ -2200,29 +2206,6 @@ template<> inline CSSPrimitiveValue::operator ETextTransform() const
     }
 }
 
-template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EUnicodeBidi e)
-    : CSSValue(PrimitiveClass)
-{
-    m_primitiveUnitType = CSS_IDENT;
-    switch (e) {
-    case UBNormal:
-        m_value.ident = CSSValueNormal;
-        break;
-    case Embed:
-        m_value.ident = CSSValueEmbed;
-        break;
-    case Override:
-        m_value.ident = CSSValueBidiOverride;
-        break;
-    case Isolate:
-        m_value.ident = CSSValueWebkitIsolate;
-        break;
-    case Plaintext:
-        m_value.ident = CSSValueWebkitPlaintext;
-        break;
-    }
-}
-
 template<> inline CSSPrimitiveValue::operator EUnicodeBidi() const
 {
     switch (m_value.ident) {
diff --git a/Source/WebCore/css/CSSProperty.cpp b/Source/WebCore/css/CSSProperty.cpp
index fd85e9bae..01e7077bf 100644
--- a/Source/WebCore/css/CSSProperty.cpp
+++ b/Source/WebCore/css/CSSProperty.cpp
@@ -573,6 +573,9 @@ bool CSSProperty::isInheritedProperty(unsigned propertyID)
 #if ENABLE(CSS_GRID_LAYOUT)
     case CSSPropertyWebkitGridColumns:
     case CSSPropertyWebkitGridRows:
+
+    case CSSPropertyWebkitGridColumn:
+    case CSSPropertyWebkitGridRow:
 #endif
     case CSSPropertyWebkitLineClamp:
     case CSSPropertyWebkitLogicalWidth:
diff --git a/Source/WebCore/css/CSSProperty.h b/Source/WebCore/css/CSSProperty.h
index 2674544d1..d90d31e68 100644
--- a/Source/WebCore/css/CSSProperty.h
+++ b/Source/WebCore/css/CSSProperty.h
@@ -30,7 +30,6 @@
 namespace WebCore {
 
 class CSSProperty {
-    WTF_MAKE_FAST_ALLOCATED;
 public:
     CSSProperty(unsigned propID, PassRefPtr<CSSValue> value, bool important = false, int shorthandID = 0, bool implicit = false)
         : m_id(propID)
@@ -68,9 +67,4 @@ public:
 
 } // namespace WebCore
 
-namespace WTF {
-    // Properties in Vector can be initialized with memset and moved using memcpy.
-    template<> struct VectorTraits<WebCore::CSSProperty> : SimpleClassVectorTraits { };
-}
-
 #endif // CSSProperty_h
diff --git a/Source/WebCore/css/CSSPropertyNames.in b/Source/WebCore/css/CSSPropertyNames.in
index 9afda37a7..41394466b 100644
--- a/Source/WebCore/css/CSSPropertyNames.in
+++ b/Source/WebCore/css/CSSPropertyNames.in
@@ -376,6 +376,8 @@ z-index
 #if defined(ENABLE_CSS_GRID_LAYOUT) && ENABLE_CSS_GRID_LAYOUT
 -webkit-grid-columns
 -webkit-grid-rows
+-webkit-grid-column
+-webkit-grid-row
 #endif
 #if defined(ENABLE_DASHBOARD_SUPPORT) && ENABLE_DASHBOARD_SUPPORT
 -webkit-dashboard-region
diff --git a/Source/WebCore/css/CSSRule.h b/Source/WebCore/css/CSSRule.h
index 5f5627417..6f9ee410b 100644
--- a/Source/WebCore/css/CSSRule.h
+++ b/Source/WebCore/css/CSSRule.h
@@ -111,8 +111,7 @@ public:
 
 protected:
     CSSRule(CSSStyleSheet* parent, Type type)
-        : m_sourceLine(0)
-        , m_hasCachedSelectorText(false)
+        : m_hasCachedSelectorText(false)
         , m_parentIsRule(false)
         , m_type(type)
         , m_parentStyleSheet(parent)
@@ -124,14 +123,10 @@ protected:
 
     ~CSSRule() { }
 
-    int sourceLine() const { return m_sourceLine; }
-    void setSourceLine(int sourceLine) { m_sourceLine = sourceLine; }
     bool hasCachedSelectorText() const { return m_hasCachedSelectorText; }
     void setHasCachedSelectorText(bool hasCachedSelectorText) const { m_hasCachedSelectorText = hasCachedSelectorText; }
 
 private:
-    // Only used by CSSStyleRule but kept here to maximize struct packing.
-    signed m_sourceLine : 26;
     mutable unsigned m_hasCachedSelectorText : 1;
     unsigned m_parentIsRule : 1;
     unsigned m_type : 4;
diff --git a/Source/WebCore/css/CSSSelector.cpp b/Source/WebCore/css/CSSSelector.cpp
index be28c601b..aee19f6e9 100644
--- a/Source/WebCore/css/CSSSelector.cpp
+++ b/Source/WebCore/css/CSSSelector.cpp
@@ -188,6 +188,7 @@ PseudoId CSSSelector::pseudoId(PseudoType type)
     case PseudoValid:
     case PseudoInvalid:
     case PseudoIndeterminate:
+    case PseudoScope:
     case PseudoTarget:
     case PseudoLang:
     case PseudoNot:
@@ -272,6 +273,7 @@ static HashMap<AtomicStringImpl*, CSSSelector::PseudoType>* nameToPseudoTypeMap(
     DEFINE_STATIC_LOCAL(AtomicString, scrollbarTrack, ("-webkit-scrollbar-track"));
     DEFINE_STATIC_LOCAL(AtomicString, scrollbarTrackPiece, ("-webkit-scrollbar-track-piece"));
     DEFINE_STATIC_LOCAL(AtomicString, selection, ("selection"));
+    DEFINE_STATIC_LOCAL(AtomicString, scope, ("scope"));
     DEFINE_STATIC_LOCAL(AtomicString, target, ("target"));
     DEFINE_STATIC_LOCAL(AtomicString, visited, ("visited"));
     DEFINE_STATIC_LOCAL(AtomicString, windowInactive, ("window-inactive"));
@@ -362,6 +364,7 @@ static HashMap<AtomicStringImpl*, CSSSelector::PseudoType>* nameToPseudoTypeMap(
         nameToPseudoType->set(scrollbarTrackPiece.impl(), CSSSelector::PseudoScrollbarTrackPiece);
         nameToPseudoType->set(cornerPresent.impl(), CSSSelector::PseudoCornerPresent);
         nameToPseudoType->set(selection.impl(), CSSSelector::PseudoSelection);
+        nameToPseudoType->set(scope.impl(), CSSSelector::PseudoScope);
         nameToPseudoType->set(target.impl(), CSSSelector::PseudoTarget);
         nameToPseudoType->set(visited.impl(), CSSSelector::PseudoVisited);
         nameToPseudoType->set(firstPage.impl(), CSSSelector::PseudoFirstPage);
@@ -454,6 +457,7 @@ void CSSSelector::extractPseudoType() const
     case PseudoValid:
     case PseudoInvalid:
     case PseudoIndeterminate:
+    case PseudoScope:
     case PseudoTarget:
     case PseudoLang:
     case PseudoNot:
diff --git a/Source/WebCore/css/CSSSelector.h b/Source/WebCore/css/CSSSelector.h
index afd52def9..112d96cea 100644
--- a/Source/WebCore/css/CSSSelector.h
+++ b/Source/WebCore/css/CSSSelector.h
@@ -144,6 +144,7 @@ namespace WebCore {
             PseudoValid,
             PseudoInvalid,
             PseudoIndeterminate,
+            PseudoScope,
             PseudoTarget,
             PseudoBefore,
             PseudoAfter,
diff --git a/Source/WebCore/css/CSSStyleApplyProperty.cpp b/Source/WebCore/css/CSSStyleApplyProperty.cpp
index 274ceb482..cfd6931d1 100644
--- a/Source/WebCore/css/CSSStyleApplyProperty.cpp
+++ b/Source/WebCore/css/CSSStyleApplyProperty.cpp
@@ -26,6 +26,7 @@
 #include "CSSStyleApplyProperty.h"
 
 #include "CSSAspectRatioValue.h"
+#include "CSSCalculationValue.h"
 #include "CSSCursorImageValue.h"
 #include "CSSFlexValue.h"
 #include "CSSPrimitiveValueMappings.h"
@@ -389,6 +390,8 @@ public:
                 setValue(selector->style(), length);
             } else if (primitiveValue->isPercentage())
                 setValue(selector->style(), Length(primitiveValue->getDoubleValue(), Percent));
+            else if (primitiveValue->isCalculatedPercentageWithLength())
+                setValue(selector->style(), Length(primitiveValue->cssCalcValue()->toCalcValue(selector->style(), selector->rootElementStyle(), selector->style()->effectiveZoom())));            
         }
     }
 
@@ -1144,6 +1147,36 @@ public:
     }
 };
 
+class ApplyPropertyUnicodeBidi {
+public:
+    static void applyValue(CSSStyleSelector* selector, CSSValue* value)
+    {
+        if (value->isValueList()) {
+            EUnicodeBidi rendererUnicodeBidi = RenderStyle::initialUnicodeBidi();
+            for (CSSValueListIterator i = value; i.hasMore(); i.advance()) {
+                CSSValue* item = i.value();
+                ASSERT(item->isPrimitiveValue());
+                EUnicodeBidi currentValue = *static_cast<CSSPrimitiveValue*>(item);
+                ASSERT(currentValue == Override || currentValue == Isolate);
+                if (currentValue != rendererUnicodeBidi && rendererUnicodeBidi != RenderStyle::initialUnicodeBidi())
+                    rendererUnicodeBidi = OverrideIsolate;
+                else
+                    rendererUnicodeBidi = currentValue;
+            }
+            selector->style()->setUnicodeBidi(rendererUnicodeBidi);
+        }
+        if (!value->isPrimitiveValue())
+            return;
+        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+        selector->style()->setUnicodeBidi(*primitiveValue);
+    }
+    static PropertyHandler createHandler()
+    {
+        PropertyHandler handler = ApplyPropertyDefaultBase<EUnicodeBidi, &RenderStyle::unicodeBidi, EUnicodeBidi, &RenderStyle::setUnicodeBidi, EUnicodeBidi, &RenderStyle::initialUnicodeBidi>::createHandler();
+        return PropertyHandler(handler.inheritFunction(), handler.initialFunction(), &applyValue);
+    }
+};
+
 class ApplyPropertyLineHeight {
 public:
     static void applyValue(CSSStyleSelector* selector, CSSValue* value)
@@ -1186,14 +1219,22 @@ private:
     static Length inchLength(double inch) { return CSSPrimitiveValue::create(inch, CSSPrimitiveValue::CSS_IN)->computeLength<Length>(0, 0); }
     static bool getPageSizeFromName(CSSPrimitiveValue* pageSizeName, CSSPrimitiveValue* pageOrientation, Length& width, Length& height)
     {
-        static const Length a5Width = mmLength(148), a5Height = mmLength(210);
-        static const Length a4Width = mmLength(210), a4Height = mmLength(297);
-        static const Length a3Width = mmLength(297), a3Height = mmLength(420);
-        static const Length b5Width = mmLength(176), b5Height = mmLength(250);
-        static const Length b4Width = mmLength(250), b4Height = mmLength(353);
-        static const Length letterWidth = inchLength(8.5), letterHeight = inchLength(11);
-        static const Length legalWidth = inchLength(8.5), legalHeight = inchLength(14);
-        static const Length ledgerWidth = inchLength(11), ledgerHeight = inchLength(17);
+        DEFINE_STATIC_LOCAL(Length, a5Width, (mmLength(148)));
+        DEFINE_STATIC_LOCAL(Length, a5Height, (mmLength(210)));
+        DEFINE_STATIC_LOCAL(Length, a4Width, (mmLength(210)));
+        DEFINE_STATIC_LOCAL(Length, a4Height, (mmLength(297)));
+        DEFINE_STATIC_LOCAL(Length, a3Width, (mmLength(297)));
+        DEFINE_STATIC_LOCAL(Length, a3Height, (mmLength(420)));
+        DEFINE_STATIC_LOCAL(Length, b5Width, (mmLength(176)));
+        DEFINE_STATIC_LOCAL(Length, b5Height, (mmLength(250)));
+        DEFINE_STATIC_LOCAL(Length, b4Width, (mmLength(250)));
+        DEFINE_STATIC_LOCAL(Length, b4Height, (mmLength(353)));
+        DEFINE_STATIC_LOCAL(Length, letterWidth, (inchLength(8.5)));
+        DEFINE_STATIC_LOCAL(Length, letterHeight, (inchLength(11)));
+        DEFINE_STATIC_LOCAL(Length, legalWidth, (inchLength(8.5)));
+        DEFINE_STATIC_LOCAL(Length, legalHeight, (inchLength(14)));
+        DEFINE_STATIC_LOCAL(Length, ledgerWidth, (inchLength(11)));
+        DEFINE_STATIC_LOCAL(Length, ledgerHeight, (inchLength(17)));
 
         if (!pageSizeName)
             return false;
@@ -1684,239 +1725,119 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     for (int i = 0; i < numCSSProperties; ++i)
         m_propertyMap[i] = PropertyHandler();
 
-    setPropertyHandler(CSSPropertyWebkitAspectRatio, ApplyPropertyAspectRatio::createHandler());
-
-    setPropertyHandler(CSSPropertyColor, ApplyPropertyColor<InheritFromParent, &RenderStyle::color, &RenderStyle::setColor, &RenderStyle::setVisitedLinkColor, &RenderStyle::invalidColor, RenderStyle::initialColor>::createHandler());
-    setPropertyHandler(CSSPropertyDirection, ApplyPropertyDirection<&RenderStyle::direction, &RenderStyle::setDirection, RenderStyle::initialDirection>::createHandler());
-
-    setPropertyHandler(CSSPropertyBackgroundAttachment, ApplyPropertyFillLayer<EFillAttachment, CSSPropertyBackgroundAttachment, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isAttachmentSet, &FillLayer::attachment, &FillLayer::setAttachment, &FillLayer::clearAttachment, &FillLayer::initialFillAttachment, &CSSStyleSelector::mapFillAttachment>::createHandler());
-    setPropertyHandler(CSSPropertyBackgroundClip, ApplyPropertyFillLayer<EFillBox, CSSPropertyBackgroundClip, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isClipSet, &FillLayer::clip, &FillLayer::setClip, &FillLayer::clearClip, &FillLayer::initialFillClip, &CSSStyleSelector::mapFillClip>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitBackgroundClip, CSSPropertyBackgroundClip);
-    setPropertyHandler(CSSPropertyWebkitBackgroundComposite, ApplyPropertyFillLayer<CompositeOperator, CSSPropertyWebkitBackgroundComposite, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isCompositeSet, &FillLayer::composite, &FillLayer::setComposite, &FillLayer::clearComposite, &FillLayer::initialFillComposite, &CSSStyleSelector::mapFillComposite>::createHandler());
-
-    setPropertyHandler(CSSPropertyDisplay, ApplyPropertyDisplay::createHandler());
-
-    setPropertyHandler(CSSPropertyBackgroundImage, ApplyPropertyFillLayer<StyleImage*, CSSPropertyBackgroundImage, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isImageSet, &FillLayer::image, &FillLayer::setImage, &FillLayer::clearImage, &FillLayer::initialFillImage, &CSSStyleSelector::mapFillImage>::createHandler());
-
-    setPropertyHandler(CSSPropertyBackgroundOrigin, ApplyPropertyFillLayer<EFillBox, CSSPropertyBackgroundOrigin, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isOriginSet, &FillLayer::origin, &FillLayer::setOrigin, &FillLayer::clearOrigin, &FillLayer::initialFillOrigin, &CSSStyleSelector::mapFillOrigin>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitBackgroundOrigin, CSSPropertyBackgroundOrigin);
-
-    setPropertyHandler(CSSPropertyBackgroundPositionX, ApplyPropertyFillLayer<Length, CSSPropertyBackgroundPositionX, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isXPositionSet, &FillLayer::xPosition, &FillLayer::setXPosition, &FillLayer::clearXPosition, &FillLayer::initialFillXPosition, &CSSStyleSelector::mapFillXPosition>::createHandler());
-    setPropertyHandler(CSSPropertyBackgroundPositionY, ApplyPropertyFillLayer<Length, CSSPropertyBackgroundPositionY, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isYPositionSet, &FillLayer::yPosition, &FillLayer::setYPosition, &FillLayer::clearYPosition, &FillLayer::initialFillYPosition, &CSSStyleSelector::mapFillYPosition>::createHandler());
+    // Please keep CSS property list in alphabetical order.
+    setPropertyHandler(CSSPropertyBackgroundAttachment, ApplyPropertyFillLayer<EFillAttachment, CSSPropertyBackgroundAttachment, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isAttachmentSet, &FillLayer::attachment, &FillLayer::setAttachment, &FillLayer::clearAttachment, &FillLayer::initialFillAttachment, &CSSStyleSelector::mapFillAttachment>::createHandler());
+    setPropertyHandler(CSSPropertyBackgroundClip, ApplyPropertyFillLayer<EFillBox, CSSPropertyBackgroundClip, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isClipSet, &FillLayer::clip, &FillLayer::setClip, &FillLayer::clearClip, &FillLayer::initialFillClip, &CSSStyleSelector::mapFillClip>::createHandler());
+    setPropertyHandler(CSSPropertyBackgroundColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::backgroundColor, &RenderStyle::setBackgroundColor, &RenderStyle::setVisitedLinkBackgroundColor, &RenderStyle::invalidColor>::createHandler());
+    setPropertyHandler(CSSPropertyBackgroundImage, ApplyPropertyFillLayer<StyleImage*, CSSPropertyBackgroundImage, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isImageSet, &FillLayer::image, &FillLayer::setImage, &FillLayer::clearImage, &FillLayer::initialFillImage, &CSSStyleSelector::mapFillImage>::createHandler());
+    setPropertyHandler(CSSPropertyBackgroundOrigin, ApplyPropertyFillLayer<EFillBox, CSSPropertyBackgroundOrigin, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isOriginSet, &FillLayer::origin, &FillLayer::setOrigin, &FillLayer::clearOrigin, &FillLayer::initialFillOrigin, &CSSStyleSelector::mapFillOrigin>::createHandler());
     setPropertyHandler(CSSPropertyBackgroundPosition, ApplyPropertyExpanding<SuppressValue, CSSPropertyBackgroundPositionX, CSSPropertyBackgroundPositionY>::createHandler());
-
-    setPropertyHandler(CSSPropertyBackgroundRepeatX, ApplyPropertyFillLayer<EFillRepeat, CSSPropertyBackgroundRepeatX, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isRepeatXSet, &FillLayer::repeatX, &FillLayer::setRepeatX, &FillLayer::clearRepeatX, &FillLayer::initialFillRepeatX, &CSSStyleSelector::mapFillRepeatX>::createHandler());
-    setPropertyHandler(CSSPropertyBackgroundRepeatY, ApplyPropertyFillLayer<EFillRepeat, CSSPropertyBackgroundRepeatY, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isRepeatYSet, &FillLayer::repeatY, &FillLayer::setRepeatY, &FillLayer::clearRepeatY, &FillLayer::initialFillRepeatY, &CSSStyleSelector::mapFillRepeatY>::createHandler());
+    setPropertyHandler(CSSPropertyBackgroundPositionX, ApplyPropertyFillLayer<Length, CSSPropertyBackgroundPositionX, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isXPositionSet, &FillLayer::xPosition, &FillLayer::setXPosition, &FillLayer::clearXPosition, &FillLayer::initialFillXPosition, &CSSStyleSelector::mapFillXPosition>::createHandler());
+    setPropertyHandler(CSSPropertyBackgroundPositionY, ApplyPropertyFillLayer<Length, CSSPropertyBackgroundPositionY, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isYPositionSet, &FillLayer::yPosition, &FillLayer::setYPosition, &FillLayer::clearYPosition, &FillLayer::initialFillYPosition, &CSSStyleSelector::mapFillYPosition>::createHandler());
     setPropertyHandler(CSSPropertyBackgroundRepeat, ApplyPropertyExpanding<SuppressValue, CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY>::createHandler());
-
-    setPropertyHandler(CSSPropertyBackgroundSize, ApplyPropertyFillLayer<FillSize, CSSPropertyBackgroundSize, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers,
-                       &FillLayer::isSizeSet, &FillLayer::size, &FillLayer::setSize, &FillLayer::clearSize, &FillLayer::initialFillSize, &CSSStyleSelector::mapFillSize>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitBackgroundSize, CSSPropertyBackgroundSize);
-
-    setPropertyHandler(CSSPropertyWebkitMaskAttachment, ApplyPropertyFillLayer<EFillAttachment, CSSPropertyWebkitMaskAttachment, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isAttachmentSet, &FillLayer::attachment, &FillLayer::setAttachment, &FillLayer::clearAttachment, &FillLayer::initialFillAttachment, &CSSStyleSelector::mapFillAttachment>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskClip, ApplyPropertyFillLayer<EFillBox, CSSPropertyWebkitMaskClip, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isClipSet, &FillLayer::clip, &FillLayer::setClip, &FillLayer::clearClip, &FillLayer::initialFillClip, &CSSStyleSelector::mapFillClip>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskComposite, ApplyPropertyFillLayer<CompositeOperator, CSSPropertyWebkitMaskComposite, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isCompositeSet, &FillLayer::composite, &FillLayer::setComposite, &FillLayer::clearComposite, &FillLayer::initialFillComposite, &CSSStyleSelector::mapFillComposite>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitMaskImage, ApplyPropertyFillLayer<StyleImage*, CSSPropertyWebkitMaskImage, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isImageSet, &FillLayer::image, &FillLayer::setImage, &FillLayer::clearImage, &FillLayer::initialFillImage, &CSSStyleSelector::mapFillImage>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitMaskOrigin, ApplyPropertyFillLayer<EFillBox, CSSPropertyWebkitMaskOrigin, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isOriginSet, &FillLayer::origin, &FillLayer::setOrigin, &FillLayer::clearOrigin, &FillLayer::initialFillOrigin, &CSSStyleSelector::mapFillOrigin>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskSize, ApplyPropertyFillLayer<FillSize, CSSPropertyWebkitMaskSize, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isSizeSet, &FillLayer::size, &FillLayer::setSize, &FillLayer::clearSize, &FillLayer::initialFillSize, &CSSStyleSelector::mapFillSize>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitMaskPositionX, ApplyPropertyFillLayer<Length, CSSPropertyWebkitMaskPositionX, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isXPositionSet, &FillLayer::xPosition, &FillLayer::setXPosition, &FillLayer::clearXPosition, &FillLayer::initialFillXPosition, &CSSStyleSelector::mapFillXPosition>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskPositionY, ApplyPropertyFillLayer<Length, CSSPropertyWebkitMaskPositionY, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isYPositionSet, &FillLayer::yPosition, &FillLayer::setYPosition, &FillLayer::clearYPosition, &FillLayer::initialFillYPosition, &CSSStyleSelector::mapFillYPosition>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskPosition, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitMaskPositionX, CSSPropertyWebkitMaskPositionY>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitMaskRepeatX, ApplyPropertyFillLayer<EFillRepeat, CSSPropertyWebkitMaskRepeatX, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isRepeatXSet, &FillLayer::repeatX, &FillLayer::setRepeatX, &FillLayer::clearRepeatX, &FillLayer::initialFillRepeatX, &CSSStyleSelector::mapFillRepeatX>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskRepeatY, ApplyPropertyFillLayer<EFillRepeat, CSSPropertyWebkitMaskRepeatY, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers,
-                       &FillLayer::isRepeatYSet, &FillLayer::repeatY, &FillLayer::setRepeatY, &FillLayer::clearRepeatY, &FillLayer::initialFillRepeatY, &CSSStyleSelector::mapFillRepeatY>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskRepeat, ApplyPropertyExpanding<SuppressValue, CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY>::createHandler());
-
-    setPropertyHandler(CSSPropertyBackgroundColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::backgroundColor, &RenderStyle::setBackgroundColor, &RenderStyle::setVisitedLinkBackgroundColor, &RenderStyle::invalidColor>::createHandler());
-
-    setPropertyHandler(CSSPropertyBorderCollapse, ApplyPropertyDefault<EBorderCollapse, &RenderStyle::borderCollapse, EBorderCollapse, &RenderStyle::setBorderCollapse, EBorderCollapse, &RenderStyle::initialBorderCollapse>::createHandler());
-
+    setPropertyHandler(CSSPropertyBackgroundRepeatX, ApplyPropertyFillLayer<EFillRepeat, CSSPropertyBackgroundRepeatX, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isRepeatXSet, &FillLayer::repeatX, &FillLayer::setRepeatX, &FillLayer::clearRepeatX, &FillLayer::initialFillRepeatX, &CSSStyleSelector::mapFillRepeatX>::createHandler());
+    setPropertyHandler(CSSPropertyBackgroundRepeatY, ApplyPropertyFillLayer<EFillRepeat, CSSPropertyBackgroundRepeatY, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isRepeatYSet, &FillLayer::repeatY, &FillLayer::setRepeatY, &FillLayer::clearRepeatY, &FillLayer::initialFillRepeatY, &CSSStyleSelector::mapFillRepeatY>::createHandler());
+    setPropertyHandler(CSSPropertyBackgroundSize, ApplyPropertyFillLayer<FillSize, CSSPropertyBackgroundSize, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isSizeSet, &FillLayer::size, &FillLayer::setSize, &FillLayer::clearSize, &FillLayer::initialFillSize, &CSSStyleSelector::mapFillSize>::createHandler());
+    setPropertyHandler(CSSPropertyBorder, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderStyle, CSSPropertyBorderWidth, CSSPropertyBorderColor>::createHandler());
+    setPropertyHandler(CSSPropertyBorderBottom, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderBottomColor, CSSPropertyBorderBottomStyle, CSSPropertyBorderBottomWidth>::createHandler());
     setPropertyHandler(CSSPropertyBorderBottomColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderBottomColor, &RenderStyle::setBorderBottomColor, &RenderStyle::setVisitedLinkBorderBottomColor, &RenderStyle::color>::createHandler());
-    setPropertyHandler(CSSPropertyBorderLeftColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderLeftColor, &RenderStyle::setBorderLeftColor, &RenderStyle::setVisitedLinkBorderLeftColor, &RenderStyle::color>::createHandler());
-    setPropertyHandler(CSSPropertyBorderRightColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderRightColor, &RenderStyle::setBorderRightColor, &RenderStyle::setVisitedLinkBorderRightColor, &RenderStyle::color>::createHandler());
-    setPropertyHandler(CSSPropertyBorderTopColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderTopColor, &RenderStyle::setBorderTopColor, &RenderStyle::setVisitedLinkBorderTopColor, &RenderStyle::color>::createHandler());
-
-    setPropertyHandler(CSSPropertyBorderTopStyle, ApplyPropertyDefault<EBorderStyle, &RenderStyle::borderTopStyle, EBorderStyle, &RenderStyle::setBorderTopStyle, EBorderStyle, &RenderStyle::initialBorderStyle>::createHandler());
-    setPropertyHandler(CSSPropertyBorderRightStyle, ApplyPropertyDefault<EBorderStyle, &RenderStyle::borderRightStyle, EBorderStyle, &RenderStyle::setBorderRightStyle, EBorderStyle, &RenderStyle::initialBorderStyle>::createHandler());
+    setPropertyHandler(CSSPropertyBorderBottomLeftRadius, ApplyPropertyBorderRadius<&RenderStyle::borderBottomLeftRadius, &RenderStyle::setBorderBottomLeftRadius, &RenderStyle::initialBorderRadius>::createHandler());
+    setPropertyHandler(CSSPropertyBorderBottomRightRadius, ApplyPropertyBorderRadius<&RenderStyle::borderBottomRightRadius, &RenderStyle::setBorderBottomRightRadius, &RenderStyle::initialBorderRadius>::createHandler());
     setPropertyHandler(CSSPropertyBorderBottomStyle, ApplyPropertyDefault<EBorderStyle, &RenderStyle::borderBottomStyle, EBorderStyle, &RenderStyle::setBorderBottomStyle, EBorderStyle, &RenderStyle::initialBorderStyle>::createHandler());
-    setPropertyHandler(CSSPropertyBorderLeftStyle, ApplyPropertyDefault<EBorderStyle, &RenderStyle::borderLeftStyle, EBorderStyle, &RenderStyle::setBorderLeftStyle, EBorderStyle, &RenderStyle::initialBorderStyle>::createHandler());
-
-    setPropertyHandler(CSSPropertyBorderTopWidth, ApplyPropertyComputeLength<unsigned, &RenderStyle::borderTopWidth, &RenderStyle::setBorderTopWidth, &RenderStyle::initialBorderWidth, NormalDisabled, ThicknessEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyBorderRightWidth, ApplyPropertyComputeLength<unsigned, &RenderStyle::borderRightWidth, &RenderStyle::setBorderRightWidth, &RenderStyle::initialBorderWidth, NormalDisabled, ThicknessEnabled>::createHandler());
     setPropertyHandler(CSSPropertyBorderBottomWidth, ApplyPropertyComputeLength<unsigned, &RenderStyle::borderBottomWidth, &RenderStyle::setBorderBottomWidth, &RenderStyle::initialBorderWidth, NormalDisabled, ThicknessEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyBorderLeftWidth, ApplyPropertyComputeLength<unsigned, &RenderStyle::borderLeftWidth, &RenderStyle::setBorderLeftWidth, &RenderStyle::initialBorderWidth, NormalDisabled, ThicknessEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyOutlineWidth, ApplyPropertyComputeLength<unsigned short, &RenderStyle::outlineWidth, &RenderStyle::setOutlineWidth, &RenderStyle::initialOutlineWidth, NormalDisabled, ThicknessEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitColumnRuleWidth, ApplyPropertyComputeLength<unsigned short, &RenderStyle::columnRuleWidth, &RenderStyle::setColumnRuleWidth, &RenderStyle::initialColumnRuleWidth, NormalDisabled, ThicknessEnabled>::createHandler());
-
-    setPropertyHandler(CSSPropertyBorderTop, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderTopColor, CSSPropertyBorderTopStyle, CSSPropertyBorderTopWidth>::createHandler());
-    setPropertyHandler(CSSPropertyBorderRight, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderRightColor, CSSPropertyBorderRightStyle, CSSPropertyBorderRightWidth>::createHandler());
-    setPropertyHandler(CSSPropertyBorderBottom, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderBottomColor, CSSPropertyBorderBottomStyle, CSSPropertyBorderBottomWidth>::createHandler());
-    setPropertyHandler(CSSPropertyBorderLeft, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderLeftColor, CSSPropertyBorderLeftStyle, CSSPropertyBorderLeftWidth>::createHandler());
-
-    setPropertyHandler(CSSPropertyBorderStyle, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderTopStyle, CSSPropertyBorderRightStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle>::createHandler());
-    setPropertyHandler(CSSPropertyBorderWidth, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderTopWidth, CSSPropertyBorderRightWidth, CSSPropertyBorderBottomWidth, CSSPropertyBorderLeftWidth>::createHandler());
+    setPropertyHandler(CSSPropertyBorderCollapse, ApplyPropertyDefault<EBorderCollapse, &RenderStyle::borderCollapse, EBorderCollapse, &RenderStyle::setBorderCollapse, EBorderCollapse, &RenderStyle::initialBorderCollapse>::createHandler());
     setPropertyHandler(CSSPropertyBorderColor, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderTopColor, CSSPropertyBorderRightColor, CSSPropertyBorderBottomColor, CSSPropertyBorderLeftColor>::createHandler());
-    setPropertyHandler(CSSPropertyBorder, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderStyle, CSSPropertyBorderWidth, CSSPropertyBorderColor>::createHandler());
-
     setPropertyHandler(CSSPropertyBorderImage, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderImageSource, CSSPropertyBorderImageSlice, CSSPropertyBorderImageWidth, CSSPropertyBorderImageOutset, CSSPropertyBorderImageRepeat>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitBorderImage, ApplyPropertyBorderImage<Image, CSSPropertyWebkitBorderImage, &RenderStyle::borderImage, &RenderStyle::setBorderImage>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskBoxImage, ApplyPropertyBorderImage<Mask, CSSPropertyWebkitMaskBoxImage, &RenderStyle::maskBoxImage, &RenderStyle::setMaskBoxImage>::createHandler());
-
     setPropertyHandler(CSSPropertyBorderImageOutset, ApplyPropertyBorderImageModifier<Image, Outset>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskBoxImageOutset, ApplyPropertyBorderImageModifier<Mask, Outset>::createHandler());
     setPropertyHandler(CSSPropertyBorderImageRepeat, ApplyPropertyBorderImageModifier<Image, Repeat>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskBoxImageRepeat, ApplyPropertyBorderImageModifier<Mask, Repeat>::createHandler());
     setPropertyHandler(CSSPropertyBorderImageSlice, ApplyPropertyBorderImageModifier<Image, Slice>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskBoxImageSlice, ApplyPropertyBorderImageModifier<Mask, Slice>::createHandler());
-    setPropertyHandler(CSSPropertyBorderImageWidth, ApplyPropertyBorderImageModifier<Image, Width>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskBoxImageWidth, ApplyPropertyBorderImageModifier<Mask, Width>::createHandler());
-
     setPropertyHandler(CSSPropertyBorderImageSource, ApplyPropertyBorderImageSource<CSSPropertyBorderImageSource, &RenderStyle::borderImageSource, &RenderStyle::setBorderImageSource, &RenderStyle::initialBorderImageSource>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMaskBoxImageSource, ApplyPropertyBorderImageSource<CSSPropertyWebkitMaskBoxImageSource, &RenderStyle::maskBoxImageSource, &RenderStyle::setMaskBoxImageSource, &RenderStyle::initialMaskBoxImageSource>::createHandler());
-
-    setPropertyHandler(CSSPropertyBorderTopLeftRadius, ApplyPropertyBorderRadius<&RenderStyle::borderTopLeftRadius, &RenderStyle::setBorderTopLeftRadius, &RenderStyle::initialBorderRadius>::createHandler());
-    setPropertyHandler(CSSPropertyBorderTopRightRadius, ApplyPropertyBorderRadius<&RenderStyle::borderTopRightRadius, &RenderStyle::setBorderTopRightRadius, &RenderStyle::initialBorderRadius>::createHandler());
-    setPropertyHandler(CSSPropertyBorderBottomLeftRadius, ApplyPropertyBorderRadius<&RenderStyle::borderBottomLeftRadius, &RenderStyle::setBorderBottomLeftRadius, &RenderStyle::initialBorderRadius>::createHandler());
-    setPropertyHandler(CSSPropertyBorderBottomRightRadius, ApplyPropertyBorderRadius<&RenderStyle::borderBottomRightRadius, &RenderStyle::setBorderBottomRightRadius, &RenderStyle::initialBorderRadius>::createHandler());
+    setPropertyHandler(CSSPropertyBorderImageWidth, ApplyPropertyBorderImageModifier<Image, Width>::createHandler());
+    setPropertyHandler(CSSPropertyBorderLeft, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderLeftColor, CSSPropertyBorderLeftStyle, CSSPropertyBorderLeftWidth>::createHandler());
+    setPropertyHandler(CSSPropertyBorderLeftColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderLeftColor, &RenderStyle::setBorderLeftColor, &RenderStyle::setVisitedLinkBorderLeftColor, &RenderStyle::color>::createHandler());
+    setPropertyHandler(CSSPropertyBorderLeftStyle, ApplyPropertyDefault<EBorderStyle, &RenderStyle::borderLeftStyle, EBorderStyle, &RenderStyle::setBorderLeftStyle, EBorderStyle, &RenderStyle::initialBorderStyle>::createHandler());
+    setPropertyHandler(CSSPropertyBorderLeftWidth, ApplyPropertyComputeLength<unsigned, &RenderStyle::borderLeftWidth, &RenderStyle::setBorderLeftWidth, &RenderStyle::initialBorderWidth, NormalDisabled, ThicknessEnabled>::createHandler());
     setPropertyHandler(CSSPropertyBorderRadius, ApplyPropertyExpanding<ExpandValue, CSSPropertyBorderTopLeftRadius, CSSPropertyBorderTopRightRadius, CSSPropertyBorderBottomLeftRadius, CSSPropertyBorderBottomRightRadius>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitBorderRadius, CSSPropertyBorderRadius);
-
-    setPropertyHandler(CSSPropertyWebkitBorderHorizontalSpacing, ApplyPropertyComputeLength<short, &RenderStyle::horizontalBorderSpacing, &RenderStyle::setHorizontalBorderSpacing, &RenderStyle::initialHorizontalBorderSpacing>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitBorderVerticalSpacing, ApplyPropertyComputeLength<short, &RenderStyle::verticalBorderSpacing, &RenderStyle::setVerticalBorderSpacing, &RenderStyle::initialVerticalBorderSpacing>::createHandler());
+    setPropertyHandler(CSSPropertyBorderRight, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderRightColor, CSSPropertyBorderRightStyle, CSSPropertyBorderRightWidth>::createHandler());
+    setPropertyHandler(CSSPropertyBorderRightColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderRightColor, &RenderStyle::setBorderRightColor, &RenderStyle::setVisitedLinkBorderRightColor, &RenderStyle::color>::createHandler());
+    setPropertyHandler(CSSPropertyBorderRightStyle, ApplyPropertyDefault<EBorderStyle, &RenderStyle::borderRightStyle, EBorderStyle, &RenderStyle::setBorderRightStyle, EBorderStyle, &RenderStyle::initialBorderStyle>::createHandler());
+    setPropertyHandler(CSSPropertyBorderRightWidth, ApplyPropertyComputeLength<unsigned, &RenderStyle::borderRightWidth, &RenderStyle::setBorderRightWidth, &RenderStyle::initialBorderWidth, NormalDisabled, ThicknessEnabled>::createHandler());
     setPropertyHandler(CSSPropertyBorderSpacing, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitBorderHorizontalSpacing, CSSPropertyWebkitBorderVerticalSpacing>::createHandler());
-
-    setPropertyHandler(CSSPropertyLetterSpacing, ApplyPropertyComputeLength<int, &RenderStyle::letterSpacing, &RenderStyle::setLetterSpacing, &RenderStyle::initialLetterWordSpacing, NormalEnabled, ThicknessDisabled, SVGZoomEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyWordSpacing, ApplyPropertyComputeLength<int, &RenderStyle::wordSpacing, &RenderStyle::setWordSpacing, &RenderStyle::initialLetterWordSpacing, NormalEnabled, ThicknessDisabled, SVGZoomEnabled>::createHandler());
-
+    setPropertyHandler(CSSPropertyBorderStyle, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderTopStyle, CSSPropertyBorderRightStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle>::createHandler());
+    setPropertyHandler(CSSPropertyBorderTop, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderTopColor, CSSPropertyBorderTopStyle, CSSPropertyBorderTopWidth>::createHandler());
+    setPropertyHandler(CSSPropertyBorderTopColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::borderTopColor, &RenderStyle::setBorderTopColor, &RenderStyle::setVisitedLinkBorderTopColor, &RenderStyle::color>::createHandler());
+    setPropertyHandler(CSSPropertyBorderTopLeftRadius, ApplyPropertyBorderRadius<&RenderStyle::borderTopLeftRadius, &RenderStyle::setBorderTopLeftRadius, &RenderStyle::initialBorderRadius>::createHandler());
+    setPropertyHandler(CSSPropertyBorderTopRightRadius, ApplyPropertyBorderRadius<&RenderStyle::borderTopRightRadius, &RenderStyle::setBorderTopRightRadius, &RenderStyle::initialBorderRadius>::createHandler());
+    setPropertyHandler(CSSPropertyBorderTopStyle, ApplyPropertyDefault<EBorderStyle, &RenderStyle::borderTopStyle, EBorderStyle, &RenderStyle::setBorderTopStyle, EBorderStyle, &RenderStyle::initialBorderStyle>::createHandler());
+    setPropertyHandler(CSSPropertyBorderTopWidth, ApplyPropertyComputeLength<unsigned, &RenderStyle::borderTopWidth, &RenderStyle::setBorderTopWidth, &RenderStyle::initialBorderWidth, NormalDisabled, ThicknessEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyBorderWidth, ApplyPropertyExpanding<SuppressValue, CSSPropertyBorderTopWidth, CSSPropertyBorderRightWidth, CSSPropertyBorderBottomWidth, CSSPropertyBorderLeftWidth>::createHandler());
+    setPropertyHandler(CSSPropertyBottom, ApplyPropertyLength<&RenderStyle::bottom, &RenderStyle::setBottom, &RenderStyle::initialOffset, AutoEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyBoxSizing, ApplyPropertyDefault<EBoxSizing, &RenderStyle::boxSizing, EBoxSizing, &RenderStyle::setBoxSizing, EBoxSizing, &RenderStyle::initialBoxSizing>::createHandler());
     setPropertyHandler(CSSPropertyCaptionSide, ApplyPropertyDefault<ECaptionSide, &RenderStyle::captionSide, ECaptionSide, &RenderStyle::setCaptionSide, ECaptionSide, &RenderStyle::initialCaptionSide>::createHandler());
     setPropertyHandler(CSSPropertyClear, ApplyPropertyDefault<EClear, &RenderStyle::clear, EClear, &RenderStyle::setClear, EClear, &RenderStyle::initialClear>::createHandler());
-
     setPropertyHandler(CSSPropertyClip, ApplyPropertyClip::createHandler());
-
-    setPropertyHandler(CSSPropertyCursor, ApplyPropertyCursor::createHandler());
-
+    setPropertyHandler(CSSPropertyColor, ApplyPropertyColor<InheritFromParent, &RenderStyle::color, &RenderStyle::setColor, &RenderStyle::setVisitedLinkColor, &RenderStyle::invalidColor, RenderStyle::initialColor>::createHandler());
     setPropertyHandler(CSSPropertyCounterIncrement, ApplyPropertyCounter<Increment>::createHandler());
     setPropertyHandler(CSSPropertyCounterReset, ApplyPropertyCounter<Reset>::createHandler());
-
+    setPropertyHandler(CSSPropertyCursor, ApplyPropertyCursor::createHandler());
+    setPropertyHandler(CSSPropertyDirection, ApplyPropertyDirection<&RenderStyle::direction, &RenderStyle::setDirection, RenderStyle::initialDirection>::createHandler());
+    setPropertyHandler(CSSPropertyDisplay, ApplyPropertyDisplay::createHandler());
     setPropertyHandler(CSSPropertyEmptyCells, ApplyPropertyDefault<EEmptyCell, &RenderStyle::emptyCells, EEmptyCell, &RenderStyle::setEmptyCells, EEmptyCell, &RenderStyle::initialEmptyCells>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitFlexOrder, ApplyPropertyDefault<int, &RenderStyle::flexOrder, int, &RenderStyle::setFlexOrder, int, &RenderStyle::initialFlexOrder>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFlexPack, ApplyPropertyDefault<EFlexPack, &RenderStyle::flexPack, EFlexPack, &RenderStyle::setFlexPack, EFlexPack, &RenderStyle::initialFlexPack>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFlexAlign, ApplyPropertyDefault<EFlexAlign, &RenderStyle::flexAlign, EFlexAlign, &RenderStyle::setFlexAlign, EFlexAlign, &RenderStyle::initialFlexAlign>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFlexItemAlign, ApplyPropertyDefault<EFlexAlign, &RenderStyle::flexItemAlign, EFlexAlign, &RenderStyle::setFlexItemAlign, EFlexAlign, &RenderStyle::initialFlexItemAlign>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFlexDirection, ApplyPropertyDefault<EFlexDirection, &RenderStyle::flexDirection, EFlexDirection, &RenderStyle::setFlexDirection, EFlexDirection, &RenderStyle::initialFlexDirection>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFlexWrap, ApplyPropertyDefault<EFlexWrap, &RenderStyle::flexWrap, EFlexWrap, &RenderStyle::setFlexWrap, EFlexWrap, &RenderStyle::initialFlexWrap>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFlexFlow, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitFlexDirection, CSSPropertyWebkitFlexWrap>::createHandler());
-
     setPropertyHandler(CSSPropertyFloat, ApplyPropertyDefault<EFloat, &RenderStyle::floating, EFloat, &RenderStyle::setFloating, EFloat, &RenderStyle::initialFloating>::createHandler());
-
     setPropertyHandler(CSSPropertyFontSize, ApplyPropertyFontSize::createHandler());
     setPropertyHandler(CSSPropertyFontStyle, ApplyPropertyFont<FontItalic, &FontDescription::italic, &FontDescription::setItalic, FontItalicOff>::createHandler());
     setPropertyHandler(CSSPropertyFontVariant, ApplyPropertyFont<FontSmallCaps, &FontDescription::smallCaps, &FontDescription::setSmallCaps, FontSmallCapsOff>::createHandler());
-    setPropertyHandler(CSSPropertyTextRendering, ApplyPropertyFont<TextRenderingMode, &FontDescription::textRenderingMode, &FontDescription::setTextRenderingMode, AutoTextRendering>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFontKerning, ApplyPropertyFont<FontDescription::Kerning, &FontDescription::kerning, &FontDescription::setKerning, FontDescription::AutoKerning>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFontSmoothing, ApplyPropertyFont<FontSmoothingMode, &FontDescription::fontSmoothing, &FontDescription::setFontSmoothing, AutoSmoothing>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTextOrientation, ApplyPropertyFont<TextOrientation, &FontDescription::textOrientation, &FontDescription::setTextOrientation, TextOrientationVerticalRight>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFontVariantLigatures, ApplyPropertyFontVariantLigatures::createHandler());
     setPropertyHandler(CSSPropertyFontWeight, ApplyPropertyFontWeight::createHandler());
-
-    setPropertyHandler(CSSPropertyTextAlign, ApplyPropertyTextAlign::createHandler());
-    setPropertyHandler(CSSPropertyTextDecoration, ApplyPropertyTextDecoration::createHandler());
-
-    setPropertyHandler(CSSPropertyOutlineStyle, ApplyPropertyOutlineStyle::createHandler());
-    setPropertyHandler(CSSPropertyOutlineColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::outlineColor, &RenderStyle::setOutlineColor, &RenderStyle::setVisitedLinkOutlineColor, &RenderStyle::color>::createHandler());
-    setPropertyHandler(CSSPropertyOutlineOffset, ApplyPropertyComputeLength<int, &RenderStyle::outlineOffset, &RenderStyle::setOutlineOffset, &RenderStyle::initialOutlineOffset>::createHandler());
-
-    setPropertyHandler(CSSPropertyOutline, ApplyPropertyExpanding<SuppressValue, CSSPropertyOutlineWidth, CSSPropertyOutlineColor, CSSPropertyOutlineStyle>::createHandler());
-
-    setPropertyHandler(CSSPropertyOverflowX, ApplyPropertyDefault<EOverflow, &RenderStyle::overflowX, EOverflow, &RenderStyle::setOverflowX, EOverflow, &RenderStyle::initialOverflowX>::createHandler());
-    setPropertyHandler(CSSPropertyOverflowY, ApplyPropertyDefault<EOverflow, &RenderStyle::overflowY, EOverflow, &RenderStyle::setOverflowY, EOverflow, &RenderStyle::initialOverflowY>::createHandler());
-    setPropertyHandler(CSSPropertyOverflow, ApplyPropertyExpanding<ExpandValue, CSSPropertyOverflowX, CSSPropertyOverflowY>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitColumnRuleColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::columnRuleColor, &RenderStyle::setColumnRuleColor, &RenderStyle::setVisitedLinkColumnRuleColor, &RenderStyle::color>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTextEmphasisColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::textEmphasisColor, &RenderStyle::setTextEmphasisColor, &RenderStyle::setVisitedLinkTextEmphasisColor, &RenderStyle::color>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTextFillColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::textFillColor, &RenderStyle::setTextFillColor, &RenderStyle::setVisitedLinkTextFillColor, &RenderStyle::color>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitTextStrokeColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::textStrokeColor, &RenderStyle::setTextStrokeColor, &RenderStyle::setVisitedLinkTextStrokeColor, &RenderStyle::color>::createHandler());
-
-    setPropertyHandler(CSSPropertyTop, ApplyPropertyLength<&RenderStyle::top, &RenderStyle::setTop, &RenderStyle::initialOffset, AutoEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyRight, ApplyPropertyLength<&RenderStyle::right, &RenderStyle::setRight, &RenderStyle::initialOffset, AutoEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyBottom, ApplyPropertyLength<&RenderStyle::bottom, &RenderStyle::setBottom, &RenderStyle::initialOffset, AutoEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyLeft, ApplyPropertyLength<&RenderStyle::left, &RenderStyle::setLeft, &RenderStyle::initialOffset, AutoEnabled>::createHandler());
-
-    setPropertyHandler(CSSPropertyWidth, ApplyPropertyLength<&RenderStyle::width, &RenderStyle::setWidth, &RenderStyle::initialSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled, NoneDisabled, UndefinedDisabled, FlexWidth>::createHandler());
     setPropertyHandler(CSSPropertyHeight, ApplyPropertyLength<&RenderStyle::height, &RenderStyle::setHeight, &RenderStyle::initialSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled, NoneDisabled, UndefinedDisabled, FlexHeight>::createHandler());
-
-    setPropertyHandler(CSSPropertyTextIndent, ApplyPropertyLength<&RenderStyle::textIndent, &RenderStyle::setTextIndent, &RenderStyle::initialTextIndent>::createHandler());
-
+    setPropertyHandler(CSSPropertyImageRendering, ApplyPropertyDefault<EImageRendering, &RenderStyle::imageRendering, EImageRendering, &RenderStyle::setImageRendering, EImageRendering, &RenderStyle::initialImageRendering>::createHandler());
+    setPropertyHandler(CSSPropertyLeft, ApplyPropertyLength<&RenderStyle::left, &RenderStyle::setLeft, &RenderStyle::initialOffset, AutoEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyLetterSpacing, ApplyPropertyComputeLength<int, &RenderStyle::letterSpacing, &RenderStyle::setLetterSpacing, &RenderStyle::initialLetterWordSpacing, NormalEnabled, ThicknessDisabled, SVGZoomEnabled>::createHandler());
     setPropertyHandler(CSSPropertyLineHeight, ApplyPropertyLineHeight::createHandler());
-
+    setPropertyHandler(CSSPropertyListStyle, ApplyPropertyExpanding<SuppressValue, CSSPropertyListStyleType, CSSPropertyListStyleImage, CSSPropertyListStylePosition>::createHandler());
     setPropertyHandler(CSSPropertyListStyleImage, ApplyPropertyStyleImage<&RenderStyle::listStyleImage, &RenderStyle::setListStyleImage, &RenderStyle::initialListStyleImage, CSSPropertyListStyleImage>::createHandler());
     setPropertyHandler(CSSPropertyListStylePosition, ApplyPropertyDefault<EListStylePosition, &RenderStyle::listStylePosition, EListStylePosition, &RenderStyle::setListStylePosition, EListStylePosition, &RenderStyle::initialListStylePosition>::createHandler());
     setPropertyHandler(CSSPropertyListStyleType, ApplyPropertyDefault<EListStyleType, &RenderStyle::listStyleType, EListStyleType, &RenderStyle::setListStyleType, EListStyleType, &RenderStyle::initialListStyleType>::createHandler());
-    setPropertyHandler(CSSPropertyListStyle, ApplyPropertyExpanding<SuppressValue, CSSPropertyListStyleType, CSSPropertyListStyleImage, CSSPropertyListStylePosition>::createHandler());
-
+    setPropertyHandler(CSSPropertyMargin, ApplyPropertyExpanding<SuppressValue, CSSPropertyMarginTop, CSSPropertyMarginRight, CSSPropertyMarginBottom, CSSPropertyMarginLeft>::createHandler());
+    setPropertyHandler(CSSPropertyMarginBottom, ApplyPropertyLength<&RenderStyle::marginBottom, &RenderStyle::setMarginBottom, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyMarginLeft, ApplyPropertyLength<&RenderStyle::marginLeft, &RenderStyle::setMarginLeft, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyMarginRight, ApplyPropertyLength<&RenderStyle::marginRight, &RenderStyle::setMarginRight, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyMarginTop, ApplyPropertyLength<&RenderStyle::marginTop, &RenderStyle::setMarginTop, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
     setPropertyHandler(CSSPropertyMaxHeight, ApplyPropertyLength<&RenderStyle::maxHeight, &RenderStyle::setMaxHeight, &RenderStyle::initialMaxSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled, NoneEnabled, UndefinedEnabled>::createHandler());
     setPropertyHandler(CSSPropertyMaxWidth, ApplyPropertyLength<&RenderStyle::maxWidth, &RenderStyle::setMaxWidth, &RenderStyle::initialMaxSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled, NoneEnabled, UndefinedEnabled>::createHandler());
     setPropertyHandler(CSSPropertyMinHeight, ApplyPropertyLength<&RenderStyle::minHeight, &RenderStyle::setMinHeight, &RenderStyle::initialMinSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled>::createHandler());
     setPropertyHandler(CSSPropertyMinWidth, ApplyPropertyLength<&RenderStyle::minWidth, &RenderStyle::setMinWidth, &RenderStyle::initialMinSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled>::createHandler());
-
-    setPropertyHandler(CSSPropertyMarginTop, ApplyPropertyLength<&RenderStyle::marginTop, &RenderStyle::setMarginTop, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyMarginRight, ApplyPropertyLength<&RenderStyle::marginRight, &RenderStyle::setMarginRight, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyMarginBottom, ApplyPropertyLength<&RenderStyle::marginBottom, &RenderStyle::setMarginBottom, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyMarginLeft, ApplyPropertyLength<&RenderStyle::marginLeft, &RenderStyle::setMarginLeft, &RenderStyle::initialMargin, AutoEnabled>::createHandler());
-    setPropertyHandler(CSSPropertyMargin, ApplyPropertyExpanding<SuppressValue, CSSPropertyMarginTop, CSSPropertyMarginRight, CSSPropertyMarginBottom, CSSPropertyMarginLeft>::createHandler());
-
-    setPropertyHandler(CSSPropertyWebkitMarginBeforeCollapse, ApplyPropertyDefault<EMarginCollapse, &RenderStyle::marginBeforeCollapse, EMarginCollapse, &RenderStyle::setMarginBeforeCollapse, EMarginCollapse, &RenderStyle::initialMarginBeforeCollapse>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMarginAfterCollapse, ApplyPropertyDefault<EMarginCollapse, &RenderStyle::marginAfterCollapse, EMarginCollapse, &RenderStyle::setMarginAfterCollapse, EMarginCollapse, &RenderStyle::initialMarginAfterCollapse>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitMarginTopCollapse, CSSPropertyWebkitMarginBeforeCollapse);
-    setPropertyHandler(CSSPropertyWebkitMarginBottomCollapse, CSSPropertyWebkitMarginAfterCollapse);
-    setPropertyHandler(CSSPropertyWebkitMarginCollapse, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitMarginBeforeCollapse, CSSPropertyWebkitMarginAfterCollapse>::createHandler());
-
-    setPropertyHandler(CSSPropertyPaddingTop, ApplyPropertyLength<&RenderStyle::paddingTop, &RenderStyle::setPaddingTop, &RenderStyle::initialPadding>::createHandler());
-    setPropertyHandler(CSSPropertyPaddingRight, ApplyPropertyLength<&RenderStyle::paddingRight, &RenderStyle::setPaddingRight, &RenderStyle::initialPadding>::createHandler());
+    setPropertyHandler(CSSPropertyOrphans, ApplyPropertyDefault<short, &RenderStyle::orphans, short, &RenderStyle::setOrphans, short, &RenderStyle::initialOrphans>::createHandler());
+    setPropertyHandler(CSSPropertyOutline, ApplyPropertyExpanding<SuppressValue, CSSPropertyOutlineWidth, CSSPropertyOutlineColor, CSSPropertyOutlineStyle>::createHandler());
+    setPropertyHandler(CSSPropertyOutlineColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::outlineColor, &RenderStyle::setOutlineColor, &RenderStyle::setVisitedLinkOutlineColor, &RenderStyle::color>::createHandler());
+    setPropertyHandler(CSSPropertyOutlineOffset, ApplyPropertyComputeLength<int, &RenderStyle::outlineOffset, &RenderStyle::setOutlineOffset, &RenderStyle::initialOutlineOffset>::createHandler());
+    setPropertyHandler(CSSPropertyOutlineStyle, ApplyPropertyOutlineStyle::createHandler());
+    setPropertyHandler(CSSPropertyOutlineWidth, ApplyPropertyComputeLength<unsigned short, &RenderStyle::outlineWidth, &RenderStyle::setOutlineWidth, &RenderStyle::initialOutlineWidth, NormalDisabled, ThicknessEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyOverflow, ApplyPropertyExpanding<ExpandValue, CSSPropertyOverflowX, CSSPropertyOverflowY>::createHandler());
+    setPropertyHandler(CSSPropertyOverflowX, ApplyPropertyDefault<EOverflow, &RenderStyle::overflowX, EOverflow, &RenderStyle::setOverflowX, EOverflow, &RenderStyle::initialOverflowX>::createHandler());
+    setPropertyHandler(CSSPropertyOverflowY, ApplyPropertyDefault<EOverflow, &RenderStyle::overflowY, EOverflow, &RenderStyle::setOverflowY, EOverflow, &RenderStyle::initialOverflowY>::createHandler());
+    setPropertyHandler(CSSPropertyPadding, ApplyPropertyExpanding<SuppressValue, CSSPropertyPaddingTop, CSSPropertyPaddingRight, CSSPropertyPaddingBottom, CSSPropertyPaddingLeft>::createHandler());
     setPropertyHandler(CSSPropertyPaddingBottom, ApplyPropertyLength<&RenderStyle::paddingBottom, &RenderStyle::setPaddingBottom, &RenderStyle::initialPadding>::createHandler());
     setPropertyHandler(CSSPropertyPaddingLeft, ApplyPropertyLength<&RenderStyle::paddingLeft, &RenderStyle::setPaddingLeft, &RenderStyle::initialPadding>::createHandler());
-    setPropertyHandler(CSSPropertyPadding, ApplyPropertyExpanding<SuppressValue, CSSPropertyPaddingTop, CSSPropertyPaddingRight, CSSPropertyPaddingBottom, CSSPropertyPaddingLeft>::createHandler());
-
+    setPropertyHandler(CSSPropertyPaddingRight, ApplyPropertyLength<&RenderStyle::paddingRight, &RenderStyle::setPaddingRight, &RenderStyle::initialPadding>::createHandler());
+    setPropertyHandler(CSSPropertyPaddingTop, ApplyPropertyLength<&RenderStyle::paddingTop, &RenderStyle::setPaddingTop, &RenderStyle::initialPadding>::createHandler());
     setPropertyHandler(CSSPropertyPageBreakAfter, ApplyPropertyDefault<EPageBreak, &RenderStyle::pageBreakAfter, EPageBreak, &RenderStyle::setPageBreakAfter, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
     setPropertyHandler(CSSPropertyPageBreakBefore, ApplyPropertyDefault<EPageBreak, &RenderStyle::pageBreakBefore, EPageBreak, &RenderStyle::setPageBreakBefore, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
     setPropertyHandler(CSSPropertyPageBreakInside, ApplyPropertyDefault<EPageBreak, &RenderStyle::pageBreakInside, EPageBreak, &RenderStyle::setPageBreakInside, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
-
     setPropertyHandler(CSSPropertyPosition, ApplyPropertyDefault<EPosition, &RenderStyle::position, EPosition, &RenderStyle::setPosition, EPosition, &RenderStyle::initialPosition>::createHandler());
-
     setPropertyHandler(CSSPropertyResize, ApplyPropertyResize::createHandler());
+    setPropertyHandler(CSSPropertyRight, ApplyPropertyLength<&RenderStyle::right, &RenderStyle::setRight, &RenderStyle::initialOffset, AutoEnabled>::createHandler());
     setPropertyHandler(CSSPropertySize, ApplyPropertyPageSize::createHandler());
+    setPropertyHandler(CSSPropertySpeak, ApplyPropertyDefault<ESpeak, &RenderStyle::speak, ESpeak, &RenderStyle::setSpeak, ESpeak, &RenderStyle::initialSpeak>::createHandler());
     setPropertyHandler(CSSPropertyTableLayout, ApplyPropertyDefault<ETableLayout, &RenderStyle::tableLayout, ETableLayout, &RenderStyle::setTableLayout, ETableLayout, &RenderStyle::initialTableLayout>::createHandler());
+    setPropertyHandler(CSSPropertyTextAlign, ApplyPropertyTextAlign::createHandler());
+    setPropertyHandler(CSSPropertyTextDecoration, ApplyPropertyTextDecoration::createHandler());
+    setPropertyHandler(CSSPropertyTextIndent, ApplyPropertyLength<&RenderStyle::textIndent, &RenderStyle::setTextIndent, &RenderStyle::initialTextIndent>::createHandler());
+    setPropertyHandler(CSSPropertyTextRendering, ApplyPropertyFont<TextRenderingMode, &FontDescription::textRenderingMode, &FontDescription::setTextRenderingMode, AutoTextRendering>::createHandler());
     setPropertyHandler(CSSPropertyTextTransform, ApplyPropertyDefault<ETextTransform, &RenderStyle::textTransform, ETextTransform, &RenderStyle::setTextTransform, ETextTransform, &RenderStyle::initialTextTransform>::createHandler());
-    setPropertyHandler(CSSPropertyUnicodeBidi, ApplyPropertyDefault<EUnicodeBidi, &RenderStyle::unicodeBidi, EUnicodeBidi, &RenderStyle::setUnicodeBidi, EUnicodeBidi, &RenderStyle::initialUnicodeBidi>::createHandler());
+    setPropertyHandler(CSSPropertyTop, ApplyPropertyLength<&RenderStyle::top, &RenderStyle::setTop, &RenderStyle::initialOffset, AutoEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyUnicodeBidi, ApplyPropertyUnicodeBidi::createHandler());
     setPropertyHandler(CSSPropertyVerticalAlign, ApplyPropertyVerticalAlign::createHandler());
     setPropertyHandler(CSSPropertyVisibility, ApplyPropertyDefault<EVisibility, &RenderStyle::visibility, EVisibility, &RenderStyle::setVisibility, EVisibility, &RenderStyle::initialVisibility>::createHandler());
-    setPropertyHandler(CSSPropertyWhiteSpace, ApplyPropertyDefault<EWhiteSpace, &RenderStyle::whiteSpace, EWhiteSpace, &RenderStyle::setWhiteSpace, EWhiteSpace, &RenderStyle::initialWhiteSpace>::createHandler());
-    setPropertyHandler(CSSPropertyWordBreak, ApplyPropertyDefault<EWordBreak, &RenderStyle::wordBreak, EWordBreak, &RenderStyle::setWordBreak, EWordBreak, &RenderStyle::initialWordBreak>::createHandler());
-    setPropertyHandler(CSSPropertyWordWrap, ApplyPropertyDefault<EWordWrap, &RenderStyle::wordWrap, EWordWrap, &RenderStyle::setWordWrap, EWordWrap, &RenderStyle::initialWordWrap>::createHandler());
-
     setPropertyHandler(CSSPropertyWebkitAnimationDelay, ApplyPropertyAnimation<double, &Animation::delay, &Animation::setDelay, &Animation::isDelaySet, &Animation::clearDelay, &Animation::initialAnimationDelay, &CSSStyleSelector::mapAnimationDelay, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAnimationDirection, ApplyPropertyAnimation<Animation::AnimationDirection, &Animation::direction, &Animation::setDirection, &Animation::isDirectionSet, &Animation::clearDirection, &Animation::initialAnimationDirection, &CSSStyleSelector::mapAnimationDirection, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAnimationDuration, ApplyPropertyAnimation<double, &Animation::duration, &Animation::setDuration, &Animation::isDurationSet, &Animation::clearDuration, &Animation::initialAnimationDuration, &CSSStyleSelector::mapAnimationDuration, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
@@ -1926,7 +1847,17 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyWebkitAnimationPlayState, ApplyPropertyAnimation<EAnimPlayState, &Animation::playState, &Animation::setPlayState, &Animation::isPlayStateSet, &Animation::clearPlayState, &Animation::initialAnimationPlayState, &CSSStyleSelector::mapAnimationPlayState, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAnimationTimingFunction, ApplyPropertyAnimation<const PassRefPtr<TimingFunction>, &Animation::timingFunction, &Animation::setTimingFunction, &Animation::isTimingFunctionSet, &Animation::clearTimingFunction, &Animation::initialAnimationTimingFunction, &CSSStyleSelector::mapAnimationTimingFunction, &RenderStyle::accessAnimations, &RenderStyle::animations>::createHandler());
     setPropertyHandler(CSSPropertyWebkitAppearance, ApplyPropertyDefault<ControlPart, &RenderStyle::appearance, ControlPart, &RenderStyle::setAppearance, ControlPart, &RenderStyle::initialAppearance>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitAspectRatio, ApplyPropertyAspectRatio::createHandler());
     setPropertyHandler(CSSPropertyWebkitBackfaceVisibility, ApplyPropertyDefault<EBackfaceVisibility, &RenderStyle::backfaceVisibility, EBackfaceVisibility, &RenderStyle::setBackfaceVisibility, EBackfaceVisibility, &RenderStyle::initialBackfaceVisibility>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBackgroundClip, CSSPropertyBackgroundClip);
+    setPropertyHandler(CSSPropertyWebkitBackgroundComposite, ApplyPropertyFillLayer<CompositeOperator, CSSPropertyWebkitBackgroundComposite, BackgroundFillLayer, &RenderStyle::accessBackgroundLayers, &RenderStyle::backgroundLayers, &FillLayer::isCompositeSet, &FillLayer::composite, &FillLayer::setComposite, &FillLayer::clearComposite, &FillLayer::initialFillComposite, &CSSStyleSelector::mapFillComposite>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBackgroundOrigin, CSSPropertyBackgroundOrigin);
+    setPropertyHandler(CSSPropertyWebkitBackgroundSize, CSSPropertyBackgroundSize);
+    setPropertyHandler(CSSPropertyWebkitBorderFit, ApplyPropertyDefault<EBorderFit, &RenderStyle::borderFit, EBorderFit, &RenderStyle::setBorderFit, EBorderFit, &RenderStyle::initialBorderFit>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBorderHorizontalSpacing, ApplyPropertyComputeLength<short, &RenderStyle::horizontalBorderSpacing, &RenderStyle::setHorizontalBorderSpacing, &RenderStyle::initialHorizontalBorderSpacing>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBorderImage, ApplyPropertyBorderImage<Image, CSSPropertyWebkitBorderImage, &RenderStyle::borderImage, &RenderStyle::setBorderImage>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitBorderRadius, CSSPropertyBorderRadius);
+    setPropertyHandler(CSSPropertyWebkitBorderVerticalSpacing, ApplyPropertyComputeLength<short, &RenderStyle::verticalBorderSpacing, &RenderStyle::setVerticalBorderSpacing, &RenderStyle::initialVerticalBorderSpacing>::createHandler());
     setPropertyHandler(CSSPropertyWebkitBoxAlign, ApplyPropertyDefault<EBoxAlignment, &RenderStyle::boxAlign, EBoxAlignment, &RenderStyle::setBoxAlign, EBoxAlignment, &RenderStyle::initialBoxAlign>::createHandler());
     setPropertyHandler(CSSPropertyWebkitBoxDirection, ApplyPropertyDefault<EBoxDirection, &RenderStyle::boxDirection, EBoxDirection, &RenderStyle::setBoxDirection, EBoxDirection, &RenderStyle::initialBoxDirection>::createHandler());
     setPropertyHandler(CSSPropertyWebkitBoxFlex, ApplyPropertyDefault<float, &RenderStyle::boxFlex, float, &RenderStyle::setBoxFlex, float, &RenderStyle::initialBoxFlex>::createHandler());
@@ -1935,36 +1866,85 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyWebkitBoxOrdinalGroup, ApplyPropertyDefault<unsigned int, &RenderStyle::boxOrdinalGroup, unsigned int, &RenderStyle::setBoxOrdinalGroup, unsigned int, &RenderStyle::initialBoxOrdinalGroup>::createHandler());
     setPropertyHandler(CSSPropertyWebkitBoxOrient, ApplyPropertyDefault<EBoxOrient, &RenderStyle::boxOrient, EBoxOrient, &RenderStyle::setBoxOrient, EBoxOrient, &RenderStyle::initialBoxOrient>::createHandler());
     setPropertyHandler(CSSPropertyWebkitBoxPack, ApplyPropertyDefault<EBoxPack, &RenderStyle::boxPack, EBoxPack, &RenderStyle::setBoxPack, EBoxPack, &RenderStyle::initialBoxPack>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColorCorrection, ApplyPropertyDefault<ColorSpace, &RenderStyle::colorSpace, ColorSpace, &RenderStyle::setColorSpace, ColorSpace, &RenderStyle::initialColorSpace>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnAxis, ApplyPropertyDefault<ColumnAxis, &RenderStyle::columnAxis, ColumnAxis, &RenderStyle::setColumnAxis, ColumnAxis, &RenderStyle::initialColumnAxis>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnBreakAfter, ApplyPropertyDefault<EPageBreak, &RenderStyle::columnBreakAfter, EPageBreak, &RenderStyle::setColumnBreakAfter, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnBreakBefore, ApplyPropertyDefault<EPageBreak, &RenderStyle::columnBreakBefore, EPageBreak, &RenderStyle::setColumnBreakBefore, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnBreakInside, ApplyPropertyDefault<EPageBreak, &RenderStyle::columnBreakInside, EPageBreak, &RenderStyle::setColumnBreakInside, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
     setPropertyHandler(CSSPropertyWebkitColumnCount, ApplyPropertyAuto<unsigned short, &RenderStyle::columnCount, &RenderStyle::setColumnCount, &RenderStyle::hasAutoColumnCount, &RenderStyle::setHasAutoColumnCount>::createHandler());
     setPropertyHandler(CSSPropertyWebkitColumnGap, ApplyPropertyAuto<float, &RenderStyle::columnGap, &RenderStyle::setColumnGap, &RenderStyle::hasNormalColumnGap, &RenderStyle::setHasNormalColumnGap, ComputeLength, CSSValueNormal>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnRuleColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::columnRuleColor, &RenderStyle::setColumnRuleColor, &RenderStyle::setVisitedLinkColumnRuleColor, &RenderStyle::color>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnRuleWidth, ApplyPropertyComputeLength<unsigned short, &RenderStyle::columnRuleWidth, &RenderStyle::setColumnRuleWidth, &RenderStyle::initialColumnRuleWidth, NormalDisabled, ThicknessEnabled>::createHandler());
     setPropertyHandler(CSSPropertyWebkitColumns, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitColumnWidth, CSSPropertyWebkitColumnCount>::createHandler());
     setPropertyHandler(CSSPropertyWebkitColumnSpan, ApplyPropertyDefault<ColumnSpan, &RenderStyle::columnSpan, ColumnSpan, &RenderStyle::setColumnSpan, ColumnSpan, &RenderStyle::initialColumnSpan>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitColumnRuleStyle, ApplyPropertyDefault<EBorderStyle, &RenderStyle::columnRuleStyle, EBorderStyle, &RenderStyle::setColumnRuleStyle, EBorderStyle, &RenderStyle::initialBorderStyle>::createHandler());
     setPropertyHandler(CSSPropertyWebkitColumnWidth, ApplyPropertyAuto<float, &RenderStyle::columnWidth, &RenderStyle::setColumnWidth, &RenderStyle::hasAutoColumnWidth, &RenderStyle::setHasAutoColumnWidth, ComputeLength>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexAlign, ApplyPropertyDefault<EFlexAlign, &RenderStyle::flexAlign, EFlexAlign, &RenderStyle::setFlexAlign, EFlexAlign, &RenderStyle::initialFlexAlign>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexDirection, ApplyPropertyDefault<EFlexDirection, &RenderStyle::flexDirection, EFlexDirection, &RenderStyle::setFlexDirection, EFlexDirection, &RenderStyle::initialFlexDirection>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexFlow, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitFlexDirection, CSSPropertyWebkitFlexWrap>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexItemAlign, ApplyPropertyDefault<EFlexAlign, &RenderStyle::flexItemAlign, EFlexAlign, &RenderStyle::setFlexItemAlign, EFlexAlign, &RenderStyle::initialFlexItemAlign>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexOrder, ApplyPropertyDefault<int, &RenderStyle::flexOrder, int, &RenderStyle::setFlexOrder, int, &RenderStyle::initialFlexOrder>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexPack, ApplyPropertyDefault<EFlexPack, &RenderStyle::flexPack, EFlexPack, &RenderStyle::setFlexPack, EFlexPack, &RenderStyle::initialFlexPack>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlexWrap, ApplyPropertyDefault<EFlexWrap, &RenderStyle::flexWrap, EFlexWrap, &RenderStyle::setFlexWrap, EFlexWrap, &RenderStyle::initialFlexWrap>::createHandler());
     setPropertyHandler(CSSPropertyWebkitFlowFrom, ApplyPropertyString<MapNoneToNull, &RenderStyle::regionThread, &RenderStyle::setRegionThread, &RenderStyle::initialRegionThread>::createHandler());
-    setPropertyHandler(CSSPropertyWebkitFlowInto, ApplyPropertyString<MapAutoToNull, &RenderStyle::flowThread, &RenderStyle::setFlowThread, &RenderStyle::initialFlowThread>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFlowInto, ApplyPropertyString<MapNoneToNull, &RenderStyle::flowThread, &RenderStyle::setFlowThread, &RenderStyle::initialFlowThread>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFontKerning, ApplyPropertyFont<FontDescription::Kerning, &FontDescription::kerning, &FontDescription::setKerning, FontDescription::AutoKerning>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFontSmoothing, ApplyPropertyFont<FontSmoothingMode, &FontDescription::fontSmoothing, &FontDescription::setFontSmoothing, AutoSmoothing>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitFontVariantLigatures, ApplyPropertyFontVariantLigatures::createHandler());
     setPropertyHandler(CSSPropertyWebkitHighlight, ApplyPropertyString<MapNoneToNull, &RenderStyle::highlight, &RenderStyle::setHighlight, &RenderStyle::initialHighlight>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHyphenateCharacter, ApplyPropertyString<MapAutoToNull, &RenderStyle::hyphenationString, &RenderStyle::setHyphenationString, &RenderStyle::initialHyphenationString>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHyphenateLimitAfter, ApplyPropertyNumber<short, &RenderStyle::hyphenationLimitAfter, &RenderStyle::setHyphenationLimitAfter, &RenderStyle::initialHyphenationLimitAfter>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHyphenateLimitBefore, ApplyPropertyNumber<short, &RenderStyle::hyphenationLimitBefore, &RenderStyle::setHyphenationLimitBefore, &RenderStyle::initialHyphenationLimitBefore>::createHandler());
     setPropertyHandler(CSSPropertyWebkitHyphenateLimitLines, ApplyPropertyNumber<short, &RenderStyle::hyphenationLimitLines, &RenderStyle::setHyphenationLimitLines, &RenderStyle::initialHyphenationLimitLines, CSSValueNoLimit>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitHyphens, ApplyPropertyDefault<Hyphens, &RenderStyle::hyphens, Hyphens, &RenderStyle::setHyphens, Hyphens, &RenderStyle::initialHyphens>::createHandler());
     setPropertyHandler(CSSPropertyWebkitLineAlign, ApplyPropertyDefault<LineAlign, &RenderStyle::lineAlign, LineAlign, &RenderStyle::setLineAlign, LineAlign, &RenderStyle::initialLineAlign>::createHandler());
     setPropertyHandler(CSSPropertyWebkitLineBreak, ApplyPropertyDefault<EKHTMLLineBreak, &RenderStyle::khtmlLineBreak, EKHTMLLineBreak, &RenderStyle::setKHTMLLineBreak, EKHTMLLineBreak, &RenderStyle::initialKHTMLLineBreak>::createHandler());
     setPropertyHandler(CSSPropertyWebkitLineGrid, ApplyPropertyString<MapNoneToNull, &RenderStyle::lineGrid, &RenderStyle::setLineGrid, &RenderStyle::initialLineGrid>::createHandler());
     setPropertyHandler(CSSPropertyWebkitLineSnap, ApplyPropertyDefault<LineSnap, &RenderStyle::lineSnap, LineSnap, &RenderStyle::setLineSnap, LineSnap, &RenderStyle::initialLineSnap>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMarginAfterCollapse, ApplyPropertyDefault<EMarginCollapse, &RenderStyle::marginAfterCollapse, EMarginCollapse, &RenderStyle::setMarginAfterCollapse, EMarginCollapse, &RenderStyle::initialMarginAfterCollapse>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMarginBeforeCollapse, ApplyPropertyDefault<EMarginCollapse, &RenderStyle::marginBeforeCollapse, EMarginCollapse, &RenderStyle::setMarginBeforeCollapse, EMarginCollapse, &RenderStyle::initialMarginBeforeCollapse>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMarginBottomCollapse, CSSPropertyWebkitMarginAfterCollapse);
+    setPropertyHandler(CSSPropertyWebkitMarginCollapse, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitMarginBeforeCollapse, CSSPropertyWebkitMarginAfterCollapse>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMarginTopCollapse, CSSPropertyWebkitMarginBeforeCollapse);
     setPropertyHandler(CSSPropertyWebkitMarqueeDirection, ApplyPropertyDefault<EMarqueeDirection, &RenderStyle::marqueeDirection, EMarqueeDirection, &RenderStyle::setMarqueeDirection, EMarqueeDirection, &RenderStyle::initialMarqueeDirection>::createHandler());
     setPropertyHandler(CSSPropertyWebkitMarqueeStyle, ApplyPropertyDefault<EMarqueeBehavior, &RenderStyle::marqueeBehavior, EMarqueeBehavior, &RenderStyle::setMarqueeBehavior, EMarqueeBehavior, &RenderStyle::initialMarqueeBehavior>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskAttachment, ApplyPropertyFillLayer<EFillAttachment, CSSPropertyWebkitMaskAttachment, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isAttachmentSet, &FillLayer::attachment, &FillLayer::setAttachment, &FillLayer::clearAttachment, &FillLayer::initialFillAttachment, &CSSStyleSelector::mapFillAttachment>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskBoxImage, ApplyPropertyBorderImage<Mask, CSSPropertyWebkitMaskBoxImage, &RenderStyle::maskBoxImage, &RenderStyle::setMaskBoxImage>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskBoxImageOutset, ApplyPropertyBorderImageModifier<Mask, Outset>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskBoxImageRepeat, ApplyPropertyBorderImageModifier<Mask, Repeat>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskBoxImageSlice, ApplyPropertyBorderImageModifier<Mask, Slice>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskBoxImageSource, ApplyPropertyBorderImageSource<CSSPropertyWebkitMaskBoxImageSource, &RenderStyle::maskBoxImageSource, &RenderStyle::setMaskBoxImageSource, &RenderStyle::initialMaskBoxImageSource>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskBoxImageWidth, ApplyPropertyBorderImageModifier<Mask, Width>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskClip, ApplyPropertyFillLayer<EFillBox, CSSPropertyWebkitMaskClip, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isClipSet, &FillLayer::clip, &FillLayer::setClip, &FillLayer::clearClip, &FillLayer::initialFillClip, &CSSStyleSelector::mapFillClip>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskComposite, ApplyPropertyFillLayer<CompositeOperator, CSSPropertyWebkitMaskComposite, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isCompositeSet, &FillLayer::composite, &FillLayer::setComposite, &FillLayer::clearComposite, &FillLayer::initialFillComposite, &CSSStyleSelector::mapFillComposite>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskImage, ApplyPropertyFillLayer<StyleImage*, CSSPropertyWebkitMaskImage, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isImageSet, &FillLayer::image, &FillLayer::setImage, &FillLayer::clearImage, &FillLayer::initialFillImage, &CSSStyleSelector::mapFillImage>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskOrigin, ApplyPropertyFillLayer<EFillBox, CSSPropertyWebkitMaskOrigin, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isOriginSet, &FillLayer::origin, &FillLayer::setOrigin, &FillLayer::clearOrigin, &FillLayer::initialFillOrigin, &CSSStyleSelector::mapFillOrigin>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskPosition, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitMaskPositionX, CSSPropertyWebkitMaskPositionY>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskPositionX, ApplyPropertyFillLayer<Length, CSSPropertyWebkitMaskPositionX, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isXPositionSet, &FillLayer::xPosition, &FillLayer::setXPosition, &FillLayer::clearXPosition, &FillLayer::initialFillXPosition, &CSSStyleSelector::mapFillXPosition>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskPositionY, ApplyPropertyFillLayer<Length, CSSPropertyWebkitMaskPositionY, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isYPositionSet, &FillLayer::yPosition, &FillLayer::setYPosition, &FillLayer::clearYPosition, &FillLayer::initialFillYPosition, &CSSStyleSelector::mapFillYPosition>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskRepeat, ApplyPropertyExpanding<SuppressValue, CSSPropertyBackgroundRepeatX, CSSPropertyBackgroundRepeatY>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskRepeatX, ApplyPropertyFillLayer<EFillRepeat, CSSPropertyWebkitMaskRepeatX, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isRepeatXSet, &FillLayer::repeatX, &FillLayer::setRepeatX, &FillLayer::clearRepeatX, &FillLayer::initialFillRepeatX, &CSSStyleSelector::mapFillRepeatX>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskRepeatY, ApplyPropertyFillLayer<EFillRepeat, CSSPropertyWebkitMaskRepeatY, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isRepeatYSet, &FillLayer::repeatY, &FillLayer::setRepeatY, &FillLayer::clearRepeatY, &FillLayer::initialFillRepeatY, &CSSStyleSelector::mapFillRepeatY>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitMaskSize, ApplyPropertyFillLayer<FillSize, CSSPropertyWebkitMaskSize, MaskFillLayer, &RenderStyle::accessMaskLayers, &RenderStyle::maskLayers, &FillLayer::isSizeSet, &FillLayer::size, &FillLayer::setSize, &FillLayer::clearSize, &FillLayer::initialFillSize, &CSSStyleSelector::mapFillSize>::createHandler());
     setPropertyHandler(CSSPropertyWebkitMatchNearestMailBlockquoteColor, ApplyPropertyDefault<EMatchNearestMailBlockquoteColor, &RenderStyle::matchNearestMailBlockquoteColor, EMatchNearestMailBlockquoteColor, &RenderStyle::setMatchNearestMailBlockquoteColor, EMatchNearestMailBlockquoteColor, &RenderStyle::initialMatchNearestMailBlockquoteColor>::createHandler());
     setPropertyHandler(CSSPropertyWebkitNbspMode, ApplyPropertyDefault<ENBSPMode, &RenderStyle::nbspMode, ENBSPMode, &RenderStyle::setNBSPMode, ENBSPMode, &RenderStyle::initialNBSPMode>::createHandler());
     setPropertyHandler(CSSPropertyWebkitPerspectiveOrigin, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitPerspectiveOriginX, CSSPropertyWebkitPerspectiveOriginY>::createHandler());
     setPropertyHandler(CSSPropertyWebkitPerspectiveOriginX, ApplyPropertyLength<&RenderStyle::perspectiveOriginX, &RenderStyle::setPerspectiveOriginX, &RenderStyle::initialPerspectiveOriginX>::createHandler());
     setPropertyHandler(CSSPropertyWebkitPerspectiveOriginY, ApplyPropertyLength<&RenderStyle::perspectiveOriginY, &RenderStyle::setPerspectiveOriginY, &RenderStyle::initialPerspectiveOriginY>::createHandler());
     setPropertyHandler(CSSPropertyWebkitPrintColorAdjust, ApplyPropertyDefault<PrintColorAdjust, &RenderStyle::printColorAdjust, PrintColorAdjust, &RenderStyle::setPrintColorAdjust, PrintColorAdjust, &RenderStyle::initialPrintColorAdjust>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitRegionBreakAfter, ApplyPropertyDefault<EPageBreak, &RenderStyle::regionBreakAfter, EPageBreak, &RenderStyle::setRegionBreakAfter, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitRegionBreakBefore, ApplyPropertyDefault<EPageBreak, &RenderStyle::regionBreakBefore, EPageBreak, &RenderStyle::setRegionBreakBefore, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitRegionBreakInside, ApplyPropertyDefault<EPageBreak, &RenderStyle::regionBreakInside, EPageBreak, &RenderStyle::setRegionBreakInside, EPageBreak, &RenderStyle::initialPageBreak>::createHandler());
     setPropertyHandler(CSSPropertyWebkitRegionOverflow, ApplyPropertyDefault<RegionOverflow, &RenderStyle::regionOverflow, RegionOverflow, &RenderStyle::setRegionOverflow, RegionOverflow, &RenderStyle::initialRegionOverflow>::createHandler());
     setPropertyHandler(CSSPropertyWebkitRtlOrdering, ApplyPropertyDefault<Order, &RenderStyle::rtlOrdering, Order, &RenderStyle::setRTLOrdering, Order, &RenderStyle::initialRTLOrdering>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTextCombine, ApplyPropertyDefault<TextCombine, &RenderStyle::textCombine, TextCombine, &RenderStyle::setTextCombine, TextCombine, &RenderStyle::initialTextCombine>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTextEmphasisColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::textEmphasisColor, &RenderStyle::setTextEmphasisColor, &RenderStyle::setVisitedLinkTextEmphasisColor, &RenderStyle::color>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTextEmphasisPosition, ApplyPropertyDefault<TextEmphasisPosition, &RenderStyle::textEmphasisPosition, TextEmphasisPosition, &RenderStyle::setTextEmphasisPosition, TextEmphasisPosition, &RenderStyle::initialTextEmphasisPosition>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTextEmphasisStyle, ApplyPropertyTextEmphasisStyle::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTextFillColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::textFillColor, &RenderStyle::setTextFillColor, &RenderStyle::setVisitedLinkTextFillColor, &RenderStyle::color>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTextOrientation, ApplyPropertyFont<TextOrientation, &FontDescription::textOrientation, &FontDescription::setTextOrientation, TextOrientationVerticalRight>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTextSecurity, ApplyPropertyDefault<ETextSecurity, &RenderStyle::textSecurity, ETextSecurity, &RenderStyle::setTextSecurity, ETextSecurity, &RenderStyle::initialTextSecurity>::createHandler());
+    setPropertyHandler(CSSPropertyWebkitTextStrokeColor, ApplyPropertyColor<NoInheritFromParent, &RenderStyle::textStrokeColor, &RenderStyle::setTextStrokeColor, &RenderStyle::setVisitedLinkTextStrokeColor, &RenderStyle::color>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTransformOrigin, ApplyPropertyExpanding<SuppressValue, CSSPropertyWebkitTransformOriginX, CSSPropertyWebkitTransformOriginY, CSSPropertyWebkitTransformOriginZ>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTransformOriginX, ApplyPropertyLength<&RenderStyle::transformOriginX, &RenderStyle::setTransformOriginX, &RenderStyle::initialTransformOriginX>::createHandler());
     setPropertyHandler(CSSPropertyWebkitTransformOriginY, ApplyPropertyLength<&RenderStyle::transformOriginY, &RenderStyle::setTransformOriginY, &RenderStyle::initialTransformOriginY>::createHandler());
@@ -1982,10 +1962,12 @@ CSSStyleApplyProperty::CSSStyleApplyProperty()
     setPropertyHandler(CSSPropertyWebkitWrapMargin, ApplyPropertyLength<&RenderStyle::wrapMargin, &RenderStyle::setWrapMargin, &RenderStyle::initialWrapMargin>::createHandler());
     setPropertyHandler(CSSPropertyWebkitWrapPadding, ApplyPropertyLength<&RenderStyle::wrapPadding, &RenderStyle::setWrapPadding, &RenderStyle::initialWrapPadding>::createHandler());
     setPropertyHandler(CSSPropertyWebkitWrapThrough, ApplyPropertyDefault<WrapThrough, &RenderStyle::wrapThrough, WrapThrough, &RenderStyle::setWrapThrough, WrapThrough, &RenderStyle::initialWrapThrough>::createHandler());
-
+    setPropertyHandler(CSSPropertyWhiteSpace, ApplyPropertyDefault<EWhiteSpace, &RenderStyle::whiteSpace, EWhiteSpace, &RenderStyle::setWhiteSpace, EWhiteSpace, &RenderStyle::initialWhiteSpace>::createHandler());
     setPropertyHandler(CSSPropertyWidows, ApplyPropertyDefault<short, &RenderStyle::widows, short, &RenderStyle::setWidows, short, &RenderStyle::initialWidows>::createHandler());
-    setPropertyHandler(CSSPropertyOrphans, ApplyPropertyDefault<short, &RenderStyle::orphans, short, &RenderStyle::setOrphans, short, &RenderStyle::initialOrphans>::createHandler());
-
+    setPropertyHandler(CSSPropertyWidth, ApplyPropertyLength<&RenderStyle::width, &RenderStyle::setWidth, &RenderStyle::initialSize, AutoEnabled, IntrinsicEnabled, MinIntrinsicEnabled, NoneDisabled, UndefinedDisabled, FlexWidth>::createHandler());
+    setPropertyHandler(CSSPropertyWordBreak, ApplyPropertyDefault<EWordBreak, &RenderStyle::wordBreak, EWordBreak, &RenderStyle::setWordBreak, EWordBreak, &RenderStyle::initialWordBreak>::createHandler());
+    setPropertyHandler(CSSPropertyWordSpacing, ApplyPropertyComputeLength<int, &RenderStyle::wordSpacing, &RenderStyle::setWordSpacing, &RenderStyle::initialLetterWordSpacing, NormalEnabled, ThicknessDisabled, SVGZoomEnabled>::createHandler());
+    setPropertyHandler(CSSPropertyWordWrap, ApplyPropertyDefault<EWordWrap, &RenderStyle::wordWrap, EWordWrap, &RenderStyle::setWordWrap, EWordWrap, &RenderStyle::initialWordWrap>::createHandler());
     setPropertyHandler(CSSPropertyZIndex, ApplyPropertyAuto<int, &RenderStyle::zIndex, &RenderStyle::setZIndex, &RenderStyle::hasAutoZIndex, &RenderStyle::setHasAutoZIndex>::createHandler());
     setPropertyHandler(CSSPropertyZoom, ApplyPropertyZoom::createHandler());
 }
diff --git a/Source/WebCore/css/CSSStyleDeclaration.idl b/Source/WebCore/css/CSSStyleDeclaration.idl
index 8be67e4a6..9846c5458 100644
--- a/Source/WebCore/css/CSSStyleDeclaration.idl
+++ b/Source/WebCore/css/CSSStyleDeclaration.idl
@@ -24,8 +24,11 @@ module css {
     interface [
         JSCustomMarkFunction,
         JSGenerateIsReachable,
+        JSCustomGetOwnPropertySlotAndDescriptor,
         CustomNamedSetter,
+#if defined(V8_BINDING) && V8_BINDING
         NamedGetter,
+#endif
         IndexedGetter,
         CustomEnumerateProperty,
         V8DependentLifetime
diff --git a/Source/WebCore/css/CSSStyleRule.cpp b/Source/WebCore/css/CSSStyleRule.cpp
index 7a1d66fca..65da867c5 100644
--- a/Source/WebCore/css/CSSStyleRule.cpp
+++ b/Source/WebCore/css/CSSStyleRule.cpp
@@ -22,35 +22,34 @@
 #include "config.h"
 #include "CSSStyleRule.h"
 
-#include "CSSPageRule.h"
 #include "CSSParser.h"
 #include "CSSSelector.h"
 #include "CSSStyleSheet.h"
 #include "Document.h"
 #include "StylePropertySet.h"
-#include "StyledElement.h"
-#include "StyleSheet.h"
-
+#include "StyleRule.h"
 #include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
 CSSStyleRule::CSSStyleRule(CSSStyleSheet* parent, int line)
     : CSSRule(parent, CSSRule::STYLE_RULE)
+    , m_styleRule(adoptPtr(new StyleRule(line, this)))
 {
-    setSourceLine(line);
-
-    // m_sourceLine is a bitfield, so let's catch any overflow early in debug mode.
-    ASSERT(sourceLine() == line);
 }
 
 CSSStyleRule::~CSSStyleRule()
 {
-    if (m_style)
-        m_style->clearParentRule(this);
+    if (m_styleRule->properties())
+        m_styleRule->properties()->clearParentRule(this);
     cleanup();
 }
 
+CSSStyleDeclaration* CSSStyleRule::style() const
+{
+    return m_styleRule->properties()->ensureRuleCSSStyleDeclaration(this);
+}
+
 typedef HashMap<const CSSStyleRule*, String> SelectorTextCache;
 static SelectorTextCache& selectorTextCache()
 {
@@ -69,8 +68,8 @@ inline void CSSStyleRule::cleanup()
 String CSSStyleRule::generateSelectorText() const
 {
     StringBuilder builder;
-    for (CSSSelector* s = selectorList().first(); s; s = CSSSelectorList::next(s)) {
-        if (s != selectorList().first())
+    for (CSSSelector* s = m_styleRule->selectorList().first(); s; s = CSSSelectorList::next(s)) {
+        if (s != m_styleRule->selectorList().first())
             builder.append(", ");
         builder.append(s->selectorText());
     }
@@ -106,7 +105,7 @@ void CSSStyleRule::setSelectorText(const String& selectorText)
         return;
 
     String oldSelectorText = this->selectorText();
-    m_selectorList.adopt(selectorList);
+    m_styleRule->adoptSelectorList(selectorList);
 
     if (hasCachedSelectorText()) {
         ASSERT(selectorTextCache().contains(this));
@@ -124,16 +123,10 @@ String CSSStyleRule::cssText() const
     String result = selectorText();
 
     result += " { ";
-    result += m_style->asText();
+    result += m_styleRule->properties()->asText();
     result += "}";
 
     return result;
 }
 
-void CSSStyleRule::addSubresourceStyleURLs(ListHashSet<KURL>& urls)
-{
-    if (m_style)
-        m_style->addSubresourceStyleURLs(urls, parentStyleSheet());
-}
-
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSStyleRule.h b/Source/WebCore/css/CSSStyleRule.h
index f70b9b231..c71d53ed2 100644
--- a/Source/WebCore/css/CSSStyleRule.h
+++ b/Source/WebCore/css/CSSStyleRule.h
@@ -23,39 +23,31 @@
 #define CSSStyleRule_h
 
 #include "CSSRule.h"
-#include "CSSSelectorList.h"
-#include "StylePropertySet.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
 class CSSSelector;
+class CSSStyleDeclaration;
+class StyleRule;
 
 class CSSStyleRule : public CSSRule {
 public:
-    static PassRefPtr<CSSStyleRule> create(CSSStyleSheet* parent, int sourceLine)
+    static PassRefPtr<CSSStyleRule> create(CSSStyleSheet* parent, int line)
     {
-        return adoptRef(new CSSStyleRule(parent, sourceLine));
+        return adoptRef(new CSSStyleRule(parent, line));
     }
     ~CSSStyleRule();
 
     String selectorText() const;
     void setSelectorText(const String&);
 
-    CSSStyleDeclaration* style() const { return m_style->ensureRuleCSSStyleDeclaration(this); }
+    CSSStyleDeclaration* style() const;
 
     String cssText() const;
-
-    void adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectors) { m_selectorList.adoptSelectorVector(selectors); }
-    void setDeclaration(PassRefPtr<StylePropertySet> style) { m_style = style; }
-
-    const CSSSelectorList& selectorList() const { return m_selectorList; }
-    StylePropertySet* declaration() const { return m_style.get(); }
-
-    void addSubresourceStyleURLs(ListHashSet<KURL>& urls);
-
-    using CSSRule::sourceLine;
+    
+    StyleRule* styleRule() const { return m_styleRule.get(); }
 
 private:
     CSSStyleRule(CSSStyleSheet* parent, int sourceLine);
@@ -63,8 +55,7 @@ private:
     void cleanup();
     String generateSelectorText() const;
 
-    RefPtr<StylePropertySet> m_style;
-    CSSSelectorList m_selectorList;
+    OwnPtr<StyleRule> m_styleRule;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/css/CSSStyleSelector.cpp b/Source/WebCore/css/CSSStyleSelector.cpp
index b172c4733..e9823d586 100644
--- a/Source/WebCore/css/CSSStyleSelector.cpp
+++ b/Source/WebCore/css/CSSStyleSelector.cpp
@@ -30,10 +30,12 @@
 
 #include "Attribute.h"
 #include "CachedImage.h"
+#include "CalculationValue.h"
 #include "ContentData.h"
 #include "Counter.h"
 #include "CounterContent.h"
 #include "CSSBorderImage.h"
+#include "CSSCalculationValue.h"
 #include "CSSCursorImageValue.h"
 #include "CSSFontFaceRule.h"
 #include "CSSFontSelector.h"
@@ -92,10 +94,12 @@
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #include "ShadowData.h"
+#include "ShadowRoot.h"
 #include "ShadowValue.h"
 #include "SkewTransformOperation.h"
 #include "StyleCachedImage.h"
 #include "StylePendingImage.h"
+#include "StyleRule.h"
 #include "StyleGeneratedImage.h"
 #include "StyleSheetList.h"
 #include "Text.h"
@@ -121,6 +125,7 @@
 #endif
 
 #if ENABLE(SVG)
+#include "SVGElement.h"
 #include "SVGNames.h"
 #endif
 
@@ -166,17 +171,12 @@ HANDLE_INHERIT_AND_INITIAL(prop, Prop) \
 if (primitiveValue) \
     m_style->set##Prop(*primitiveValue);
 
-#define HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(prop, Prop, Value) \
-HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(prop, Prop, Value) \
-if (primitiveValue) \
-    m_style->set##Prop(*primitiveValue);
-
 class RuleData {
 public:
-    RuleData(CSSStyleRule*, CSSSelector*, unsigned position, bool canUseFastCheckSelector = true);
+    RuleData(StyleRule*, CSSSelector*, unsigned position, bool canUseFastCheckSelector, bool inRegionRule);
 
     unsigned position() const { return m_position; }
-    CSSStyleRule* rule() const { return m_rule; }
+    StyleRule* rule() const { return m_rule; }
     CSSSelector* selector() const { return m_selector; }
 
     bool hasFastCheckableSelector() const { return m_hasFastCheckableSelector; }
@@ -185,23 +185,25 @@ public:
     bool containsUncommonAttributeSelector() const { return m_containsUncommonAttributeSelector; }
     unsigned specificity() const { return m_specificity; }
     unsigned linkMatchType() const { return m_linkMatchType; }
+    bool isInRegionRule() const { return m_isInRegionRule; }
 
     // Try to balance between memory usage (there can be lots of RuleData objects) and good filtering performance.
     static const unsigned maximumIdentifierCount = 4;
     const unsigned* descendantSelectorIdentifierHashes() const { return m_descendantSelectorIdentifierHashes; }
 
 private:
-    CSSStyleRule* m_rule;
+    StyleRule* m_rule;
     CSSSelector* m_selector;
     unsigned m_specificity;
     // This number was picked fairly arbitrarily. We can probably lower it if we need to.
     // Some simple testing showed <100,000 RuleData's on large sites.
-    unsigned m_position : 26;
+    unsigned m_position : 25;
     unsigned m_hasFastCheckableSelector : 1;
     unsigned m_hasMultipartSelector : 1;
     unsigned m_hasRightmostSelectorMatchingHTMLBasedOnRuleHash : 1;
     unsigned m_containsUncommonAttributeSelector : 1;
     unsigned m_linkMatchType : 2; //  SelectorChecker::LinkMatchMask
+    unsigned m_isInRegionRule : 1;
     // Use plain array instead of a Vector to minimize memory overhead.
     unsigned m_descendantSelectorIdentifierHashes[maximumIdentifierCount];
 };
@@ -223,10 +225,10 @@ public:
 
     typedef HashMap<AtomicStringImpl*, OwnPtr<Vector<RuleData> > > AtomRuleMap;
 
-    void addRulesFromSheet(CSSStyleSheet*, const MediaQueryEvaluator&, CSSStyleSelector* = 0, const Element* = 0);
+    void addRulesFromSheet(CSSStyleSheet*, const MediaQueryEvaluator&, CSSStyleSelector* = 0, const ContainerNode* = 0);
 
-    void addStyleRule(CSSStyleRule*, bool canUseFastCheckSelector = true);
-    void addRule(CSSStyleRule*, CSSSelector*, bool canUseFastCheckSelector = true);
+    void addStyleRule(StyleRule*, bool canUseFastCheckSelector = true, bool isInRegionRule = false);
+    void addRule(StyleRule*, CSSSelector*, bool canUseFastCheckSelector = true, bool isInRegionRule = false);
     void addPageRule(CSSPageRule*);
     void addToRuleSet(AtomicStringImpl* key, AtomRuleMap&, const RuleData&);
     void addRegionRule(WebKitCSSRegionRule*);
@@ -339,7 +341,7 @@ CSSStyleSelector::CSSStyleSelector(Document* document, StyleSheetList* styleShee
     , m_hasPendingShaders(false)
 #endif
 #if ENABLE(STYLE_SCOPED)
-    , m_scopingElementStackParent(0)
+    , m_scopeStackParent(0)
 #endif
 {
     Element* root = document->documentElement();
@@ -443,7 +445,7 @@ void CSSStyleSelector::collectFeatures()
 }
 
 #if ENABLE(STYLE_SCOPED)
-const Element* CSSStyleSelector::determineScopingElement(const CSSStyleSheet* sheet)
+const ContainerNode* CSSStyleSelector::determineScope(const CSSStyleSheet* sheet)
 {
     ASSERT(sheet);
 
@@ -458,14 +460,18 @@ const Element* CSSStyleSelector::determineScopingElement(const CSSStyleSheet* sh
     if (!styleElement->scoped())
         return 0;
 
-    return styleElement->parentElement();
+    ContainerNode* parent = styleElement->parentNode();
+    if (!parent)
+        return 0;
+
+    return (parent->isElementNode() || parent->isShadowRoot()) ? parent : 0;
 }
 
-inline RuleSet* CSSStyleSelector::scopedRuleSetForElement(const Element* element) const
+inline RuleSet* CSSStyleSelector::ruleSetForScope(const ContainerNode* scope) const
 {
-    if (!element->hasScopedHTMLStyleChild())
+    if (!scope->hasScopedHTMLStyleChild())
         return 0;
-    ScopedRuleSetMap::const_iterator it = m_scopedAuthorStyles.find(element);
+    ScopedRuleSetMap::const_iterator it = m_scopedAuthorStyles.find(scope);
     return it != m_scopedAuthorStyles.end() ? it->second.get() : 0; 
 }
 #endif
@@ -480,7 +486,7 @@ void CSSStyleSelector::appendAuthorStylesheets(unsigned firstNew, const Vector<R
             continue;
         CSSStyleSheet* cssSheet = static_cast<CSSStyleSheet*>(stylesheets[i].get());
 #if ENABLE(STYLE_SCOPED)
-        const Element* scope = determineScopingElement(cssSheet);
+        const ContainerNode* scope = determineScope(cssSheet);
         if (scope) {
             pair<ScopedRuleSetMap::iterator, bool> addResult = m_scopedAuthorStyles.add(scope, nullptr);
             if (addResult.second)
@@ -499,68 +505,88 @@ void CSSStyleSelector::appendAuthorStylesheets(unsigned firstNew, const Vector<R
 }
 
 #if ENABLE(STYLE_SCOPED)
-void CSSStyleSelector::setupScopingElementStack(const Element* parent)
+void CSSStyleSelector::setupScopeStack(const ContainerNode* parent)
 {
     // The scoping element stack shouldn't be used if <style scoped> isn't used anywhere.
     ASSERT(!m_scopedAuthorStyles.isEmpty());
 
-    m_scopingElementStack.shrink(0);
-    for (; parent; parent = parent->parentOrHostElement()) {
-        RuleSet* ruleSet = scopedRuleSetForElement(parent);
+    m_scopeStack.shrink(0);
+    for (; parent; parent = parent->parentOrHostNode()) {
+        RuleSet* ruleSet = ruleSetForScope(parent);
         if (ruleSet)
-            m_scopingElementStack.append(ScopeStackFrame(parent, ruleSet));
+            m_scopeStack.append(ScopeStackFrame(parent, ruleSet));
     }
-    m_scopingElementStack.reverse();
-    m_scopingElementStackParent = parent;
+    m_scopeStack.reverse();
+    m_scopeStackParent = parent;
 }
-#endif
 
-void CSSStyleSelector::pushParent(Element* parent)
+void CSSStyleSelector::pushScope(const ContainerNode* scope, const ContainerNode* scopeParent)
 {
-    const Element* parentsParent = parent->parentOrHostElement();
-    // We are not always invoked consistently. For example, script execution can cause us to enter
-    // style recalc in the middle of tree building. We may also be invoked from somewhere within the tree.
-    // Reset the stack in this case, or if we see a new root element.
-    // Otherwise just push the new parent.
-    if (!parentsParent || m_checker.parentStackIsEmpty())
-        m_checker.setupParentStack(parent);
-    else
-        m_checker.pushParent(parent);
-
-#if ENABLE(STYLE_SCOPED)
     // Shortcut: Don't bother with the scoping element stack if <style scoped> isn't used anywhere.
     if (m_scopedAuthorStyles.isEmpty()) {
-        ASSERT(!m_scopingElementStackParent);
-        ASSERT(m_scopingElementStack.isEmpty());
+        ASSERT(!m_scopeStackParent);
+        ASSERT(m_scopeStack.isEmpty());
         return;
     }
     // In some wacky cases during style resolve we may get invoked for random elements.
     // Recreate the whole scoping element stack in such cases.
-    if (!scopingElementStackIsConsistent(parentsParent)) {
-        setupScopingElementStack(parent);
+    if (!scopeStackIsConsistent(scopeParent)) {
+        setupScopeStack(scope);
         return;
     }
     // Otherwise just push the parent onto the stack.
-    RuleSet* ruleSet = scopedRuleSetForElement(parent);
+    RuleSet* ruleSet = ruleSetForScope(scope);
     if (ruleSet)
-        m_scopingElementStack.append(ScopeStackFrame(parent, ruleSet));
-    m_scopingElementStackParent = parent;
+        m_scopeStack.append(ScopeStackFrame(scope, ruleSet));
+    m_scopeStackParent = scope;
+}
+
+void CSSStyleSelector::popScope(const ContainerNode* scope)
+{
+    // Only bother to update the scoping element stack if it is consistent.
+    if (scopeStackIsConsistent(scope)) {
+        m_scopeStack.removeLast();
+        m_scopeStackParent = scope->parentOrHostNode();
+    }
+}
 #endif
+
+void CSSStyleSelector::pushParentElement(Element* parent)
+{
+    const ContainerNode* parentsParent = parent->parentOrHostElement();
+
+    // We are not always invoked consistently. For example, script execution can cause us to enter
+    // style recalc in the middle of tree building. We may also be invoked from somewhere within the tree.
+    // Reset the stack in this case, or if we see a new root element.
+    // Otherwise just push the new parent.
+    if (!parentsParent || m_checker.parentStackIsEmpty())
+        m_checker.setupParentStack(parent);
+    else
+        m_checker.pushParent(parent);
+
+    // Note: We mustn't skip ShadowRoot nodes for the scope stack.
+    pushScope(parent, parent->parentOrHostNode());
 }
 
-void CSSStyleSelector::popParent(Element* parent)
+void CSSStyleSelector::popParentElement(Element* parent)
 {
     // Note that we may get invoked for some random elements in some wacky cases during style resolve.
     // Pause maintaining the stack in this case.
     if (m_checker.parentStackIsConsistent(parent))
         m_checker.popParent();
-#if ENABLE(STYLE_SCOPED)
-    // Only bother to update the scoping element stack if it is consistent.
-    if (scopingElementStackIsConsistent(parent)) {
-        m_scopingElementStack.removeLast();
-        m_scopingElementStackParent = parent->parentOrHostElement();
-    }
-#endif
+    popScope(parent);
+}
+
+void CSSStyleSelector::pushParentShadowRoot(const ShadowRoot* shadowRoot)
+{
+    ASSERT(shadowRoot->host());
+    pushScope(shadowRoot, shadowRoot->host());
+}
+
+void CSSStyleSelector::popParentShadowRoot(const ShadowRoot* shadowRoot)
+{
+    ASSERT(shadowRoot->host());
+    popScope(shadowRoot);
 }
 
 // This is a simplified style setting function for keyframe styles
@@ -750,15 +776,28 @@ static void ensureDefaultStyleSheetsForElement(Element* element)
     ASSERT_UNUSED(loadedMathMLUserAgentSheet, loadedMathMLUserAgentSheet || defaultStyle->features().siblingRules.isEmpty());
 }
 
-void CSSStyleSelector::addMatchedProperties(MatchResult& matchResult, StylePropertySet* properties, CSSStyleRule* rule, unsigned linkMatchType)
+void CSSStyleSelector::addMatchedProperties(MatchResult& matchResult, StylePropertySet* properties, StyleRule* rule, unsigned linkMatchType, bool inRegionRule)
 {
     matchResult.matchedProperties.grow(matchResult.matchedProperties.size() + 1);
     MatchedProperties& newProperties = matchResult.matchedProperties.last();
     newProperties.properties = properties;
     newProperties.linkMatchType = linkMatchType;
+    newProperties.isInRegionRule = inRegionRule;
     matchResult.matchedRules.append(rule);
 }
 
+inline void CSSStyleSelector::addElementStyleProperties(MatchResult& result, StylePropertySet* propertySet, bool isCacheable)
+{
+    if (!propertySet)
+        return;
+    result.ranges.lastAuthorRule = result.matchedProperties.size();
+    if (result.ranges.firstAuthorRule == -1)
+        result.ranges.firstAuthorRule = result.ranges.lastAuthorRule;
+    addMatchedProperties(result, propertySet);
+    if (!isCacheable)
+        result.isCacheable = false;
+}
+
 void CSSStyleSelector::collectMatchingRules(RuleSet* rules, int& firstRuleIndex, int& lastRuleIndex, const MatchOptions& options)
 {
     ASSERT(rules);
@@ -815,7 +854,7 @@ void CSSStyleSelector::sortAndTransferMatchedRules(MatchResult& result)
         if (!m_ruleList)
             m_ruleList = CSSRuleList::create();
         for (unsigned i = 0; i < m_matchedRules.size(); ++i)
-            m_ruleList->append(m_matchedRules[i]->rule());
+            m_ruleList->append(m_matchedRules[i]->rule()->ensureCSSStyleRule());
         return;
     }
 
@@ -828,7 +867,7 @@ void CSSStyleSelector::sortAndTransferMatchedRules(MatchResult& result)
         unsigned linkMatchType = m_matchedRules[i]->linkMatchType();
         if (swapVisitedUnvisited && linkMatchType && linkMatchType != SelectorChecker::MatchAll)
             linkMatchType = (linkMatchType == SelectorChecker::MatchVisited) ? SelectorChecker::MatchLink : SelectorChecker::MatchVisited;
-        addMatchedProperties(result, m_matchedRules[i]->rule()->declaration(), m_matchedRules[i]->rule(), linkMatchType);
+        addMatchedProperties(result, m_matchedRules[i]->rule()->properties(), m_matchedRules[i]->rule(), linkMatchType, m_matchedRules[i]->isInRegionRule());
     }
 }
 
@@ -841,17 +880,17 @@ void CSSStyleSelector::matchScopedAuthorRules(MatchResult& result, bool includeE
     MatchOptions options(includeEmptyRules);
 
     // Match scoped author rules by traversing the scoped element stack (rebuild it if it got inconsistent).
-    const Element* parent = m_element->parentOrHostElement();
-    if (!scopingElementStackIsConsistent(parent))
-        setupScopingElementStack(parent);
-    for (size_t i = m_scopingElementStack.size(); i; --i) {
-        const ScopeStackFrame& frame = m_scopingElementStack[i - 1];
-        options.scope = frame.m_element;
+    const ContainerNode* parent = m_element->parentOrHostNode();
+    if (!scopeStackIsConsistent(parent))
+        setupScopeStack(parent);
+    for (size_t i = m_scopeStack.size(); i; --i) {
+        const ScopeStackFrame& frame = m_scopeStack[i - 1];
+        options.scope = frame.m_scope;
         collectMatchingRules(frame.m_ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
         collectMatchingRulesForRegion(frame.m_ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
     }
     // Also include the current element.
-    RuleSet* ruleSet = scopedRuleSetForElement(m_element);
+    RuleSet* ruleSet = ruleSetForScope(m_element);
     if (ruleSet) {
         options.scope = m_element;
         collectMatchingRules(ruleSet, result.ranges.firstAuthorRule, result.ranges.lastAuthorRule, options);
@@ -948,7 +987,7 @@ void CSSStyleSelector::collectMatchingRulesForList(const Vector<RuleData>* rules
         if (canUseFastReject && m_checker.fastRejectSelector<RuleData::maximumIdentifierCount>(ruleData.descendantSelectorIdentifierHashes()))
             continue;
 
-        CSSStyleRule* rule = ruleData.rule();
+        StyleRule* rule = ruleData.rule();
         InspectorInstrumentationCookie cookie = InspectorInstrumentation::willMatchRule(document(), rule);
 #if ENABLE(STYLE_SCOPED)
         if (checkSelector(ruleData, options.scope)) {
@@ -972,12 +1011,13 @@ void CSSStyleSelector::collectMatchingRulesForList(const Vector<RuleData>* rules
                 continue;
             }
             // If the rule has no properties to apply, then ignore it in the non-debug mode.
-            StylePropertySet* decl = rule->declaration();
-            if (!decl || (decl->isEmpty() && !options.includeEmptyRules)) {
+            StylePropertySet* properties = rule->properties();
+            if (!properties || (properties->isEmpty() && !options.includeEmptyRules)) {
                 InspectorInstrumentation::didMatchRule(cookie, false);
                 continue;
             }
-            if (m_sameOriginOnly && !m_checker.document()->securityOrigin()->canRequest(rule->baseURL())) {
+            // FIXME: Exposing getMatchedCSSRules as a web facing API is forcing us to have a way to get the base URL per-rule.
+            if (m_sameOriginOnly && !m_checker.document()->securityOrigin()->canRequest(rule->ensureCSSStyleRule()->baseURL())) {
                 InspectorInstrumentation::didMatchRule(cookie, false);
                 continue;
             }
@@ -1028,23 +1068,12 @@ void CSSStyleSelector::matchAllRules(MatchResult& result)
         
     // Now check author rules, beginning first with presentational attributes mapped from HTML.
     if (m_styledElement) {
-        if (StylePropertySet* attributeStyle = m_styledElement->attributeStyle()) {
-            result.ranges.lastAuthorRule = m_matchedRules.size();
-            if (result.ranges.firstAuthorRule == -1)
-                result.ranges.firstAuthorRule = result.ranges.lastAuthorRule;
-            addMatchedProperties(result, attributeStyle);
-        }
+        addElementStyleProperties(result, m_styledElement->attributeStyle());
 
         // Now we check additional mapped declarations.
         // Tables and table cells share an additional mapped rule that must be applied
         // after all attributes, since their mapped style depends on the values of multiple attributes.
-        if (StylePropertySet* additionalStyle = m_styledElement->additionalAttributeStyle()) {
-            if (result.ranges.firstAuthorRule == -1)
-                result.ranges.firstAuthorRule = result.matchedProperties.size();
-            result.ranges.lastAuthorRule = result.ranges.firstAuthorRule;
-            addMatchedProperties(result, additionalStyle);
-            result.isCacheable = false;
-        }
+        addElementStyleProperties(result, m_styledElement->additionalAttributeStyle());
 
         if (m_styledElement->isHTMLElement()) {
             bool isAuto;
@@ -1059,16 +1088,19 @@ void CSSStyleSelector::matchAllRules(MatchResult& result)
         matchAuthorRules(result, false);
 
     // Now check our inline style attribute.
-    if (m_matchAuthorAndUserStyles && m_styledElement) {
-        StylePropertySet* inlineDecl = m_styledElement->inlineStyleDecl();
-        if (inlineDecl) {
-            result.ranges.lastAuthorRule = result.matchedProperties.size();
-            if (result.ranges.firstAuthorRule == -1)
-                result.ranges.firstAuthorRule = result.ranges.lastAuthorRule;
-            addMatchedProperties(result, inlineDecl);
-            result.isCacheable = false;
-        }
+    if (m_matchAuthorAndUserStyles && m_styledElement && m_styledElement->inlineStyle()) {
+        // Inline style is immutable as long as there is no CSSOM wrapper.
+        // FIXME: Media control shadow trees seem to have problems with caching.
+        bool isInlineStyleCacheable = !m_styledElement->inlineStyle()->hasCSSOMWrapper() && !m_styledElement->isInShadowTree();
+        // FIXME: Constify.
+        addElementStyleProperties(result, const_cast<StylePropertySet*>(m_styledElement->inlineStyle()), isInlineStyleCacheable);
     }
+
+#if ENABLE(SVG)
+    // Now check SMIL animation override style.
+    if (m_matchAuthorAndUserStyles && m_styledElement && m_styledElement->isSVGElement())
+        addElementStyleProperties(result, static_cast<SVGElement*>(m_styledElement)->animatedSMILStyleProperties(), false /* isCacheable */);
+#endif
 }
 
 inline void CSSStyleSelector::initElement(Element* e)
@@ -1122,8 +1154,12 @@ Node* CSSStyleSelector::locateCousinList(Element* parent, unsigned& visitedNodeC
         return 0;
 #endif
     StyledElement* p = static_cast<StyledElement*>(parent);
-    if (p->inlineStyleDecl())
+    if (p->inlineStyle())
         return 0;
+#if ENABLE(SVG)
+    if (p->isSVGElement() && static_cast<SVGElement*>(p)->animatedSMILStyleProperties())
+        return 0;
+#endif
     if (p->hasID() && m_features.idsInRules.contains(p->idForStyleResolution().impl()))
         return 0;
 
@@ -1222,13 +1258,6 @@ bool CSSStyleSelector::canShareStyleWithControl(StyledElement* element) const
             return false;
     }
 
-    if (element->fastGetAttribute(typeAttr) != m_element->fastGetAttribute(typeAttr))
-        return false;
-
-    if (element->fastGetAttribute(readonlyAttr) != m_element->fastGetAttribute(readonlyAttr))
-        return false;
-
-
     return true;
 }
 
@@ -1270,10 +1299,18 @@ bool CSSStyleSelector::canShareStyleWithElement(StyledElement* element) const
         return false;
     if (element->hasClass() != m_element->hasClass())
         return false;
-    if (element->inlineStyleDecl())
+    if (element->inlineStyle())
         return false;
+#if ENABLE(SVG)
+    if (element->isSVGElement() && static_cast<SVGElement*>(element)->animatedSMILStyleProperties())
+        return false;
+#endif
     if (!!element->attributeStyle() != !!m_styledElement->attributeStyle())
         return false;
+    StylePropertySet* additionalAttributeStyleA = element->additionalAttributeStyle();
+    StylePropertySet* additionalAttributeStyleB = m_styledElement->additionalAttributeStyle();
+    if (!additionalAttributeStyleA != !additionalAttributeStyleB)
+        return false;
     if (element->isLink() != m_element->isLink())
         return false;
     if (style->affectedByUncommonAttributeSelectors())
@@ -1284,19 +1321,40 @@ bool CSSStyleSelector::canShareStyleWithElement(StyledElement* element) const
         return false;
     if (element->focused() != m_element->focused())
         return false;
+    if (element->shadowPseudoId() != m_element->shadowPseudoId())
+        return false;
     if (element == element->document()->cssTarget())
         return false;
     if (m_element == m_element->document()->cssTarget())
         return false;
-    if (style->transitions() || style->animations())
+    if (element->getAttribute(typeAttr) != m_element->getAttribute(typeAttr))
         return false;
-    if (element->isLink() && m_elementLinkState != style->insideLink())
+    if (element->fastGetAttribute(XMLNames::langAttr) != m_element->fastGetAttribute(XMLNames::langAttr))
         return false;
-    if (element->shadowPseudoId() != m_element->shadowPseudoId())
+    if (element->fastGetAttribute(langAttr) != m_element->fastGetAttribute(langAttr))
+        return false;
+    if (element->fastGetAttribute(readonlyAttr) != m_element->fastGetAttribute(readonlyAttr))
+        return false;
+    if (element->fastGetAttribute(cellpaddingAttr) != m_element->fastGetAttribute(cellpaddingAttr))
         return false;
+
     if (element->hasID() && m_features.idsInRules.contains(element->idForStyleResolution().impl()))
         return false;
-    if (m_element->isFormControlElement() && !canShareStyleWithControl(element))
+
+#if ENABLE(STYLE_SCOPED)
+    if (element->hasScopedHTMLStyleChild())
+        return false;
+#endif
+
+    bool isControl = element->isFormControlElement();
+
+    if (isControl != m_element->isFormControlElement())
+        return false;
+
+    if (isControl && !canShareStyleWithControl(element))
+        return false;
+
+    if (style->transitions() || style->animations())
         return false;
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -1317,26 +1375,14 @@ bool CSSStyleSelector::canShareStyleWithElement(StyledElement* element) const
     if (element->hasClass() && m_element->getAttribute(classAttr) != element->getAttribute(classAttr))
         return false;
 
-    StylePropertySet* additionalAttributeStyleA = element->additionalAttributeStyle();
-    StylePropertySet* additionalAttributeStyleB = m_styledElement->additionalAttributeStyle();
-    if (!additionalAttributeStyleA != !additionalAttributeStyleB)
-        return false;
-
-    if (element->fastGetAttribute(XMLNames::langAttr) != m_element->fastGetAttribute(XMLNames::langAttr))
-        return false;
-    if (element->fastGetAttribute(langAttr) != m_element->fastGetAttribute(langAttr))
-        return false;
-
     if (element->attributeStyle() && !attributeStylesEqual(element->attributeStyle(), m_styledElement->attributeStyle()))
         return false;
 
     if (additionalAttributeStyleA && !attributeStylesEqual(additionalAttributeStyleA, additionalAttributeStyleB))
         return false;
 
-#if ENABLE(STYLE_SCOPED)
-    if (element->hasScopedHTMLStyleChild())
+    if (element->isLink() && m_elementLinkState != style->insideLink())
         return false;
-#endif
 
     return true;
 }
@@ -1367,8 +1413,12 @@ RenderStyle* CSSStyleSelector::locateSharedStyle()
     if (!m_styledElement || !m_parentStyle)
         return 0;
     // If the element has inline style it is probably unique.
-    if (m_styledElement->inlineStyleDecl())
+    if (m_styledElement->inlineStyle())
+        return 0;
+#if ENABLE(SVG)
+    if (m_styledElement->isSVGElement() && static_cast<SVGElement*>(m_styledElement)->animatedSMILStyleProperties())
         return 0;
+#endif
     // Ids stop style sharing if they show up in the stylesheets.
     if (m_styledElement->hasID() && m_features.idsInRules.contains(m_styledElement->idForStyleResolution().impl()))
         return 0;
@@ -1437,7 +1487,7 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForDocument(Document* document, C
     RefPtr<RenderStyle> documentStyle = RenderStyle::create();
     documentStyle->setDisplay(BLOCK);
     documentStyle->setRTLOrdering(document->visuallyOrdered() ? VisualOrder : LogicalOrder);
-    documentStyle->setZoom(frame ? frame->pageZoomFactor() : 1);
+    documentStyle->setZoom(frame && !document->printing() ? frame->pageZoomFactor() : 1);
     documentStyle->setPageScaleTransform(frame ? frame->frameScaleFactor() : 1);
     documentStyle->setUserModify(document->inDesignMode() ? READ_WRITE : READ_ONLY);
     documentStyle->setLocale(document->contentLanguage());
@@ -2103,13 +2153,12 @@ PassRefPtr<CSSRuleList> CSSStyleSelector::pseudoStyleRulesForElement(Element* e,
     return m_ruleList.release();
 }
 
-inline bool CSSStyleSelector::checkSelector(const RuleData& ruleData, const Element* scope)
+inline bool CSSStyleSelector::checkSelector(const RuleData& ruleData, const ContainerNode* scope)
 {
     m_dynamicPseudo = NOPSEUDO;
     m_checker.clearHasUnknownPseudoElements();
 
-    // Let the slow path handle SVG as it has some additional rules regarding shadow trees.
-    if (ruleData.hasFastCheckableSelector() && !m_element->isSVGElement()) {
+    if (ruleData.hasFastCheckableSelector()) {
         // We know this selector does not include any pseudo elements.
         if (m_checker.pseudoStyle() != NOPSEUDO)
             return false;
@@ -2161,7 +2210,7 @@ bool CSSStyleSelector::determineStylesheetSelectorScopes(CSSStyleSheet* styleshe
     for (size_t i = 0; i < size; i++) {
         CSSRule* rule = stylesheet->item(i);
         if (rule->isStyleRule()) {
-            CSSStyleRule* styleRule = static_cast<CSSStyleRule*>(rule);
+            StyleRule* styleRule = static_cast<CSSStyleRule*>(rule)->styleRule();
             if (!SelectorChecker::determineSelectorScopes(styleRule->selectorList(), idScopes, classScopes))
                 return false;
             continue;
@@ -2210,7 +2259,7 @@ static inline bool selectorListContainsUncommonAttributeSelector(const CSSSelect
 
 static inline bool isCommonAttributeSelectorAttribute(const QualifiedName& attribute)
 {
-    // These are explicitly tested for equality in canShareStyleWithControl.
+    // These are explicitly tested for equality in canShareStyleWithElement.
     return attribute == typeAttr || attribute == readonlyAttr;
 }
 
@@ -2236,7 +2285,7 @@ static inline bool containsUncommonAttributeSelector(const CSSSelector* selector
     return false;
 }
 
-RuleData::RuleData(CSSStyleRule* rule, CSSSelector* selector, unsigned position, bool canUseFastCheckSelector)
+RuleData::RuleData(StyleRule* rule, CSSSelector* selector, unsigned position, bool canUseFastCheckSelector, bool inRegionRule)
     : m_rule(rule)
     , m_selector(selector)
     , m_specificity(selector->specificity())
@@ -2246,6 +2295,7 @@ RuleData::RuleData(CSSStyleRule* rule, CSSSelector* selector, unsigned position,
     , m_hasRightmostSelectorMatchingHTMLBasedOnRuleHash(isSelectorMatchingHTMLBasedOnRuleHash(selector))
     , m_containsUncommonAttributeSelector(WebCore::containsUncommonAttributeSelector(selector))
     , m_linkMatchType(SelectorChecker::determineLinkMatchType(selector))
+    , m_isInRegionRule(inRegionRule)
 {
     SelectorChecker::collectIdentifierHashes(m_selector, m_descendantSelectorIdentifierHashes, maximumIdentifierCount);
 }
@@ -2310,9 +2360,9 @@ void RuleSet::addToRuleSet(AtomicStringImpl* key, AtomRuleMap& map, const RuleDa
     rules->append(ruleData);
 }
 
-void RuleSet::addRule(CSSStyleRule* rule, CSSSelector* selector, bool canUseFastCheckSelector)
+void RuleSet::addRule(StyleRule* rule, CSSSelector* selector, bool canUseFastCheckSelector, bool inRegionRule)
 {
-    RuleData ruleData(rule, selector, m_ruleCount++, canUseFastCheckSelector);
+    RuleData ruleData(rule, selector, m_ruleCount++, canUseFastCheckSelector, inRegionRule);
     collectFeaturesFromRuleData(m_features, ruleData);
 
     if (selector->m_match == CSSSelector::Id) {
@@ -2369,13 +2419,13 @@ void RuleSet::addRegionRule(WebKitCSSRegionRule* rule)
     for (unsigned i = 0; i < rulesSize; ++i) {
         CSSRule* regionStylingRule = regionStylingRules->item(i);
         if (regionStylingRule->isStyleRule())
-            regionRuleSet->addStyleRule(static_cast<CSSStyleRule*>(regionStylingRule));
+            regionRuleSet->addStyleRule(static_cast<CSSStyleRule*>(regionStylingRule)->styleRule(), true, true);
     }
 
     m_regionSelectorsAndRuleSets.append(RuleSetSelectorPair(rule->selectorList().first(), regionRuleSet));
 }
 
-void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator& medium, CSSStyleSelector* styleSelector, const Element* scope)
+void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator& medium, CSSStyleSelector* styleSelector, const ContainerNode* scope)
 {
     ASSERT(sheet);
 
@@ -2389,7 +2439,7 @@ void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator&
     for (int i = 0; i < len; i++) {
         CSSRule* rule = sheet->item(i);
         if (rule->isStyleRule())
-            addStyleRule(static_cast<CSSStyleRule*>(rule), !scope);
+            addStyleRule(static_cast<CSSStyleRule*>(rule)->styleRule(), !scope);
         else if (rule->isPageRule())
             addPageRule(static_cast<CSSPageRule*>(rule));
         else if (rule->isImportRule()) {
@@ -2406,7 +2456,7 @@ void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator&
                 for (unsigned j = 0; j < rules->length(); j++) {
                     CSSRule *childItem = rules->item(j);
                     if (childItem->isStyleRule())
-                        addStyleRule(static_cast<CSSStyleRule*>(childItem), !scope);
+                        addStyleRule(static_cast<CSSStyleRule*>(childItem)->styleRule(), !scope);
                     else if (childItem->isPageRule())
                         addPageRule(static_cast<CSSPageRule*>(childItem));
                     else if (childItem->isFontFaceRule() && styleSelector) {
@@ -2450,10 +2500,10 @@ void RuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluator&
         shrinkToFit();
 }
 
-void RuleSet::addStyleRule(CSSStyleRule* rule, bool canUseFastCheckSelector)
+void RuleSet::addStyleRule(StyleRule* rule, bool canUseFastCheckSelector, bool isInRegionRule)
 {
     for (CSSSelector* s = rule->selectorList().first(); s; s = CSSSelectorList::next(s))
-        addRule(rule, s, canUseFastCheckSelector);
+        addRule(rule, s, canUseFastCheckSelector, isInRegionRule);
 }
 
 static inline void shrinkMapVectorsToFit(RuleSet::AtomRuleMap& map)
@@ -2478,19 +2528,17 @@ void RuleSet::shrinkToFit()
 // -------------------------------------------------------------------------------------
 // this is mostly boring stuff on how to apply a certain rule to the renderstyle...
 
-static Length convertToLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, bool toFloat, double multiplier = 1, bool *ok = 0)
+static Length convertToLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, bool toFloat, double multiplier = 1)
 {
     // This function is tolerant of a null style value. The only place style is used is in
     // length measurements, like 'ems' and 'px'. And in those cases style is only used
     // when the units are EMS or EXS. So we will just fail in those cases.
     Length l;
     if (!primitiveValue) {
-        if (ok)
-            *ok = false;
+        l = Length(Undefined);
     } else {
         if (!style && primitiveValue->isFontRelativeLength()) {
-            if (ok)
-                *ok = false;
+            l = Length(Undefined);
         } else if (primitiveValue->isLength()) {
             if (toFloat)
                 l = Length(primitiveValue->computeLength<double>(style, rootStyle, multiplier), Fixed);
@@ -2500,38 +2548,27 @@ static Length convertToLength(CSSPrimitiveValue* primitiveValue, RenderStyle* st
             l = Length(primitiveValue->getDoubleValue(), Percent);
         else if (primitiveValue->isNumber())
             l = Length(primitiveValue->getDoubleValue() * 100.0, Percent);
-        else if (ok)
-            *ok = false;
+        else
+            l = Length(Undefined);
     }
     return l;
 }
 
-static Length convertToIntLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, double multiplier = 1, bool *ok = 0)
-{
-    return convertToLength(primitiveValue, style, rootStyle, false, multiplier, ok);
-}
-
-static Length convertToFloatLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, double multiplier = 1, bool *ok = 0)
+Length CSSStyleSelector::convertToIntLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, double multiplier)
 {
-    return convertToLength(primitiveValue, style, rootStyle, true, multiplier, ok);
+    return convertToLength(primitiveValue, style, rootStyle, false, multiplier);
 }
 
-static inline bool isInsideRegionRule(CSSRule* rule)
+Length CSSStyleSelector::convertToFloatLength(CSSPrimitiveValue* primitiveValue, RenderStyle* style, RenderStyle* rootStyle, double multiplier)
 {
-    // FIXME: Cache this bit somewhere.
-    while (rule) {
-        if (rule->isRegionRule())
-            return true;
-        rule = rule->parentRule();
-    }
-    return false;
+    return convertToLength(primitiveValue, style, rootStyle, true, multiplier);
 }
 
 template <bool applyFirst>
-void CSSStyleSelector::applyProperties(const StylePropertySet* properties, CSSStyleRule* rule, bool isImportant, bool inheritedOnly)
+void CSSStyleSelector::applyProperties(const StylePropertySet* properties, StyleRule* rule, bool isImportant, bool inheritedOnly, bool filterRegionProperties)
 {
+    ASSERT(!filterRegionProperties || m_regionForStyling);
     InspectorInstrumentationCookie cookie = InspectorInstrumentation::willProcessRule(document(), rule);
-    bool styleDeclarationInsideRegionRule = m_regionForStyling && isInsideRegionRule(rule);
 
     unsigned propertyCount = properties->propertyCount();
     for (unsigned i = 0; i < propertyCount; ++i) {
@@ -2547,8 +2584,7 @@ void CSSStyleSelector::applyProperties(const StylePropertySet* properties, CSSSt
         }
         int property = current.id();
 
-        // Filter the properties that can be applied using region styling.
-        if (styleDeclarationInsideRegionRule && !CSSStyleSelector::isValidRegionStyleProperty(property))
+        if (filterRegionProperties && !CSSStyleSelector::isValidRegionStyleProperty(property))
             continue;
 
         if (applyFirst) {
@@ -2580,19 +2616,22 @@ void CSSStyleSelector::applyMatchedProperties(const MatchResult& matchResult, bo
 
     if (m_style->insideLink() != NotInsideLink) {
         for (int i = startIndex; i <= endIndex; ++i) {
-            unsigned linkMatchType = matchResult.matchedProperties[i].linkMatchType;
+            const MatchedProperties& matchedProperties = matchResult.matchedProperties[i];
+            unsigned linkMatchType = matchedProperties.linkMatchType;
             // FIXME: It would be nicer to pass these as arguments but that requires changes in many places.
             m_applyPropertyToRegularStyle = linkMatchType & SelectorChecker::MatchLink;
             m_applyPropertyToVisitedLinkStyle = linkMatchType & SelectorChecker::MatchVisited;
 
-            applyProperties<applyFirst>(matchResult.matchedProperties[i].properties.get(), matchResult.matchedRules[i], isImportant, inheritedOnly);
+            applyProperties<applyFirst>(matchedProperties.properties.get(), matchResult.matchedRules[i], isImportant, inheritedOnly, matchedProperties.isInRegionRule);
         }
         m_applyPropertyToRegularStyle = true;
         m_applyPropertyToVisitedLinkStyle = false;
         return;
     }
-    for (int i = startIndex; i <= endIndex; ++i)
-        applyProperties<applyFirst>(matchResult.matchedProperties[i].properties.get(), matchResult.matchedRules[i], isImportant, inheritedOnly);
+    for (int i = startIndex; i <= endIndex; ++i) {
+        const MatchedProperties& matchedProperties = matchResult.matchedProperties[i];
+        applyProperties<applyFirst>(matchedProperties.properties.get(), matchResult.matchedRules[i], isImportant, inheritedOnly, matchedProperties.isInRegionRule);
+    }
 }
 
 unsigned CSSStyleSelector::computeMatchedPropertiesHash(const MatchedProperties* properties, unsigned size)
@@ -2671,8 +2710,11 @@ void CSSStyleSelector::invalidateMatchedPropertiesCache()
     m_matchedPropertiesCache.clear();
 }
 
-static bool isCacheableInMatchedPropertiesCache(const RenderStyle* style, const RenderStyle* parentStyle)
+static bool isCacheableInMatchedPropertiesCache(const Element* element, const RenderStyle* style, const RenderStyle* parentStyle)
 {
+    // FIXME: CSSPropertyWebkitWritingMode modifies state when applying to document element. We can't skip the applying by caching.
+    if (element == element->document()->documentElement() && element->document()->writingModeSetOnDocumentElement())
+        return false;
     if (style->unique() || (style->styleType() != NOPSEUDO && parentStyle->unique()))
         return false;
     if (style->hasAppearance())
@@ -2754,7 +2796,7 @@ void CSSStyleSelector::applyMatchedProperties(const MatchResult& matchResult)
     
     if (cacheItem || !cacheHash)
         return;
-    if (!isCacheableInMatchedPropertiesCache(m_style.get(), m_parentStyle))
+    if (!isCacheableInMatchedPropertiesCache(m_element, m_style.get(), m_parentStyle))
         return;
     addToMatchedPropertiesCache(m_style.get(), m_parentStyle, cacheHash, matchResult);
 }
@@ -2952,6 +2994,22 @@ static bool createGridTrackList(CSSValue* value, Vector<Length>& lengths, CSSSty
 
     return false;
 }
+
+
+static bool createGridPosition(CSSValue* value, Length& position)
+{
+    // For now, we only accept: <integer> | 'auto'
+    if (!value->isPrimitiveValue())
+        return false;
+
+    CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+    if (primitiveValue->getIdent() == CSSValueAuto)
+        return true;
+
+    ASSERT(primitiveValue->isNumber());
+    position.setValue(primitiveValue->getIntValue());
+    return true;
+}
 #endif
 
 void CSSStyleSelector::applyProperty(int id, CSSValue *value)
@@ -3292,9 +3350,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
 
     // CSS3 Properties
-    case CSSPropertyImageRendering:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(imageRendering, ImageRendering);
-        return;
     case CSSPropertyTextShadow:
     case CSSPropertyBoxShadow:
     case CSSPropertyWebkitBoxShadow: {
@@ -3368,21 +3423,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     case CSSPropertyUnicodeRange: // Only used in @font-face rules.
         return;
-    case CSSPropertyBoxSizing:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxSizing, BoxSizing);
-        return;
-    case CSSPropertyWebkitColumnRuleStyle:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnRuleStyle, ColumnRuleStyle, BorderStyle)
-        return;
-    case CSSPropertyWebkitColumnBreakBefore:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnBreakBefore, ColumnBreakBefore, PageBreak)
-        return;
-    case CSSPropertyWebkitColumnBreakAfter:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnBreakAfter, ColumnBreakAfter, PageBreak)
-        return;
-    case CSSPropertyWebkitColumnBreakInside:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnBreakInside, ColumnBreakInside, PageBreak)
-        return;
     case CSSPropertyWebkitColumnRule:
         if (isInherit) {
             m_style->setColumnRuleColor(m_parentStyle->columnRuleColor().isValid() ? m_parentStyle->columnRuleColor() : m_parentStyle->color());
@@ -3392,15 +3432,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         else if (isInitial)
             m_style->resetColumnRule();
         return;
-    case CSSPropertyWebkitRegionBreakBefore:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(regionBreakBefore, RegionBreakBefore, PageBreak)
-        return;
-    case CSSPropertyWebkitRegionBreakAfter:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(regionBreakAfter, RegionBreakAfter, PageBreak)
-        return;
-    case CSSPropertyWebkitRegionBreakInside:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(regionBreakInside, RegionBreakInside, PageBreak)
-        return;
     case CSSPropertyWebkitMarquee:
         if (!m_parentNode || !value->isInheritedValue())
             return;
@@ -3459,9 +3490,8 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                     break;
             }
         } else {
-            bool ok = true;
-            Length marqueeLength = convertToIntLength(primitiveValue, style(), m_rootElementStyle, 1, &ok);
-            if (ok)
+            Length marqueeLength = convertToIntLength(primitiveValue, style(), m_rootElementStyle, 1);
+            if (!marqueeLength.isUndefined())
                 m_style->setMarqueeIncrement(marqueeLength);
         }
         return;
@@ -3482,9 +3512,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             m_style->setLineClamp(LineClampValue(primitiveValue->getIntValue(CSSPrimitiveValue::CSS_PERCENTAGE), LineClampPercentage));
         return;
     }
-    case CSSPropertyWebkitHyphens:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(hyphens, Hyphens);
-        return;
     case CSSPropertyWebkitLocale: {
         HANDLE_INHERIT_AND_INITIAL(locale, Locale);
         if (primitiveValue->getIdent() == CSSValueAuto)
@@ -3496,9 +3523,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         setFontDescription(fontDescription);
         return;
     }
-    case CSSPropertyWebkitBorderFit:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(borderFit, BorderFit);
-        return;
     case CSSPropertyWebkitTextSizeAdjust: {
         HANDLE_INHERIT_AND_INITIAL(textSizeAdjust, TextSizeAdjust)
         if (!primitiveValue || !primitiveValue->getIdent())
@@ -3527,6 +3551,16 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             Length right = convertToIntLength(region->right(), style(), m_rootElementStyle);
             Length bottom = convertToIntLength(region->bottom(), style(), m_rootElementStyle);
             Length left = convertToIntLength(region->left(), style(), m_rootElementStyle);
+
+            if (top.isUndefined())
+                top = Length();
+            if (right.isUndefined())
+                right = Length();
+            if (bottom.isUndefined())
+                bottom = Length();
+            if (left.isUndefined())
+                left = Length();
+
             if (region->m_isCircle)
                 m_style->setDashboardRegion(StyleDashboardRegion::Circle, region->m_label, top, right, bottom, left, region == first ? false : true);
             else if (region->m_isRectangle)
@@ -3632,12 +3666,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
 #endif
-    case CSSPropertyWebkitColorCorrection:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(colorSpace, ColorSpace);
-        return;
-    case CSSPropertySpeak:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(speak, Speak);
-        return;
     case CSSPropertyInvalid:
         return;
     // Directional properties are resolved by resolveDirectionAwareProperty() before the switch.
@@ -3707,6 +3735,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     // CSS Text Layout Module Level 3: Vertical writing support
     case CSSPropertyWebkitWritingMode: {
         HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(writingMode, WritingMode)
+        // FIXME: It is not ok to modify document state while applying style.
         if (!isInherit && !isInitial && m_element && m_element == m_element->document()->documentElement())
             m_element->document()->setWritingModeSetOnDocumentElement(true);
         FontDescription fontDescription = m_style->fontDescription();
@@ -3730,10 +3759,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
 
-    case CSSPropertyWebkitColumnAxis:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(columnAxis, ColumnAxis);
-        return;
-
     case CSSPropertyWebkitWrapShapeInside:
         HANDLE_INHERIT_AND_INITIAL(wrapShapeInside, WrapShapeInside);
         if (!primitiveValue)
@@ -3804,6 +3829,21 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         m_style->setGridRows(lengths);
         return;
     }
+
+    case CSSPropertyWebkitGridColumn: {
+        Length column;
+        if (!createGridPosition(value, column))
+            return;
+        m_style->setGridItemColumn(column);
+        return;
+    }
+    case CSSPropertyWebkitGridRow: {
+        Length row;
+        if (!createGridPosition(value, row))
+            return;
+        m_style->setGridItemRow(row);
+        return;
+    }
 #endif
 
     // These properties are implemented in the CSSStyleApplyProperty lookup table.
@@ -3853,6 +3893,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyBorderTopWidth:
     case CSSPropertyBorderWidth:
     case CSSPropertyBottom:
+    case CSSPropertyBoxSizing:
     case CSSPropertyCaptionSide:
     case CSSPropertyClear:
     case CSSPropertyClip:
@@ -3869,6 +3910,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyFontVariant:
     case CSSPropertyFontWeight:
     case CSSPropertyHeight:
+    case CSSPropertyImageRendering:
     case CSSPropertyLeft:
     case CSSPropertyLetterSpacing:
     case CSSPropertyLineHeight:
@@ -3906,6 +3948,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyResize:
     case CSSPropertyRight:
     case CSSPropertySize:
+    case CSSPropertySpeak:
     case CSSPropertyTableLayout:
     case CSSPropertyTextAlign:
     case CSSPropertyTextDecoration:
@@ -3931,6 +3974,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitBackgroundComposite:
     case CSSPropertyWebkitBackgroundOrigin:
     case CSSPropertyWebkitBackgroundSize:
+    case CSSPropertyWebkitBorderFit:
     case CSSPropertyWebkitBorderHorizontalSpacing:
     case CSSPropertyWebkitBorderImage:
     case CSSPropertyWebkitBorderRadius:
@@ -3943,9 +3987,15 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitBoxOrdinalGroup:
     case CSSPropertyWebkitBoxOrient:
     case CSSPropertyWebkitBoxPack:
+    case CSSPropertyWebkitColorCorrection:
+    case CSSPropertyWebkitColumnAxis:
+    case CSSPropertyWebkitColumnBreakAfter:
+    case CSSPropertyWebkitColumnBreakBefore:
+    case CSSPropertyWebkitColumnBreakInside:
     case CSSPropertyWebkitColumnCount:
     case CSSPropertyWebkitColumnGap:
     case CSSPropertyWebkitColumnRuleColor:
+    case CSSPropertyWebkitColumnRuleStyle:
     case CSSPropertyWebkitColumnRuleWidth:
     case CSSPropertyWebkitColumns:
     case CSSPropertyWebkitColumnSpan:
@@ -3967,6 +4017,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitHyphenateLimitAfter:
     case CSSPropertyWebkitHyphenateLimitBefore:
     case CSSPropertyWebkitHyphenateLimitLines:
+    case CSSPropertyWebkitHyphens:
     case CSSPropertyWebkitLineAlign:
     case CSSPropertyWebkitLineBreak:
     case CSSPropertyWebkitLineGrid:
@@ -3997,6 +4048,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitPerspectiveOriginX:
     case CSSPropertyWebkitPerspectiveOriginY:
     case CSSPropertyWebkitPrintColorAdjust:
+    case CSSPropertyWebkitRegionBreakAfter:
+    case CSSPropertyWebkitRegionBreakBefore:
+    case CSSPropertyWebkitRegionBreakInside:
     case CSSPropertyWebkitRegionOverflow:
     case CSSPropertyWebkitRtlOrdering:
     case CSSPropertyWebkitTextCombine:
@@ -5059,22 +5113,21 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
             case WebKitCSSTransformValue::TranslateTransformOperation:
             case WebKitCSSTransformValue::TranslateXTransformOperation:
             case WebKitCSSTransformValue::TranslateYTransformOperation: {
-                bool ok = true;
                 Length tx = Length(0, Fixed);
                 Length ty = Length(0, Fixed);
                 if (transformValue->operationType() == WebKitCSSTransformValue::TranslateYTransformOperation)
-                    ty = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    ty = convertToFloatLength(firstValue, style, rootStyle, zoomFactor);
                 else {
-                    tx = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    tx = convertToFloatLength(firstValue, style, rootStyle, zoomFactor);
                     if (transformValue->operationType() != WebKitCSSTransformValue::TranslateXTransformOperation) {
                         if (transformValue->length() > 1) {
                             CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(1));
-                            ty = convertToFloatLength(secondValue, style, rootStyle, zoomFactor, &ok);
+                            ty = convertToFloatLength(secondValue, style, rootStyle, zoomFactor);
                         }
                     }
                 }
 
-                if (!ok)
+                if (tx.isUndefined() || ty.isUndefined())
                     return false;
 
                 operations.operations().append(TranslateTransformOperation::create(tx, ty, Length(0, Fixed), getTransformOperationType(transformValue->operationType())));
@@ -5082,29 +5135,28 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
             }
             case WebKitCSSTransformValue::TranslateZTransformOperation:
             case WebKitCSSTransformValue::Translate3DTransformOperation: {
-                bool ok = true;
                 Length tx = Length(0, Fixed);
                 Length ty = Length(0, Fixed);
                 Length tz = Length(0, Fixed);
                 if (transformValue->operationType() == WebKitCSSTransformValue::TranslateZTransformOperation)
-                    tz = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    tz = convertToFloatLength(firstValue, style, rootStyle, zoomFactor);
                 else if (transformValue->operationType() == WebKitCSSTransformValue::TranslateYTransformOperation)
-                    ty = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    ty = convertToFloatLength(firstValue, style, rootStyle, zoomFactor);
                 else {
-                    tx = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    tx = convertToFloatLength(firstValue, style, rootStyle, zoomFactor);
                     if (transformValue->operationType() != WebKitCSSTransformValue::TranslateXTransformOperation) {
                         if (transformValue->length() > 2) {
                             CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(2));
-                            tz = convertToFloatLength(thirdValue, style, rootStyle, zoomFactor, &ok);
+                            tz = convertToFloatLength(thirdValue, style, rootStyle, zoomFactor);
                         }
                         if (transformValue->length() > 1) {
                             CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(transformValue->itemWithoutBoundsCheck(1));
-                            ty = convertToFloatLength(secondValue, style, rootStyle, zoomFactor, &ok);
+                            ty = convertToFloatLength(secondValue, style, rootStyle, zoomFactor);
                         }
                     }
                 }
 
-                if (!ok)
+                if (tx.isUndefined() || ty.isUndefined() || tz.isUndefined())
                     return false;
 
                 operations.operations().append(TranslateTransformOperation::create(tx, ty, tz, getTransformOperationType(transformValue->operationType())));
@@ -5200,18 +5252,16 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                 break;
             }
             case WebKitCSSTransformValue::PerspectiveTransformOperation: {
-                bool ok = true;
                 Length p = Length(0, Fixed);
                 if (firstValue->isLength())
-                    p = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                    p = convertToFloatLength(firstValue, style, rootStyle, zoomFactor);
                 else {
                     // This is a quirk that should go away when 3d transforms are finalized.
                     double val = firstValue->getDoubleValue();
-                    ok = val >= 0;
-                    p = Length(clampToPositiveInteger(val), Fixed);
+                    p = val >= 0 ? Length(clampToPositiveInteger(val), Fixed) : Length(Undefined);
                 }
 
-                if (!ok)
+                if (p.isUndefined())
                     return false;
 
                 operations.operations().append(PerspectiveTransformOperation::create(p));
@@ -5557,12 +5607,11 @@ bool CSSStyleSelector::createFilterOperations(CSSValue* inValue, RenderStyle* st
             break;
         }
         case WebKitCSSFilterValue::BlurFilterOperation: {
-            bool ok = true;
             Length stdDeviation = Length(0, Fixed);
             if (filterValue->length() >= 1) {
-                stdDeviation = convertToFloatLength(firstValue, style, rootStyle, zoomFactor, &ok);
+                stdDeviation = convertToFloatLength(firstValue, style, rootStyle, zoomFactor);
             }
-            if (!ok)
+            if (stdDeviation.isUndefined())
                 return false;
 
             operations.operations().append(BlurFilterOperation::create(stdDeviation, operationType));
diff --git a/Source/WebCore/css/CSSStyleSelector.h b/Source/WebCore/css/CSSStyleSelector.h
index 4db7f226d..099a9a73e 100644
--- a/Source/WebCore/css/CSSStyleSelector.h
+++ b/Source/WebCore/css/CSSStyleSelector.h
@@ -48,7 +48,6 @@ class CSSImageValue;
 class CSSRuleList;
 class CSSSelector;
 class CSSStyleApplyProperty;
-class CSSStyleRule;
 class CSSStyleSheet;
 class CSSValue;
 class ContainerNode;
@@ -70,6 +69,7 @@ class Settings;
 class StyleImage;
 class StylePendingImage;
 class StylePropertySet;
+class StyleRule;
 class StyleShader;
 class StyleSheet;
 class StyleSheetList;
@@ -107,8 +107,10 @@ public:
     ~CSSStyleSelector();
 
     // Using these during tree walk will allow style selector to optimize child and descendant selector lookups.
-    void pushParent(Element* parent);
-    void popParent(Element* parent);
+    void pushParentElement(Element*);
+    void popParentElement(Element*);
+    void pushParentShadowRoot(const ShadowRoot*);
+    void popParentShadowRoot(const ShadowRoot*);
 
     PassRefPtr<RenderStyle> styleForElement(Element*, RenderStyle* parentStyle = 0, bool allowSharing = true, bool resolveForRootDefault = false, RenderRegion* regionForStyling = 0);
 
@@ -150,6 +152,14 @@ private:
 
     PassRefPtr<RenderStyle> styleForKeyframe(const RenderStyle*, const WebKitCSSKeyframeRule*, KeyframeValue&);
 
+#if ENABLE(STYLE_SCOPED)
+    void pushScope(const ContainerNode* scope, const ContainerNode* scopeParent);
+    void popScope(const ContainerNode* scope);
+#else
+    void pushScope(const ContainerNode*, const ContainerNode*) { }
+    void popScope(const ContainerNode*) { }
+#endif
+
 public:
     // These methods will give back the set of rules that matched for a given element (or a pseudo-element).
     enum CSSRuleFilter {
@@ -228,8 +238,8 @@ public:
 #endif // ENABLE(CSS_FILTERS)
 
     struct RuleSelectorPair {
-        RuleSelectorPair(CSSStyleRule* rule, CSSSelector* selector) : rule(rule), selector(selector) { }
-        CSSStyleRule* rule;
+        RuleSelectorPair(StyleRule* rule, CSSSelector* selector) : rule(rule), selector(selector) { }
+        StyleRule* rule;
         CSSSelector* selector;
     };
     struct Features {
@@ -271,7 +281,10 @@ private:
         
         RefPtr<StylePropertySet> properties;
         union {
-            unsigned linkMatchType;
+            struct {
+                unsigned linkMatchType : 2;
+                unsigned isInRegionRule : 1;
+            };
             // Used to make sure all memory is zero-initialized since we compute the hash over the bytes of this object.
             void* possiblyPaddedMember;
         };
@@ -280,18 +293,19 @@ private:
     struct MatchResult {
         MatchResult() : isCacheable(true) { }
         Vector<MatchedProperties, 64> matchedProperties;
-        Vector<CSSStyleRule*, 64> matchedRules;
+        Vector<StyleRule*, 64> matchedRules;
         MatchRanges ranges;
         bool isCacheable;
     };
 
     struct MatchOptions {
-        MatchOptions(bool includeEmptyRules, const Element* scope = 0) : scope(scope), includeEmptyRules(includeEmptyRules) { }
-        const Element* scope;
+        MatchOptions(bool includeEmptyRules, const ContainerNode* scope = 0) : scope(scope), includeEmptyRules(includeEmptyRules) { }
+        const ContainerNode* scope;
         bool includeEmptyRules;
     };
 
-    static void addMatchedProperties(MatchResult& matchResult, StylePropertySet* properties, CSSStyleRule* rule = 0, unsigned linkMatchType =  SelectorChecker::MatchAll);
+    static void addMatchedProperties(MatchResult&, StylePropertySet* properties, StyleRule* = 0, unsigned linkMatchType = SelectorChecker::MatchAll, bool inRegionRule = false);
+    void addElementStyleProperties(MatchResult&, StylePropertySet*, bool isCacheable = true);
 
     void matchAllRules(MatchResult&);
     void matchUARules(MatchResult&);
@@ -306,13 +320,13 @@ private:
     void sortMatchedRules();
     void sortAndTransferMatchedRules(MatchResult&);
 
-    bool checkSelector(const RuleData&, const Element* scope = 0);
+    bool checkSelector(const RuleData&, const ContainerNode* scope = 0);
     bool checkRegionSelector(CSSSelector* regionSelector, Element* regionElement);
     void applyMatchedProperties(const MatchResult&);
     template <bool firstPass>
     void applyMatchedProperties(const MatchResult&, bool important, int startIndex, int endIndex, bool inheritedOnly);
     template <bool firstPass>
-    void applyProperties(const StylePropertySet* properties, CSSStyleRule*, bool isImportant, bool inheritedOnly);
+    void applyProperties(const StylePropertySet* properties, StyleRule*, bool isImportant, bool inheritedOnly, bool filterRegionProperties);
 
     static bool isValidRegionStyleProperty(int id);
 
@@ -348,6 +362,9 @@ public:
     bool applyPropertyToRegularStyle() const { return m_applyPropertyToRegularStyle; }
     bool applyPropertyToVisitedLinkStyle() const { return m_applyPropertyToVisitedLinkStyle; }
 
+    static Length convertToIntLength(CSSPrimitiveValue*, RenderStyle*, RenderStyle* rootStyle, double multiplier = 1);
+    static Length convertToFloatLength(CSSPrimitiveValue*, RenderStyle*, RenderStyle* rootStyle, double multiplier = 1);
+
 private:
     static RenderStyle* s_styleNotYetAvailable;
 
@@ -449,29 +466,29 @@ private:
 #endif
 
 #if ENABLE(STYLE_SCOPED)
-    static const Element* determineScopingElement(const CSSStyleSheet*);
+    static const ContainerNode* determineScope(const CSSStyleSheet*);
 
-    typedef HashMap<const Element*, OwnPtr<RuleSet> > ScopedRuleSetMap;
+    typedef HashMap<const ContainerNode*, OwnPtr<RuleSet> > ScopedRuleSetMap;
 
-    RuleSet* scopedRuleSetForElement(const Element*) const;
+    RuleSet* ruleSetForScope(const ContainerNode*) const;
 
-    void setupScopingElementStack(const Element*);
-    bool scopingElementStackIsConsistent(const Element* parent) const { return parent && parent == m_scopingElementStackParent; }
+    void setupScopeStack(const ContainerNode*);
+    bool scopeStackIsConsistent(const ContainerNode* parent) const { return parent && parent == m_scopeStackParent; }
 
     ScopedRuleSetMap m_scopedAuthorStyles;
     
     struct ScopeStackFrame {
-        ScopeStackFrame() : m_element(0), m_ruleSet(0) { }
-        ScopeStackFrame(const Element* element, RuleSet* ruleSet) : m_element(element), m_ruleSet(ruleSet) { }
-        const Element* m_element;
+        ScopeStackFrame() : m_scope(0), m_ruleSet(0) { }
+        ScopeStackFrame(const ContainerNode* scope, RuleSet* ruleSet) : m_scope(scope), m_ruleSet(ruleSet) { }
+        const ContainerNode* m_scope;
         RuleSet* m_ruleSet;
     };
     // Vector (used as stack) that keeps track of scoping elements (i.e., elements with a <style scoped> child)
     // encountered during tree iteration for style resolution.
-    Vector<ScopeStackFrame> m_scopingElementStack;
+    Vector<ScopeStackFrame> m_scopeStack;
     // Element last seen as parent element when updating m_scopingElementStack.
     // This is used to decide whether m_scopingElementStack is consistent, separately from SelectorChecker::m_parentStack.
-    const Element* m_scopingElementStackParent;
+    const ContainerNode* m_scopeStackParent;
 #endif
 
     friend class CSSStyleApplyProperty;
diff --git a/Source/WebCore/css/CSSStyleSheet.cpp b/Source/WebCore/css/CSSStyleSheet.cpp
index 707ca4c3c..4cd82af22 100644
--- a/Source/WebCore/css/CSSStyleSheet.cpp
+++ b/Source/WebCore/css/CSSStyleSheet.cpp
@@ -27,12 +27,14 @@
 #include "CSSParser.h"
 #include "CSSRuleList.h"
 #include "CSSStyleRule.h"
+#include "CachedCSSStyleSheet.h"
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
 #include "Node.h"
 #include "SVGNames.h"
 #include "SecurityOrigin.h"
+#include "StyleRule.h"
 #include "TextEncoding.h"
 #include <wtf/Deque.h>
 
@@ -60,6 +62,7 @@ CSSStyleSheet::CSSStyleSheet(Node* parentNode, const String& href, const KURL& b
     , m_strictParsing(false)
     , m_isUserStyleSheet(false)
     , m_hasSyntacticallyValidCSSHeader(true)
+    , m_didLoadErrorOccur(false)
 {
     ASSERT(isAcceptableCSSStyleSheetParent(parentNode));
 }
@@ -70,6 +73,7 @@ CSSStyleSheet::CSSStyleSheet(CSSImportRule* ownerRule, const String& href, const
     , m_loadCompleted(false)
     , m_strictParsing(!ownerRule || ownerRule->useStrictParsing())
     , m_hasSyntacticallyValidCSSHeader(true)
+    , m_didLoadErrorOccur(false)
 {
     CSSStyleSheet* parentSheet = ownerRule ? ownerRule->parentStyleSheet() : 0;
     m_isUserStyleSheet = parentSheet ? parentSheet->isUserStyleSheet() : false;
@@ -237,7 +241,21 @@ void CSSStyleSheet::checkLoaded()
     RefPtr<CSSStyleSheet> protector(this);
     if (CSSStyleSheet* styleSheet = parentStyleSheet())
         styleSheet->checkLoaded();
-    m_loadCompleted = ownerNode() ? ownerNode()->sheetLoaded() : true;
+
+    RefPtr<Node> owner = ownerNode();
+    if (!owner)
+        m_loadCompleted = true;
+    else {
+        m_loadCompleted = owner->sheetLoaded();
+        if (m_loadCompleted)
+            owner->notifyLoadedSheetAndAllCriticalSubresources(m_didLoadErrorOccur);
+    }
+}
+
+void CSSStyleSheet::notifyLoadedSheet(const CachedCSSStyleSheet* sheet)
+{
+    ASSERT(sheet);
+    m_didLoadErrorOccur |= sheet->errorOccurred();
 }
 
 void CSSStyleSheet::startLoadingDynamicSheet()
@@ -306,7 +324,7 @@ void CSSStyleSheet::addSubresourceStyleURLs(ListHashSet<KURL>& urls)
             } else if (rule->isFontFaceRule())
                 static_cast<CSSFontFaceRule*>(rule)->addSubresourceStyleURLs(urls);
             else if (rule->isStyleRule() || rule->isPageRule())
-                static_cast<CSSStyleRule*>(rule)->addSubresourceStyleURLs(urls);
+                static_cast<CSSStyleRule*>(rule)->styleRule()->addSubresourceStyleURLs(urls, this);
         }
     }
 }
diff --git a/Source/WebCore/css/CSSStyleSheet.h b/Source/WebCore/css/CSSStyleSheet.h
index b027365f2..e73491918 100644
--- a/Source/WebCore/css/CSSStyleSheet.h
+++ b/Source/WebCore/css/CSSStyleSheet.h
@@ -29,6 +29,7 @@ namespace WebCore {
 struct CSSNamespace;
 class CSSParser;
 class CSSRule;
+class CachedCSSStyleSheet;
 class CachedResourceLoader;
 class Document;
 
@@ -114,6 +115,8 @@ public:
     unsigned length() const { return m_children.size(); }
     CSSRule* item(unsigned index) { return index < length() ? m_children.at(index).get() : 0; }
 
+    void notifyLoadedSheet(const CachedCSSStyleSheet*);
+
 private:
     CSSStyleSheet(Node* ownerNode, const String& originalURL, const KURL& finalURL, const String& charset);
     CSSStyleSheet(CSSImportRule* ownerRule, const String& originalURL, const KURL& finalURL, const String& charset);
@@ -128,6 +131,7 @@ private:
     bool m_strictParsing : 1;
     bool m_isUserStyleSheet : 1;
     bool m_hasSyntacticallyValidCSSHeader : 1;
+    bool m_didLoadErrorOccur : 1;
 };
 
 } // namespace
diff --git a/Source/WebCore/css/CSSValueKeywords.in b/Source/WebCore/css/CSSValueKeywords.in
index d299391d8..a80581f75 100644
--- a/Source/WebCore/css/CSSValueKeywords.in
+++ b/Source/WebCore/css/CSSValueKeywords.in
@@ -615,6 +615,8 @@ list-button
 listbox
 listitem
 media-fullscreen-button
+media-fullscreen-volume-slider
+media-fullscreen-volume-slider-thumb
 media-mute-button
 media-play-button
 media-seek-back-button
diff --git a/Source/WebCore/css/CSSWrapShapes.cpp b/Source/WebCore/css/CSSWrapShapes.cpp
index e5e9f98c3..fff84b95d 100644
--- a/Source/WebCore/css/CSSWrapShapes.cpp
+++ b/Source/WebCore/css/CSSWrapShapes.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/css/CSSWrapShapes.h b/Source/WebCore/css/CSSWrapShapes.h
index 3ff9fab83..38487b6db 100644
--- a/Source/WebCore/css/CSSWrapShapes.h
+++ b/Source/WebCore/css/CSSWrapShapes.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/css/MediaAllInOne.cpp b/Source/WebCore/css/MediaAllInOne.cpp
new file mode 100644
index 000000000..3c71b8215
--- /dev/null
+++ b/Source/WebCore/css/MediaAllInOne.cpp
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
+
+#include "MediaFeatureNames.cpp"
+#include "MediaList.cpp"
+#include "MediaQuery.cpp"
+#include "MediaQueryEvaluator.cpp"
+#include "MediaQueryExp.cpp"
+#include "MediaQueryList.cpp"
+#include "MediaQueryListListener.cpp"
+#include "MediaQueryMatcher.cpp"
diff --git a/Source/WebCore/css/SVGCSSParser.cpp b/Source/WebCore/css/SVGCSSParser.cpp
index 2c295765a..8a67fabf1 100644
--- a/Source/WebCore/css/SVGCSSParser.cpp
+++ b/Source/WebCore/css/SVGCSSParser.cpp
@@ -292,7 +292,7 @@ bool CSSParser::parseSVGValue(int propId, bool important)
             rollbackLastProperties(1);
             return false;
         }
-        CSSValue* value = m_parsedProperties[m_numParsedProperties - 1]->value();
+        CSSValue* value = m_parsedProperties.last().value();
         addProperty(CSSPropertyMarkerMid, value, important);
         addProperty(CSSPropertyMarkerEnd, value, important);
         m_implicitShorthand = false;
diff --git a/Source/WebCore/css/SelectorChecker.cpp b/Source/WebCore/css/SelectorChecker.cpp
index bc216605d..316f44650 100644
--- a/Source/WebCore/css/SelectorChecker.cpp
+++ b/Source/WebCore/css/SelectorChecker.cpp
@@ -52,17 +52,13 @@
 #include "ScrollbarTheme.h"
 #include "StyledElement.h"
 #include "Text.h"
+#include "XLinkNames.h"
 
 #if USE(PLATFORM_STRATEGIES)
 #include "PlatformStrategies.h"
 #include "VisitedLinkStrategy.h"
 #endif
 
-#if ENABLE(SVG)
-#include "SVGNames.h"
-#include "XLinkNames.h"
-#endif
-
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -218,11 +214,8 @@ static inline const AtomicString* linkAttribute(Node* node)
     Element* element = static_cast<Element*>(node);
     if (element->isHTMLElement())
         return &element->fastGetAttribute(hrefAttr);
-
-#if ENABLE(SVG)
     if (element->isSVGElement())
         return &element->getAttribute(XLinkNames::hrefAttr);
-#endif
 
     return 0;
 }
@@ -445,13 +438,6 @@ bool SelectorChecker::isFastCheckableSelector(const CSSSelector* selector)
 // * SelectorFailsCompletely  - the selector fails for e and any sibling or ancestor of e
 SelectorChecker::SelectorMatch SelectorChecker::checkSelector(const SelectorCheckingContext& context, PseudoId& dynamicPseudo) const
 {
-#if ENABLE(SVG)
-    // Spec: CSS2 selectors cannot be applied to the (conceptually) cloned DOM tree
-    // because its contents are not part of the formal document structure.
-    if (context.element->isSVGShadowRoot())
-        return SelectorFailsCompletely;
-#endif
-
     // first selector has to match
     if (!checkOneSelector(context, dynamicPseudo))
         return SelectorFailsLocally;
@@ -1122,6 +1108,10 @@ bool SelectorChecker::checkOneSelector(const SelectorCheckingContext& context, P
                     return true;
                 break;
             }
+        case CSSSelector::PseudoScope:
+            if (context.scope)
+                return element == context.scope;
+            // If there is no scope, :scope should behave as :root -> fall through
         case CSSSelector::PseudoRoot:
             if (element == element->document()->documentElement())
                 return true;
diff --git a/Source/WebCore/css/SelectorChecker.h b/Source/WebCore/css/SelectorChecker.h
index 7e80808dd..22b127f02 100644
--- a/Source/WebCore/css/SelectorChecker.h
+++ b/Source/WebCore/css/SelectorChecker.h
@@ -66,7 +66,7 @@ public:
 
         CSSSelector* selector;
         Element* element;
-        const Element* scope;
+        const ContainerNode* scope;
         VisitedMatchType visitedMatchType;
         RenderStyle* elementStyle;
         RenderStyle* elementParentStyle;
diff --git a/Source/WebCore/css/StylePropertySet.cpp b/Source/WebCore/css/StylePropertySet.cpp
index e8d97cacc..65452ec3b 100644
--- a/Source/WebCore/css/StylePropertySet.cpp
+++ b/Source/WebCore/css/StylePropertySet.cpp
@@ -57,26 +57,27 @@ StylePropertySet::StylePropertySet(const Vector<CSSProperty>& properties)
     m_properties.shrinkToFit();
 }
 
-StylePropertySet::StylePropertySet(const CSSProperty* const * properties, int numProperties, bool useStrictParsing)
+StylePropertySet::StylePropertySet(const CSSProperty* properties, int numProperties, bool useStrictParsing)
     : m_strictParsing(useStrictParsing)
     , m_hasCSSOMWrapper(false)
 {
+    // FIXME: This logic belongs in CSSParser.
+
     m_properties.reserveInitialCapacity(numProperties);
     HashMap<int, bool> candidates;
     for (int i = 0; i < numProperties; ++i) {
-        const CSSProperty *property = properties[i];
-        ASSERT(property);
-        bool important = property->isImportant();
+        const CSSProperty& property = properties[i];
+        bool important = property.isImportant();
 
-        HashMap<int, bool>::iterator it = candidates.find(property->id());
+        HashMap<int, bool>::iterator it = candidates.find(property.id());
         if (it != candidates.end()) {
             if (!important && it->second)
                 continue;
-            removeProperty(property->id());
+            removeProperty(property.id());
         }
 
-        m_properties.append(*property);
-        candidates.set(property->id(), important);
+        m_properties.append(property);
+        candidates.set(property.id(), important);
     }
 }
 
@@ -628,11 +629,11 @@ void StylePropertySet::parseDeclaration(const String& styleDeclaration, CSSStyle
     parser.parseDeclaration(this, styleDeclaration, 0, contextStyleSheet);
 }
 
-void StylePropertySet::addParsedProperties(const CSSProperty* const* properties, int numProperties)
+void StylePropertySet::addParsedProperties(const CSSProperty* properties, int numProperties)
 {
     m_properties.reserveCapacity(numProperties);
     for (int i = 0; i < numProperties; ++i)
-        addParsedProperty(*properties[i]);
+        addParsedProperty(properties[i]);
 }
 
 void StylePropertySet::addParsedProperty(const CSSProperty& property)
diff --git a/Source/WebCore/css/StylePropertySet.h b/Source/WebCore/css/StylePropertySet.h
index 9aeb2e4ae..90452ff67 100644
--- a/Source/WebCore/css/StylePropertySet.h
+++ b/Source/WebCore/css/StylePropertySet.h
@@ -43,7 +43,7 @@ public:
     {
         return adoptRef(new StylePropertySet);
     }
-    static PassRefPtr<StylePropertySet> create(const CSSProperty* const* properties, int numProperties, bool useStrictParsing)
+    static PassRefPtr<StylePropertySet> create(const CSSProperty* properties, int numProperties, bool useStrictParsing)
     {
         return adoptRef(new StylePropertySet(properties, numProperties, useStrictParsing));
     }
@@ -76,7 +76,7 @@ public:
 
     void parseDeclaration(const String& styleDeclaration, CSSStyleSheet* contextStyleSheet);
 
-    void addParsedProperties(const CSSProperty* const *, int numProperties);
+    void addParsedProperties(const CSSProperty*, int numProperties);
     void addParsedProperty(const CSSProperty&);
 
     PassRefPtr<StylePropertySet> copyBlockProperties() const;
@@ -107,11 +107,13 @@ public:
     CSSStyleDeclaration* ensureCSSStyleDeclaration() const;
     CSSStyleDeclaration* ensureRuleCSSStyleDeclaration(const CSSRule* parentRule) const;
     CSSStyleDeclaration* ensureInlineCSSStyleDeclaration(const StyledElement* parentElement) const;
+    
+    bool hasCSSOMWrapper() const { return m_hasCSSOMWrapper; }
 
 private:
     StylePropertySet();
     StylePropertySet(const Vector<CSSProperty>&);
-    StylePropertySet(const CSSProperty* const *, int numProperties, bool useStrictParsing);
+    StylePropertySet(const CSSProperty*, int numProperties, bool useStrictParsing);
 
     void setNeedsStyleRecalc();
 
diff --git a/Source/WebCore/rendering/RenderSummary.cpp b/Source/WebCore/css/StyleRule.cpp
index da2086649..fc0f9d67d 100644
--- a/Source/WebCore/rendering/RenderSummary.cpp
+++ b/Source/WebCore/css/StyleRule.cpp
@@ -1,5 +1,7 @@
 /*
- * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
+ * (C) 1999-2003 Lars Knoll (knoll@kde.org)
+ * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
+ * Copyright (C) 2002, 2005, 2006, 2008, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -15,33 +17,34 @@
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
- *
  */
 
 #include "config.h"
-#include "RenderSummary.h"
-
-#if ENABLE(DETAILS)
-
-#include "RenderDetails.h"
+#include "StyleRule.h"
 
 namespace WebCore {
 
-RenderSummary::RenderSummary(Node* node)
-    : RenderBlock(node)
+StyleRule::StyleRule(int line, CSSStyleRule* wrapper)
+    : m_sourceLine(line)
+    , m_cssomWrapper(wrapper)
 {
 }
-
-void RenderSummary::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+    
+StyleRule::~StyleRule()
 {
-    RenderBlock::styleDidChange(diff, oldStyle);
-
-
-    // Ensure that if we ended up being inline that we set our replaced flag
-    // so that we're treated like an inline-block.
-    setReplaced(isInline());
 }
-
+    
+void StyleRule::addSubresourceStyleURLs(ListHashSet<KURL>& urls, CSSStyleSheet* styleSheet) 
+{
+    if (!m_properties)
+        return;
+    m_properties->addSubresourceStyleURLs(urls, styleSheet);
+}
+    
+CSSStyleRule* StyleRule::ensureCSSStyleRule() const
+{
+    ASSERT(m_cssomWrapper);
+    return m_cssomWrapper;
 }
 
-#endif
+} // namespace WebCore
diff --git a/Source/WebCore/css/StyleRule.h b/Source/WebCore/css/StyleRule.h
new file mode 100644
index 000000000..e230a94fd
--- /dev/null
+++ b/Source/WebCore/css/StyleRule.h
@@ -0,0 +1,63 @@
+/*
+ * (C) 1999-2003 Lars Knoll (knoll@kde.org)
+ * (C) 2002-2003 Dirk Mueller (mueller@kde.org)
+ * Copyright (C) 2002, 2006, 2008, 2012 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef StyleRule_h
+#define StyleRule_h
+
+#include "CSSSelectorList.h"
+#include "StylePropertySet.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class CSSStyleRule;
+
+class StyleRule {
+    WTF_MAKE_NONCOPYABLE(StyleRule); WTF_MAKE_FAST_ALLOCATED;
+public:
+    StyleRule(int sourceLine, CSSStyleRule*);
+    ~StyleRule();
+            
+    const CSSSelectorList& selectorList() const { return m_selectorList; }
+    StylePropertySet* properties() const { return m_properties.get(); }
+    
+    void addSubresourceStyleURLs(ListHashSet<KURL>& urls, CSSStyleSheet*);
+
+    int sourceLine() const { return m_sourceLine; }
+    
+    CSSStyleRule* ensureCSSStyleRule() const;
+    
+    void adoptSelectorVector(Vector<OwnPtr<CSSParserSelector> >& selectors) { m_selectorList.adoptSelectorVector(selectors); }
+    void adoptSelectorList(CSSSelectorList& selectors) { m_selectorList.adopt(selectors); }
+    void setProperties(PassRefPtr<StylePropertySet> properties) { m_properties = properties; }
+    
+private:
+    RefPtr<StylePropertySet> m_properties;
+    CSSSelectorList m_selectorList;
+    signed m_sourceLine;
+
+    CSSStyleRule* m_cssomWrapper;
+};
+
+} // namespace WebCore
+
+#endif // StyleRule_h
diff --git a/Source/WebCore/css/WebKitCSSFilterValue.cpp b/Source/WebCore/css/WebKitCSSFilterValue.cpp
index 93ae41097..2cbbf9c45 100644
--- a/Source/WebCore/css/WebKitCSSFilterValue.cpp
+++ b/Source/WebCore/css/WebKitCSSFilterValue.cpp
@@ -45,6 +45,7 @@ bool WebKitCSSFilterValue::typeUsesSpaceSeparator(FilterOperationType operationT
 #if ENABLE(CSS_SHADERS)
     return operationType != CustomFilterOperation;
 #else
+    UNUSED_PARAM(operationType);
     return true;
 #endif
 }
diff --git a/Source/WebCore/css/WebKitCSSMatrix.idl b/Source/WebCore/css/WebKitCSSMatrix.idl
index 08fd6641d..08c41aa12 100644
--- a/Source/WebCore/css/WebKitCSSMatrix.idl
+++ b/Source/WebCore/css/WebKitCSSMatrix.idl
@@ -27,7 +27,6 @@ module css {
 
     // Introduced in DOM Level ?:
     interface [
-        ConstructorParameters=1,
         Constructor(in [Optional=DefaultIsNullString] DOMString cssValue),
         ConstructorRaisesException,
     ] WebKitCSSMatrix {
diff --git a/Source/WebCore/css/WebKitCSSRegionRule.cpp b/Source/WebCore/css/WebKitCSSRegionRule.cpp
index d809aafba..cc377c461 100644
--- a/Source/WebCore/css/WebKitCSSRegionRule.cpp
+++ b/Source/WebCore/css/WebKitCSSRegionRule.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/css/WebKitCSSRegionRule.h b/Source/WebCore/css/WebKitCSSRegionRule.h
index f4dede542..624ed3f63 100644
--- a/Source/WebCore/css/WebKitCSSRegionRule.h
+++ b/Source/WebCore/css/WebKitCSSRegionRule.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/css/WebKitCSSRegionRule.idl b/Source/WebCore/css/WebKitCSSRegionRule.idl
index dc8b0a96d..428d0c5bb 100644
--- a/Source/WebCore/css/WebKitCSSRegionRule.idl
+++ b/Source/WebCore/css/WebKitCSSRegionRule.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/css/WebKitCSSShaderValue.cpp b/Source/WebCore/css/WebKitCSSShaderValue.cpp
index ea930304b..698f170bc 100644
--- a/Source/WebCore/css/WebKitCSSShaderValue.cpp
+++ b/Source/WebCore/css/WebKitCSSShaderValue.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/css/WebKitCSSShaderValue.h b/Source/WebCore/css/WebKitCSSShaderValue.h
index 610922001..fd95bc63c 100644
--- a/Source/WebCore/css/WebKitCSSShaderValue.h
+++ b/Source/WebCore/css/WebKitCSSShaderValue.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/css/fullscreenQuickTime.css b/Source/WebCore/css/fullscreenQuickTime.css
index ea1ebd6ec..b1b93fcf2 100644
--- a/Source/WebCore/css/fullscreenQuickTime.css
+++ b/Source/WebCore/css/fullscreenQuickTime.css
@@ -88,17 +88,17 @@ video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-min-button {
     position: absolute;
     left: 11px;
     top: 15px;
-    width: 14px;
-    height: 12px;
+    width: 17px;
+    height: 14px;
 }
 
 video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-slider {
-    -webkit-appearance: media-slider;
+    -webkit-appearance: media-fullscreen-volume-slider;
     display: block;
     position: absolute;
     left: 28px;
-    top: 15px;
-    height: 12px;
+    top: 14px;
+    height: 11px;
     width: 50px;
 }
 
@@ -108,8 +108,8 @@ video:-webkit-full-screen::-webkit-media-controls-fullscreen-volume-max-button {
     position: absolute;
     left: 84px;
     top: 15px;
-    width: 14px;
-    height: 12px;
+    width: 17px;
+    height: 14px;
 }
 
 video:-webkit-full-screen::-webkit-media-controls-play-button {
diff --git a/Source/WebCore/css/mediaControls.css b/Source/WebCore/css/mediaControls.css
index 31c9d4326..b81332fc7 100644
--- a/Source/WebCore/css/mediaControls.css
+++ b/Source/WebCore/css/mediaControls.css
@@ -37,8 +37,11 @@ audio {
     width: inherit;
     height: inherit;
     position: relative;
-    display: block;
+    display: -webkit-box;
     direction: ltr;
+    -webkit-box-align: start;
+    -webkit-box-pack: end;
+    -webkit-box-orient: vertical;
 }
 
 audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
@@ -46,7 +49,7 @@ audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
     -webkit-box-orient: horizontal;
     -webkit-box-align: center;
     -webkit-user-select: none;
-    position: absolute;
+    position: relative;
     bottom: 0;
     width: 100%;
     z-index: 0;
@@ -201,15 +204,16 @@ audio::-webkit-media-controls-fullscreen-volume-max-button, video::-webkit-media
 }
 
 video::-webkit-media-text-track-container {
-    position: absolute;
+    position: relative;
     width: 100%;
     overflow: hidden;
+    padding-bottom: 5px;
 
     font-size: 22px;
     font-family: sans-serif;
     text-align: center;
     color: rgba(255, 255, 255, 0);
-    
+
     letter-spacing: normal;
     word-spacing: normal;
     text-transform: none;
@@ -222,6 +226,6 @@ video::-webkit-media-text-track-container {
 video::-webkit-media-text-track-display {
     display: inline;
     background-color: rgba(0, 0, 0, 0.8);
-    color: yellow;
+    color: rgba(255, 255, 255, 1);
     padding: 0px 2px;
 }
diff --git a/Source/WebCore/css/mediaControlsChromium.css b/Source/WebCore/css/mediaControlsChromium.css
index 508d7445e..5fb62cc34 100644
--- a/Source/WebCore/css/mediaControlsChromium.css
+++ b/Source/WebCore/css/mediaControlsChromium.css
@@ -41,7 +41,7 @@ audio:-webkit-full-page-media, video:-webkit-full-page-media {
 
 audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
     -webkit-user-select: none;
-    position: absolute;
+    position: relative;
     overflow: visible;
     bottom: 0;
     width: 100%;
diff --git a/Source/WebCore/css/mediaControlsChromiumAndroid.css b/Source/WebCore/css/mediaControlsChromiumAndroid.css
new file mode 100644
index 000000000..e0498d886
--- /dev/null
+++ b/Source/WebCore/css/mediaControlsChromiumAndroid.css
@@ -0,0 +1,186 @@
+/*
+ * Copyright (C) 2012 Google Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* Media controls for Chromium on Android*/
+
+body:-webkit-full-page-media {
+    background-color: rgb(0, 0, 0);
+}
+
+audio {
+    width: 300px;
+    height: 32px;
+}
+
+audio:-webkit-full-page-media, video:-webkit-full-page-media {
+    max-height: 100%;
+    max-width: 100%;
+}
+
+audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    -webkit-user-select: none;
+    position: absolute;
+    overflow: visible;
+    bottom: 0;
+    width: 100%;
+    height: 32px;
+    z-index: 0;
+    background-color: rgba(0, 0, 0, 0.6);
+}
+
+video:-webkit-full-page-media::-webkit-media-controls-panel {
+    bottom: 0px;
+}
+
+audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
+    display: none;
+}
+
+audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
+    -webkit-appearance: media-play-button;
+
+    position: absolute;
+    top: auto;
+    bottom: 7px;
+    left: 7px;
+    right: 6px;
+
+    width: 18px;
+    height: 19px;
+}
+
+audio::-webkit-media-controls-timeline-container {
+    -webkit-appearance: media-timeline-container;
+    -webkit-user-select: none;
+    -webkit-box-orient: horizontal;
+    -webkit-box-align: center;
+    -webkit-box-pack: center;
+    -webkit-box-flex: 1;
+
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    left: 30px;
+    right: 0;
+
+    width: auto;
+    height: 32px;
+
+    border-left: 1px solid rgba(255, 255, 255, 0.2);
+    border-right: 1px solid rgba(255, 255, 255, 0.2);
+}
+
+video::-webkit-media-controls-timeline-container {
+    -webkit-appearance: media-timeline-container;
+    -webkit-user-select: none;
+    -webkit-box-orient: horizontal;
+    -webkit-box-align: center;
+    -webkit-box-pack: center;
+    -webkit-box-flex: 1;
+
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    left: 30px;
+    right: 34px;
+
+    width: auto;
+    height: 32px;
+
+    border-left: 1px solid rgba(255, 255, 255, 0.2);
+    border-right: 1px solid rgba(255, 255, 255, 0.2);
+}
+
+audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
+    -webkit-appearance: media-current-time-display;
+    -webkit-user-select: none;
+    display: -webkit-box;
+    -webkit-box-flex: 0;
+    -webkit-box-pack: center;
+    -webkit-box-align: center;
+
+    overflow: hidden;
+    cursor: default;
+
+    line-height: 21px;
+    height: 20px;
+    width: 58px;
+
+    text-align: center;
+    font-family: Arial;
+    font-size: 16px;
+    font-weight: bold;
+    color: white;
+
+    letter-spacing: normal;
+    word-spacing: normal;
+    text-transform: none;
+    text-indent: 0;
+    text-shadow: none;
+    text-decoration: none;
+}
+
+audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
+    -webkit-appearance: media-slider;
+    display: -webkit-box;
+    box-sizing: border-box;
+    -webkit-box-flex: 1;
+
+    padding: 0px;
+    margin: 0px 6px;
+    height: 18px;
+
+    border-color: rgba(255, 255, 255, 0.2);
+    border-style: solid;
+    border-width: 1px;
+    border-radius: 2px;
+    background-color: rgba(255, 255, 255, 0.08);
+    color: rgb(50, 140, 223);
+}
+
+
+video::-webkit-media-controls-fullscreen-button {
+    -webkit-appearance: media-fullscreen-button;
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    right: 0;
+    left: auto;
+
+    width: 34px;
+    height: 32px;
+}
+
+audio::-webkit-media-controls-fullscreen-button {
+    -webkit-appearance: media-fullscreen-button;
+    display: none;
+}
+
+audio::-webkit-media-controls-volume-slider-container, video::-webkit-media-controls-volume-slider-container {
+    display: none;
+}
+
+audio::-webkit-media-controls-volume-slider, video::-webkit-media-controls-volume-slider {
+    display: none;
+}
diff --git a/Source/WebCore/dom/ActiveDOMObject.cpp b/Source/WebCore/dom/ActiveDOMObject.cpp
index bb2ec2209..1fe832aee 100644
--- a/Source/WebCore/dom/ActiveDOMObject.cpp
+++ b/Source/WebCore/dom/ActiveDOMObject.cpp
@@ -33,30 +33,6 @@
 
 namespace WebCore {
 
-ContextDestructionObserver::ContextDestructionObserver(ScriptExecutionContext* scriptExecutionContext)
-    : m_scriptExecutionContext(scriptExecutionContext)
-{
-    if (!m_scriptExecutionContext)
-        return;
-
-    ASSERT(m_scriptExecutionContext->isContextThread());
-    m_scriptExecutionContext->didCreateDestructionObserver(this);
-}
-
-ContextDestructionObserver::~ContextDestructionObserver()
-{
-    if (!m_scriptExecutionContext)
-        return;
-
-    ASSERT(m_scriptExecutionContext->isContextThread());
-    m_scriptExecutionContext->willDestroyDestructionObserver(this);
-}
-
-void ContextDestructionObserver::contextDestroyed()
-{
-    m_scriptExecutionContext = 0;
-}
-
 ActiveDOMObject::ActiveDOMObject(ScriptExecutionContext* scriptExecutionContext, void* upcastPointer)
     : ContextDestructionObserver(scriptExecutionContext)
     , m_pendingActivityCount(0)
diff --git a/Source/WebCore/dom/ActiveDOMObject.h b/Source/WebCore/dom/ActiveDOMObject.h
index dce6b56dd..2a6b1ae80 100644
--- a/Source/WebCore/dom/ActiveDOMObject.h
+++ b/Source/WebCore/dom/ActiveDOMObject.h
@@ -27,78 +27,64 @@
 #ifndef ActiveDOMObject_h
 #define ActiveDOMObject_h
 
+#include "ContextDestructionObserver.h"
 #include <wtf/Assertions.h>
 
 namespace WebCore {
 
-    class ScriptExecutionContext;
+class ActiveDOMObject : public ContextDestructionObserver {
+public:
+    ActiveDOMObject(ScriptExecutionContext*, void* upcastPointer);
 
-    // FIXME: Move this class to it's own file.
-    class ContextDestructionObserver {
-    public:
-        explicit ContextDestructionObserver(ScriptExecutionContext*);
-        virtual void contextDestroyed();
-
-        ScriptExecutionContext* scriptExecutionContext() const { return m_scriptExecutionContext; }
-
-    protected:
-        virtual ~ContextDestructionObserver();
-
-        ScriptExecutionContext* m_scriptExecutionContext;
-    };
-
-    class ActiveDOMObject : public ContextDestructionObserver {
-    public:
-        ActiveDOMObject(ScriptExecutionContext*, void* upcastPointer);
-
-        // suspendIfNeeded() should be called exactly once after object construction to synchronize
-        // the suspend state with that in ScriptExecutionContext.
-        void suspendIfNeeded();
+    // suspendIfNeeded() should be called exactly once after object construction to synchronize
+    // the suspend state with that in ScriptExecutionContext.
+    void suspendIfNeeded();
 #if !ASSERT_DISABLED
-        bool suspendIfNeededCalled() const { return m_suspendIfNeededCalled; }
+    bool suspendIfNeededCalled() const { return m_suspendIfNeededCalled; }
 #endif
 
-        virtual bool hasPendingActivity() const;
-
-        // canSuspend() is used by the caller if there is a choice between suspending and stopping.
-        // For example, a page won't be suspended and placed in the back/forward cache if it has
-        // the objects that can not be suspended.
-        // However, 'suspend' can be called even if canSuspend() would return 'false'. That
-        // happens in step-by-step JS debugging for example - in this case it would be incorrect
-        // to stop the object. Exact semantics of suspend is up to the object then.
-        enum ReasonForSuspension {
-            JavaScriptDebuggerPaused,
-            WillShowDialog,
-            DocumentWillBecomeInactive
-        };
-        virtual bool canSuspend() const;
-        virtual void suspend(ReasonForSuspension);
-        virtual void resume();
-        virtual void stop();
-
-        template<class T> void setPendingActivity(T* thisObject)
-        {
-            ASSERT(thisObject == this);
-            thisObject->ref();
-            m_pendingActivityCount++;
-        }
-
-        template<class T> void unsetPendingActivity(T* thisObject)
-        {
-            ASSERT(m_pendingActivityCount > 0);
-            --m_pendingActivityCount;
-            thisObject->deref();
-        }
-
-    protected:
-        virtual ~ActiveDOMObject();
-
-    private:
-        unsigned m_pendingActivityCount;
+    virtual bool hasPendingActivity() const;
+
+    // canSuspend() is used by the caller if there is a choice between suspending and stopping.
+    // For example, a page won't be suspended and placed in the back/forward cache if it has
+    // the objects that can not be suspended.
+    // However, 'suspend' can be called even if canSuspend() would return 'false'. That
+    // happens in step-by-step JS debugging for example - in this case it would be incorrect
+    // to stop the object. Exact semantics of suspend is up to the object then.
+    enum ReasonForSuspension {
+        JavaScriptDebuggerPaused,
+        WillShowDialog,
+        DocumentWillBecomeInactive,
+        PageWillBeSuspended
+    };
+    virtual bool canSuspend() const;
+    virtual void suspend(ReasonForSuspension);
+    virtual void resume();
+    virtual void stop();
+
+    template<class T> void setPendingActivity(T* thisObject)
+    {
+        ASSERT(thisObject == this);
+        thisObject->ref();
+        m_pendingActivityCount++;
+    }
+
+    template<class T> void unsetPendingActivity(T* thisObject)
+    {
+        ASSERT(m_pendingActivityCount > 0);
+        --m_pendingActivityCount;
+        thisObject->deref();
+    }
+
+protected:
+    virtual ~ActiveDOMObject();
+
+private:
+    unsigned m_pendingActivityCount;
 #if !ASSERT_DISABLED
-        bool m_suspendIfNeededCalled;
+    bool m_suspendIfNeededCalled;
 #endif
-    };
+};
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/dom/Attr.cpp b/Source/WebCore/dom/Attr.cpp
index e54c8d0df..75f7b8ffd 100644
--- a/Source/WebCore/dom/Attr.cpp
+++ b/Source/WebCore/dom/Attr.cpp
@@ -167,13 +167,11 @@ bool Attr::childTypeAllowed(NodeType type) const
     }
 }
 
-void Attr::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+void Attr::childrenChanged(bool, Node*, Node*, int)
 {
     if (m_ignoreChildrenChanged > 0)
         return;
 
-    Node::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
-
     invalidateNodeListsCacheAfterAttributeChanged(m_attribute->name());
 
     // FIXME: We should include entity references in the value
diff --git a/Source/WebCore/dom/Attr.h b/Source/WebCore/dom/Attr.h
index b70357495..286cfafb3 100644
--- a/Source/WebCore/dom/Attr.h
+++ b/Source/WebCore/dom/Attr.h
@@ -39,8 +39,8 @@ class CSSStyleDeclaration;
 // destruction. however, this is not yet implemented.
 
 class Attr : public ContainerNode {
+    friend class AttributeVector;
     friend class ElementAttributeData;
-    friend class NamedNodeMap;
 public:
     static PassRefPtr<Attr> create(Element*, Document*, PassRefPtr<Attribute>);
     virtual ~Attr();
diff --git a/Source/WebCore/dom/Attribute.h b/Source/WebCore/dom/Attribute.h
index 8658775b8..8c59d1c48 100644
--- a/Source/WebCore/dom/Attribute.h
+++ b/Source/WebCore/dom/Attribute.h
@@ -31,7 +31,6 @@ namespace WebCore {
 
 class Attr;
 class Element;
-class NamedNodeMap;
 
 // This has no counterpart in DOM.
 // It is an internal representation of the node value of an Attr.
diff --git a/Source/WebCore/dom/CharacterData.cpp b/Source/WebCore/dom/CharacterData.cpp
index 3879a97e9..f8e034dd6 100644
--- a/Source/WebCore/dom/CharacterData.cpp
+++ b/Source/WebCore/dom/CharacterData.cpp
@@ -81,6 +81,7 @@ unsigned CharacterData::parserAppendData(const UChar* data, unsigned dataLength,
     m_data.append(data, end);
 
     updateRenderer(oldLength, 0);
+    document()->incDOMTreeVersion();
     // We don't call dispatchModifiedEvent here because we don't want the
     // parser to dispatch DOM mutation events.
     if (parentNode())
@@ -178,6 +179,7 @@ void CharacterData::setDataAndUpdate(const String& newData, unsigned offsetOfRep
     String oldData = m_data;
     m_data = newData;
     updateRenderer(offsetOfReplacedData, oldLength);
+    document()->incDOMTreeVersion();
     dispatchModifiedEvent(oldData);
 }
 
diff --git a/Source/WebCore/dom/Clipboard.cpp b/Source/WebCore/dom/Clipboard.cpp
index 2053292a1..027992515 100644
--- a/Source/WebCore/dom/Clipboard.cpp
+++ b/Source/WebCore/dom/Clipboard.cpp
@@ -27,7 +27,6 @@
 #include "Clipboard.h"
 
 #include "CachedImage.h"
-#include "DOMStringList.h"
 #include "FileList.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -148,7 +147,7 @@ bool Clipboard::hasStringOfType(const String& type) const
     if (m_policy != ClipboardReadable && m_policy != ClipboardTypesReadable)
         return false;
     
-    return types()->contains(type);
+    return types().contains(type); 
 }
     
 void Clipboard::setDropEffect(const String &effect)
diff --git a/Source/WebCore/dom/Clipboard.h b/Source/WebCore/dom/Clipboard.h
index d33829a6c..83f0f2428 100644
--- a/Source/WebCore/dom/Clipboard.h
+++ b/Source/WebCore/dom/Clipboard.h
@@ -33,7 +33,6 @@
 
 namespace WebCore {
 
-    class DOMStringList;
     class DataTransferItemList;
     class DragData;
     class FileList;
@@ -63,11 +62,11 @@ namespace WebCore {
     
         virtual void clearData(const String& type) = 0;
         virtual void clearAllData() = 0;
-        virtual String getData(const String& type, bool& success) const = 0;
+        virtual String getData(const String& type) const = 0;
         virtual bool setData(const String& type, const String& data) = 0;
     
         // extensions beyond IE's API
-        virtual PassRefPtr<DOMStringList> types() const = 0;
+        virtual HashSet<String> types() const = 0;
         virtual PassRefPtr<FileList> files() const = 0;
 
         IntPoint dragLocation() const { return m_dragLoc; }
diff --git a/Source/WebCore/dom/Clipboard.idl b/Source/WebCore/dom/Clipboard.idl
index c1c5850ec..c94621bc7 100644
--- a/Source/WebCore/dom/Clipboard.idl
+++ b/Source/WebCore/dom/Clipboard.idl
@@ -31,13 +31,12 @@ module core {
     interface Clipboard {
                  attribute [TreatReturnedNullStringAs=Undefined] DOMString dropEffect;
                  attribute [TreatReturnedNullStringAs=Undefined] DOMString effectAllowed;
-        readonly attribute DOMStringList types;
+        readonly attribute [CustomGetter] Array types;
         readonly attribute FileList files;
 
         [Custom] void clearData(in [Optional] DOMString type)
             raises(DOMException);
-        [Custom] void getData(in DOMString type)
-            raises(DOMException);
+        DOMString getData(in DOMString type);
         boolean setData(in DOMString type, in DOMString data);
         [Custom] void setDragImage(in HTMLImageElement image, in long x, in long y)
             raises(DOMException);
diff --git a/Source/WebCore/dom/ContainerNode.cpp b/Source/WebCore/dom/ContainerNode.cpp
index 0a81c6dea..4916eb1fb 100644
--- a/Source/WebCore/dom/ContainerNode.cpp
+++ b/Source/WebCore/dom/ContainerNode.cpp
@@ -69,7 +69,7 @@ static inline void collectNodes(Node* node, NodeVector& nodes)
 
 static void collectTargetNodes(Node* node, NodeVector& nodes)
 {
-    if (node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE || node->isShadowRoot()) {
+    if (node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE) {
         nodes.append(node);
         return;
     }
@@ -240,10 +240,6 @@ void ContainerNode::parserInsertBefore(PassRefPtr<Node> newChild, Node* nextChil
     for (NodeVector::const_iterator it = targets.begin(); it != targets.end(); ++it) {
         Node* child = it->get();
 
-#if ENABLE(INSPECTOR)
-        InspectorInstrumentation::willInsertDOMNode(document(), child, this);
-#endif
-
         insertBeforeCommon(next.get(), child);
 
         childrenChanged(true, nextChildPreviousSibling.get(), nextChild, 1);
@@ -375,11 +371,14 @@ void ContainerNode::willRemove()
 {
     RefPtr<Node> protect(this);
 
-    for (RefPtr<Node> child = firstChild(); child; child = child->nextSibling()) {
-        if (child->parentNode() != this) // Check for child being removed from subtree while removing.
-            break;
-        child->willRemove();
+    NodeVector children;
+    collectNodes(this, children);
+    for (size_t i = 0; i < children.size(); ++i) {
+        if (children[i]->parentNode() != this) // Check for child being removed from subtree while removing.
+            continue;
+        children[i]->willRemove();
     }
+
     Node::willRemove();
 }
 
@@ -387,7 +386,6 @@ static void willRemoveChild(Node* child)
 {
     // update auxiliary doc info (e.g. iterators) to note that node is being removed
     child->document()->nodeWillBeRemoved(child);
-    child->document()->incDOMTreeVersion();
 
     // fire removed from document mutation events.
     dispatchChildRemovalEvents(child);
@@ -397,7 +395,6 @@ static void willRemoveChild(Node* child)
 static void willRemoveChildren(ContainerNode* container)
 {
     container->document()->nodeChildrenWillBeRemoved(container);
-    container->document()->incDOMTreeVersion();
 
     NodeVector children;
     collectNodes(container, children);
@@ -451,7 +448,6 @@ bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
     document()->removeFullScreenElementOfSubtree(child.get());
 #endif
 
-
     // Events fired when blurring currently focused node might have moved this
     // child into a different parent.
     if (child->parentNode() != this) {
@@ -467,8 +463,8 @@ bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
 
     if (child->inDocument())
         child->removedFromDocument();
-    else
-        child->removedFromTree(true);
+    else if (child->isContainerNode())
+        toContainerNode(child.get())->removedFromTree(true);
 
     dispatchSubtreeModifiedEvent();
 
@@ -517,8 +513,8 @@ void ContainerNode::parserRemoveChild(Node* oldChild)
     childrenChanged(true, prev, next, -1);
     if (oldChild->inDocument())
         oldChild->removedFromDocument();
-    else
-        oldChild->removedFromTree(true);
+    else if (oldChild->isContainerNode())
+        toContainerNode(oldChild)->removedFromTree(true);
 }
 
 // this differs from other remove functions because it forcibly removes all the children,
@@ -577,20 +573,17 @@ void ContainerNode::removeChildren()
             removedChild->detach();
     }
 
-    // FIXME: This should be just above dispatchSubtreeModifiedEvent();
-    allowEventDispatch();
-
     childrenChanged(false, 0, 0, -static_cast<int>(removedChildrenCount));
 
     for (i = 0; i < removedChildrenCount; ++i) {
         Node* removedChild = removedChildren[i].get();
         if (removedChild->inDocument())
             removedChild->removedFromDocument();
-        // removeChild() calls removedFromTree(true) if the child was not in the
-        // document. There is no explanation for this discrepancy between removeChild()
-        // and its optimized version removeChildren().
+        else if (removedChild->isContainerNode())
+            toContainerNode(removedChild)->removedFromTree(true);
     }
 
+    allowEventDispatch();
     dispatchSubtreeModifiedEvent();
 }
 
@@ -682,10 +675,6 @@ void ContainerNode::parserAddChild(PassRefPtr<Node> newChild)
     ASSERT(newChild);
     ASSERT(!newChild->parentNode()); // Use appendChild if you need to handle reparenting (and want DOM mutation events).
 
-#if ENABLE(INSPECTOR)
-    InspectorInstrumentation::willInsertDOMNode(document(), newChild.get(), this);
-#endif
-
     forbidEventDispatch();
     Node* last = m_lastChild;
     // FIXME: This method should take a PassRefPtr.
@@ -695,7 +684,6 @@ void ContainerNode::parserAddChild(PassRefPtr<Node> newChild)
     allowEventDispatch();
 
     // FIXME: Why doesn't this use notifyChildInserted(newChild) instead?
-    document()->incDOMTreeVersion();
     if (inDocument())
         newChild->insertedIntoDocument();
     childrenChanged(true, last, 0, 1);
@@ -775,15 +763,13 @@ void ContainerNode::scheduleSetNeedsStyleRecalc(StyleChangeType changeType)
 
 void ContainerNode::attach()
 {
-    for (Node* child = m_firstChild; child; child = child->nextSibling())
-        child->attach();
+    attachChildren();
     Node::attach();
 }
 
 void ContainerNode::detach()
 {
-    for (Node* child = m_firstChild; child; child = child->nextSibling())
-        child->detach();
+    detachChildren();
     clearChildNeedsStyleRecalc();
     Node::detach();
 }
@@ -795,13 +781,17 @@ void ContainerNode::insertedIntoDocument()
     Node::insertedIntoDocument();
     insertedIntoTree(false);
 
-    for (RefPtr<Node> child = m_firstChild; child; child = child->nextSibling()) {
-        // Guard against mutation during re-parenting.
-        if (!inDocument()) // Check for self being removed from document while reparenting.
-            break;
-        if (child->parentNode() != this) // Check for child being removed from subtree while reparenting.
+    NodeVector children;
+    collectNodes(this, children);
+    for (size_t i = 0; i < children.size(); ++i) {
+        // If we have been removed from the document during this loop, then
+        // we don't want to tell the rest of our children that they've been
+        // inserted into the document because they haven't.
+        if (!inDocument())
             break;
-        child->insertedIntoDocument();
+        if (children[i]->parentNode() != this)
+            continue;
+        children[i]->insertedIntoDocument();
     }
 }
 
@@ -810,31 +800,45 @@ void ContainerNode::removedFromDocument()
     Node::removedFromDocument();
     if (document()->cssTarget() == this) 
         document()->setCSSTarget(0); 
-    clearInDocument();
     removedFromTree(false);
-    for (Node* child = m_firstChild; child; child = child->nextSibling())
-        child->removedFromDocument();
+
+    NodeVector children;
+    collectNodes(this, children);
+    for (size_t i = 0; i < children.size(); ++i) {
+        // If we have been added to the document during this loop, then we
+        // don't want to tell the rest of our children that they've been
+        // removed from the document because they haven't.
+        if (inDocument())
+            break;
+        if (children[i]->parentNode() != this)
+            continue;
+        children[i]->removedFromDocument();
+    }
 }
 
 void ContainerNode::insertedIntoTree(bool deep)
 {
     if (!deep)
         return;
-    for (Node* child = m_firstChild; child; child = child->nextSibling())
-        child->insertedIntoTree(true);
+    for (Node* child = m_firstChild; child; child = child->nextSibling()) {
+        if (child->isContainerNode())
+            toContainerNode(child)->insertedIntoTree(true);
+    }
 }
 
 void ContainerNode::removedFromTree(bool deep)
 {
     if (!deep)
         return;
-    for (Node* child = m_firstChild; child; child = child->nextSibling())
-        child->removedFromTree(true);
+    for (Node* child = m_firstChild; child; child = child->nextSibling()) {
+        if (child->isContainerNode())
+            toContainerNode(child)->removedFromTree(true);
+    }
 }
 
-void ContainerNode::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+void ContainerNode::childrenChanged(bool changedByParser, Node*, Node*, int childCountDelta)
 {
-    Node::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    document()->incDOMTreeVersion();
     if (!changedByParser && childCountDelta)
         document()->updateRangesAfterChildrenChanged(this);
     invalidateNodeListsCacheAfterChildrenChanged();
@@ -1093,14 +1097,15 @@ static void notifyChildInserted(Node* child)
     Node* parentOrHostNode = c->parentOrHostNode();
     if (parentOrHostNode && parentOrHostNode->inDocument())
         c->insertedIntoDocument();
-    else
-        c->insertedIntoTree(true);
-
-    document->incDOMTreeVersion();
+    else if (c->isContainerNode())
+        toContainerNode(c.get())->insertedIntoTree(true);
 }
 
 static void dispatchChildInsertionEvents(Node* child)
 {
+    if (child->isInShadowTree())
+        return;
+
     ASSERT(!eventDispatchForbidden());
 
     RefPtr<Node> c = child;
@@ -1125,6 +1130,9 @@ static void dispatchChildInsertionEvents(Node* child)
 
 static void dispatchChildRemovalEvents(Node* child)
 {
+    if (child->isInShadowTree())
+        return;
+
     ASSERT(!eventDispatchForbidden());
 
 #if ENABLE(INSPECTOR)
diff --git a/Source/WebCore/dom/ContainerNode.h b/Source/WebCore/dom/ContainerNode.h
index 36a2f008c..e629e71eb 100644
--- a/Source/WebCore/dom/ContainerNode.h
+++ b/Source/WebCore/dom/ContainerNode.h
@@ -79,11 +79,29 @@ public:
     virtual void setHovered(bool = true) OVERRIDE;
     virtual void insertedIntoDocument() OVERRIDE;
     virtual void removedFromDocument() OVERRIDE;
-    virtual void insertedIntoTree(bool deep) OVERRIDE;
-    virtual void removedFromTree(bool deep) OVERRIDE;
-    virtual void childrenChanged(bool createdByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0) OVERRIDE;
     virtual void scheduleSetNeedsStyleRecalc(StyleChangeType = FullStyleChange) OVERRIDE;
 
+    // -----------------------------------------------------------------------------
+    // Notification of document structure changes (see Node.h for more notification methods)
+
+    // These functions are called whenever you are connected or disconnected from a tree. That tree may be the main
+    // document tree, or it could be another disconnected tree. Override these functions to do any work that depends
+    // on connectedness to some ancestor (e.g., an ancestor <form>).
+    virtual void insertedIntoTree(bool deep);
+    virtual void removedFromTree(bool deep);
+
+    // Notifies the node that it's list of children have changed (either by adding or removing child nodes), or a child
+    // node that is of the type CDATA_SECTION_NODE, TEXT_NODE or COMMENT_NODE has changed its value.
+    virtual void childrenChanged(bool createdByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
+
+    void attachAsNode();
+    void attachChildren();
+    void attachChildrenIfNeeded();
+    void attachChildrenLazily();
+    void detachAsNode();
+    void detachChildren();
+    void detachChildrenIfNeeded();
+
 protected:
     ContainerNode(Document*, ConstructionType = CreateContainer);
 
@@ -136,6 +154,51 @@ inline ContainerNode::ContainerNode(Document* document, ConstructionType type)
 {
 }
 
+inline void ContainerNode::attachAsNode()
+{
+    Node::attach();
+}
+
+inline void ContainerNode::attachChildren()
+{
+    for (Node* child = firstChild(); child; child = child->nextSibling())
+        child->attach();
+}
+
+inline void ContainerNode::attachChildrenIfNeeded()
+{
+    for (Node* child = firstChild(); child; child = child->nextSibling()) {
+        if (!child->attached())
+            child->attach();
+    }
+}
+
+inline void ContainerNode::attachChildrenLazily()
+{
+    for (Node* child = firstChild(); child; child = child->nextSibling())
+        if (!child->attached())
+            child->lazyAttach();
+}
+
+inline void ContainerNode::detachAsNode()
+{
+    Node::detach();
+}
+
+inline void ContainerNode::detachChildrenIfNeeded()
+{
+    for (Node* child = firstChild(); child; child = child->nextSibling()) {
+        if (child->attached())
+            child->detach();
+    }
+}
+
+inline void ContainerNode::detachChildren()
+{
+    for (Node* child = firstChild(); child; child = child->nextSibling())
+        child->detach();
+}
+
 inline unsigned Node::childNodeCount() const
 {
     if (!isContainerNode())
diff --git a/Source/WebCore/platform/mac/PasteboardHelper.h b/Source/WebCore/dom/ContextDestructionObserver.cpp
index 6c1e844ea..2fdd556e3 100644
--- a/Source/WebCore/platform/mac/PasteboardHelper.h
+++ b/Source/WebCore/dom/ContextDestructionObserver.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -21,35 +21,38 @@
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
  */
 
-#ifndef PasteboardHelper_h
-#define PasteboardHelper_h
+#include "config.h"
+#include "ContextDestructionObserver.h"
 
-/* FIXME: This is a helper class used to provide access to functionality inside 
- * WebKit.  The required functionality should eventually be migrated to WebCore
- * so that this class can be removed.
- */
-#if PLATFORM(MAC)
+#include "ScriptExecutionContext.h"
 
-#import <wtf/Forward.h>
+namespace WebCore {
 
-OBJC_CLASS DOMDocumentFragment;
+ContextDestructionObserver::ContextDestructionObserver(ScriptExecutionContext* scriptExecutionContext)
+    : m_scriptExecutionContext(scriptExecutionContext)
+{
+    if (!m_scriptExecutionContext)
+        return;
 
-namespace WebCore {
+    ASSERT(m_scriptExecutionContext->isContextThread());
+    m_scriptExecutionContext->didCreateDestructionObserver(this);
+}
+
+ContextDestructionObserver::~ContextDestructionObserver()
+{
+    if (!m_scriptExecutionContext)
+        return;
+
+    ASSERT(m_scriptExecutionContext->isContextThread());
+    m_scriptExecutionContext->willDestroyDestructionObserver(this);
+}
 
-    class Document;
-    
-    class PasteboardHelper {
-    public:
-        virtual ~PasteboardHelper() {}
-        virtual String urlFromPasteboard(NSPasteboard*, String* title) const = 0;
-        virtual String plainTextFromPasteboard(NSPasteboard*) const = 0;
-        virtual DOMDocumentFragment* fragmentFromPasteboard(NSPasteboard*) const = 0;
-        virtual NSArray* insertablePasteboardTypes() const = 0;
-    };
-    
+void ContextDestructionObserver::contextDestroyed()
+{
+    m_scriptExecutionContext = 0;
 }
-#endif // PLATFORM(MAC)
 
-#endif // !PasteboardHelper_h
+} // namespace WebCore
diff --git a/Source/WebCore/dom/ContextDestructionObserver.h b/Source/WebCore/dom/ContextDestructionObserver.h
new file mode 100644
index 000000000..19a7a94b4
--- /dev/null
+++ b/Source/WebCore/dom/ContextDestructionObserver.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef ContextDestructionObserver_h
+#define ContextDestructionObserver_h
+
+namespace WebCore {
+
+class ScriptExecutionContext;
+
+class ContextDestructionObserver {
+public:
+    explicit ContextDestructionObserver(ScriptExecutionContext*);
+    virtual void contextDestroyed();
+
+    ScriptExecutionContext* scriptExecutionContext() const { return m_scriptExecutionContext; }
+
+protected:
+    virtual ~ContextDestructionObserver();
+
+    ScriptExecutionContext* m_scriptExecutionContext;
+};
+
+} // namespace WebCore
+
+#endif // ContextDestructionObserver_h
diff --git a/Source/WebCore/dom/DOMAllInOne.cpp b/Source/WebCore/dom/DOMAllInOne.cpp
index 8ec4bfb6b..cd3dfd07f 100644
--- a/Source/WebCore/dom/DOMAllInOne.cpp
+++ b/Source/WebCore/dom/DOMAllInOne.cpp
@@ -43,6 +43,7 @@
 #include "Comment.cpp"
 #include "CompositionEvent.cpp"
 #include "ContainerNode.cpp"
+#include "ContextDestructionObserver.cpp"
 #include "CustomEvent.cpp"
 #include "DOMCoreException.cpp"
 #include "DOMImplementation.cpp"
@@ -117,7 +118,7 @@
 #include "SecurityContext.cpp"
 #include "SelectorQuery.cpp"
 #include "ShadowRoot.cpp"
-#include "ShadowRootList.cpp"
+#include "ShadowTree.cpp"
 #include "SpaceSplitString.cpp"
 #include "StaticHashSetNodeList.cpp"
 #include "StaticNodeList.cpp"
diff --git a/Source/WebCore/dom/DOMImplementation.cpp b/Source/WebCore/dom/DOMImplementation.cpp
index ae6d3665c..40197b322 100644
--- a/Source/WebCore/dom/DOMImplementation.cpp
+++ b/Source/WebCore/dom/DOMImplementation.cpp
@@ -399,13 +399,8 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& type, Frame
         return TextDocument::create(frame, url);
 
 #if ENABLE(SVG)
-    if (type == "image/svg+xml") {
-#if ENABLE(DASHBOARD_SUPPORT)    
-        Settings* settings = frame ? frame->settings() : 0;
-        if (!settings || !settings->usesDashboardBackwardCompatibilityMode())
-#endif
-            return SVGDocument::create(frame, url);
-    }
+    if (type == "image/svg+xml")
+        return SVGDocument::create(frame, url);
 #endif
     if (isXMLMIMEType(type))
         return Document::create(frame, url);
diff --git a/Source/WebCore/dom/DOMStringList.cpp b/Source/WebCore/dom/DOMStringList.cpp
index 430265adb..bcc0d23ba 100644
--- a/Source/WebCore/dom/DOMStringList.cpp
+++ b/Source/WebCore/dom/DOMStringList.cpp
@@ -48,4 +48,9 @@ bool DOMStringList::contains(const String& string) const
     return false;
 }
 
+void DOMStringList::sort()
+{
+    std::sort(m_strings.begin(), m_strings.end(), WTF::codePointCompareLessThan);
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/dom/DOMStringList.h b/Source/WebCore/dom/DOMStringList.h
index 6719f179a..057dac49e 100644
--- a/Source/WebCore/dom/DOMStringList.h
+++ b/Source/WebCore/dom/DOMStringList.h
@@ -45,6 +45,7 @@ public:
     bool isEmpty() const { return m_strings.isEmpty(); }
     void clear() { m_strings.clear(); }
     void append(const String& string) { m_strings.append(string); }
+    void sort();
 
     // Implements the IDL.
     size_t length() const { return m_strings.size(); }
diff --git a/Source/WebCore/dom/DeviceMotionController.cpp b/Source/WebCore/dom/DeviceMotionController.cpp
index 79eacc5e9..b988365d7 100644
--- a/Source/WebCore/dom/DeviceMotionController.cpp
+++ b/Source/WebCore/dom/DeviceMotionController.cpp
@@ -150,7 +150,7 @@ bool DeviceMotionController::isActiveAt(Page* page)
 
 void provideDeviceMotionTo(Page* page, DeviceMotionClient* client)
 {
-    PageSupplement::provideTo(page, DeviceMotionController::supplementName(), DeviceMotionController::create(client));
+    DeviceMotionController::provideTo(page, DeviceMotionController::supplementName(), DeviceMotionController::create(client));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/DeviceMotionController.h b/Source/WebCore/dom/DeviceMotionController.h
index 996c98861..1c1f6fcba 100644
--- a/Source/WebCore/dom/DeviceMotionController.h
+++ b/Source/WebCore/dom/DeviceMotionController.h
@@ -27,7 +27,7 @@
 #define DeviceMotionController_h
 
 #include "DOMWindow.h"
-#include "PageSupplement.h"
+#include "Page.h"
 #include "Timer.h"
 #include <wtf/HashCountedSet.h>
 
@@ -36,7 +36,7 @@ namespace WebCore {
 class DeviceMotionData;
 class DeviceMotionClient;
 
-class DeviceMotionController : public PageSupplement {
+class DeviceMotionController : public Supplement<Page> {
 public:
     ~DeviceMotionController();
 
@@ -54,8 +54,7 @@ public:
     bool isActive() { return !m_listeners.isEmpty(); }
 
     static const AtomicString& supplementName();
-    static DeviceMotionController* from(Frame* frame) { return static_cast<DeviceMotionController*>(PageSupplement::from(frame, supplementName())); }
-    static DeviceMotionController* from(Page* page) { return static_cast<DeviceMotionController*>(PageSupplement::from(page, supplementName())); }
+    static DeviceMotionController* from(Page* page) { return static_cast<DeviceMotionController*>(Supplement<Page>::from(page, supplementName())); }
     static bool isActiveAt(Page*);
 
 private:
diff --git a/Source/WebCore/dom/DeviceOrientationController.cpp b/Source/WebCore/dom/DeviceOrientationController.cpp
index d298b3f44..eae6fb50a 100644
--- a/Source/WebCore/dom/DeviceOrientationController.cpp
+++ b/Source/WebCore/dom/DeviceOrientationController.cpp
@@ -152,7 +152,7 @@ bool DeviceOrientationController::isActiveAt(Page* page)
 
 void provideDeviceOrientationTo(Page* page, DeviceOrientationClient* client)
 {
-    PageSupplement::provideTo(page, DeviceOrientationController::supplementName(), DeviceOrientationController::create(page, client));
+    DeviceOrientationController::provideTo(page, DeviceOrientationController::supplementName(), DeviceOrientationController::create(page, client));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/DeviceOrientationController.h b/Source/WebCore/dom/DeviceOrientationController.h
index d8efaca39..707cd5cb6 100644
--- a/Source/WebCore/dom/DeviceOrientationController.h
+++ b/Source/WebCore/dom/DeviceOrientationController.h
@@ -27,7 +27,7 @@
 #define DeviceOrientationController_h
 
 #include "DOMWindow.h"
-#include "PageSupplement.h"
+#include "Page.h"
 #include "Timer.h"
 
 #include <wtf/HashCountedSet.h>
@@ -36,9 +36,8 @@ namespace WebCore {
 
 class DeviceOrientation;
 class DeviceOrientationClient;
-class Page;
 
-class DeviceOrientationController : public PageSupplement {
+class DeviceOrientationController : public Supplement<Page> {
 public:
     ~DeviceOrientationController();
 
@@ -58,8 +57,7 @@ public:
     DeviceOrientationClient* client() const { return m_client; }
 
     static const AtomicString& supplementName();
-    static DeviceOrientationController* from(Frame* frame) { return static_cast<DeviceOrientationController*>(PageSupplement::from(frame, supplementName())); }
-    static DeviceOrientationController* from(Page* page) { return static_cast<DeviceOrientationController*>(PageSupplement::from(page, supplementName())); }
+    static DeviceOrientationController* from(Page* page) { return static_cast<DeviceOrientationController*>(Supplement<Page>::from(page, supplementName())); }
     static bool isActiveAt(Page*);
 
 private:
diff --git a/Source/WebCore/dom/Document.cpp b/Source/WebCore/dom/Document.cpp
index e85d22f2c..809f99041 100644
--- a/Source/WebCore/dom/Document.cpp
+++ b/Source/WebCore/dom/Document.cpp
@@ -33,6 +33,7 @@
 #include "Attr.h"
 #include "Attribute.h"
 #include "CDATASection.h"
+#include "CSSParser.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSStyleSelector.h"
 #include "CSSStyleSheet.h"
@@ -141,7 +142,7 @@
 #include "SegmentedString.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "StaticHashSetNodeList.h"
 #include "StyleSheetList.h"
 #include "TextResourceDecoder.h"
@@ -379,7 +380,7 @@ private:
 uint64_t Document::s_globalTreeVersion = 0;
 
 Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
-    : ContainerNode(0)
+    : ContainerNode(0, CreateDocument)
     , TreeScope(this)
     , m_guardRefCount(0)
     , m_compatibilityMode(NoQuirksMode)
@@ -419,7 +420,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     , m_isHTML(isHTML)
     , m_isViewSource(false)
     , m_sawElementsInKnownNamespaces(false)
-    , m_usingGeolocation(false)
     , m_eventQueue(DocumentEventQueue::create(this))
     , m_weakReference(DocumentWeakReference::create(this))
     , m_idAttributeName(idAttr)
@@ -471,7 +471,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
 
     m_textColor = Color::black;
     m_listenerTypes = 0;
-    setInDocument();
     m_inStyleRecalc = false;
     m_closeAfterStyleRecalc = false;
 
@@ -507,9 +506,6 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML)
     static int docID = 0;
     m_docID = docID++;
     
-#ifndef NDEBUG
-    m_updatingStyleSelector = false;
-#endif
     InspectorCounters::incrementCounter(InspectorCounters::DocumentCounter);
 }
 
@@ -673,7 +669,7 @@ void Document::buildAccessKeyMap(TreeScope* scope)
             m_elementsByAccessKey.set(accessKey.impl(), element);
 
         if (element->hasShadowRoot()) {
-            for (ShadowRoot* root = element->shadowRootList()->youngestShadowRoot(); root; root = root->olderShadowRoot())
+            for (ShadowRoot* root = element->shadowTree()->youngestShadowRoot(); root; root = root->olderShadowRoot())
                 buildAccessKeyMap(root);
         }
     }
@@ -833,11 +829,7 @@ PassRefPtr<Node> Document::importNode(Node* importedNode, bool deep, ExceptionCo
 {
     ec = 0;
     
-    if (!importedNode
-#if ENABLE(SVG) && ENABLE(DASHBOARD_SUPPORT)
-        || (importedNode->isSVGElement() && page() && page()->settings()->usesDashboardBackwardCompatibilityMode())
-#endif
-        ) {
+    if (!importedNode) {
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
@@ -1028,12 +1020,27 @@ bool Document::cssRegionsEnabled() const
     return settings() && settings()->cssRegionsEnabled(); 
 }
 
+static bool validFlowName(const String& flowName)
+{
+    if (equalIgnoringCase(flowName, "auto")
+        || equalIgnoringCase(flowName, "default")
+        || equalIgnoringCase(flowName, "inherit")
+        || equalIgnoringCase(flowName, "initial")
+        || equalIgnoringCase(flowName, "none"))
+        return false;
+    return true;
+}
+
 PassRefPtr<WebKitNamedFlow> Document::webkitGetFlowByName(const String& flowName)
 {
-    if (!cssRegionsEnabled())
+    if (!cssRegionsEnabled() || flowName.isEmpty() || !validFlowName(flowName) || !renderer())
         return 0;
-    if (!renderer())
+
+    // Make a slower check for invalid flow name
+    CSSParser p(true);
+    if (!p.parseFlowThread(flowName, this))
         return 0;
+
     if (RenderView* view = renderer()->view())
         return view->ensureRenderFlowThreadWithName(flowName)->ensureNamedFlow();
     return 0;
@@ -1851,7 +1858,6 @@ void Document::createStyleSelector()
     
 inline void Document::clearStyleSelector()
 {
-    ASSERT(!m_updatingStyleSelector);
     m_styleSelector.clear();
 }
 
@@ -2279,6 +2285,9 @@ void Document::implicitClose()
     ImageLoader::dispatchPendingBeforeLoadEvents();
     ImageLoader::dispatchPendingLoadEvents();
 
+    HTMLLinkElement::dispatchPendingLoadEvents();
+    HTMLStyleElement::dispatchPendingLoadEvents();
+
 #if ENABLE(SVG)
     // To align the HTML load event and the SVGLoad event for the outermost <svg> element, fire it from
     // here, instead of doing it from SVGElement::finishedParsingChildren (if externalResourcesRequired="false",
@@ -3042,20 +3051,21 @@ void Document::styleSelectorChanged(StyleSelectorUpdateFlag updateFlag)
 #endif
 
     bool stylesheetChangeRequiresStyleRecalc = updateActiveStylesheets(updateFlag);
-    if (!stylesheetChangeRequiresStyleRecalc)
-        return;
 
     if (updateFlag == DeferRecalcStyle) {
         scheduleForcedStyleRecalc();
         return;
     }
-    
+
     if (didLayoutWithPendingStylesheets() && m_pendingStylesheets <= 0) {
         m_pendingSheetLayout = IgnoreLayoutWithPendingSheets;
         if (renderer())
             renderer()->repaint();
     }
 
+    if (!stylesheetChangeRequiresStyleRecalc)
+        return;
+
     // This recalcStyle initiates a new recalc cycle. We need to bracket it to
     // make sure animations get the correct update time
     if (m_frame)
@@ -3290,8 +3300,6 @@ void Document::analyzeStylesheetChange(StyleSelectorUpdateFlag updateFlag, const
 
 bool Document::updateActiveStylesheets(StyleSelectorUpdateFlag updateFlag)
 {
-    ASSERT(!m_updatingStyleSelector);
-
     if (m_inStyleRecalc) {
         // SVG <use> element may manage to invalidate style selector in the middle of a style recalc.
         // https://bugs.webkit.org/show_bug.cgi?id=54344
@@ -3313,16 +3321,7 @@ bool Document::updateActiveStylesheets(StyleSelectorUpdateFlag updateFlag)
     if (requiresStyleSelectorReset)
         clearStyleSelector();
     else {
-#ifndef NDEBUG
-        m_updatingStyleSelector = true;
-#endif
-        // Detach the style selector temporarily so it can't get deleted during appendAuthorStylesheets
-        OwnPtr<CSSStyleSelector> detachedStyleSelector = m_styleSelector.release();
-        detachedStyleSelector->appendAuthorStylesheets(m_styleSheets->length(), newStylesheets);
-        m_styleSelector = detachedStyleSelector.release();
-#ifndef NDEBUG
-        m_updatingStyleSelector = false;
-#endif
+        m_styleSelector->appendAuthorStylesheets(m_styleSheets->length(), newStylesheets);
         resetCSSFeatureFlags();
     }
     m_styleSheets->swap(newStylesheets);
@@ -4751,24 +4750,6 @@ void Document::setSecurityOrigin(PassRefPtr<SecurityOrigin> origin)
     SecurityContext::setSecurityOrigin(origin);
 }
 
-#if ENABLE(SQL_DATABASE)
-
-bool Document::allowDatabaseAccess() const
-{
-    if (!page() || (page()->settings()->privateBrowsingEnabled() && !SchemeRegistry::allowsDatabaseAccessInPrivateBrowsing(securityOrigin()->protocol())))
-        return false;
-    return true;
-}
-
-void Document::databaseExceededQuota(const String& name)
-{
-    Page* currentPage = page();
-    if (currentPage)
-        currentPage->chrome()->client()->exceededDatabaseQuota(document()->frame(), name);
-}
-
-#endif
-
 bool Document::isContextThread() const
 {
     return isMainThread();
@@ -5130,28 +5111,12 @@ void Document::webkitWillEnterFullScreenForElement(Element* element)
     m_fullScreenElement->setContainsFullScreenElementOnAncestorsCrossingFrameBoundaries(true);
     
     recalcStyle(Force);
-    
-    if (m_fullScreenRenderer) {
-        setAnimatingFullScreen(true);
-#if USE(ACCELERATED_COMPOSITING)
-        view()->updateCompositingLayers();
-        if (m_fullScreenRenderer->layer() && m_fullScreenRenderer->layer()->isComposited())
-            page()->chrome()->client()->setRootFullScreenLayer(m_fullScreenRenderer->layer()->backing()->graphicsLayer());
-#endif
-    }
 }
     
 void Document::webkitDidEnterFullScreenForElement(Element*)
 {
     m_fullScreenElement->didBecomeFullscreenElement();
 
-    if (m_fullScreenRenderer) {
-        setAnimatingFullScreen(false);
-#if USE(ACCELERATED_COMPOSITING)
-        view()->updateCompositingLayers();
-        page()->chrome()->client()->setRootFullScreenLayer(0);
-#endif
-    }
     m_fullScreenChangeEventTargetQueue.append(m_fullScreenElement);
     m_fullScreenChangeDelayTimer.startOneShot(0);
 }
@@ -5161,29 +5126,16 @@ void Document::webkitWillExitFullScreenForElement(Element*)
     m_fullScreenElement->setContainsFullScreenElementOnAncestorsCrossingFrameBoundaries(false);
     
     m_fullScreenElement->willStopBeingFullscreenElement();
-
-    if (m_fullScreenRenderer) {
-        setAnimatingFullScreen(true);
-#if USE(ACCELERATED_COMPOSITING)
-        view()->updateCompositingLayers();
-        if (m_fullScreenRenderer->layer() && m_fullScreenRenderer->layer()->isComposited())
-            page()->chrome()->client()->setRootFullScreenLayer(m_fullScreenRenderer->layer()->backing()->graphicsLayer());
-#endif
-    }
 }
 
 void Document::webkitDidExitFullScreenForElement(Element*)
 {
     m_areKeysEnabledInFullScreen = false;
-    setAnimatingFullScreen(false);
     
     if (m_fullScreenRenderer)
         m_fullScreenRenderer->unwrapRenderer();
 
     m_fullScreenChangeEventTargetQueue.append(m_fullScreenElement.release());
-#if USE(ACCELERATED_COMPOSITING)
-    page()->chrome()->client()->setRootFullScreenLayer(0);
-#endif
     scheduleForcedStyleRecalc();
     
     m_fullScreenChangeDelayTimer.startOneShot(0);
@@ -5310,15 +5262,6 @@ void Document::setAnimatingFullScreen(bool flag)
         m_fullScreenElement->setNeedsStyleRecalc();
         scheduleForcedStyleRecalc();
     }
-
-#if USE(ACCELERATED_COMPOSITING)
-    if (m_fullScreenRenderer && m_fullScreenRenderer->layer()) {
-        m_fullScreenRenderer->layer()->contentChanged(RenderLayer::FullScreenChanged);
-        // Clearing the layer's backing will force the compositor to reparent
-        // the layer the next time layers are synchronized.
-        m_fullScreenRenderer->layer()->clearBacking();
-    }
-#endif
 }
 #endif
 
@@ -5478,7 +5421,6 @@ void Document::removeCachedMicroDataItemList(MicroDataItemList* list, const Stri
 {
     ASSERT(rareData());
     ASSERT(rareData()->nodeLists());
-    ASSERT_UNUSED(list, list->hasOwnCaches());
 
     NodeListsNodeData* data = rareData()->nodeLists();
 
diff --git a/Source/WebCore/dom/Document.h b/Source/WebCore/dom/Document.h
index 772e4cd6b..1e305d460 100644
--- a/Source/WebCore/dom/Document.h
+++ b/Source/WebCore/dom/Document.h
@@ -1028,17 +1028,9 @@ public:
     bool processingLoadEvent() const { return m_processingLoadEvent; }
     bool loadEventFinished() const { return m_loadEventFinished; }
 
-#if ENABLE(SQL_DATABASE)
-    virtual bool allowDatabaseAccess() const;
-    virtual void databaseExceededQuota(const String& name);
-#endif
-
     virtual bool isContextThread() const;
     virtual bool isJSExecutionForbidden() const { return false; }
 
-    void setUsingGeolocation(bool f) { m_usingGeolocation = f; }
-    bool usingGeolocation() const { return m_usingGeolocation; };
-
     bool containsValidityStyleRules() const { return m_containsValidityStyleRules; }
     void setContainsValidityStyleRules() { m_containsValidityStyleRules = true; }
 
@@ -1417,8 +1409,6 @@ private:
     bool m_isViewSource;
     bool m_sawElementsInKnownNamespaces;
 
-    bool m_usingGeolocation;
-
     RefPtr<DocumentEventQueue> m_eventQueue;
 
     RefPtr<DocumentWeakReference> m_weakReference;
@@ -1462,11 +1452,7 @@ private:
 #endif
 
     Timer<Document> m_pendingTasksTimer;
-    Vector<OwnPtr<Task> > m_pendingTasks;
-    
-#ifndef NDEBUG
-    bool m_updatingStyleSelector;
-#endif
+    Vector<OwnPtr<Task> > m_pendingTasks;    
 };
 
 // Put these methods here, because they require the Document definition, but we really want to inline them.
diff --git a/Source/WebCore/dom/DocumentType.h b/Source/WebCore/dom/DocumentType.h
index 8fd11f035..fd6c89124 100644
--- a/Source/WebCore/dom/DocumentType.h
+++ b/Source/WebCore/dom/DocumentType.h
@@ -37,6 +37,7 @@ public:
         return adoptRef(new DocumentType(document, name, publicId, systemId));
     }
 
+    // FIXME: We never fill m_entities and m_notations. Current implementation of NamedNodeMap doesn't work without an associated Element yet.
     NamedNodeMap* entities() const { return m_entities.get(); }
     NamedNodeMap* notations() const { return m_notations.get(); }
 
diff --git a/Source/WebCore/dom/Element.cpp b/Source/WebCore/dom/Element.cpp
index 1b4d839db..cdb17b6b4 100644
--- a/Source/WebCore/dom/Element.cpp
+++ b/Source/WebCore/dom/Element.cpp
@@ -52,6 +52,7 @@
 #include "InspectorInstrumentation.h"
 #include "MutationObserverInterestGroup.h"
 #include "MutationRecord.h"
+#include "NamedNodeMap.h"
 #include "NodeList.h"
 #include "NodeRenderStyle.h"
 #include "NodeRenderingContext.h"
@@ -60,6 +61,7 @@
 #include "RenderRegion.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
+#include "RuntimeEnabledFeatures.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
 #include "Text.h"
@@ -93,7 +95,7 @@ public:
         if (m_pushedStyleSelector)
             return;
         m_pushedStyleSelector = m_parent->document()->styleSelector();
-        m_pushedStyleSelector->pushParent(m_parent);
+        m_pushedStyleSelector->pushParentElement(m_parent);
     }
     ~StyleSelectorParentPusher() 
     {
@@ -107,7 +109,7 @@ public:
         if (m_pushedStyleSelector != m_parent->document()->styleSelector())
             return;
 
-        m_pushedStyleSelector->popParent(m_parent); 
+        m_pushedStyleSelector->popParentElement(m_parent); 
     }
 
 private:
@@ -122,9 +124,10 @@ PassRefPtr<Element> Element::create(const QualifiedName& tagName, Document* docu
 
 Element::~Element()
 {
-    removeShadowRoot();
-    if (m_attributeMap)
-        m_attributeMap->detachFromElement();
+    if (shadowTree())
+        rareData()->m_shadowTree.clear();
+    if (m_attributeData)
+        m_attributeData->clearAttributes();
 }
 
 inline ElementRareData* Element::rareData() const
@@ -184,10 +187,9 @@ void Element::copyNonAttributeProperties(const Element*)
 
 void Element::removeAttribute(const QualifiedName& name)
 {
-    if (!m_attributeMap)
+    if (!attributeData())
         return;
-
-    m_attributeMap->removeAttribute(name);
+    attributeData()->removeAttribute(name, this);
 }
 
 void Element::setBooleanAttribute(const QualifiedName& name, bool value)
@@ -198,6 +200,17 @@ void Element::setBooleanAttribute(const QualifiedName& name, bool value)
         removeAttribute(name);
 }
 
+NamedNodeMap* Element::attributes() const
+{
+    ensureUpdatedAttributeData();
+    ElementRareData* rareData = const_cast<Element*>(this)->ensureRareData();
+    if (NamedNodeMap* attributeMap = rareData->m_attributeMap.get())
+        return attributeMap;
+
+    rareData->m_attributeMap = NamedNodeMap::create(const_cast<Element*>(this));
+    return rareData->m_attributeMap.get();
+}
+
 Node::NodeType Element::nodeType() const
 {
     return ELEMENT_NODE;
@@ -218,8 +231,8 @@ const AtomicString& Element::getAttribute(const QualifiedName& name) const
         updateAnimatedSVGAttribute(name);
 #endif
 
-    if (m_attributeMap) {
-        if (Attribute* attribute = m_attributeMap->getAttributeItem(name))
+    if (m_attributeData) {
+        if (Attribute* attribute = getAttributeItem(name))
             return attribute->value();
     }
     return nullAtom;
@@ -595,8 +608,8 @@ const AtomicString& Element::getAttribute(const String& name) const
     }
 #endif
 
-    if (m_attributeMap) {
-        if (Attribute* attribute = m_attributeMap->getAttributeItem(name, ignoreCase))
+    if (m_attributeData) {
+        if (Attribute* attribute = m_attributeData->getAttributeItem(name, ignoreCase))
             return attribute->value();
     }
 
@@ -622,38 +635,41 @@ void Element::setAttribute(const AtomicString& name, const AtomicString& value,
     setAttributeInternal(index, qName, value);
 }
 
-void Element::setAttribute(const QualifiedName& name, const AtomicString& value)
+void Element::setAttribute(const QualifiedName& name, const AtomicString& value, bool notifyChanged)
 {
-    setAttributeInternal(ensureUpdatedAttributeData()->getAttributeItemIndex(name), name, value);
+    setAttributeInternal(ensureUpdatedAttributeData()->getAttributeItemIndex(name), name, value, notifyChanged);
 }
 
-inline void Element::setAttributeInternal(size_t index, const QualifiedName& name, const AtomicString& value)
+inline void Element::setAttributeInternal(size_t index, const QualifiedName& name, const AtomicString& value, bool notifyChanged)
 {
-    ElementAttributeData* attributeData = &m_attributeMap->m_attributeData;
-    Attribute* old = index != notFound ? attributeData->attributeItem(index) : 0;
+    Attribute* old = index != notFound ? m_attributeData->attributeItem(index) : 0;
     if (value.isNull()) {
         if (old)
-            attributeData->removeAttribute(index, this);
+            m_attributeData->removeAttribute(index, this);
         return;
     }
 
     if (!old) {
-        attributeData->addAttribute(Attribute::create(name, value), this);
+        m_attributeData->addAttribute(Attribute::create(name, value), this);
         return;
     }
 
-    willModifyAttribute(name, old ? old->value() : nullAtom, value);
+    if (notifyChanged)
+        willModifyAttribute(name, old ? old->value() : nullAtom, value);
 
     if (Attr* attrNode = old->attr())
         attrNode->setValue(value);
     else
         old->setValue(value);
 
-    didModifyAttribute(old);
+    if (notifyChanged)
+        didModifyAttribute(old);
 }
 
 void Element::attributeChanged(Attribute* attr)
 {
+    document()->incDOMTreeVersion();
+
     if (isIdAttributeName(attr->name()))
         idAttributeChanged(attr);
     else if (attr->name() == HTMLNames::nameAttr)
@@ -723,48 +739,59 @@ static bool isAttributeToRemove(const QualifiedName& name, const AtomicString& v
     return (name.localName().endsWith(hrefAttr.localName()) || name == srcAttr || name == actionAttr) && protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(value));       
 }
 
-void Element::parserSetAttributeMap(PassOwnPtr<NamedNodeMap> list, FragmentScriptingPermission scriptingPermission)
+void Element::parserSetAttributes(PassOwnPtr<AttributeVector> attributeVector, FragmentScriptingPermission scriptingPermission)
 {
     ASSERT(!inDocument());
     ASSERT(!parentNode());
 
-    document()->incDOMTreeVersion();
+    ASSERT(!m_attributeData);
+
+    if (!attributeVector)
+        return;
 
-    ASSERT(!m_attributeMap);
-    m_attributeMap = list;
-
-    if (m_attributeMap) {
-        ElementAttributeData* attributeData = &m_attributeMap->m_attributeData;
-        m_attributeMap->m_element = this;
-        // If the element is created as result of a paste or drag-n-drop operation
-        // we want to remove all the script and event handlers.
-        if (scriptingPermission == FragmentScriptingNotAllowed) {
-            unsigned i = 0;
-            while (i < m_attributeMap->length()) {
-                const QualifiedName& attributeName = attributeData->m_attributes[i]->name();
-                if (isEventHandlerAttribute(attributeName)) {
-                    attributeData->m_attributes.remove(i);
-                    continue;
-                }
-
-                if (isAttributeToRemove(attributeName, attributeData->m_attributes[i]->value()))
-                    attributeData->m_attributes[i]->setValue(nullAtom);
-                i++;
+    createAttributeData();
+    m_attributeData->m_attributes.swap(*attributeVector);
+
+    // If the element is created as result of a paste or drag-n-drop operation
+    // we want to remove all the script and event handlers.
+    if (scriptingPermission == FragmentScriptingNotAllowed) {
+        unsigned i = 0;
+        while (i < m_attributeData->length()) {
+            const QualifiedName& attributeName = m_attributeData->m_attributes[i]->name();
+            if (isEventHandlerAttribute(attributeName)) {
+                m_attributeData->m_attributes.remove(i);
+                continue;
             }
+
+            if (isAttributeToRemove(attributeName, m_attributeData->m_attributes[i]->value()))
+                m_attributeData->m_attributes[i]->setValue(nullAtom);
+            i++;
         }
-        // Store the set of attributes that changed on the stack in case
-        // attributeChanged mutates m_attributeMap.
-        Vector<RefPtr<Attribute> > attributes;
-        attributeData->copyAttributesToVector(attributes);
-        for (Vector<RefPtr<Attribute> >::iterator iter = attributes.begin(); iter != attributes.end(); ++iter)
-            attributeChanged(iter->get());
     }
+
+    // Store the set of attributes that changed on the stack in case
+    // attributeChanged mutates m_attributeData.
+    Vector<RefPtr<Attribute> > attributes;
+    m_attributeData->copyAttributesToVector(attributes);
+    for (Vector<RefPtr<Attribute> >::iterator iter = attributes.begin(); iter != attributes.end(); ++iter)
+        attributeChanged(iter->get());
 }
 
 bool Element::hasAttributes() const
 {
     updateInvalidAttributes();
-    return m_attributeMap && m_attributeMap->length();
+    return m_attributeData && m_attributeData->length();
+}
+
+bool Element::hasEquivalentAttributes(const Element* other) const
+{
+    ElementAttributeData* attributeData = updatedAttributeData();
+    ElementAttributeData* otherAttributeData = other->updatedAttributeData();
+    if (attributeData)
+        return attributeData->isEquivalent(otherAttributeData);
+    if (otherAttributeData)
+        return otherAttributeData->isEquivalent(attributeData);
+    return true;
 }
 
 String Element::nodeName() const
@@ -805,9 +832,9 @@ KURL Element::baseURI() const
     return KURL(parentBase, baseAttribute);
 }
 
-void Element::createAttributeMap() const
+void Element::createAttributeData() const
 {
-    m_attributeMap = NamedNodeMap::create(const_cast<Element*>(this));
+    m_attributeData = ElementAttributeData::create();
 }
 
 bool Element::isURLAttribute(Attribute*) const
@@ -847,8 +874,8 @@ void Element::willRemove()
     if (containsFullScreenElement())
         setContainsFullScreenElementOnAncestorsCrossingFrameBoundaries(false);
 #endif
-    if (ShadowRootList* shadowRoots = shadowRootList())
-        shadowRoots->willRemove();
+    if (ShadowTree* tree = shadowTree())
+        tree->willRemove();
     ContainerNode::willRemove();
 }
 
@@ -857,17 +884,17 @@ void Element::insertedIntoDocument()
     // need to do superclass processing first so inDocument() is true
     // by the time we reach updateId
     ContainerNode::insertedIntoDocument();
-    if (ShadowRootList* shadowRoots = shadowRootList())
-        shadowRoots->insertedIntoDocument();
+    if (ShadowTree* tree = shadowTree())
+        tree->insertedIntoDocument();
 
-    if (m_attributeMap) {
+    if (m_attributeData) {
         if (hasID()) {
-            Attribute* idItem = m_attributeMap->getAttributeItem(document()->idAttributeName());
+            Attribute* idItem = getAttributeItem(document()->idAttributeName());
             if (idItem && !idItem->isNull())
                 updateId(nullAtom, idItem->value());
         }
         if (hasName()) {
-            Attribute* nameItem = m_attributeMap->getAttributeItem(HTMLNames::nameAttr);
+            Attribute* nameItem = getAttributeItem(HTMLNames::nameAttr);
             if (nameItem && !nameItem->isNull())
                 updateName(nullAtom, nameItem->value());
         }
@@ -876,22 +903,22 @@ void Element::insertedIntoDocument()
 
 void Element::removedFromDocument()
 {
-    if (m_attributeMap) {
+    if (m_attributeData) {
         if (hasID()) {
-            Attribute* idItem = m_attributeMap->getAttributeItem(document()->idAttributeName());
+            Attribute* idItem = getAttributeItem(document()->idAttributeName());
             if (idItem && !idItem->isNull())
                 updateId(idItem->value(), nullAtom);
         }
         if (hasName()) {
-            Attribute* nameItem = m_attributeMap->getAttributeItem(HTMLNames::nameAttr);
+            Attribute* nameItem = getAttributeItem(HTMLNames::nameAttr);
             if (nameItem && !nameItem->isNull())
                 updateName(nameItem->value(), nullAtom);
         }
     }
 
     ContainerNode::removedFromDocument();
-    if (ShadowRootList* shadowRoots = shadowRootList())
-        shadowRoots->removedFromDocument();
+    if (ShadowTree* tree = shadowTree())
+        tree->removedFromDocument();
 }
 
 void Element::insertedIntoTree(bool deep)
@@ -899,8 +926,8 @@ void Element::insertedIntoTree(bool deep)
     ContainerNode::insertedIntoTree(deep);
     if (!deep)
         return;
-    if (ShadowRootList* shadowRoots = shadowRootList())
-        shadowRoots->insertedIntoTree(true);
+    if (ShadowTree* tree = shadowTree())
+        tree->insertedIntoTree(true);
 
 #if ENABLE(FULLSCREEN_API)
     if (containsFullScreenElement() && parentElement() && !parentElement()->containsFullScreenElement())
@@ -913,8 +940,8 @@ void Element::removedFromTree(bool deep)
     ContainerNode::removedFromTree(deep);
     if (!deep)
         return;
-    if (ShadowRootList* shadowRoots = shadowRootList())
-        shadowRoots->removedFromTree(true);
+    if (ShadowTree* tree = shadowTree())
+        tree->removedFromTree(true);
 }
 
 void Element::attach()
@@ -926,18 +953,9 @@ void Element::attach()
     StyleSelectorParentPusher parentPusher(this);
 
     // When a shadow root exists, it does the work of attaching the children.
-    if (hasShadowRoot()) {
+    if (ShadowTree* tree = shadowTree()) {
         parentPusher.push();
-        shadowRootList()->attach();
-
-        // In a shadow tree, some of light children may be attached by 'content' element.
-        // However, when there is no content element or content element does not select
-        // all light children, we have to attach the rest of light children here.
-        for (Node* child = firstChild(); child; child = child->nextSibling()) {
-            if (!child->attached())
-                child->attach();
-        }
-        Node::attach();
+        tree->attachHost(this);
     } else {
         if (firstChild())
             parentPusher.push();
@@ -964,9 +982,11 @@ void Element::detach()
     cancelFocusAppearanceUpdate();
     if (hasRareData())
         rareData()->resetComputedStyle();
-    ContainerNode::detach();
-    if (ShadowRootList* shadowRoots = shadowRootList())
-        shadowRoots->detach();
+
+    if (ShadowTree* tree = shadowTree())
+        tree->detachHost(this);
+    else
+        ContainerNode::detach();
 
     RenderWidget::resumeWidgetHierarchyUpdates();
 }
@@ -1089,12 +1109,16 @@ void Element::recalcStyle(StyleChange change)
         } else if (styleChangeType() == SyntheticStyleChange)
              setRenderStyle(newStyle);
 
+        // If "rem" units are used anywhere in the document, and if the document element's font size changes, then go ahead and force font updating
+        // all the way down the tree. This is simpler than having to maintain a cache of objects (and such font size changes should be rare anyway).
+        if (document()->usesRemUnits() && document()->documentElement() == this && ch != NoChange && currentStyle && newStyle && currentStyle->fontSize() != newStyle->fontSize()) {
+            // Cached RenderStyles may depend on the rem units.
+            document()->styleSelector()->invalidateMatchedPropertiesCache();
+            change = Force;
+        }
+
         if (change != Force) {
-            // If "rem" units are used anywhere in the document, and if the document element's font size changes, then go ahead and force font updating
-            // all the way down the tree.  This is simpler than having to maintain a cache of objects (and such font size changes should be rare anyway).
-            if (document()->usesRemUnits() && ch != NoChange && currentStyle && newStyle && currentStyle->fontSize() != newStyle->fontSize() && document()->documentElement() == this)
-                change = Force;
-            else if (styleChangeType() >= FullStyleChange)
+            if (styleChangeType() >= FullStyleChange)
                 change = Force;
             else
                 change = ch;
@@ -1126,10 +1150,10 @@ void Element::recalcStyle(StyleChange change)
     }
     // FIXME: This does not care about sibling combinators. Will be necessary in XBL2 world.
     if (hasShadowRoot()) {
-        ShadowRootList* list = shadowRootList();
-        if (change >= Inherit || list->childNeedsStyleRecalc() || list->needsStyleRecalc()) {
+        ShadowTree* tree = shadowTree();
+        if (change >= Inherit || tree->childNeedsStyleRecalc() || tree->needsStyleRecalc()) {
             parentPusher.push();
-            list->recalcShadowTreeStyle(change);
+            tree->recalcShadowTreeStyle(change);
         }
     }
 
@@ -1142,93 +1166,36 @@ void Element::recalcStyle(StyleChange change)
 
 bool Element::hasShadowRoot() const
 {
-    if (ShadowRootList* list = shadowRootList())
-        return list->hasShadowRoot();
+    if (ShadowTree* tree = shadowTree())
+        return tree->hasShadowRoot();
     return false;
 }
 
-ShadowRootList* Element::shadowRootList() const
+ShadowTree* Element::shadowTree() const
 {
     if (!hasRareData())
         return 0;
 
-    return &rareData()->m_shadowRootList;
+    return rareData()->m_shadowTree.get();
 }
 
-static bool validateShadowRoot(Document* document, ShadowRoot* shadowRoot, ExceptionCode& ec)
+ShadowTree* Element::ensureShadowTree()
 {
-    if (!shadowRoot)
-        return true;
-
-    if (shadowRoot->shadowHost()) {
-        ec = HIERARCHY_REQUEST_ERR;
-        return false;
-    }
-
-    if (shadowRoot->document() != document) {
-        ec = WRONG_DOCUMENT_ERR;
-        return false;
-    }
+    if (ShadowTree* tree = ensureRareData()->m_shadowTree.get())
+        return tree;
 
-    return true;
-}
-
-void Element::setShadowRoot(PassRefPtr<ShadowRoot> shadowRoot, ExceptionCode& ec)
-{
-    if (!validateShadowRoot(document(), shadowRoot.get(), ec))
-        return;
-
-    if (!hasRareData())
-        ensureRareData();
-
-    removeShadowRoot();
-
-    shadowRoot->setShadowHost(this);
-    shadowRootList()->pushShadowRoot(shadowRoot.get());
-
-    if (inDocument())
-        shadowRoot->insertedIntoDocument();
-    if (attached()) {
-        shadowRoot->lazyAttach();
-        for (Node* child = firstChild(); child; child = child->nextSibling())
-            child->detach();
-    }
+    rareData()->m_shadowTree = adoptPtr(new ShadowTree());
+    return rareData()->m_shadowTree.get();
 }
 
 ShadowRoot* Element::ensureShadowRoot()
 {
     if (hasShadowRoot())
-        return shadowRootList()->oldestShadowRoot();
+        return shadowTree()->oldestShadowRoot();
 
     return ShadowRoot::create(this, ShadowRoot::CreatingUserAgentShadowRoot).get();
 }
 
-void Element::removeShadowRoot()
-{
-    if (!hasShadowRoot())
-        return;
-
-    while (RefPtr<ShadowRoot> oldRoot = shadowRootList()->popShadowRoot()) {
-        document()->removeFocusedNodeOfSubtree(oldRoot.get());
-
-        if (oldRoot->attached())
-            oldRoot->detach();
-
-        oldRoot->setShadowHost(0);
-        document()->adoptIfNeeded(oldRoot.get());
-        if (oldRoot->inDocument())
-            oldRoot->removedFromDocument();
-        else
-            oldRoot->removedFromTree(true);
-        if (attached()) {
-            for (Node* child = firstChild(); child; child = child->nextSibling()) {
-                if (!child->attached())
-                    child->lazyAttach();
-            }
-        }
-    }
-}
-
 const AtomicString& Element::shadowPseudoId() const
 {
     return hasRareData() ? rareData()->m_shadowPseudoId : nullAtom;
@@ -1275,6 +1242,9 @@ static void checkForEmptyStyleChange(Element* element, RenderStyle* style)
 static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool finishedParsingCallback,
                                         Node* beforeChange, Node* afterChange, int childCountDelta)
 {
+    // :empty selector.
+    checkForEmptyStyleChange(e, style);
+    
     if (!style || (e->needsStyleRecalc() && style->childrenAffectedByPositionalRules()))
         return;
 
@@ -1346,9 +1316,6 @@ static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool fin
     if ((style->childrenAffectedByForwardPositionalRules() && afterChange) ||
         (style->childrenAffectedByBackwardPositionalRules() && beforeChange))
         e->setNeedsStyleRecalc();
-    
-    // :empty selector.
-    checkForEmptyStyleChange(e, style);
 }
 
 void Element::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -1361,7 +1328,7 @@ void Element::childrenChanged(bool changedByParser, Node* beforeChange, Node* af
 
     if (hasRareData()) {
         if (hasShadowRoot())
-            shadowRootList()->hostChildrenChanged();
+            shadowTree()->hostChildrenChanged();
     }
 }
 
@@ -1370,7 +1337,7 @@ void Element::beginParsingChildren()
     clearIsParsingChildrenFinished();
     CSSStyleSelector* styleSelector = document()->styleSelectorIfExists();
     if (styleSelector && attached())
-        styleSelector->pushParent(this);
+        styleSelector->pushParentElement(this);
 }
 
 void Element::finishParsingChildren()
@@ -1379,7 +1346,7 @@ void Element::finishParsingChildren()
     setIsParsingChildrenFinished();
     checkForSiblingStyleChanges(this, renderStyle(), true, lastChild(), 0, 0);
     if (CSSStyleSelector* styleSelector = document()->styleSelectorIfExists())
-        styleSelector->popParent(this);
+        styleSelector->popParentElement(this);
 }
 
 #ifndef NDEBUG
@@ -1419,16 +1386,34 @@ PassRefPtr<Attr> Element::setAttributeNode(Attr* attr, ExceptionCode& ec)
         ec = TYPE_MISMATCH_ERR;
         return 0;
     }
-    return static_pointer_cast<Attr>(ensureUpdatedAttributes()->setNamedItem(attr, ec));
+
+    ElementAttributeData* attributeData = ensureUpdatedAttributeData();
+    Attribute* attribute = attr->attr();
+    size_t index = attributeData->getAttributeItemIndex(attribute->name());
+    Attribute* oldAttribute = index != notFound ? attributeData->attributeItem(index) : 0;
+    if (oldAttribute == attribute)
+        return attr; // we know about it already
+
+    // INUSE_ATTRIBUTE_ERR: Raised if node is an Attr that is already an attribute of another Element object.
+    // The DOM user must explicitly clone Attr nodes to re-use them in other elements.
+    if (attr->ownerElement()) {
+        ec = INUSE_ATTRIBUTE_ERR;
+        return 0;
+    }
+
+    RefPtr<Attr> oldAttr;
+    if (oldAttribute) {
+        oldAttr = oldAttribute->createAttrIfNeeded(this);
+        attributeData->replaceAttribute(index, attribute, this);
+    } else
+        attributeData->addAttribute(attribute, this);
+
+    return oldAttr.release();
 }
 
 PassRefPtr<Attr> Element::setAttributeNodeNS(Attr* attr, ExceptionCode& ec)
 {
-    if (!attr) {
-        ec = TYPE_MISMATCH_ERR;
-        return 0;
-    }
-    return static_pointer_cast<Attr>(ensureUpdatedAttributes()->setNamedItem(attr, ec));
+    return setAttributeNode(attr, ec);
 }
 
 PassRefPtr<Attr> Element::removeAttributeNode(Attr* attr, ExceptionCode& ec)
@@ -1444,11 +1429,17 @@ PassRefPtr<Attr> Element::removeAttributeNode(Attr* attr, ExceptionCode& ec)
 
     ASSERT(document() == attr->document());
 
-    NamedNodeMap* attrs = updatedAttributes();
-    if (!attrs)
+    ElementAttributeData* attributeData = updatedAttributeData();
+    if (!attributeData)
         return 0;
 
-    return static_pointer_cast<Attr>(attrs->removeNamedItem(attr->qualifiedName(), ec));
+    size_t index = attributeData->getAttributeItemIndex(attr->qualifiedName());
+    if (index == notFound) {
+        ec = NOT_FOUND_ERR;
+        return 0;
+    }
+
+    return attributeData->takeAttribute(index, this);
 }
 
 void Element::setAttributeNS(const AtomicString& namespaceURI, const AtomicString& qualifiedName, const AtomicString& value, ExceptionCode& ec, FragmentScriptingPermission scriptingPermission)
@@ -1491,19 +1482,18 @@ void Element::removeAttributeNS(const String& namespaceURI, const String& localN
 
 PassRefPtr<Attr> Element::getAttributeNode(const String& name)
 {
-    NamedNodeMap* attrs = updatedAttributes();
-    if (!attrs)
+    ElementAttributeData* attributeData = updatedAttributeData();
+    if (!attributeData)
         return 0;
-    String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
-    return static_pointer_cast<Attr>(attrs->getNamedItem(localName));
+    return attributeData->getAttributeNode(name, shouldIgnoreAttributeCase(this), this);
 }
 
 PassRefPtr<Attr> Element::getAttributeNodeNS(const String& namespaceURI, const String& localName)
 {
-    NamedNodeMap* attrs = updatedAttributes();
-    if (!attrs)
+    ElementAttributeData* attributeData = updatedAttributeData();
+    if (!attributeData)
         return 0;
-    return static_pointer_cast<Attr>(attrs->getNamedItem(QualifiedName(nullAtom, localName, namespaceURI)));
+    return attributeData->getAttributeNode(QualifiedName(nullAtom, localName, namespaceURI), this);
 }
 
 bool Element::hasAttribute(const String& name) const
@@ -1653,8 +1643,13 @@ RenderStyle* Element::computedStyle(PseudoId pseudoElementSpecifier)
     // FIXME: Find and use the renderer from the pseudo element instead of the actual element so that the 'length'
     // properties, which are only known by the renderer because it did the layout, will be correct and so that the
     // values returned for the ":selection" pseudo-element will be correct.
-    if (RenderStyle* usedStyle = renderStyle())
-        return pseudoElementSpecifier ? usedStyle->getCachedPseudoStyle(pseudoElementSpecifier) : usedStyle;
+    if (RenderStyle* usedStyle = renderStyle()) {
+        if (pseudoElementSpecifier) {
+            RenderStyle* cachedPseudoStyle = usedStyle->getCachedPseudoStyle(pseudoElementSpecifier);
+            return cachedPseudoStyle ? cachedPseudoStyle : usedStyle;
+         } else
+            return usedStyle;
+    }
 
     if (!attached())
         // FIXME: Try to do better than this. Ensure that styleForElement() works for elements that are not in the
@@ -1807,8 +1802,8 @@ DOMStringMap* Element::dataset()
 KURL Element::getURLAttribute(const QualifiedName& name) const
 {
 #if !ASSERT_DISABLED
-    if (m_attributeMap) {
-        if (Attribute* attribute = m_attributeMap->getAttributeItem(name))
+    if (m_attributeData) {
+        if (Attribute* attribute = getAttributeItem(name))
             ASSERT(isURLAttribute(attribute));
     }
 #endif
@@ -1818,8 +1813,8 @@ KURL Element::getURLAttribute(const QualifiedName& name) const
 KURL Element::getNonEmptyURLAttribute(const QualifiedName& name) const
 {
 #if !ASSERT_DISABLED
-    if (m_attributeMap) {
-        if (Attribute* attribute = m_attributeMap->getAttributeItem(name))
+    if (m_attributeData) {
+        if (Attribute* attribute = getAttributeItem(name))
             ASSERT(isURLAttribute(attribute));
     }
 #endif
@@ -1986,25 +1981,27 @@ bool Element::fastAttributeLookupAllowed(const QualifiedName& name) const
 }
 #endif
 
-void Element::willModifyAttribute(const QualifiedName& name, const AtomicString& oldValue, const AtomicString& newValue)
+#ifdef DUMP_NODE_STATISTICS
+bool Element::hasNamedNodeMap() const
 {
-    document()->incDOMTreeVersion();
+    return hasRareData() && rareData()->m_attributeMap;
+}
+#endif
 
+void Element::willModifyAttribute(const QualifiedName& name, const AtomicString& oldValue, const AtomicString& newValue)
+{
     if (isIdAttributeName(name))
         updateId(oldValue, newValue);
     else if (name == HTMLNames::nameAttr)
         updateName(oldValue, newValue);
 
 #if ENABLE(MUTATION_OBSERVERS)
-    if (!isSynchronizingStyleAttribute()) {
-        if (OwnPtr<MutationObserverInterestGroup> recipients = MutationObserverInterestGroup::createForAttributesMutation(this, name))
-            recipients->enqueueMutationRecord(MutationRecord::createAttributes(this, name, oldValue));
-    }
+    if (OwnPtr<MutationObserverInterestGroup> recipients = MutationObserverInterestGroup::createForAttributesMutation(this, name))
+        recipients->enqueueMutationRecord(MutationRecord::createAttributes(this, name, oldValue));
 #endif
 
 #if ENABLE(INSPECTOR)
-    if (!isSynchronizingStyleAttribute())
-        InspectorInstrumentation::willModifyDOMAttr(document(), this, oldValue, newValue);
+    InspectorInstrumentation::willModifyDOMAttr(document(), this, oldValue, newValue);
 #endif
 }
 
@@ -2012,10 +2009,8 @@ void Element::didModifyAttribute(Attribute* attr)
 {
     attributeChanged(attr);
 
-    if (!isSynchronizingStyleAttribute()) {
-        InspectorInstrumentation::didModifyDOMAttr(document(), this, attr->name().localName(), attr->value());
-        dispatchSubtreeModifiedEvent();
-    }
+    InspectorInstrumentation::didModifyDOMAttr(document(), this, attr->name().localName(), attr->value());
+    dispatchSubtreeModifiedEvent();
 }
 
 void Element::didRemoveAttribute(Attribute* attr)
@@ -2028,10 +2023,8 @@ void Element::didRemoveAttribute(Attribute* attr)
     attributeChanged(attr);
     attr->setValue(savedValue);
 
-    if (!isSynchronizingStyleAttribute()) {
-        InspectorInstrumentation::didRemoveDOMAttr(document(), this, attr->name().localName());
-        dispatchSubtreeModifiedEvent();
-    }
+    InspectorInstrumentation::didRemoveDOMAttr(document(), this, attr->name().localName());
+    dispatchSubtreeModifiedEvent();
 }
 
 
diff --git a/Source/WebCore/dom/Element.h b/Source/WebCore/dom/Element.h
index c9a1139a9..8c825073f 100644
--- a/Source/WebCore/dom/Element.h
+++ b/Source/WebCore/dom/Element.h
@@ -27,9 +27,9 @@
 
 #include "CollectionType.h"
 #include "Document.h"
+#include "ElementAttributeData.h"
 #include "FragmentScriptingPermission.h"
 #include "HTMLNames.h"
-#include "NamedNodeMap.h"
 #include "ScrollTypes.h"
 
 namespace WebCore {
@@ -42,7 +42,7 @@ class DOMTokenList;
 class ElementRareData;
 class IntSize;
 class ShadowRoot;
-class ShadowRootList;
+class ShadowTree;
 class WebKitAnimationList;
 
 enum SpellcheckAttributeState {
@@ -113,7 +113,7 @@ public:
 
     bool hasAttribute(const QualifiedName&) const;
     const AtomicString& getAttribute(const QualifiedName&) const;
-    void setAttribute(const QualifiedName&, const AtomicString& value);
+    void setAttribute(const QualifiedName&, const AtomicString& value, bool notifyChanged = true);
     void removeAttribute(const QualifiedName&);
 
     // Typed getters and setters for language bindings.
@@ -130,6 +130,9 @@ public:
     bool fastAttributeLookupAllowed(const QualifiedName&) const;
 #endif
 
+#ifdef DUMP_NODE_STATISTICS
+    bool hasNamedNodeMap() const;
+#endif
     bool hasAttributes() const;
     // This variant will not update the potentially invalid attributes. To be used when not interested
     // in style attribute or one of the SVG animation attributes.
@@ -160,7 +163,6 @@ public:
     size_t attributeCount() const;
     Attribute* attributeItem(unsigned index) const;
     Attribute* getAttributeItem(const QualifiedName&) const;
-    void removeAttribute(unsigned index);
 
     void scrollIntoView(bool alignToTop = true);
     void scrollIntoViewIfNeeded(bool centerIfNeeded = true);
@@ -228,23 +230,21 @@ public:
     void setBooleanAttribute(const QualifiedName& name, bool);
 
     // For exposing to DOM only.
-    NamedNodeMap* attributes() const { return ensureUpdatedAttributes(); }
-
-    NamedNodeMap* ensureUpdatedAttributes() const;
-    NamedNodeMap* updatedAttributes() const;
+    NamedNodeMap* attributes() const;
 
     // This method is called whenever an attribute is added, changed or removed.
     virtual void attributeChanged(Attribute*);
 
     // Only called by the parser immediately after element construction.
-    void parserSetAttributeMap(PassOwnPtr<NamedNodeMap>, FragmentScriptingPermission);
+    void parserSetAttributes(PassOwnPtr<AttributeVector>, FragmentScriptingPermission);
 
-    ElementAttributeData* attributeData() const { return m_attributeMap ? m_attributeMap->attributeData() : 0; }
+    ElementAttributeData* attributeData() const { return m_attributeData.get(); }
     ElementAttributeData* ensureAttributeData() const;
     ElementAttributeData* updatedAttributeData() const;
     ElementAttributeData* ensureUpdatedAttributeData() const;
 
     void setAttributesFromElement(const Element&);
+    bool hasEquivalentAttributes(const Element* other) const;
 
     virtual void copyNonAttributeProperties(const Element* source);
 
@@ -254,13 +254,12 @@ public:
     void recalcStyle(StyleChange = NoChange);
 
     bool hasShadowRoot() const;
-    ShadowRootList* shadowRootList() const;
+    ShadowTree* shadowTree() const;
+    ShadowTree* ensureShadowTree();
 
-    // FIXME: These API will be moved to ShadowRootList.
-    // https://bugs.webkit.org/show_bug.cgi?id=78313
-    void setShadowRoot(PassRefPtr<ShadowRoot>, ExceptionCode&);
+    // FIXME: Remove Element::ensureShadowRoot
+    // https://bugs.webkit.org/show_bug.cgi?id=77608
     ShadowRoot* ensureShadowRoot();
-    void removeShadowRoot();
 
     virtual const AtomicString& shadowPseudoId() const;
     void setShadowPseudoId(const AtomicString&, ExceptionCode& = ASSERT_NO_EXCEPTION);
@@ -430,7 +429,7 @@ private:
     virtual NodeType nodeType() const;
     virtual bool childTypeAllowed(NodeType) const;
 
-    void setAttributeInternal(size_t index, const QualifiedName&, const AtomicString& value);
+    void setAttributeInternal(size_t index, const QualifiedName&, const AtomicString& value, bool notifyChanged = true);
 
 #ifndef NDEBUG
     virtual void formatForDebugger(char* buffer, unsigned length) const;
@@ -438,7 +437,7 @@ private:
 
     bool pseudoStyleCacheIsInvalid(const RenderStyle* currentStyle, RenderStyle* newStyle);
 
-    void createAttributeMap() const;
+    void createAttributeData() const;
 
     virtual void updateStyleAttribute() const { }
 
@@ -470,7 +469,7 @@ private:
     void updateExtraNamedItemRegistration(const AtomicString& oldName, const AtomicString& newName);
 
 private:
-    mutable OwnPtr<NamedNodeMap> m_attributeMap;
+    mutable OwnPtr<ElementAttributeData> m_attributeData;
 };
     
 inline Element* toElement(Node* node)
@@ -530,25 +529,11 @@ inline Element* Element::nextElementSibling() const
     return static_cast<Element*>(n);
 }
 
-inline NamedNodeMap* Element::ensureUpdatedAttributes() const
-{
-    updateInvalidAttributes();
-    if (!m_attributeMap)
-        createAttributeMap();
-    return m_attributeMap.get();
-}
-
-inline NamedNodeMap* Element::updatedAttributes() const
-{
-    updateInvalidAttributes();
-    return m_attributeMap.get();
-}
-
 inline ElementAttributeData* Element::ensureAttributeData() const
 {
-    if (!m_attributeMap)
-        createAttributeMap();
-    return m_attributeMap->attributeData();
+    if (!m_attributeData)
+        createAttributeData();
+    return m_attributeData.get();
 }
 
 inline ElementAttributeData* Element::updatedAttributeData() const
@@ -608,14 +593,14 @@ inline void Element::willRemoveAttribute(const QualifiedName& name, const Atomic
 inline bool Element::fastHasAttribute(const QualifiedName& name) const
 {
     ASSERT(fastAttributeLookupAllowed(name));
-    return m_attributeMap && m_attributeMap->getAttributeItem(name);
+    return m_attributeData && getAttributeItem(name);
 }
 
 inline const AtomicString& Element::fastGetAttribute(const QualifiedName& name) const
 {
     ASSERT(fastAttributeLookupAllowed(name));
-    if (m_attributeMap) {
-        if (Attribute* attribute = m_attributeMap->getAttributeItem(name))
+    if (m_attributeData) {
+        if (Attribute* attribute = getAttributeItem(name))
             return attribute->value();
     }
     return nullAtom;
@@ -623,13 +608,13 @@ inline const AtomicString& Element::fastGetAttribute(const QualifiedName& name)
 
 inline bool Element::hasAttributesWithoutUpdate() const
 {
-    return m_attributeMap && !m_attributeMap->isEmpty();
+    return m_attributeData && !m_attributeData->isEmpty();
 }
 
 inline const AtomicString& Element::idForStyleResolution() const
 {
     ASSERT(hasID());
-    return attributeData()->idForStyleResolution();
+    return m_attributeData->idForStyleResolution();
 }
 
 inline bool Element::isIdAttributeName(const QualifiedName& attributeName) const
@@ -658,26 +643,20 @@ inline void Element::setIdAttribute(const AtomicString& value)
 
 inline size_t Element::attributeCount() const
 {
-    ASSERT(m_attributeMap);
-    return m_attributeMap->length();
+    ASSERT(m_attributeData);
+    return m_attributeData->length();
 }
 
 inline Attribute* Element::attributeItem(unsigned index) const
 {
-    ASSERT(m_attributeMap);
-    return m_attributeMap->attributeItem(index);
+    ASSERT(m_attributeData);
+    return m_attributeData->attributeItem(index);
 }
 
 inline Attribute* Element::getAttributeItem(const QualifiedName& name) const
 {
-    ASSERT(m_attributeMap);
-    return m_attributeMap->getAttributeItem(name);
-}
-
-inline void Element::removeAttribute(unsigned index)
-{
-    ASSERT(m_attributeMap);
-    m_attributeMap->removeAttribute(index);
+    ASSERT(m_attributeData);
+    return m_attributeData->getAttributeItem(name);
 }
 
 inline void Element::updateInvalidAttributes() const
diff --git a/Source/WebCore/dom/Element.idl b/Source/WebCore/dom/Element.idl
index c66b14592..8725bcbc1 100644
--- a/Source/WebCore/dom/Element.idl
+++ b/Source/WebCore/dom/Element.idl
@@ -22,8 +22,7 @@ module core {
 
     interface [
         JSGenerateToNativeObject,
-        JSInlineGetOwnPropertySlot,
-        V8CustomToJSObject
+        JSInlineGetOwnPropertySlot
     ] Element : Node {
 
         // DOM Level 1 Core
diff --git a/Source/WebCore/dom/ElementAttributeData.cpp b/Source/WebCore/dom/ElementAttributeData.cpp
index 71457f4b1..601c34b9b 100644
--- a/Source/WebCore/dom/ElementAttributeData.cpp
+++ b/Source/WebCore/dom/ElementAttributeData.cpp
@@ -26,11 +26,22 @@
 #include "config.h"
 #include "ElementAttributeData.h"
 
-#include "Attr.h"
 #include "StyledElement.h"
 
 namespace WebCore {
 
+void AttributeVector::removeAttribute(const QualifiedName& name)
+{
+    size_t index = getAttributeItemIndex(name);
+    if (index == notFound)
+        return;
+
+    RefPtr<Attribute> attribute = at(index);
+    if (Attr* attr = attribute->attr())
+        attr->m_element = 0;
+    remove(index);
+}
+
 ElementAttributeData::~ElementAttributeData()
 {
     detachAttributesFromElement();
@@ -40,8 +51,8 @@ void ElementAttributeData::setClass(const String& className, bool shouldFoldCase
 {
     m_classNames.set(className, shouldFoldCase);
 }
-
-StylePropertySet* ElementAttributeData::ensureInlineStyleDecl(StyledElement* element)
+    
+StylePropertySet* ElementAttributeData::ensureInlineStyle(StyledElement* element)
 {
     if (!m_inlineStyleDecl) {
         ASSERT(element->isStyledElement());
@@ -51,7 +62,30 @@ StylePropertySet* ElementAttributeData::ensureInlineStyleDecl(StyledElement* ele
     return m_inlineStyleDecl.get();
 }
 
-void ElementAttributeData::destroyInlineStyleDecl(StyledElement* element)
+StylePropertySet* ElementAttributeData::ensureMutableInlineStyle(StyledElement* element)
+{
+    if (m_inlineStyleDecl && !m_inlineStyleDecl->hasCSSOMWrapper()) {
+        m_inlineStyleDecl = m_inlineStyleDecl->copy();
+        m_inlineStyleDecl->setStrictParsing(element->isHTMLElement() && !element->document()->inQuirksMode());
+        return m_inlineStyleDecl.get();
+    }
+    return ensureInlineStyle(element);
+}
+    
+void ElementAttributeData::updateInlineStyleAvoidingMutation(StyledElement* element, const String& text)
+{
+    // We reconstruct the property set instead of mutating if there is no CSSOM wrapper.
+    // This makes wrapperless property sets immutable and so cacheable.
+    if (m_inlineStyleDecl && !m_inlineStyleDecl->hasCSSOMWrapper())
+        m_inlineStyleDecl.clear();
+    if (!m_inlineStyleDecl) {
+        m_inlineStyleDecl = StylePropertySet::create();
+        m_inlineStyleDecl->setStrictParsing(element->isHTMLElement() && !element->document()->inQuirksMode());
+    }
+    m_inlineStyleDecl->parseDeclaration(text, element->document()->elementSheet());
+}
+
+void ElementAttributeData::destroyInlineStyle(StyledElement* element)
 {
     if (!m_inlineStyleDecl)
         return;
@@ -91,6 +125,35 @@ void ElementAttributeData::removeAttribute(size_t index, Element* element)
         element->didRemoveAttribute(attribute.get());
 }
 
+PassRefPtr<Attr> ElementAttributeData::takeAttribute(size_t index, Element* element)
+{
+    ASSERT(index < length());
+    ASSERT(element);
+
+    RefPtr<Attr> attr = m_attributes[index]->createAttrIfNeeded(element);
+    removeAttribute(index, element);
+    return attr.release();
+}
+
+bool ElementAttributeData::isEquivalent(const ElementAttributeData* other) const
+{
+    if (!other)
+        return isEmpty();
+
+    unsigned len = length();
+    if (len != other->length())
+        return false;
+
+    for (unsigned i = 0; i < len; i++) {
+        Attribute* attr = attributeItem(i);
+        Attribute* otherAttr = other->getAttributeItem(attr->name());
+        if (!otherAttr || attr->value() != otherAttr->value())
+            return false;
+    }
+
+    return true;
+}
+
 void ElementAttributeData::detachAttributesFromElement()
 {
     size_t size = m_attributes.size();
diff --git a/Source/WebCore/dom/ElementAttributeData.h b/Source/WebCore/dom/ElementAttributeData.h
index be145617c..e0866b29a 100644
--- a/Source/WebCore/dom/ElementAttributeData.h
+++ b/Source/WebCore/dom/ElementAttributeData.h
@@ -26,6 +26,7 @@
 #ifndef ElementAttributeData_h
 #define ElementAttributeData_h
 
+#include "Attr.h"
 #include "Attribute.h"
 #include "SpaceSplitString.h"
 #include "StylePropertySet.h"
@@ -35,8 +36,57 @@ namespace WebCore {
 
 class Element;
 
+class AttributeVector : public Vector<RefPtr<Attribute>, 4> {
+    friend class ElementAttributeData;
+
+public:
+    static PassOwnPtr<AttributeVector> create()
+    {
+        return adoptPtr(new AttributeVector());
+    }
+
+    Attribute* attributeItem(unsigned index) const { return at(index).get(); }
+    Attribute* getAttributeItem(const QualifiedName&) const;
+    size_t getAttributeItemIndex(const QualifiedName&) const;
+
+    // Used during parsing: only inserts if not already there.
+    void insertAttribute(PassRefPtr<Attribute> newAttribute);
+    void removeAttribute(const QualifiedName&);
+
+private:
+    AttributeVector() { }
+};
+
+inline Attribute* AttributeVector::getAttributeItem(const QualifiedName& name) const
+{
+    size_t index = getAttributeItemIndex(name);
+    if (index != notFound)
+        return at(index).get();
+    return 0;
+}
+
+inline size_t AttributeVector::getAttributeItemIndex(const QualifiedName& name) const
+{
+    for (unsigned i = 0; i < size(); ++i) {
+        if (at(i)->name().matches(name))
+            return i;
+    }
+    return notFound;
+}
+
+inline void AttributeVector::insertAttribute(PassRefPtr<Attribute> newAttribute)
+{
+    if (!getAttributeItem(newAttribute->name()))
+        append(newAttribute);
+}
+
 class ElementAttributeData {
 public:
+    static PassOwnPtr<ElementAttributeData> create()
+    {
+        return adoptPtr(new ElementAttributeData);
+    }
+
     ~ElementAttributeData();
 
     void clearClass() { m_classNames.clear(); }
@@ -46,9 +96,11 @@ public:
     const AtomicString& idForStyleResolution() const { return m_idForStyleResolution; }
     void setIdForStyleResolution(const AtomicString& newId) { m_idForStyleResolution = newId; }
 
-    StylePropertySet* inlineStyleDecl() { return m_inlineStyleDecl.get(); }
-    StylePropertySet* ensureInlineStyleDecl(StyledElement*);
-    void destroyInlineStyleDecl(StyledElement* element);
+    StylePropertySet* inlineStyle() { return m_inlineStyleDecl.get(); }
+    StylePropertySet* ensureInlineStyle(StyledElement*);
+    StylePropertySet* ensureMutableInlineStyle(StyledElement*);
+    void updateInlineStyleAvoidingMutation(StyledElement*, const String& text);
+    void destroyInlineStyle(StyledElement*);
 
     StylePropertySet* attributeStyle() const { return m_attributeStyle.get(); }
     void setAttributeStyle(PassRefPtr<StylePropertySet> style) { m_attributeStyle = style; }
@@ -56,22 +108,28 @@ public:
     size_t length() const { return m_attributes.size(); }
     bool isEmpty() const { return m_attributes.isEmpty(); }
 
+    PassRefPtr<Attr> getAttributeNode(const String&, bool shouldIgnoreAttributeCase, Element*) const;
+    PassRefPtr<Attr> getAttributeNode(const QualifiedName&, Element*) const;
+
     // Internal interface.
-    Attribute* attributeItem(unsigned index) const { return m_attributes[index].get(); }
-    Attribute* getAttributeItem(const QualifiedName&) const;
-    size_t getAttributeItemIndex(const QualifiedName&) const;
+    Attribute* attributeItem(unsigned index) const { return m_attributes.attributeItem(index); }
+    Attribute* getAttributeItem(const QualifiedName& name) const { return m_attributes.getAttributeItem(name); }
+    size_t getAttributeItemIndex(const QualifiedName& name) const { return m_attributes.getAttributeItemIndex(name); }
+    size_t getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const;
 
     // These functions do no error checking.
     void addAttribute(PassRefPtr<Attribute>, Element*);
     void removeAttribute(const QualifiedName&, Element*);
     void removeAttribute(size_t index, Element*);
+    PassRefPtr<Attr> takeAttribute(size_t index, Element*);
 
     bool hasID() const { return !m_idForStyleResolution.isNull(); }
     bool hasClass() const { return !m_classNames.isNull(); }
 
+    bool isEquivalent(const ElementAttributeData* other) const;
+
 private:
     friend class Element;
-    friend class NamedNodeMap;
 
     ElementAttributeData()
     {
@@ -80,7 +138,6 @@ private:
     void detachAttributesFromElement();
     void copyAttributesToVector(Vector<RefPtr<Attribute> >&);
     Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const;
-    size_t getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const;
     size_t getAttributeItemIndexSlowCase(const String& name, bool shouldIgnoreAttributeCase) const;
     void setAttributes(const ElementAttributeData& other, Element*);
     void clearAttributes();
@@ -90,7 +147,7 @@ private:
     RefPtr<StylePropertySet> m_attributeStyle;
     SpaceSplitString m_classNames;
     AtomicString m_idForStyleResolution;
-    Vector<RefPtr<Attribute>, 4> m_attributes;
+    AttributeVector m_attributes;
 };
 
 inline void ElementAttributeData::removeAttribute(const QualifiedName& name, Element* element)
@@ -102,17 +159,27 @@ inline void ElementAttributeData::removeAttribute(const QualifiedName& name, Ele
     removeAttribute(index, element);
 }
 
-inline Attribute* ElementAttributeData::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
+inline PassRefPtr<Attr> ElementAttributeData::getAttributeNode(const String& name, bool shouldIgnoreAttributeCase, Element* element) const
 {
-    size_t index = getAttributeItemIndex(name, shouldIgnoreAttributeCase);
-    if (index != notFound)
-        return m_attributes[index].get();
-    return 0;
+    ASSERT(element);
+    Attribute* attribute = getAttributeItem(name, shouldIgnoreAttributeCase);
+    if (!attribute)
+        return 0;
+    return attribute->createAttrIfNeeded(element);
 }
 
-inline Attribute* ElementAttributeData::getAttributeItem(const QualifiedName& name) const
+inline PassRefPtr<Attr> ElementAttributeData::getAttributeNode(const QualifiedName& name, Element* element) const
 {
-    size_t index = getAttributeItemIndex(name);
+    ASSERT(element);
+    Attribute* attribute = getAttributeItem(name);
+    if (!attribute)
+        return 0;
+    return attribute->createAttrIfNeeded(element);
+}
+
+inline Attribute* ElementAttributeData::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
+{
+    size_t index = getAttributeItemIndex(name, shouldIgnoreAttributeCase);
     if (index != notFound)
         return m_attributes[index].get();
     return 0;
@@ -120,16 +187,6 @@ inline Attribute* ElementAttributeData::getAttributeItem(const QualifiedName& na
 
 // We use a boolean parameter instead of calling shouldIgnoreAttributeCase so that the caller
 // can tune the behavior (hasAttribute is case sensitive whereas getAttribute is not).
-inline size_t ElementAttributeData::getAttributeItemIndex(const QualifiedName& name) const
-{
-    size_t len = length();
-    for (unsigned i = 0; i < len; ++i) {
-        if (m_attributes[i]->name().matches(name))
-            return i;
-    }
-    return notFound;
-}
-
 inline size_t ElementAttributeData::getAttributeItemIndex(const String& name, bool shouldIgnoreAttributeCase) const
 {
     unsigned len = length();
diff --git a/Source/WebCore/dom/ElementRareData.h b/Source/WebCore/dom/ElementRareData.h
index ff45783bd..cd2384d88 100644
--- a/Source/WebCore/dom/ElementRareData.h
+++ b/Source/WebCore/dom/ElementRareData.h
@@ -26,8 +26,9 @@
 #include "DatasetDOMStringMap.h"
 #include "Element.h"
 #include "HTMLCollection.h"
+#include "NamedNodeMap.h"
 #include "NodeRareData.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
@@ -64,11 +65,12 @@ public:
 
     LayoutSize m_minimumSizeForResizing;
     RefPtr<RenderStyle> m_computedStyle;
-    ShadowRootList m_shadowRootList;
     AtomicString m_shadowPseudoId;
 
     OwnPtr<DatasetDOMStringMap> m_datasetDOMStringMap;
     OwnPtr<ClassList> m_classList;
+    OwnPtr<ShadowTree> m_shadowTree;
+    OwnPtr<NamedNodeMap> m_attributeMap;
 
     bool m_styleAffectedByEmpty;
 
@@ -94,7 +96,7 @@ inline ElementRareData::ElementRareData()
 
 inline ElementRareData::~ElementRareData()
 {
-    ASSERT(!m_shadowRootList.hasShadowRoot());
+    ASSERT(!m_shadowTree);
 }
 
 inline void ElementRareData::resetComputedStyle()
diff --git a/Source/WebCore/dom/EventDispatcher.cpp b/Source/WebCore/dom/EventDispatcher.cpp
index 3ee5285bc..5866e6068 100644
--- a/Source/WebCore/dom/EventDispatcher.cpp
+++ b/Source/WebCore/dom/EventDispatcher.cpp
@@ -55,36 +55,32 @@ bool EventDispatcher::dispatchEvent(Node* node, PassRefPtr<EventDispatchMediator
     return mediator->dispatchEvent(&dispatcher);
 }
 
-static EventTarget* findElementInstance(Node* referenceNode)
+inline static EventTarget* eventTargetRespectingSVGTargetRules(Node* referenceNode)
 {
+    ASSERT(referenceNode);
+
 #if ENABLE(SVG)
+    if (!referenceNode->isSVGElement() || !referenceNode->isInShadowTree())
+        return referenceNode;
+
     // Spec: The event handling for the non-exposed tree works as if the referenced element had been textually included
     // as a deeply cloned child of the 'use' element, except that events are dispatched to the SVGElementInstance objects
-    for (Node* n = referenceNode; n; n = n->parentNode()) {
-        if (!n->isSVGShadowRoot() || !n->isSVGElement())
-            continue;
-
-        Element* shadowTreeParentElement = n->svgShadowHost();
-        ASSERT(shadowTreeParentElement->hasTagName(SVGNames::useTag));
-
-        if (SVGElementInstance* instance = static_cast<SVGUseElement*>(shadowTreeParentElement)->instanceForShadowTreeElement(referenceNode))
+    Element* shadowHostElement = referenceNode->treeScope()->rootNode()->shadowHost();
+    // At this time, SVG nodes are not allowed in non-<use> shadow trees, so any shadow root we do
+    // have should be a use. The assert and following test is here to catch future shadow DOM changes
+    // that do enable SVG in a shadow tree.
+    ASSERT(!shadowHostElement || shadowHostElement->hasTagName(SVGNames::useTag));
+    if (shadowHostElement && shadowHostElement->hasTagName(SVGNames::useTag)) {
+        SVGUseElement* useElement = static_cast<SVGUseElement*>(shadowHostElement);
+
+        if (SVGElementInstance* instance = useElement->instanceForShadowTreeElement(referenceNode))
             return instance;
     }
-#else
-    // SVG elements with SVG disabled should not be possible.
-    ASSERT_NOT_REACHED();
 #endif
 
     return referenceNode;
 }
 
-inline static EventTarget* eventTargetRespectingSVGTargetRules(Node* referenceNode)
-{
-    ASSERT(referenceNode);
-
-    return referenceNode->isSVGElement() ? findElementInstance(referenceNode) : referenceNode;
-}
-
 void EventDispatcher::dispatchScopedEvent(Node* node, PassRefPtr<EventDispatchMediator> mediator)
 {
     // We need to set the target here because it can go away by the time we actually fire the event.
@@ -120,11 +116,6 @@ void EventDispatcher::dispatchSimulatedClick(Node* node, PassRefPtr<Event> under
     gNodesDispatchingSimulatedClicks->remove(node);
 }
 
-static inline bool isShadowRootOrSVGShadowRoot(const Node* node)
-{
-    return node->isShadowRoot() || node->isSVGShadowRoot();
-}
-
 static inline bool isShadowHost(Node* node)
 {
     return node->isElementNode() && toElement(node)->hasShadowRoot();
@@ -141,7 +132,7 @@ PassRefPtr<EventTarget> EventDispatcher::adjustToShadowBoundaries(PassRefPtr<Nod
     bool diverged = false;
     for (Vector<Node*>::const_iterator i = relatedTargetAncestors.end() - 1; i >= relatedTargetAncestors.begin(); --i) {
         if (diverged) {
-            if (isShadowRootOrSVGShadowRoot(*i)) {
+            if ((*i)->isShadowRoot()) {
                 firstDivergentBoundary = i + 1;
                 break;
             }
@@ -155,7 +146,7 @@ PassRefPtr<EventTarget> EventDispatcher::adjustToShadowBoundaries(PassRefPtr<Nod
 
         targetAncestor--;
 
-        if (isShadowRootOrSVGShadowRoot(*i))
+        if ((*i)->isShadowRoot())
             lowestCommonBoundary = targetAncestor;
 
         if ((*i) != (*targetAncestor).node())
@@ -167,7 +158,7 @@ PassRefPtr<EventTarget> EventDispatcher::adjustToShadowBoundaries(PassRefPtr<Nod
         // FIXME: Remove the first check once conversion to new shadow DOM is complete <http://webkit.org/b/48698>
         if (m_node->shadowHost() == relatedTarget.get() || isShadowHost(relatedTarget.get())) {
             Vector<EventContext>::const_iterator relatedTargetChild = targetAncestor - 1;
-            if (relatedTargetChild >= m_ancestors.begin() && isShadowRootOrSVGShadowRoot(relatedTargetChild->node()))
+            if (relatedTargetChild >= m_ancestors.begin() && relatedTargetChild->node()->isShadowRoot())
                 lowestCommonBoundary = relatedTargetChild;
         }
     } else if ((*firstDivergentBoundary) == m_node.get()) {
@@ -217,7 +208,7 @@ PassRefPtr<EventTarget> EventDispatcher::adjustRelatedTarget(Event* event, PassR
     Vector<Node*> relatedTargetAncestors;
     Node* outermostShadowBoundary = relatedTarget.get();
     for (Node* n = outermostShadowBoundary; n; n = n->parentOrHostNode()) {
-        if (isShadowRootOrSVGShadowRoot(n))
+        if (n->isShadowRoot())
             outermostShadowBoundary = n->parentOrHostNode();
         if (!noCommonBoundary)
             relatedTargetAncestors.append(n);
@@ -251,18 +242,12 @@ void EventDispatcher::ensureEventAncestors(Event* event)
 
     Node* ancestor = m_node.get();
     EventTarget* target = eventTargetRespectingSVGTargetRules(ancestor);
-    bool shouldSkipNextAncestor = false;
     while (true) {
-        bool isSVGShadowRoot = ancestor->isSVGShadowRoot();
-        if (isSVGShadowRoot || ancestor->isShadowRoot()) {
+        if (ancestor->isShadowRoot()) {
             if (determineDispatchBehavior(event, ancestor) == StayInsideShadowDOM)
                 return;
-#if ENABLE(SVG)
-            ancestor = isSVGShadowRoot ? ancestor->svgShadowHost() : ancestor->shadowHost();
-#else
             ancestor = ancestor->shadowHost();
-#endif
-            if (!shouldSkipNextAncestor)
+            if (!m_node->isSVGElement())
                 target = ancestor;
         } else
             ancestor = ancestor->parentNodeGuaranteedHostFree();
@@ -270,13 +255,6 @@ void EventDispatcher::ensureEventAncestors(Event* event)
         if (!ancestor)
             return;
 
-#if ENABLE(SVG)
-        // Skip SVGShadowTreeRootElement.
-        shouldSkipNextAncestor = ancestor->isSVGShadowRoot();
-        if (shouldSkipNextAncestor)
-            continue;
-#endif
-        // FIXME: Unroll the extra loop inside eventTargetRespectingSVGTargetRules into this loop.
         m_ancestors.append(EventContext(ancestor, eventTargetRespectingSVGTargetRules(ancestor), target));
     }
 }
diff --git a/Source/WebCore/dom/EventNames.h b/Source/WebCore/dom/EventNames.h
index a616f7476..860423225 100644
--- a/Source/WebCore/dom/EventNames.h
+++ b/Source/WebCore/dom/EventNames.h
@@ -185,6 +185,18 @@ namespace WebCore {
     \
     macro(webkitspeechchange) \
     \
+    macro(audiostart) \
+    macro(soundstart) \
+    macro(speechstart) \
+    macro(speechend) \
+    macro(soundend) \
+    macro(audioend) \
+    macro(result) \
+    macro(nomatch) \
+    macro(resultdeleted) \
+    macro(start) \
+    macro(end) \
+    \
     macro(webglcontextlost) \
     macro(webglcontextrestored) \
     macro(webglcontextcreationerror) \
diff --git a/Source/WebCore/dom/EventFactory.in b/Source/WebCore/dom/EventNames.in
index 1b500cd79..d86611240 100644
--- a/Source/WebCore/dom/EventFactory.in
+++ b/Source/WebCore/dom/EventNames.in
@@ -31,6 +31,7 @@ AudioProcessingEvent conditional=WEB_AUDIO
 OfflineAudioCompletionEvent conditional=WEB_AUDIO
 MediaStreamEvent conditional=MEDIA_STREAM
 SpeechInputEvent conditional=INPUT_SPEECH
+SpeechRecognitionEvent conditional=SCRIPTED_SPEECH
 WebGLContextEvent conditional=WEBGL
 StorageEvent
 SVGEvents interfaceName=Event, conditional=SVG
diff --git a/Source/WebCore/dom/MouseRelatedEvent.cpp b/Source/WebCore/dom/MouseRelatedEvent.cpp
index c4b144475..caee58fe7 100644
--- a/Source/WebCore/dom/MouseRelatedEvent.cpp
+++ b/Source/WebCore/dom/MouseRelatedEvent.cpp
@@ -214,14 +214,14 @@ int MouseRelatedEvent::offsetX()
 {
     if (!m_hasCachedRelativePosition)
         computeRelativePosition();
-    return m_offsetLocation.x();
+    return roundToInt(m_offsetLocation.x());
 }
 
 int MouseRelatedEvent::offsetY()
 {
     if (!m_hasCachedRelativePosition)
         computeRelativePosition();
-    return m_offsetLocation.y();
+    return roundToInt(m_offsetLocation.y());
 }
 
 int MouseRelatedEvent::pageX() const
diff --git a/Source/WebCore/dom/NamedNodeMap.cpp b/Source/WebCore/dom/NamedNodeMap.cpp
index 47145970e..942c40c9b 100644
--- a/Source/WebCore/dom/NamedNodeMap.cpp
+++ b/Source/WebCore/dom/NamedNodeMap.cpp
@@ -42,58 +42,53 @@ static inline bool shouldIgnoreAttributeCase(const Element* e)
 
 void NamedNodeMap::ref()
 {
-    ASSERT(m_element);
     m_element->ref();
 }
 
 void NamedNodeMap::deref()
 {
-    ASSERT(m_element);
     m_element->deref();
 }
 
 PassRefPtr<Node> NamedNodeMap::getNamedItem(const String& name) const
 {
-    Attribute* a = m_attributeData.getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
-    if (!a)
-        return 0;
-    
-    return a->createAttrIfNeeded(m_element);
+    return m_element->attributeData()->getAttributeNode(name, shouldIgnoreAttributeCase(m_element), m_element);
 }
 
 PassRefPtr<Node> NamedNodeMap::getNamedItemNS(const String& namespaceURI, const String& localName) const
 {
-    return getNamedItem(QualifiedName(nullAtom, localName, namespaceURI));
+    return m_element->attributeData()->getAttributeNode(QualifiedName(nullAtom, localName, namespaceURI), m_element);
 }
 
 PassRefPtr<Node> NamedNodeMap::removeNamedItem(const String& name, ExceptionCode& ec)
 {
-    Attribute* a = m_attributeData.getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
-    if (!a) {
+    ElementAttributeData* attributeData = m_element->attributeData();
+
+    size_t index = attributeData->getAttributeItemIndex(name, shouldIgnoreAttributeCase(m_element));
+    if (index == notFound) {
         ec = NOT_FOUND_ERR;
         return 0;
     }
     
-    return removeNamedItem(a->name(), ec);
+    return attributeData->takeAttribute(index, m_element);
 }
 
 PassRefPtr<Node> NamedNodeMap::removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode& ec)
 {
-    return removeNamedItem(QualifiedName(nullAtom, localName, namespaceURI), ec);
-}
+    ElementAttributeData* attributeData = m_element->attributeData();
 
-PassRefPtr<Node> NamedNodeMap::getNamedItem(const QualifiedName& name) const
-{
-    Attribute* a = getAttributeItem(name);
-    if (!a)
+    size_t index = attributeData->getAttributeItemIndex(QualifiedName(nullAtom, localName, namespaceURI));
+    if (index == notFound) {
+        ec = NOT_FOUND_ERR;
         return 0;
+    }
 
-    return a->createAttrIfNeeded(m_element);
+    return attributeData->takeAttribute(index, m_element);
 }
 
 PassRefPtr<Node> NamedNodeMap::setNamedItem(Node* node, ExceptionCode& ec)
 {
-    if (!m_element || !node) {
+    if (!node) {
         ec = NOT_FOUND_ERR;
         return 0;
     }
@@ -103,29 +98,8 @@ PassRefPtr<Node> NamedNodeMap::setNamedItem(Node* node, ExceptionCode& ec)
         ec = HIERARCHY_REQUEST_ERR;
         return 0;
     }
-    Attr* attr = static_cast<Attr*>(node);
-
-    Attribute* attribute = attr->attr();
-    size_t index = getAttributeItemIndex(attribute->name());
-    Attribute* oldAttribute = index != notFound ? attributeItem(index) : 0;
-    if (oldAttribute == attribute)
-        return node; // we know about it already
-
-    // INUSE_ATTRIBUTE_ERR: Raised if node is an Attr that is already an attribute of another Element object.
-    // The DOM user must explicitly clone Attr nodes to re-use them in other elements.
-    if (attr->ownerElement()) {
-        ec = INUSE_ATTRIBUTE_ERR;
-        return 0;
-    }
-
-    RefPtr<Attr> oldAttr;
-    if (oldAttribute) {
-        oldAttr = oldAttribute->createAttrIfNeeded(m_element);
-        m_attributeData.replaceAttribute(index, attribute, m_element);
-    } else
-        m_attributeData.addAttribute(attribute, m_element);
 
-    return oldAttr.release();
+    return m_element->setAttributeNode(static_cast<Attr*>(node), ec);
 }
 
 PassRefPtr<Node> NamedNodeMap::setNamedItemNS(Node* node, ExceptionCode& ec)
@@ -133,58 +107,16 @@ PassRefPtr<Node> NamedNodeMap::setNamedItemNS(Node* node, ExceptionCode& ec)
     return setNamedItem(node, ec);
 }
 
-PassRefPtr<Node> NamedNodeMap::removeNamedItem(const QualifiedName& name, ExceptionCode& ec)
-{
-    ASSERT(m_element);
-
-    size_t index = getAttributeItemIndex(name);
-    if (index == notFound) {
-        ec = NOT_FOUND_ERR;
-        return 0;
-    }
-
-    RefPtr<Attr> attr = m_attributeData.m_attributes[index]->createAttrIfNeeded(m_element);
-
-    removeAttribute(index);
-
-    return attr.release();
-}
-
 PassRefPtr<Node> NamedNodeMap::item(unsigned index) const
 {
     if (index >= length())
         return 0;
-
-    return m_attributeData.m_attributes[index]->createAttrIfNeeded(m_element);
+    return m_element->attributeItem(index)->createAttrIfNeeded(m_element);
 }
 
-void NamedNodeMap::detachFromElement()
+size_t NamedNodeMap::length() const
 {
-    // This can't happen if the holder of the map is JavaScript, because we mark the
-    // element if the map is alive. So it has no impact on web page behavior. Because
-    // of that, we can simply clear all the attributes to avoid accessing stale
-    // pointers to do things like create Attr objects.
-    m_element = 0;
-    m_attributeData.clearAttributes();
-}
-
-bool NamedNodeMap::mapsEquivalent(const NamedNodeMap* otherMap) const
-{
-    if (!otherMap)
-        return isEmpty();
-    
-    unsigned len = length();
-    if (len != otherMap->length())
-        return false;
-    
-    for (unsigned i = 0; i < len; i++) {
-        Attribute* attr = attributeItem(i);
-        Attribute* otherAttr = otherMap->getAttributeItem(attr->name());
-        if (!otherAttr || attr->value() != otherAttr->value())
-            return false;
-    }
-    
-    return true;
+    return m_element->attributeCount();
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/dom/NamedNodeMap.h b/Source/WebCore/dom/NamedNodeMap.h
index 3201fcd08..d42d52d23 100644
--- a/Source/WebCore/dom/NamedNodeMap.h
+++ b/Source/WebCore/dom/NamedNodeMap.h
@@ -25,19 +25,21 @@
 #ifndef NamedNodeMap_h
 #define NamedNodeMap_h
 
-#include "ElementAttributeData.h"
-#include "SpaceSplitString.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
 class Node;
+class Element;
 
 typedef int ExceptionCode;
 
 class NamedNodeMap {
     friend class Element;
 public:
-    static PassOwnPtr<NamedNodeMap> create(Element* element = 0)
+    static PassOwnPtr<NamedNodeMap> create(Element* element)
     {
         return adoptPtr(new NamedNodeMap(element));
     }
@@ -53,58 +55,22 @@ public:
     PassRefPtr<Node> getNamedItemNS(const String& namespaceURI, const String& localName) const;
     PassRefPtr<Node> removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode&);
 
-    PassRefPtr<Node> getNamedItem(const QualifiedName& name) const;
-    PassRefPtr<Node> removeNamedItem(const QualifiedName& name, ExceptionCode&);
     PassRefPtr<Node> setNamedItem(Node*, ExceptionCode&);
     PassRefPtr<Node> setNamedItemNS(Node*, ExceptionCode&);
 
     PassRefPtr<Node> item(unsigned index) const;
-    size_t length() const { return m_attributeData.length(); }
-    bool isEmpty() const { return m_attributeData.isEmpty(); }
-
-    // Internal interface.
-
-    Attribute* attributeItem(unsigned index) const { return m_attributeData.attributeItem(index); }
-    Attribute* getAttributeItem(const QualifiedName& name) const { return m_attributeData.getAttributeItem(name); }
-    size_t getAttributeItemIndex(const QualifiedName& name) const { return m_attributeData.getAttributeItemIndex(name); }
-
-    void shrinkToLength() { m_attributeData.m_attributes.shrinkCapacity(length()); }
-    void reserveInitialCapacity(unsigned capacity) { m_attributeData.m_attributes.reserveInitialCapacity(capacity); }
-
-    // Used during parsing: only inserts if not already there. No error checking!
-    void insertAttribute(PassRefPtr<Attribute> newAttribute, bool allowDuplicates)
-    {
-        ASSERT(!m_element);
-        if (allowDuplicates || !getAttributeItem(newAttribute->name()))
-            addAttribute(newAttribute);
-    }
-
-    bool mapsEquivalent(const NamedNodeMap* otherMap) const;
-
-    // These functions do no error checking.
-    void addAttribute(PassRefPtr<Attribute> attribute) { m_attributeData.addAttribute(attribute, m_element); }
-    void removeAttribute(const QualifiedName& name) { m_attributeData.removeAttribute(name, m_element); }
-    void removeAttribute(size_t index) { m_attributeData.removeAttribute(index, m_element); }
+    size_t length() const;
 
     Element* element() const { return m_element; }
 
-    ElementAttributeData* attributeData() { return &m_attributeData; }
-    const ElementAttributeData* attributeData() const { return &m_attributeData; }
-
 private:
     NamedNodeMap(Element* element)
         : m_element(element)
     {
+        // Only supports NamedNodeMaps with Element associated, DocumentType.entities and DocumentType.notations are not supported yet.
+        ASSERT(m_element);
     }
 
-    void detachFromElement();
-    Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const { return m_attributeData.getAttributeItem(name, shouldIgnoreAttributeCase); }
-
-    // FIXME: NamedNodeMap is being broken up into two classes, one containing data
-    //        for elements with attributes, and one for exposure to the DOM.
-    //        See <http://webkit.org/b/75069> for more information.
-    ElementAttributeData m_attributeData;
-
     Element* m_element;
 };
 
diff --git a/Source/WebCore/dom/Node.cpp b/Source/WebCore/dom/Node.cpp
index 2e9c61a7e..aa789f517 100644
--- a/Source/WebCore/dom/Node.cpp
+++ b/Source/WebCore/dom/Node.cpp
@@ -86,7 +86,7 @@
 #include "ScopedEventQueue.h"
 #include "SelectorQuery.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "StaticNodeList.h"
 #include "StorageEvent.h"
 #include "TagNodeList.h"
@@ -120,8 +120,6 @@
 #include "HTMLPropertiesCollection.h"
 #endif
 
-#define DUMP_NODE_STATISTICS 0
-
 using namespace std;
 
 namespace WebCore {
@@ -161,13 +159,21 @@ void Node::dumpStatistics()
 
     size_t attributes = 0;
     size_t attributesWithAttr = 0;
-    size_t attrMaps = 0;
+    size_t elementsWithAttributeStorage = 0;
+    size_t elementsWithRareData = 0;
+    size_t elementsWithNamedNodeMap = 0;
 
     for (HashSet<Node*>::iterator it = liveNodeSet.begin(); it != liveNodeSet.end(); ++it) {
         Node* node = *it;
 
-        if (node->hasRareData())
+        if (node->hasRareData()) {
             ++nodesWithRareData;
+            if (node->isElementNode()) {
+                ++elementsWithRareData;
+                if (toElement(node)->hasNamedNodeMap())
+                    ++elementsWithNamedNodeMap;
+            }
+        }
 
         switch (node->nodeType()) {
             case ELEMENT_NODE: {
@@ -179,12 +185,11 @@ void Node::dumpStatistics()
                 if (!result.second)
                     result.first->second++;
 
-                // AttributeMap stats
-                if (NamedNodeMap* attrMap = element->attributes(true)) {
-                    attributes += attrMap->length();
-                    ++attrMaps;
-                    for (unsigned i = 0; i < attrMap->length(); ++i) {
-                        Attribute* attr = attrMap->attributeItem(i);
+                if (ElementAttributeData* attributeData = element->attributeData()) {
+                    attributes += attributeData->length();
+                    ++elementsWithAttributeStorage;
+                    for (unsigned i = 0; i < attributeData->length(); ++i) {
+                        Attribute* attr = attributeData->attributeItem(i);
                         if (attr->attr())
                             ++attributesWithAttr;
                     }
@@ -248,7 +253,7 @@ void Node::dumpStatistics()
     printf("Number of Nodes: %d\n\n", liveNodeSet.size());
     printf("Number of Nodes with RareData: %zu\n\n", nodesWithRareData);
 
-    printf("NodeType distrubution:\n");
+    printf("NodeType distribution:\n");
     printf("  Number of Element nodes: %zu\n", elementNodes);
     printf("  Number of Attribute nodes: %zu\n", attrNodes);
     printf("  Number of Text nodes: %zu\n", textNodes);
@@ -268,10 +273,12 @@ void Node::dumpStatistics()
     for (HashMap<String, size_t>::iterator it = perTagCount.begin(); it != perTagCount.end(); ++it)
         printf("  Number of <%s> tags: %zu\n", it->first.utf8().data(), it->second);
 
-    printf("Attribute Maps:\n");
+    printf("Attributes:\n");
     printf("  Number of Attributes (non-Node and Node): %zu [%zu]\n", attributes, sizeof(Attribute));
     printf("  Number of Attributes with an Attr: %zu\n", attributesWithAttr);
-    printf("  Number of NamedNodeMaps: %zu [%zu]\n", attrMaps, sizeof(NamedNodeMap));
+    printf("  Number of Elements with attribute storage: %zu [%zu]\n", elementsWithAttributeStorage, sizeof(ElementAttributeData));
+    printf("  Number of Elements with RareData: %zu\n", elementsWithRareData);
+    printf("  Number of Elements with NamedNodeMap: %zu [%zu]\n", elementsWithNamedNodeMap, sizeof(NamedNodeMap));
 #endif
 }
 
@@ -798,7 +805,7 @@ bool Node::hasNonEmptyBoundingBox() const
     if (!box->borderBoundingBox().isEmpty())
         return true;
 
-    Vector<LayoutRect> rects;
+    Vector<IntRect> rects;
     FloatPoint absPos = renderer()->localToAbsolute();
     renderer()->absoluteRects(rects, flooredLayoutPoint(absPos));
     size_t n = rects.size();
@@ -811,7 +818,7 @@ bool Node::hasNonEmptyBoundingBox() const
 
 inline static ShadowRoot* oldestShadowRootFor(const Node* node)
 {
-    return node->isElementNode() && toElement(node)->hasShadowRoot() ? toElement(node)->shadowRootList()->oldestShadowRoot() : 0;
+    return node->isElementNode() && toElement(node)->hasShadowRoot() ? toElement(node)->shadowTree()->oldestShadowRoot() : 0;
 }
 
 inline void Node::setStyleChange(StyleChangeType changeType)
@@ -965,6 +972,7 @@ void Node::invalidateNodeListsCacheAfterAttributeChanged(const QualifiedName& at
 #if ENABLE(MICRODATA)
         && attrName != itemscopeAttr
         && attrName != itempropAttr
+        && attrName != itemtypeAttr
 #endif
         && attrName != nameAttr)
         return;
@@ -1031,6 +1039,16 @@ void Node::removeCachedClassNodeList(ClassNodeList* list, const String& classNam
     data->m_classNodeListCache.remove(className);
 }
 
+void Node::removeCachedRegionNodeList(RegionNodeList* list, const AtomicString& flowName)
+{
+    ASSERT(rareData());
+    ASSERT(rareData()->nodeLists());
+
+    NodeListsNodeData* data = rareData()->nodeLists();
+    ASSERT_UNUSED(list, list == data->m_regionNodeListCache.get(flowName));
+    data->m_regionNodeListCache.remove(flowName);
+}
+
 void Node::removeCachedNameNodeList(NameNodeList* list, const String& nodeName)
 {
     ASSERT(rareData());
@@ -1470,12 +1488,6 @@ bool Node::canStartSelection() const
     return parentOrHostNode() ? parentOrHostNode()->canStartSelection() : true;
 }
 
-#if ENABLE(SVG)
-SVGUseElement* Node::svgShadowHost() const
-{
-    return isSVGShadowRoot() ? static_cast<SVGUseElement*>(parent()) : 0;
-}
-#endif
 
 Node* Node::shadowAncestorNode() const
 {
@@ -1498,7 +1510,7 @@ Node* Node::shadowTreeRootNode() const
 {
     Node* root = const_cast<Node*>(this);
     while (root) {
-        if (root->isShadowRoot() || root->isSVGShadowRoot())
+        if (root->isShadowRoot())
             return root;
         root = root->parentNodeGuaranteedHostFree();
     }
@@ -1510,7 +1522,7 @@ Node* Node::nonBoundaryShadowTreeRootNode()
     ASSERT(!isShadowRoot());
     Node* root = this;
     while (root) {
-        if (root->isShadowRoot() || root->isSVGShadowRoot())
+        if (root->isShadowRoot())
             return root;
         Node* parent = root->parentNodeGuaranteedHostFree();
         if (parent && parent->isShadowRoot())
@@ -1526,7 +1538,7 @@ ContainerNode* Node::nonShadowBoundaryParentNode() const
     return parent && !parent->isShadowRoot() ? parent : 0;
 }
 
-bool Node::isInShadowTree()
+bool Node::isInShadowTree() const
 {
     return treeScope() != document();
 }
@@ -1667,6 +1679,18 @@ PassRefPtr<NodeList> Node::getElementsByClassName(const String& classNames)
     return list.release();
 }
 
+PassRefPtr<NodeList> Node::getRegionsByContentNode(const AtomicString& flowName)
+{
+    pair<NodeListsNodeData::RegionNodeListCache::iterator, bool> result
+    = ensureRareData()->ensureNodeLists(this)->m_regionNodeListCache.add(flowName, 0);
+    if (!result.second)
+        return PassRefPtr<NodeList>(result.first->second);
+    
+    RefPtr<RegionNodeList> list = RegionNodeList::create(this, flowName);
+    result.first->second = list.get();
+    return list.release();
+}
+
 PassRefPtr<Element> Node::querySelector(const String& selectors, ExceptionCode& ec)
 {
     if (selectors.isEmpty()) {
@@ -1756,18 +1780,8 @@ bool Node::isEqualNode(Node* other) const
     if (nodeValue() != other->nodeValue())
         return false;
     
-    if (isElementNode()) {
-        NamedNodeMap* attributes = toElement(this)->updatedAttributes();
-        NamedNodeMap* otherAttributes = toElement(other)->updatedAttributes();
-
-        if (attributes) {
-            if (!attributes->mapsEquivalent(otherAttributes))
-                return false;
-        } else if (otherAttributes) {
-            if (!otherAttributes->mapsEquivalent(attributes))
-                return false;
-        }
-    }
+    if (isElementNode() && !toElement(this)->hasEquivalentAttributes(toElement(other)))
+        return false;
     
     Node* child = firstChild();
     Node* otherChild = other->firstChild();
@@ -1796,19 +1810,7 @@ bool Node::isEqualNode(Node* other) const
         if (documentTypeThis->internalSubset() != documentTypeOther->internalSubset())
             return false;
 
-        NamedNodeMap* entities = documentTypeThis->entities();
-        NamedNodeMap* otherEntities = documentTypeOther->entities();
-        if (!entities && otherEntities)
-            return false;
-        if (entities && !entities->mapsEquivalent(otherEntities))
-            return false;
-
-        NamedNodeMap* notations = documentTypeThis->notations();
-        NamedNodeMap* otherNotations = documentTypeOther->notations();
-        if (!notations && otherNotations)
-            return false;
-        if (notations && !notations->mapsEquivalent(otherNotations))
-            return false;
+        // FIXME: We don't compare entities or notations because currently both are always empty.
     }
     
     return true;
@@ -2043,7 +2045,7 @@ void Node::setTextContent(const String& text, ExceptionCode& ec)
         case ENTITY_NODE:
         case ENTITY_REFERENCE_NODE:
         case DOCUMENT_FRAGMENT_NODE: {
-            ContainerNode* container = toContainerNode(this);
+            RefPtr<ContainerNode> container = toContainerNode(this);
 #if ENABLE(MUTATION_OBSERVERS)
             ChildListMutationScope mutation(this);
 #endif
@@ -2107,7 +2109,7 @@ unsigned short Node::compareDocumentPosition(Node* otherNode)
     if (attr1 && attr2 && start1 == start2 && start1) {
         // We are comparing two attributes on the same node. Crawl our attribute map and see which one we hit first.
         Element* owner1 = attr1->ownerElement();
-        owner1->updatedAttributes(); // Force update invalid attributes.
+        owner1->updatedAttributeData(); // Force update invalid attributes.
         unsigned length = owner1->attributeCount();
         for (unsigned i = 0; i < length; ++i) {
             // If neither of the two determining nodes is a child node and nodeType is the same for both determining nodes, then an 
@@ -2204,23 +2206,6 @@ FloatPoint Node::convertFromPage(const FloatPoint& p) const
     return p;
 }
 
-#if ENABLE(MICRODATA)
-void Node::itemTypeAttributeChanged()
-{
-    Node * rootNode = document();
-
-    if (!rootNode->hasRareData())
-        return;
-
-    NodeRareData* data = rootNode->rareData();
-
-    if (!data->nodeLists())
-        return;
-
-    data->nodeLists()->invalidateMicrodataItemListCaches();
-}
-#endif
-
 #ifndef NDEBUG
 
 static void appendAttributeDesc(const Node* node, String& string, const QualifiedName& name, const char* attrDesc)
@@ -2352,6 +2337,9 @@ void NodeListsNodeData::invalidateCaches()
     TagNodeListCacheNS::const_iterator tagCacheNSEnd = m_tagNodeListCacheNS.end();
     for (TagNodeListCacheNS::const_iterator it = m_tagNodeListCacheNS.begin(); it != tagCacheNSEnd; ++it)
         it->second->invalidateCache();
+    RegionNodeListCache::const_iterator regionListCacheEnd = m_regionNodeListCache.end();
+    for (RegionNodeListCache::const_iterator it = m_regionNodeListCache.begin(); it != regionListCacheEnd; ++it)
+        it->second->invalidateCache();
     invalidateCachesThatDependOnAttributes();
 }
 
@@ -2368,18 +2356,11 @@ void NodeListsNodeData::invalidateCachesThatDependOnAttributes()
         m_labelsNodeListCache->invalidateCache();
 
 #if ENABLE(MICRODATA)
-    invalidateMicrodataItemListCaches();
-#endif
-}
-
-#if ENABLE(MICRODATA)
-void NodeListsNodeData::invalidateMicrodataItemListCaches()
-{
     MicroDataItemListCache::iterator itemListCacheEnd = m_microDataItemListCache.end();
     for (MicroDataItemListCache::iterator it = m_microDataItemListCache.begin(); it != itemListCacheEnd; ++it)
         it->second->invalidateCache();
-}
 #endif
+}
 
 bool NodeListsNodeData::isEmpty() const
 {
@@ -2398,10 +2379,12 @@ bool NodeListsNodeData::isEmpty() const
     if (!m_microDataItemListCache.isEmpty())
         return false;
 #endif
+    if (!m_regionNodeListCache.isEmpty())
+        return false;
 
     if (m_labelsNodeListCache)
         return false;
-
+    
     return true;
 }
 
@@ -2435,12 +2418,12 @@ ScriptExecutionContext* Node::scriptExecutionContext() const
 
 void Node::insertedIntoDocument()
 {
-    setInDocument();
+    setFlag(InDocumentFlag);
 }
 
 void Node::removedFromDocument()
 {
-    clearInDocument();
+    clearFlag(InDocumentFlag);
 }
 
 void Node::didMoveToNewDocument(Document* oldDocument)
@@ -2793,9 +2776,10 @@ bool Node::dispatchEvent(PassRefPtr<Event> event)
 
 void Node::dispatchSubtreeModifiedEvent()
 {
+    if (isInShadowTree())
+        return;
+
     ASSERT(!eventDispatchForbidden());
-    
-    document()->incDOMTreeVersion();
 
     if (!document()->hasListenerType(Document::DOMSUBTREEMODIFIED_LISTENER))
         return;
diff --git a/Source/WebCore/dom/Node.h b/Source/WebCore/dom/Node.h
index 9ca126498..b2d403e14 100644
--- a/Source/WebCore/dom/Node.h
+++ b/Source/WebCore/dom/Node.h
@@ -44,6 +44,9 @@ namespace JSC {
 }
 #endif
 
+// This needs to be here because Document.h also depends on it.
+#define DUMP_NODE_STATISTICS 0
+
 namespace WebCore {
 
 class Attribute;
@@ -72,15 +75,13 @@ class PlatformKeyboardEvent;
 class PlatformMouseEvent;
 class PlatformWheelEvent;
 class QualifiedName;
+class RegionNodeList;
 class RegisteredEventListener;
 class RenderArena;
 class RenderBox;
 class RenderBoxModelObject;
 class RenderObject;
 class RenderStyle;
-#if ENABLE(SVG)
-class SVGUseElement;
-#endif
 class TagNodeList;
 class TreeScope;
 
@@ -90,7 +91,7 @@ class HTMLPropertiesCollection;
 
 typedef int ExceptionCode;
 
-const int nodeStyleChangeShift = 23;
+const int nodeStyleChangeShift = 22;
 
 // SyntheticStyleChange means that we need to go through the entire style change logic even though
 // no style property has actually changed. It is used to restructure the tree when, for instance,
@@ -204,14 +205,8 @@ public:
     bool isElementNode() const { return getFlag(IsElementFlag); }
     bool isContainerNode() const { return getFlag(IsContainerFlag); }
     bool isTextNode() const { return getFlag(IsTextFlag); }
-
     bool isHTMLElement() const { return getFlag(IsHTMLFlag); }
-
     bool isSVGElement() const { return getFlag(IsSVGFlag); }
-    bool isSVGShadowRoot() const { return getFlag(IsShadowRootOrSVGShadowRootFlag) && isSVGElement(); }
-#if ENABLE(SVG)
-    SVGUseElement* svgShadowHost() const;
-#endif
 
     virtual bool isMediaControlElement() const { return false; }
     virtual bool isMediaControls() const { return false; }
@@ -221,22 +216,18 @@ public:
     bool isCommentNode() const { return getFlag(IsCommentFlag); }
     virtual bool isCharacterDataNode() const { return false; }
     bool isDocumentNode() const;
-    bool isShadowRoot() const { return getFlag(IsShadowRootOrSVGShadowRootFlag) && !isSVGElement(); }
-    virtual bool isContentElement() const { return false; }
-#if ENABLE(SHADOW_DOM)
-    virtual bool isShadowElement() const { return false; }
-#endif
+    bool isShadowRoot() const { return getFlag(IsShadowRootFlag); }
 
     Node* shadowAncestorNode() const;
     // Returns 0, a ShadowRoot, or a legacy shadow root.
     Node* shadowTreeRootNode() const;
     // Returns 0, a child of ShadowRoot, or a legacy shadow root.
     Node* nonBoundaryShadowTreeRootNode();
-    bool isInShadowTree();
-    // Node's parent, shadow tree host, or SVG use.
+    bool isInShadowTree() const;
+    // Node's parent, shadow tree host.
     ContainerNode* parentOrHostNode() const;
     Element* parentOrHostElement() const;
-    // Use when it's guaranteed to that shadowHost is 0 and svgShadowHost is 0.
+    // Use when it's guaranteed to that shadowHost is 0.
     ContainerNode* parentNodeGuaranteedHostFree() const;
     // Returns the parent node, but 0 if the parent node is a ShadowRoot.
     ContainerNode* nonShadowBoundaryParentNode() const;
@@ -297,6 +288,7 @@ public:
 
     // For <link> and <style> elements.
     virtual bool sheetLoaded() { return true; }
+    virtual void notifyLoadedSheetAndAllCriticalSubresources(bool /* error loading subresource */) { }
     virtual void startLoadingDynamicSheet() { ASSERT_NOT_REACHED(); }
 
     bool attributeStyleDirty() const { return getFlag(AttributeStyleDirtyFlag); }
@@ -322,8 +314,6 @@ public:
     void setHasName(bool f) { setFlag(f, HasNameFlag); }
     void setChildNeedsStyleRecalc() { setFlag(ChildNeedsStyleRecalcFlag); }
     void clearChildNeedsStyleRecalc() { clearFlag(ChildNeedsStyleRecalcFlag); }
-    void setInDocument() { setFlag(InDocumentFlag); }
-    void clearInDocument() { clearFlag(InDocumentFlag); }
 
     void setInActiveChain() { setFlag(InActiveChainFlag); }
     void clearInActiveChain() { clearFlag(InActiveChainFlag); }
@@ -508,7 +498,7 @@ public:
     RenderStyle* computedStyle(PseudoId pseudoElementSpecifier = NOPSEUDO) { return virtualComputedStyle(pseudoElementSpecifier); }
 
     // -----------------------------------------------------------------------------
-    // Notification of document structure changes
+    // Notification of document structure changes (see ContainerNode.h for more notification methods)
 
     // Notifies the node that it has been inserted into the document. This is called during document parsing, and also
     // when a node is added through the DOM methods insertBefore(), appendChild() or replaceChild(). Note that this only
@@ -526,16 +516,6 @@ public:
     // dispatching, and is called _after_ the node is removed from the tree.
     virtual void removedFromDocument();
 
-    // These functions are called whenever you are connected or disconnected from a tree.  That tree may be the main
-    // document tree, or it could be another disconnected tree.  Override these functions to do any work that depends
-    // on connectedness to some ancestor (e.g., an ancestor <form> for example).
-    virtual void insertedIntoTree(bool /*deep*/) { }
-    virtual void removedFromTree(bool /*deep*/) { }
-
-    // Notifies the node that it's list of children have changed (either by adding or removing child nodes), or a child
-    // node that is of the type CDATA_SECTION_NODE, TEXT_NODE or COMMENT_NODE has changed its value.
-    virtual void childrenChanged(bool /*changedByParser*/ = false, Node* /*beforeChange*/ = 0, Node* /*afterChange*/ = 0, int /*childCountDelta*/ = 0) { }
-
 #ifndef NDEBUG
     virtual void formatForDebugger(char* buffer, unsigned length) const;
 
@@ -549,6 +529,7 @@ public:
     void unregisterDynamicSubtreeNodeList(DynamicSubtreeNodeList*);
     void invalidateNodeListsCacheAfterAttributeChanged(const QualifiedName&);
     void invalidateNodeListsCacheAfterChildrenChanged();
+    void invalidateRegionListCache();
     void notifyLocalNodeListsLabelChanged();
     void removeCachedClassNodeList(ClassNodeList*, const String&);
 
@@ -556,6 +537,7 @@ public:
     void removeCachedTagNodeList(TagNodeList*, const AtomicString&);
     void removeCachedTagNodeList(TagNodeList*, const QualifiedName&);
     void removeCachedLabelsNodeList(DynamicSubtreeNodeList*);
+    void removeCachedRegionNodeList(RegionNodeList*, const AtomicString&);
 
     void removeCachedChildNodeList();
 
@@ -563,6 +545,7 @@ public:
     PassRefPtr<NodeList> getElementsByTagNameNS(const AtomicString& namespaceURI, const AtomicString& localName);
     PassRefPtr<NodeList> getElementsByName(const String& elementName);
     PassRefPtr<NodeList> getElementsByClassName(const String& classNames);
+    PassRefPtr<NodeList> getRegionsByContentNode(const AtomicString& flowName);
 
     PassRefPtr<Element> querySelector(const String& selectors, ExceptionCode&);
     PassRefPtr<NodeList> querySelectorAll(const String& selectors, ExceptionCode&);
@@ -620,8 +603,6 @@ public:
     virtual EventTargetData* ensureEventTargetData();
 
 #if ENABLE(MICRODATA)
-    void itemTypeAttributeChanged();
-
     DOMSettableTokenList* itemProp();
     DOMSettableTokenList* itemRef();
     DOMSettableTokenList* itemType();
@@ -662,28 +643,27 @@ private:
         InActiveChainFlag = 1 << 13,
         InDetachFlag = 1 << 14,
         HasRareDataFlag = 1 << 15,
-        IsShadowRootOrSVGShadowRootFlag = 1 << 16,
+        IsShadowRootFlag = 1 << 16,
 
         // These bits are used by derived classes, pulled up here so they can
         // be stored in the same memory word as the Node bits above.
         IsParsingChildrenFinishedFlag = 1 << 17, // Element
         IsStyleAttributeValidFlag = 1 << 18, // StyledElement
-        IsSynchronizingStyleAttributeFlag = 1 << 19, // StyledElement
 #if ENABLE(SVG)
-        AreSVGAttributesValidFlag = 1 << 20, // Element
-        IsSynchronizingSVGAttributesFlag = 1 << 21, // SVGElement
-        HasSVGRareDataFlag = 1 << 22, // SVGElement
+        AreSVGAttributesValidFlag = 1 << 19, // Element
+        IsSynchronizingSVGAttributesFlag = 1 << 20, // SVGElement
+        HasSVGRareDataFlag = 1 << 21, // SVGElement
 #endif
 
         StyleChangeMask = 1 << nodeStyleChangeShift | 1 << (nodeStyleChangeShift + 1),
 
-        SelfOrAncestorHasDirAutoFlag = 1 << 25,
-        HasCustomWillOrDidRecalcStyleFlag = 1 << 26,
-        HasCustomStyleForRendererFlag = 1 << 27,
+        SelfOrAncestorHasDirAutoFlag = 1 << 24,
+        HasCustomWillOrDidRecalcStyleFlag = 1 << 25,
+        HasCustomStyleForRendererFlag = 1 << 26,
 
-        HasNameFlag = 1 << 28,
+        HasNameFlag = 1 << 27,
 
-        AttributeStyleDirtyFlag = 1 << 31,
+        AttributeStyleDirtyFlag = 1 << 28,
 
 #if ENABLE(SVG)
         DefaultNodeFlags = IsParsingChildrenFinishedFlag | IsStyleAttributeValidFlag | AreSVGAttributesValidFlag
@@ -706,11 +686,11 @@ protected:
         CreateComment = DefaultNodeFlags | IsCommentFlag,
         CreateContainer = DefaultNodeFlags | IsContainerFlag, 
         CreateElement = CreateContainer | IsElementFlag, 
-        CreateShadowRoot = CreateContainer | IsShadowRootOrSVGShadowRootFlag,
+        CreateShadowRoot = CreateContainer | IsShadowRootFlag,
         CreateStyledElement = CreateElement | IsStyledElementFlag, 
         CreateHTMLElement = CreateStyledElement | IsHTMLFlag, 
         CreateSVGElement = CreateStyledElement | IsSVGFlag,
-        CreateSVGShadowRoot = CreateSVGElement | IsShadowRootOrSVGShadowRootFlag,
+        CreateDocument = CreateContainer | InDocumentFlag
     };
     Node(Document*, ConstructionType);
 
@@ -790,10 +770,6 @@ protected:
     void setIsStyleAttributeValid(bool f) { setFlag(f, IsStyleAttributeValidFlag); }
     void setIsStyleAttributeValid() const { setFlag(IsStyleAttributeValidFlag); }
     void clearIsStyleAttributeValid() { clearFlag(IsStyleAttributeValidFlag); }
-    bool isSynchronizingStyleAttribute() const { return getFlag(IsSynchronizingStyleAttributeFlag); }
-    void setIsSynchronizingStyleAttribute(bool f) { setFlag(f, IsSynchronizingStyleAttributeFlag); }
-    void setIsSynchronizingStyleAttribute() const { setFlag(IsSynchronizingStyleAttributeFlag); }
-    void clearIsSynchronizingStyleAttribute() const { clearFlag(IsSynchronizingStyleAttributeFlag); }
 
 #if ENABLE(SVG)
     bool areSVGAttributesValid() const { return getFlag(AreSVGAttributesValidFlag); }
@@ -823,7 +799,7 @@ inline void addSubresourceURL(ListHashSet<KURL>& urls, const KURL& url)
 
 inline ContainerNode* Node::parentNode() const
 {
-    return getFlag(IsShadowRootOrSVGShadowRootFlag) ? 0 : parent();
+    return getFlag(IsShadowRootFlag) ? 0 : parent();
 }
 
 inline ContainerNode* Node::parentOrHostNode() const
@@ -833,7 +809,7 @@ inline ContainerNode* Node::parentOrHostNode() const
 
 inline ContainerNode* Node::parentNodeGuaranteedHostFree() const
 {
-    ASSERT(!getFlag(IsShadowRootOrSVGShadowRootFlag));
+    ASSERT(!getFlag(IsShadowRootFlag));
     return parentOrHostNode();
 }
 
diff --git a/Source/WebCore/dom/NodeRareData.h b/Source/WebCore/dom/NodeRareData.h
index 0864b2626..97a0fbabd 100644
--- a/Source/WebCore/dom/NodeRareData.h
+++ b/Source/WebCore/dom/NodeRareData.h
@@ -29,6 +29,7 @@
 #include "MutationObserverRegistration.h"
 #include "NameNodeList.h"
 #include "QualifiedName.h"
+#include "RegionNodeList.h"
 #include "TagNodeList.h"
 #include "WebKitMutationObserver.h"
 #include <wtf/HashSet.h>
@@ -71,6 +72,9 @@ public:
 #endif
 
     LabelsNodeList* m_labelsNodeListCache;
+
+    typedef HashMap<AtomicString, RegionNodeList*> RegionNodeListCache;
+    RegionNodeListCache m_regionNodeListCache;
  
     static PassOwnPtr<NodeListsNodeData> create()
     {
@@ -80,10 +84,6 @@ public:
     void invalidateCaches();
     void invalidateCachesThatDependOnAttributes();
 
-#if ENABLE(MICRODATA)
-    void invalidateMicrodataItemListCaches();
-#endif
-
     bool isEmpty() const;
 
 private:
diff --git a/Source/WebCore/dom/NodeRenderingContext.cpp b/Source/WebCore/dom/NodeRenderingContext.cpp
index cdcb102d8..93f316668 100644
--- a/Source/WebCore/dom/NodeRenderingContext.cpp
+++ b/Source/WebCore/dom/NodeRenderingContext.cpp
@@ -29,13 +29,15 @@
 #include "ContainerNode.h"
 #include "HTMLContentElement.h"
 #include "HTMLContentSelector.h"
+#include "HTMLNames.h"
+#include "HTMLShadowElement.h"
 #include "Node.h"
 #include "RenderFlowThread.h"
 #include "RenderFullScreen.h"
 #include "RenderObject.h"
 #include "RenderView.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 
 #if ENABLE(SVG)
 #include "SVGNames.h"
@@ -43,11 +45,16 @@
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
+static RenderObject* firstRendererOf(Node*);
+static RenderObject* lastRendererOf(Node*);
+
 NodeRenderingContext::NodeRenderingContext(Node* node)
     : m_phase(AttachingNotInTree)
     , m_node(node)
     , m_parentNodeForRenderingAndStyle(0)
-    , m_visualParentShadowRootList(0)
+    , m_visualParentShadowTree(0)
     , m_insertionPoint(0)
     , m_style(0)
     , m_parentFlowRenderer(0)
@@ -56,20 +63,25 @@ NodeRenderingContext::NodeRenderingContext(Node* node)
     if (!parent)
         return;
 
-    if (parent->isShadowRoot()) {
+    if (parent->isShadowRoot() && toShadowRoot(parent)->isYoungest()) {
         m_phase = AttachingShadowChild;
         m_parentNodeForRenderingAndStyle = parent->shadowHost();
         return;
     }
 
-    if (parent->isElementNode()) {
-        if (toElement(parent)->hasShadowRoot()) {
-            m_visualParentShadowRootList = toElement(parent)->shadowRootList();
-            if ((m_insertionPoint = m_visualParentShadowRootList->insertionPointFor(m_node))
-                && m_visualParentShadowRootList->isSelectorActive()) {
-                m_phase = AttachingDistributed;
-                m_parentNodeForRenderingAndStyle = NodeRenderingContext(m_insertionPoint).parentNodeForRenderingAndStyle();
-                return;
+    if (parent->isElementNode() || parent->isShadowRoot()) {
+        if (parent->isElementNode() && toElement(parent)->hasShadowRoot())
+            m_visualParentShadowTree = toElement(parent)->shadowTree();
+        else if (parent->isShadowRoot())
+            m_visualParentShadowTree = toShadowRoot(parent)->tree();
+
+        if (m_visualParentShadowTree) {
+            if ((m_insertionPoint = m_visualParentShadowTree->insertionPointFor(m_node))) {
+                if (toShadowRoot(m_insertionPoint->shadowTreeRootNode())->isUsedForRendering()) {
+                    m_phase = AttachingDistributed;
+                    m_parentNodeForRenderingAndStyle = NodeRenderingContext(m_insertionPoint).parentNodeForRenderingAndStyle();
+                    return;
+                }
             }
 
             m_phase = AttachingNotDistributed;
@@ -77,7 +89,13 @@ NodeRenderingContext::NodeRenderingContext(Node* node)
             return;
         }
 
-        if (isInsertionPoint(parent)) {
+        if (isShadowBoundary(parent)) {
+            if (!toShadowRoot(parent->shadowTreeRootNode())->isUsedForRendering()) {
+                m_phase = AttachingNotDistributed;
+                m_parentNodeForRenderingAndStyle = parent;
+                return;
+            }
+
             if (toInsertionPoint(parent)->hasSelection())
                 m_phase = AttachingNotFallbacked;
             else
@@ -95,7 +113,7 @@ NodeRenderingContext::NodeRenderingContext(Node* node, RenderStyle* style)
     : m_phase(Calculating)
     , m_node(node)
     , m_parentNodeForRenderingAndStyle(0)
-    , m_visualParentShadowRootList(0)
+    , m_visualParentShadowTree(0)
     , m_insertionPoint(0)
     , m_style(style)
     , m_parentFlowRenderer(0)
@@ -117,7 +135,7 @@ PassRefPtr<RenderStyle> NodeRenderingContext::releaseStyle()
     return m_style.release();
 }
 
-static RenderObject* nextRendererOf(InsertionPoint* parent, Node* current)
+static inline RenderObject* nextRendererOfInsertionPoint(InsertionPoint* parent, Node* current)
 {
     HTMLContentSelection* currentSelection = parent->selections()->find(current);
     if (!currentSelection)
@@ -131,7 +149,7 @@ static RenderObject* nextRendererOf(InsertionPoint* parent, Node* current)
     return 0;
 }
 
-static RenderObject* previousRendererOf(InsertionPoint* parent, Node* current)
+static inline RenderObject* previousRendererOfInsertionPoint(InsertionPoint* parent, Node* current)
 {
     RenderObject* lastRenderer = 0;
 
@@ -145,7 +163,7 @@ static RenderObject* previousRendererOf(InsertionPoint* parent, Node* current)
     return lastRenderer;
 }
 
-static RenderObject* firstRendererOf(InsertionPoint* parent)
+static inline RenderObject* firstRendererOfInsertionPoint(InsertionPoint* parent)
 {
     if (parent->hasSelection()) {
         for (HTMLContentSelection* selection = parent->selections()->first(); selection; selection = selection->next()) {
@@ -156,10 +174,10 @@ static RenderObject* firstRendererOf(InsertionPoint* parent)
         return 0;
     }
 
-    return NodeRenderingContext(parent).nextRenderer();
+    return firstRendererOf(parent->firstChild());
 }
 
-static RenderObject* lastRendererOf(InsertionPoint* parent)
+static inline RenderObject* lastRendererOfInsertionPoint(InsertionPoint* parent)
 {
     if (parent->hasSelection()) {
         for (HTMLContentSelection* selection = parent->selections()->last(); selection; selection = selection->previous()) {
@@ -170,7 +188,44 @@ static RenderObject* lastRendererOf(InsertionPoint* parent)
         return 0;
     }
 
-    return NodeRenderingContext(parent).previousRenderer();
+    return lastRendererOf(parent->lastChild());
+}
+
+static inline RenderObject* firstRendererOf(Node* node)
+{
+    for (; node; node = node->nextSibling()) {
+        if (node->renderer()) {
+            // Do not return elements that are attached to a different flow-thread.
+            if (node->renderer()->style() && !node->renderer()->style()->flowThread().isEmpty())
+                continue;
+            return node->renderer();
+        }
+
+        if (isInsertionPoint(node)) {
+            if (RenderObject* first = firstRendererOfInsertionPoint(toInsertionPoint(node)))
+                return first;
+        }
+    }
+
+    return 0;
+}
+
+static inline RenderObject* lastRendererOf(Node* node)
+{
+    for (; node; node = node->previousSibling()) {
+        if (node->renderer()) {
+            // Do not return elements that are attached to a different flow-thread.
+            if (node->renderer()->style() && !node->renderer()->style()->flowThread().isEmpty())
+                continue;
+            return node->renderer();
+        }
+        if (isInsertionPoint(node)) {
+            if (RenderObject* last = lastRendererOfInsertionPoint(toInsertionPoint(node)))
+                return last;
+        }
+    }
+
+    return 0;
 }
 
 RenderObject* NodeRenderingContext::nextRenderer() const
@@ -183,7 +238,7 @@ RenderObject* NodeRenderingContext::nextRenderer() const
         return m_parentFlowRenderer->nextRendererForNode(m_node);
 
     if (m_phase == AttachingDistributed) {
-        if (RenderObject* found = nextRendererOf(m_insertionPoint, m_node))
+        if (RenderObject* found = nextRendererOfInsertionPoint(m_insertionPoint, m_node))
             return found;
         return NodeRenderingContext(m_insertionPoint).nextRenderer();
     }
@@ -193,21 +248,7 @@ RenderObject* NodeRenderingContext::nextRenderer() const
     if (m_node->parentOrHostNode() && !m_node->parentOrHostNode()->attached())
         return 0;
 
-    for (Node* node = m_node->nextSibling(); node; node = node->nextSibling()) {
-        if (node->renderer()) {
-            // Do not return elements that are attached to a different flow-thread.
-            if (node->renderer()->style() && !node->renderer()->style()->flowThread().isEmpty())
-                continue;
-            return node->renderer();
-        }
-
-        if (isInsertionPoint(node)) {
-            if (RenderObject* first = firstRendererOf(toInsertionPoint(node)))
-                return first;
-        }
-    }
-
-    return 0;
+    return firstRendererOf(m_node->nextSibling());
 }
 
 RenderObject* NodeRenderingContext::previousRenderer() const
@@ -221,27 +262,14 @@ RenderObject* NodeRenderingContext::previousRenderer() const
         return m_parentFlowRenderer->previousRendererForNode(m_node);
 
     if (m_phase == AttachingDistributed) {
-        if (RenderObject* found = previousRendererOf(m_insertionPoint, m_node))
+        if (RenderObject* found = previousRendererOfInsertionPoint(m_insertionPoint, m_node))
             return found;
         return NodeRenderingContext(m_insertionPoint).previousRenderer();
     }
 
     // FIXME: We should have the same O(N^2) avoidance as nextRenderer does
     // however, when I tried adding it, several tests failed.
-    for (Node* node = m_node->previousSibling(); node; node = node->previousSibling()) {
-        if (node->renderer()) {
-            // Do not return elements that are attached to a different flow-thread.
-            if (node->renderer()->style() && !node->renderer()->style()->flowThread().isEmpty())
-                continue;
-            return node->renderer();
-        }
-        if (isInsertionPoint(node)) {
-            if (RenderObject* last = lastRendererOf(toInsertionPoint(node)))
-                return last;
-        }
-    }
-
-    return 0;
+    return lastRendererOf(m_node->previousSibling());
 }
 
 RenderObject* NodeRenderingContext::parentRenderer() const
@@ -260,8 +288,8 @@ RenderObject* NodeRenderingContext::parentRenderer() const
 
 void NodeRenderingContext::hostChildrenChanged()
 {
-    if (m_phase == AttachingNotDistributed)
-        m_visualParentShadowRootList->hostChildrenChanged();
+    if (m_phase == AttachingNotDistributed && m_visualParentShadowTree)
+        m_visualParentShadowTree->hostChildrenChanged();
 }
 
 bool NodeRenderingContext::shouldCreateRenderer() const
diff --git a/Source/WebCore/dom/NodeRenderingContext.h b/Source/WebCore/dom/NodeRenderingContext.h
index ca20d525c..ce2c2e1f1 100644
--- a/Source/WebCore/dom/NodeRenderingContext.h
+++ b/Source/WebCore/dom/NodeRenderingContext.h
@@ -39,7 +39,7 @@ class Node;
 class RenderFlowThread;
 class RenderObject;
 class RenderStyle;
-class ShadowRootList;
+class ShadowTree;
 
 class NodeRenderingContext {
 public:
@@ -82,7 +82,7 @@ private:
     AttachingPhase m_phase;
     Node* m_node;
     ContainerNode* m_parentNodeForRenderingAndStyle;
-    ShadowRootList* m_visualParentShadowRootList;
+    ShadowTree* m_visualParentShadowTree;
     InsertionPoint* m_insertionPoint;
     RefPtr<RenderStyle> m_style;
     RenderFlowThread* m_parentFlowRenderer;
diff --git a/Source/WebCore/dom/Position.cpp b/Source/WebCore/dom/Position.cpp
index 74b16ab60..31ab445a0 100644
--- a/Source/WebCore/dom/Position.cpp
+++ b/Source/WebCore/dom/Position.cpp
@@ -1152,7 +1152,8 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
             }
 
             if (((caretOffset == caretMaxOffset) ^ (affinity == DOWNSTREAM))
-                || ((caretOffset == caretMinOffset) ^ (affinity == UPSTREAM)))
+                || ((caretOffset == caretMinOffset) ^ (affinity == UPSTREAM))
+                || (caretOffset == caretMaxOffset && box->nextLeafChild() && box->nextLeafChild()->isLineBreak()))
                 break;
 
             candidate = box;
@@ -1217,10 +1218,10 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
     }
 
     if (caretOffset == inlineBox->caretLeftmostOffset()) {
-        InlineBox* prevBox = inlineBox->prevLeafChild();
+        InlineBox* prevBox = inlineBox->prevLeafChildIgnoringLineBreak();
         if (!prevBox || prevBox->bidiLevel() < level) {
             // Left edge of a secondary run. Set to the right edge of the entire run.
-            while (InlineBox* nextBox = inlineBox->nextLeafChild()) {
+            while (InlineBox* nextBox = inlineBox->nextLeafChildIgnoringLineBreak()) {
                 if (nextBox->bidiLevel() < level)
                     break;
                 inlineBox = nextBox;
@@ -1228,7 +1229,7 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
             caretOffset = inlineBox->caretRightmostOffset();
         } else if (prevBox->bidiLevel() > level) {
             // Right edge of a "tertiary" run. Set to the left edge of that run.
-            while (InlineBox* tertiaryBox = inlineBox->prevLeafChild()) {
+            while (InlineBox* tertiaryBox = inlineBox->prevLeafChildIgnoringLineBreak()) {
                 if (tertiaryBox->bidiLevel() <= level)
                     break;
                 inlineBox = tertiaryBox;
@@ -1236,10 +1237,10 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
             caretOffset = inlineBox->caretLeftmostOffset();
         }
     } else {
-        InlineBox* nextBox = inlineBox->nextLeafChild();
+        InlineBox* nextBox = inlineBox->nextLeafChildIgnoringLineBreak();
         if (!nextBox || nextBox->bidiLevel() < level) {
             // Right edge of a secondary run. Set to the left edge of the entire run.
-            while (InlineBox* prevBox = inlineBox->prevLeafChild()) {
+            while (InlineBox* prevBox = inlineBox->prevLeafChildIgnoringLineBreak()) {
                 if (prevBox->bidiLevel() < level)
                     break;
                 inlineBox = prevBox;
@@ -1247,7 +1248,7 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
             caretOffset = inlineBox->caretLeftmostOffset();
         } else if (nextBox->bidiLevel() > level) {
             // Left edge of a "tertiary" run. Set to the right edge of that run.
-            while (InlineBox* tertiaryBox = inlineBox->nextLeafChild()) {
+            while (InlineBox* tertiaryBox = inlineBox->nextLeafChildIgnoringLineBreak()) {
                 if (tertiaryBox->bidiLevel() <= level)
                     break;
                 inlineBox = tertiaryBox;
diff --git a/Source/WebCore/dom/Range.cpp b/Source/WebCore/dom/Range.cpp
index 0c00cfda9..88b337b32 100644
--- a/Source/WebCore/dom/Range.cpp
+++ b/Source/WebCore/dom/Range.cpp
@@ -1275,8 +1275,6 @@ void Range::checkNodeBA(Node* n, ExceptionCode& ec) const
         case Node::PROCESSING_INSTRUCTION_NODE:
         case Node::TEXT_NODE:
         case Node::XPATH_NAMESPACE_NODE:
-            if (root->isSVGShadowRoot())
-                break;
             ec = RangeException::INVALID_NODE_TYPE_ERR;
             return;
     }
@@ -1672,7 +1670,7 @@ IntRect Range::boundingBox()
     const size_t n = rects.size();
     for (size_t i = 0; i < n; ++i)
         result.unite(rects[i]);
-    return pixelSnappedIntRect(result);
+    return result;
 }
 
 void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight, RangeInFixedPosition* inFixed)
diff --git a/Source/WebCore/dom/RegionNodeList.cpp b/Source/WebCore/dom/RegionNodeList.cpp
new file mode 100644
index 000000000..2116d3bcc
--- /dev/null
+++ b/Source/WebCore/dom/RegionNodeList.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RegionNodeList.h"
+
+#include "Document.h"
+#include "RenderFlowThread.h"
+#include "RenderRegion.h"
+#include "WebKitNamedFlow.h"
+
+namespace WebCore {
+
+RegionNodeList::RegionNodeList(PassRefPtr<Node> node, const AtomicString& flowName)
+: DynamicSubtreeNodeList(node->document())
+, m_contentNode(node)
+, m_flowName(flowName)
+{
+}
+
+RegionNodeList::~RegionNodeList()
+{
+    m_contentNode->removeCachedRegionNodeList(this, m_flowName);
+} 
+
+bool RegionNodeList::nodeMatches(Element* testNode) const
+{
+    if (!m_contentNode->renderer())
+        return false;
+
+    if (!testNode->renderer() || !testNode->renderer()->isRenderRegion())
+        return false;
+
+    RenderRegion* region = toRenderRegion(testNode->renderer());
+    if (!region->isValid() || (region->style()->regionThread() != m_flowName))
+        return false;
+
+    return region->flowThread()->objectInFlowRegion(m_contentNode->renderer(), region);
+}
+
+} // namespace WebCore
+
diff --git a/Source/WebCore/dom/RegionNodeList.h b/Source/WebCore/dom/RegionNodeList.h
new file mode 100644
index 000000000..813957d2d
--- /dev/null
+++ b/Source/WebCore/dom/RegionNodeList.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer.
+ * 2. Redistributions in binary form must reproduce the above
+ *    copyright notice, this list of conditions and the following
+ *    disclaimer in the documentation and/or other materials
+ *    provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR
+ * TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF
+ * THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef RegionNodeList_h
+#define RegionNodeList_h
+
+#include "DynamicNodeList.h"
+#include "Node.h"
+
+namespace WebCore {
+
+class RegionNodeList : public DynamicSubtreeNodeList {
+public:
+    static PassRefPtr<RegionNodeList> create(PassRefPtr<Node> node, const AtomicString& flowName)
+    {
+        return adoptRef(new RegionNodeList(node, flowName));
+    }
+    
+    virtual ~RegionNodeList();
+
+protected:
+    virtual bool nodeMatches(Element*) const;
+
+private:
+    RegionNodeList(PassRefPtr<Node>, const AtomicString& flowName);
+    
+    RefPtr<Node> m_contentNode;
+    AtomicString m_flowName;
+};
+    
+} // namespace WebCore
+
+#endif
+
diff --git a/Source/WebCore/dom/ScriptElement.cpp b/Source/WebCore/dom/ScriptElement.cpp
index 895e8337d..6e8e83bb4 100644
--- a/Source/WebCore/dom/ScriptElement.cpp
+++ b/Source/WebCore/dom/ScriptElement.cpp
@@ -199,15 +199,6 @@ bool ScriptElement::prepareScript(const TextPosition& scriptStartPosition, Legac
     if (!document->frame()->script()->canExecuteScripts(AboutToExecuteScript))
         return false;
 
-    Node* ancestor = m_element->parentNode();
-    while (ancestor) {
-        if (ancestor->isSVGShadowRoot()) {
-            fprintf(stderr, "aborted script: shadow root\n");
-            return false;
-        }
-        ancestor = ancestor->parentNode();
-    }
-
     if (!isScriptForEventSupported())
         return false;
 
diff --git a/Source/WebCore/dom/ScriptExecutionContext.cpp b/Source/WebCore/dom/ScriptExecutionContext.cpp
index 9a5682d7f..92445ca80 100644
--- a/Source/WebCore/dom/ScriptExecutionContext.cpp
+++ b/Source/WebCore/dom/ScriptExecutionContext.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2012 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,9 +31,6 @@
 #include "ActiveDOMObject.h"
 #include "ContentSecurityPolicy.h"
 #include "DOMTimer.h"
-#include "Database.h"
-#include "DatabaseTask.h"
-#include "DatabaseThread.h"
 #include "ErrorEvent.h"
 #include "EventListener.h"
 #include "EventTarget.h"
@@ -94,9 +92,8 @@ ScriptExecutionContext::ScriptExecutionContext()
     , m_inDestructor(false)
     , m_inDispatchErrorEvent(false)
     , m_activeDOMObjectsAreSuspended(false)
-#if ENABLE(SQL_DATABASE)
-    , m_hasOpenDatabases(false)
-#endif
+    , m_reasonForSuspendingActiveDOMObjects(static_cast<ActiveDOMObject::ReasonForSuspension>(-1))
+    , m_activeDOMObjectsAreStopped(false)
 {
 }
 
@@ -115,50 +112,16 @@ ScriptExecutionContext::~ScriptExecutionContext()
         ASSERT((*iter)->scriptExecutionContext() == this);
         (*iter)->contextDestroyed();
     }
-#if ENABLE(SQL_DATABASE)
-    if (m_databaseThread) {
-        ASSERT(m_databaseThread->terminationRequested());
-        m_databaseThread = 0;
-    }
-#endif
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
     if (m_fileThread) {
         m_fileThread->stop();
         m_fileThread = 0;
     }
-#endif
-#if ENABLE(BLOB)
     if (m_publicURLManager)
         m_publicURLManager->contextDestroyed();
 #endif
 }
 
-#if ENABLE(SQL_DATABASE)
-
-DatabaseThread* ScriptExecutionContext::databaseThread()
-{
-    if (!m_databaseThread && !m_hasOpenDatabases) {
-        // Create the database thread on first request - but not if at least one database was already opened,
-        // because in that case we already had a database thread and terminated it and should not create another.
-        m_databaseThread = DatabaseThread::create();
-        if (!m_databaseThread->start())
-            m_databaseThread = 0;
-    }
-
-    return m_databaseThread.get();
-}
-
-void ScriptExecutionContext::stopDatabases(DatabaseTaskSynchronizer* cleanupSync)
-{
-    ASSERT(isContextThread());
-    if (m_databaseThread)
-        m_databaseThread->requestTermination(cleanupSync);
-    else if (cleanupSync)
-        cleanupSync->taskCompleted();
-}
-
-#endif
-
 void ScriptExecutionContext::processMessagePortMessagesSoon()
 {
     postTask(ProcessMessagesSoonTask::create());
@@ -252,6 +215,7 @@ void ScriptExecutionContext::resumeActiveDOMObjects()
 
 void ScriptExecutionContext::stopActiveDOMObjects()
 {
+    m_activeDOMObjectsAreStopped = true;
     // No protection against m_activeDOMObjects changing during iteration: stop() shouldn't execute arbitrary JS.
     m_iteratingActiveDOMObjects = true;
     HashMap<ActiveDOMObject*, void*>::iterator activeObjectsEnd = m_activeDOMObjects.end();
@@ -393,7 +357,7 @@ DOMTimer* ScriptExecutionContext::findTimeout(int timeoutId)
     return m_timeouts.get(timeoutId);
 }
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 FileThread* ScriptExecutionContext::fileThread()
 {
     if (!m_fileThread) {
@@ -403,9 +367,7 @@ FileThread* ScriptExecutionContext::fileThread()
     }
     return m_fileThread.get();
 }
-#endif
 
-#if ENABLE(BLOB)
 PublicURLManager& ScriptExecutionContext::publicURLManager()
 {
     if (!m_publicURLManager)
diff --git a/Source/WebCore/dom/ScriptExecutionContext.h b/Source/WebCore/dom/ScriptExecutionContext.h
index 15ceb42ee..238fa6d2b 100644
--- a/Source/WebCore/dom/ScriptExecutionContext.h
+++ b/Source/WebCore/dom/ScriptExecutionContext.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2012 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,6 +33,7 @@
 #include "KURL.h"
 #include "ScriptCallStack.h"
 #include "SecurityContext.h"
+#include "Supplementable.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
@@ -56,17 +58,12 @@ class MessagePort;
 #if ENABLE(BLOB)
 class PublicURLManager;
 #endif
-#if ENABLE(SQL_DATABASE)
-class Database;
-class DatabaseTaskSynchronizer;
-class DatabaseThread;
-#endif
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 class FileThread;
 #endif
 
-class ScriptExecutionContext : public SecurityContext {
+class ScriptExecutionContext : public SecurityContext, public Supplementable<ScriptExecutionContext> {
 public:
     ScriptExecutionContext();
     virtual ~ScriptExecutionContext();
@@ -74,15 +71,6 @@ public:
     virtual bool isDocument() const { return false; }
     virtual bool isWorkerContext() const { return false; }
 
-#if ENABLE(SQL_DATABASE)
-    virtual bool allowDatabaseAccess() const = 0;
-    virtual void databaseExceededQuota(const String& name) = 0;
-    DatabaseThread* databaseThread();
-    void setHasOpenDatabases() { m_hasOpenDatabases = true; }
-    bool hasOpenDatabases() const { return m_hasOpenDatabases; }
-    // When the database cleanup is done, cleanupSync will be signalled.
-    void stopDatabases(DatabaseTaskSynchronizer*);
-#endif
     virtual bool isContextThread() const { return true; }
     virtual bool isJSExecutionForbidden() const = 0;
 
@@ -110,6 +98,7 @@ public:
     virtual void stopActiveDOMObjects();
 
     bool activeDOMObjectsAreSuspended() const { return m_activeDOMObjectsAreSuspended; }
+    bool activeDOMObjectsAreStopped() const { return m_activeDOMObjectsAreStopped; }
 
     // Called from the constructor and destructors of ActiveDOMObject.
     void didCreateActiveDOMObject(ActiveDOMObject*, void* upcastPointer);
@@ -158,7 +147,7 @@ public:
     JSC::JSGlobalData* globalData();
 #endif
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
     FileThread* fileThread();
     void stopFileThread();
 #endif
@@ -223,13 +212,9 @@ private:
 
     bool m_activeDOMObjectsAreSuspended;
     ActiveDOMObject::ReasonForSuspension m_reasonForSuspendingActiveDOMObjects;
+    bool m_activeDOMObjectsAreStopped;
 
-#if ENABLE(SQL_DATABASE)
-    RefPtr<DatabaseThread> m_databaseThread;
-    bool m_hasOpenDatabases; // This never changes back to false, even after the database thread is closed.
-#endif
-
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
     RefPtr<FileThread> m_fileThread;
 #endif
 };
diff --git a/Source/WebCore/dom/ShadowRoot.cpp b/Source/WebCore/dom/ShadowRoot.cpp
index 6cf50acb9..7a971d5fb 100644
--- a/Source/WebCore/dom/ShadowRoot.cpp
+++ b/Source/WebCore/dom/ShadowRoot.cpp
@@ -27,15 +27,18 @@
 #include "config.h"
 #include "ShadowRoot.h"
 
+#include "CSSStyleSelector.h"
 #include "Document.h"
+#include "DocumentFragment.h"
 #include "Element.h"
 #include "HTMLContentElement.h"
 #include "HTMLContentSelector.h"
 #include "HTMLNames.h"
 #include "InsertionPoint.h"
 #include "NodeRareData.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "SVGNames.h"
+#include "markup.h"
 
 #if ENABLE(SHADOW_DOM)
 #include "RuntimeEnabledFeatures.h"
@@ -49,6 +52,7 @@ ShadowRoot::ShadowRoot(Document* document)
     , m_prev(0)
     , m_next(0)
     , m_applyAuthorSheets(false)
+    , m_insertionPointAssignedTo(0)
 {
     ASSERT(document);
     
@@ -123,7 +127,7 @@ PassRefPtr<ShadowRoot> ShadowRoot::create(Element* element, ShadowRootCreationPu
     RefPtr<ShadowRoot> shadowRoot = adoptRef(new ShadowRoot(element->document()));
 
     ec = 0;
-    element->setShadowRoot(shadowRoot, ec);
+    element->ensureShadowTree()->addShadowRoot(element, shadowRoot, ec);
     if (ec)
         return 0;
     ASSERT(element == shadowRoot->host());
@@ -142,6 +146,18 @@ PassRefPtr<Node> ShadowRoot::cloneNode(bool)
     return 0;
 }
 
+String ShadowRoot::innerHTML() const
+{
+    return createMarkup(this, ChildrenOnly);
+}
+
+void ShadowRoot::setInnerHTML(const String& markup, ExceptionCode& ec)
+{
+    RefPtr<DocumentFragment> fragment = createFragmentFromSource(markup, host(), ec);
+    if (fragment)
+        replaceChildrenWithFragment(this, fragment.release(), ec);
+}
+
 bool ShadowRoot::childTypeAllowed(NodeType type) const
 {
     switch (type) {
@@ -157,17 +173,17 @@ bool ShadowRoot::childTypeAllowed(NodeType type) const
     }
 }
 
-ShadowRootList* ShadowRoot::list() const
+ShadowTree* ShadowRoot::tree() const
 {
     if (host())
-        return host()->shadowRootList();
+        return host()->shadowTree();
     return 0;
 }
 
-bool ShadowRoot::hasContentElement() const
+bool ShadowRoot::hasInsertionPoint() const
 {
     for (Node* n = firstChild(); n; n = n->traverseNextNode(this)) {
-        if (n->isContentElement())
+        if (isInsertionPoint(n))
             return true;
     }
 
@@ -186,15 +202,10 @@ void ShadowRoot::setApplyAuthorSheets(bool value)
 
 void ShadowRoot::attach()
 {
-    // Children of m_selector is populated lazily in
-    // ensureSelector(), and here we just ensure that
-    // it is in clean state.
-    // FIXME: This assertion breaks if multiple shadow roots are being attached.
-    // ShadowRootList should have responsibility of side effect of selector in attaching/detaching.
-    ASSERT(!host()->shadowRootList()->selector() || !host()->shadowRootList()->selector()->hasCandidates());
+    CSSStyleSelector* styleSelector = document()->styleSelector();
+    styleSelector->pushParentShadowRoot(this);
     DocumentFragment::attach();
-    if (HTMLContentSelector* selector = host()->shadowRootList()->selector())
-        selector->didSelect();
+    styleSelector->popParentShadowRoot(this);
 }
 
 }
diff --git a/Source/WebCore/dom/ShadowRoot.h b/Source/WebCore/dom/ShadowRoot.h
index 312116749..e760558f9 100644
--- a/Source/WebCore/dom/ShadowRoot.h
+++ b/Source/WebCore/dom/ShadowRoot.h
@@ -27,6 +27,7 @@
 #ifndef ShadowRoot_h
 #define ShadowRoot_h
 
+#include "Document.h"
 #include "DocumentFragment.h"
 #include "ExceptionCode.h"
 #include "TreeScope.h"
@@ -38,7 +39,7 @@ class Document;
 class HTMLContentElement;
 class HTMLContentSelector;
 class InsertionPoint;
-class ShadowRootList;
+class ShadowTree;
 
 class ShadowRoot : public DocumentFragment, public TreeScope, public DoublyLinkedListNode<ShadowRoot> {
     friend class WTF::DoublyLinkedListNode<ShadowRoot>;
@@ -64,18 +65,30 @@ public:
     InsertionPoint* insertionPointFor(Node*) const;
     void hostChildrenChanged();
 
-    virtual void attach();
-
     virtual bool applyAuthorSheets() const;
     void setApplyAuthorSheets(bool);
 
     Element* host() const { return shadowHost(); }
-    ShadowRootList* list() const;
+    ShadowTree* tree() const;
+
+    String innerHTML() const;
+    void setInnerHTML(const String&, ExceptionCode&);
+
+    Element* activeElement() const;
 
     ShadowRoot* youngerShadowRoot() const { return prev(); }
     ShadowRoot* olderShadowRoot() const { return next(); }
 
-    bool hasContentElement() const;
+    bool isYoungest() const { return !youngerShadowRoot(); }
+    bool isOldest() const { return !olderShadowRoot(); }
+
+    bool hasInsertionPoint() const;
+
+    virtual void attach();
+
+    bool isUsedForRendering() const;
+    InsertionPoint* assignedTo() const;
+    void setAssignedTo(InsertionPoint*);
 
 private:
     ShadowRoot(Document*);
@@ -88,8 +101,32 @@ private:
     ShadowRoot* m_prev;
     ShadowRoot* m_next;
     bool m_applyAuthorSheets : 1;
+    InsertionPoint* m_insertionPointAssignedTo;
 };
 
+inline InsertionPoint* ShadowRoot::assignedTo() const
+{
+    return m_insertionPointAssignedTo;
+}
+
+inline void ShadowRoot::setAssignedTo(InsertionPoint* insertionPoint)
+{
+    ASSERT(!m_insertionPointAssignedTo || !insertionPoint);
+    m_insertionPointAssignedTo = insertionPoint;
+}
+
+inline bool ShadowRoot::isUsedForRendering() const
+{
+    return isYoungest() || assignedTo();
+}
+
+inline Element* ShadowRoot::activeElement() const
+{
+    if (document()->isHTMLDocument())
+        return treeScope()->activeElement();
+    return 0;
+}
+
 inline const ShadowRoot* toShadowRoot(const Node* node)
 {
     ASSERT(!node || node->isShadowRoot());
@@ -101,6 +138,18 @@ inline ShadowRoot* toShadowRoot(Node* node)
     return const_cast<ShadowRoot*>(toShadowRoot(static_cast<const Node*>(node)));
 }
 
+inline ShadowRoot* toShadowRoot(TreeScope* scope)
+{
+    ASSERT(!scope || scope->isShadowRoot());
+    return static_cast<ShadowRoot*>(scope);
+}
+
+// Put this TreeScope method here to inline it.
+inline bool TreeScope::isShadowRoot() const
+{
+    return m_rootNode->isShadowRoot();
+}
+
 } // namespace
 
 #endif
diff --git a/Source/WebCore/dom/ShadowRoot.idl b/Source/WebCore/dom/ShadowRoot.idl
index ffa3b03b4..e9e8b1b40 100644
--- a/Source/WebCore/dom/ShadowRoot.idl
+++ b/Source/WebCore/dom/ShadowRoot.idl
@@ -33,6 +33,11 @@ module core {
         ConstructorRaisesException
     ] ShadowRoot : DocumentFragment {
         readonly attribute Element host;
+        readonly attribute Element activeElement;
+
+        attribute [TreatNullAs=NullString] DOMString innerHTML
+            setter raises(DOMException);
+
         Element getElementById(in [Optional=DefaultIsUndefined] DOMString elementId);
         NodeList getElementsByClassName(in [Optional=DefaultIsUndefined] DOMString className);
         NodeList getElementsByTagName(in [Optional=DefaultIsUndefined] DOMString tagName);
diff --git a/Source/WebCore/dom/ShadowRootList.cpp b/Source/WebCore/dom/ShadowRootList.cpp
deleted file mode 100644
index 3adee6370..000000000
--- a/Source/WebCore/dom/ShadowRootList.cpp
+++ /dev/null
@@ -1,238 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "ShadowRootList.h"
-
-#include "Document.h"
-#include "Element.h"
-#include "HTMLContentSelector.h"
-#include "RuntimeEnabledFeatures.h"
-#include "ShadowRoot.h"
-#include "Text.h"
-
-namespace WebCore {
-
-ShadowRootList::ShadowRootList()
-    : m_needsRecalculateContent(false)
-{
-}
-
-ShadowRootList::~ShadowRootList()
-{
-    ASSERT(!hasShadowRoot());
-}
-
-void ShadowRootList::pushShadowRoot(ShadowRoot* shadowRoot)
-{
-#if ENABLE(SHADOW_DOM)
-    if (!RuntimeEnabledFeatures::multipleShadowSubtreesEnabled())
-        ASSERT(!hasShadowRoot());
-#else
-    ASSERT(!hasShadowRoot());
-#endif
-
-    m_shadowRoots.push(shadowRoot);
-}
-
-ShadowRoot* ShadowRootList::popShadowRoot()
-{
-    if (!hasShadowRoot())
-        return 0;
-
-    return m_shadowRoots.removeHead();
-}
-
-void ShadowRootList::insertedIntoDocument()
-{
-    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
-        root->insertedIntoDocument();
-}
-
-void ShadowRootList::removedFromDocument()
-{
-    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
-        root->removedFromDocument();
-}
-
-void ShadowRootList::insertedIntoTree(bool deep)
-{
-    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
-        root->insertedIntoTree(deep);
-}
-
-void ShadowRootList::removedFromTree(bool deep)
-{
-    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
-        root->removedFromTree(deep);
-}
-
-void ShadowRootList::willRemove()
-{
-    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
-        root->willRemove();
-}
-
-void ShadowRootList::attach()
-{
-    // FIXME: Currently we only support the case that the shadow root list has at most one shadow root.
-    // See also https://bugs.webkit.org/show_bug.cgi?id=77503 and its dependent bugs.
-    ASSERT(m_shadowRoots.size() <= 1);
-
-    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
-        if (!root->attached())
-            root->attach();
-    }
-}
-
-void ShadowRootList::detach()
-{
-    // FIXME: Currently we only support the case that the shadow root list has at most one shadow root.
-    // See also https://bugs.webkit.org/show_bug.cgi?id=77503 and its dependent bugs.
-    ASSERT(m_shadowRoots.size() <= 1);
-
-    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
-        if (root->attached())
-            root->detach();
-    }
-}
-
-InsertionPoint* ShadowRootList::insertionPointFor(Node* node) const
-{
-    if (!m_selector)
-        return 0;
-    HTMLContentSelection* found = m_selector->findFor(node);
-    if (!found)
-        return 0;
-    return found->insertionPoint();
-}
-
-bool ShadowRootList::isSelectorActive() const
-{
-    return m_selector && m_selector->hasCandidates();
-}
-
-void ShadowRootList::reattach()
-{
-    detach();
-    attach();
-}
-
-bool ShadowRootList::childNeedsStyleRecalc()
-{
-    ASSERT(youngestShadowRoot());
-    if (!youngestShadowRoot())
-        return false;
-
-    return youngestShadowRoot()->childNeedsStyleRecalc();
-}
-
-bool ShadowRootList::needsStyleRecalc()
-{
-    ASSERT(youngestShadowRoot());
-    if (!youngestShadowRoot())
-        return false;
-
-    return youngestShadowRoot()->needsStyleRecalc();
-}
-
-void ShadowRootList::recalcShadowTreeStyle(Node::StyleChange change)
-{
-    ShadowRoot* youngest = youngestShadowRoot();
-    if (!youngest)
-        return;
-
-    if (needsReattachHostChildrenAndShadow())
-        reattachHostChildrenAndShadow();
-    else {
-        for (Node* n = youngest->firstChild(); n; n = n->nextSibling()) {
-            if (n->isElementNode())
-                static_cast<Element*>(n)->recalcStyle(change);
-            else if (n->isTextNode())
-                toText(n)->recalcTextStyle(change);
-        }
-    }
-
-    clearNeedsReattachHostChildrenAndShadow();
-    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
-        root->clearNeedsStyleRecalc();
-        root->clearChildNeedsStyleRecalc();
-    }
-}
-
-bool ShadowRootList::needsReattachHostChildrenAndShadow()
-{
-    return m_needsRecalculateContent || (youngestShadowRoot() && youngestShadowRoot()->hasContentElement());
-}
-
-void ShadowRootList::hostChildrenChanged()
-{
-    ASSERT(youngestShadowRoot());
-
-    if (!youngestShadowRoot()->hasContentElement())
-        return;
-
-    // This results in forced detaching/attaching of the shadow render tree. See ShadowRoot::recalcStyle().
-    setNeedsReattachHostChildrenAndShadow();
-}
-
-void ShadowRootList::setNeedsReattachHostChildrenAndShadow()
-{
-    m_needsRecalculateContent = true;
-
-    host()->setNeedsStyleRecalc();
-}
-
-void ShadowRootList::reattachHostChildrenAndShadow()
-{
-    ASSERT(youngestShadowRoot());
-
-    Node* hostNode = youngestShadowRoot()->host();
-    if (!hostNode)
-        return;
-
-    for (Node* child = hostNode->firstChild(); child; child = child->nextSibling()) {
-        if (child->attached())
-            child->detach();
-    }
-
-    reattach();
-
-    for (Node* child = hostNode->firstChild(); child; child = child->nextSibling()) {
-        if (!child->attached())
-            child->attach();
-    }
-}
-
-HTMLContentSelector* ShadowRootList::ensureSelector()
-{
-    if (!m_selector)
-        m_selector = adoptPtr(new HTMLContentSelector());
-    m_selector->willSelectOver(host());
-    return m_selector.get();
-}
-
-} // namespace
diff --git a/Source/WebCore/dom/ShadowTree.cpp b/Source/WebCore/dom/ShadowTree.cpp
new file mode 100644
index 000000000..aec998bd8
--- /dev/null
+++ b/Source/WebCore/dom/ShadowTree.cpp
@@ -0,0 +1,328 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ShadowTree.h"
+
+#include "CSSStyleSelector.h"
+#include "Document.h"
+#include "Element.h"
+#include "HTMLContentSelector.h"
+#include "HTMLShadowElement.h"
+#include "InspectorInstrumentation.h"
+#include "RuntimeEnabledFeatures.h"
+#include "ShadowRoot.h"
+#include "Text.h"
+
+namespace WebCore {
+
+class ShadowRootVector : public Vector<RefPtr<ShadowRoot> > {
+public:
+    explicit ShadowRootVector(ShadowTree* tree)
+    {
+        for (ShadowRoot* root = tree->youngestShadowRoot(); root; root = root->olderShadowRoot())
+            append(root);
+    }
+};
+
+ShadowTree::ShadowTree()
+    : m_needsRecalculateContent(false)
+{
+}
+
+ShadowTree::~ShadowTree()
+{
+    if (hasShadowRoot())
+        removeAllShadowRoots();
+}
+
+static bool validateShadowRoot(Document* document, ShadowRoot* shadowRoot, ExceptionCode& ec)
+{
+    if (!shadowRoot)
+        return true;
+
+    if (shadowRoot->shadowHost()) {
+        ec = HIERARCHY_REQUEST_ERR;
+        return false;
+    }
+
+    if (shadowRoot->document() != document) {
+        ec = WRONG_DOCUMENT_ERR;
+        return false;
+    }
+
+    return true;
+}
+
+void ShadowTree::addShadowRoot(Element* shadowHost, PassRefPtr<ShadowRoot> shadowRoot, ExceptionCode& ec)
+{
+    ASSERT(shadowHost);
+    ASSERT(shadowRoot);
+#if ENABLE(SHADOW_DOM)
+    ASSERT(!hasShadowRoot() || RuntimeEnabledFeatures::multipleShadowSubtreesEnabled());
+#else
+    ASSERT(!hasShadowRoot());
+#endif
+
+    if (!validateShadowRoot(shadowHost->document(), shadowRoot.get(), ec))
+        return;
+
+    shadowRoot->setShadowHost(shadowHost);
+
+    if (shadowHost->inDocument())
+        shadowRoot->insertedIntoDocument();
+    if (shadowHost->attached()) {
+        shadowRoot->lazyAttach();
+        detach();
+        shadowHost->detachChildren();
+    }
+
+    m_shadowRoots.push(shadowRoot.get());
+    InspectorInstrumentation::didPushShadowRoot(shadowHost, shadowRoot.get());
+}
+
+void ShadowTree::removeAllShadowRoots()
+{
+    if (!hasShadowRoot())
+        return;
+
+    // Dont protect this ref count.
+    Element* shadowHost = host();
+
+    while (RefPtr<ShadowRoot> oldRoot = m_shadowRoots.removeHead()) {
+        InspectorInstrumentation::willPopShadowRoot(shadowHost, oldRoot.get());
+        shadowHost->document()->removeFocusedNodeOfSubtree(oldRoot.get());
+
+        if (oldRoot->attached())
+            oldRoot->detach();
+
+        oldRoot->setShadowHost(0);
+        oldRoot->setPrev(0);
+        oldRoot->setNext(0);
+        shadowHost->document()->adoptIfNeeded(oldRoot.get());
+        if (oldRoot->inDocument())
+            oldRoot->removedFromDocument();
+        else
+            oldRoot->removedFromTree(true);
+    }
+
+    if (shadowHost->attached())
+        shadowHost->attachChildrenLazily();
+}
+
+void ShadowTree::insertedIntoDocument()
+{
+    ShadowRootVector roots(this);
+    for (size_t i = 0; i < roots.size(); ++i)
+        roots[i]->insertedIntoDocument();
+}
+
+void ShadowTree::removedFromDocument()
+{
+    ShadowRootVector roots(this);
+    for (size_t i = 0; i < roots.size(); ++i)
+        roots[i]->removedFromDocument();
+}
+
+void ShadowTree::insertedIntoTree(bool deep)
+{
+    ShadowRootVector roots(this);
+    for (size_t i = 0; i < roots.size(); ++i)
+        roots[i]->insertedIntoTree(deep);
+}
+
+void ShadowTree::removedFromTree(bool deep)
+{
+    ShadowRootVector roots(this);
+    for (size_t i = 0; i < roots.size(); ++i)
+        roots[i]->removedFromTree(deep);
+}
+
+void ShadowTree::willRemove()
+{
+    ShadowRootVector roots(this);
+    for (size_t i = 0; i < roots.size(); ++i)
+        roots[i]->willRemove();
+}
+
+void ShadowTree::setParentTreeScope(TreeScope* scope)
+{
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
+        root->setParentTreeScope(scope);
+}
+
+void ShadowTree::attach()
+{
+    // Children of m_selector is populated lazily in
+    // ensureSelector(), and here we just ensure that it is in clean state.
+    ASSERT(!selector() || !selector()->hasCandidates());
+
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
+        if (!root->attached())
+            root->attach();
+    }
+
+    if (HTMLContentSelector* contentSelector = selector())
+        contentSelector->didSelect();
+}
+
+void ShadowTree::attachHost(Element* host)
+{
+    attach();
+    host->attachChildrenIfNeeded();
+    host->attachAsNode();
+}
+
+void ShadowTree::detach()
+{
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
+        if (root->attached())
+            root->detach();
+    }
+}
+
+void ShadowTree::detachHost(Element* host)
+{
+    host->detachChildrenIfNeeded();
+    detach();
+    host->detachAsNode();
+}
+
+InsertionPoint* ShadowTree::insertionPointFor(Node* node) const
+{
+    ASSERT(node && node->parentNode());
+
+    if (node->parentNode()->isShadowRoot()) {
+        if (InsertionPoint* insertionPoint = toShadowRoot(node->parentNode())->assignedTo())
+            return insertionPoint;
+
+        return 0;
+    }
+
+    if (!m_selector)
+        return 0;
+    HTMLContentSelection* found = m_selector->findFor(node);
+    if (!found)
+        return 0;
+    return found->insertionPoint();
+}
+
+void ShadowTree::reattach()
+{
+    detach();
+    attach();
+}
+
+bool ShadowTree::childNeedsStyleRecalc()
+{
+    ASSERT(youngestShadowRoot());
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
+        if (root->childNeedsStyleRecalc())
+            return true;
+
+    return false;
+}
+
+bool ShadowTree::needsStyleRecalc()
+{
+    ASSERT(youngestShadowRoot());
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
+        if (root->needsStyleRecalc())
+            return true;
+
+    return false;
+}
+
+void ShadowTree::recalcShadowTreeStyle(Node::StyleChange change)
+{
+    ShadowRoot* youngest = youngestShadowRoot();
+    if (!youngest)
+        return;
+
+    if (needsReattachHostChildrenAndShadow())
+        reattachHostChildrenAndShadow();
+    else {
+        CSSStyleSelector* styleSelector = youngest->document()->styleSelector();
+
+        styleSelector->pushParentShadowRoot(youngest);
+        for (Node* n = youngest->firstChild(); n; n = n->nextSibling()) {
+            if (n->isElementNode())
+                static_cast<Element*>(n)->recalcStyle(change);
+            else if (n->isTextNode())
+                toText(n)->recalcTextStyle(change);
+        }
+        styleSelector->popParentShadowRoot(youngest);
+    }
+
+    clearNeedsReattachHostChildrenAndShadow();
+    for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
+        root->clearNeedsStyleRecalc();
+        root->clearChildNeedsStyleRecalc();
+    }
+}
+
+bool ShadowTree::needsReattachHostChildrenAndShadow()
+{
+    return m_needsRecalculateContent || (youngestShadowRoot() && youngestShadowRoot()->hasInsertionPoint());
+}
+
+void ShadowTree::hostChildrenChanged()
+{
+    ASSERT(youngestShadowRoot());
+
+    if (!youngestShadowRoot()->hasInsertionPoint())
+        return;
+
+    // This results in forced detaching/attaching of the shadow render tree. See ShadowRoot::recalcStyle().
+    setNeedsReattachHostChildrenAndShadow();
+}
+
+void ShadowTree::setNeedsReattachHostChildrenAndShadow()
+{
+    m_needsRecalculateContent = true;
+
+    host()->setNeedsStyleRecalc();
+}
+
+void ShadowTree::reattachHostChildrenAndShadow()
+{
+    ASSERT(youngestShadowRoot());
+
+    Element* hostNode = youngestShadowRoot()->host();
+    hostNode->detachChildrenIfNeeded();
+    reattach();
+    hostNode->attachChildrenIfNeeded();
+}
+
+HTMLContentSelector* ShadowTree::ensureSelector()
+{
+    if (!m_selector)
+        m_selector = adoptPtr(new HTMLContentSelector());
+    m_selector->willSelectOver(host());
+    return m_selector.get();
+}
+
+} // namespace
diff --git a/Source/WebCore/dom/ShadowRootList.h b/Source/WebCore/dom/ShadowTree.h
index db3170a6d..54c41bbe4 100644
--- a/Source/WebCore/dom/ShadowRootList.h
+++ b/Source/WebCore/dom/ShadowTree.h
@@ -24,9 +24,10 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ShadowRootList_h
-#define ShadowRootList_h
+#ifndef ShadowTree_h
+#define ShadowTree_h
 
+#include "ExceptionCode.h"
 #include "ShadowRoot.h"
 #include <wtf/DoublyLinkedList.h>
 #include <wtf/Noncopyable.h>
@@ -39,18 +40,19 @@ class Node;
 class Element;
 class HTMLContentSelector;
 class InsertionPoint;
+class TreeScope;
 
-class ShadowRootList {
+class ShadowTree {
 public:
-    ShadowRootList();
-    ~ShadowRootList();
+    ShadowTree();
+    ~ShadowTree();
 
     bool hasShadowRoot() const;
     ShadowRoot* youngestShadowRoot() const;
     ShadowRoot* oldestShadowRoot() const;
 
-    void pushShadowRoot(ShadowRoot*);
-    ShadowRoot* popShadowRoot();
+    void addShadowRoot(Element* shadowHost, PassRefPtr<ShadowRoot>, ExceptionCode&);
+    void removeAllShadowRoots();
 
     void insertedIntoDocument();
     void removedFromDocument();
@@ -58,9 +60,13 @@ public:
     void removedFromTree(bool deep);
     void willRemove();
 
+    void setParentTreeScope(TreeScope*);
+
     void attach();
     void detach();
     void reattach();
+    void attachHost(Element*);
+    void detachHost(Element*);
 
     bool childNeedsStyleRecalc();
     bool needsStyleRecalc();
@@ -76,43 +82,41 @@ public:
     HTMLContentSelector* selector() const;
     HTMLContentSelector* ensureSelector();
 
-    bool isSelectorActive() const;
-
 private:
     Element* host() const;
 
     DoublyLinkedList<ShadowRoot> m_shadowRoots;
     OwnPtr<HTMLContentSelector> m_selector;
     bool m_needsRecalculateContent : 1;
-    WTF_MAKE_NONCOPYABLE(ShadowRootList);
+    WTF_MAKE_NONCOPYABLE(ShadowTree);
 };
 
-inline bool ShadowRootList::hasShadowRoot() const
+inline bool ShadowTree::hasShadowRoot() const
 {
     return !m_shadowRoots.isEmpty();
 }
 
-inline ShadowRoot* ShadowRootList::youngestShadowRoot() const
+inline ShadowRoot* ShadowTree::youngestShadowRoot() const
 {
     return m_shadowRoots.head();
 }
 
-inline ShadowRoot* ShadowRootList::oldestShadowRoot() const
+inline ShadowRoot* ShadowTree::oldestShadowRoot() const
 {
     return m_shadowRoots.tail();
 }
 
-inline HTMLContentSelector* ShadowRootList::selector() const
+inline HTMLContentSelector* ShadowTree::selector() const
 {
     return m_selector.get();
 }
 
-inline void ShadowRootList::clearNeedsReattachHostChildrenAndShadow()
+inline void ShadowTree::clearNeedsReattachHostChildrenAndShadow()
 {
     m_needsRecalculateContent = false;
 }
 
-inline Element* ShadowRootList::host() const
+inline Element* ShadowTree::host() const
 {
     ASSERT(hasShadowRoot());
     return youngestShadowRoot()->host();
diff --git a/Source/WebCore/dom/StaticNodeList.cpp b/Source/WebCore/dom/StaticNodeList.cpp
index fe1d1cbe4..412c125e0 100644
--- a/Source/WebCore/dom/StaticNodeList.cpp
+++ b/Source/WebCore/dom/StaticNodeList.cpp
@@ -50,7 +50,7 @@ Node* StaticNodeList::itemWithName(const AtomicString& elementId) const
     size_t length = m_nodes.size();
     for (size_t i = 0; i < length; ++i) {
         Node* node = m_nodes[i].get();
-        if (static_cast<Element*>(node)->getIdAttribute() == elementId)
+        if (node->isElementNode() && toElement(node)->getIdAttribute() == elementId)
             return node;
     }
 
diff --git a/Source/WebCore/dom/StyledElement.cpp b/Source/WebCore/dom/StyledElement.cpp
index 99e7f3523..19b310488 100644
--- a/Source/WebCore/dom/StyledElement.cpp
+++ b/Source/WebCore/dom/StyledElement.cpp
@@ -46,27 +46,56 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+struct PresentationAttributeCacheKey {
+    PresentationAttributeCacheKey() : tagName(0) { }
+    AtomicStringImpl* tagName;
+    // Only the values need refcounting.
+    Vector<pair<AtomicStringImpl*, AtomicString>, 3> attributesAndValues;
+};
+
+struct PresentationAttributeCacheEntry {
+    PresentationAttributeCacheKey key;
+    RefPtr<StylePropertySet> value;
+};
+
+typedef HashMap<unsigned, OwnPtr<PresentationAttributeCacheEntry>, AlreadyHashed> PresentationAttributeCache;
+    
+static bool operator!=(const PresentationAttributeCacheKey& a, const PresentationAttributeCacheKey& b)
+{
+    if (a.tagName != b.tagName)
+        return true;
+    return a.attributesAndValues != b.attributesAndValues;
+}
+
+static PresentationAttributeCache& presentationAttributeCache()
+{
+    DEFINE_STATIC_LOCAL(PresentationAttributeCache, cache, ());
+    return cache;
+}
+
 void StyledElement::updateStyleAttribute() const
 {
     ASSERT(!isStyleAttributeValid());
     setIsStyleAttributeValid();
-    setIsSynchronizingStyleAttribute();
-    if (StylePropertySet* inlineStyle = inlineStyleDecl())
-        const_cast<StyledElement*>(this)->setAttribute(styleAttr, inlineStyle->asText());
-    clearIsSynchronizingStyleAttribute();
+    if (const StylePropertySet* inlineStyle = this->inlineStyle())
+        const_cast<StyledElement*>(this)->setAttribute(styleAttr, inlineStyle->asText(), /*notifyChanged*/ false);
 }
 
 StyledElement::~StyledElement()
 {
-    destroyInlineStyleDecl();
+    destroyInlineStyle();
+}
+
+CSSStyleDeclaration* StyledElement::style() 
+{ 
+    return ensureAttributeData()->ensureMutableInlineStyle(this)->ensureInlineCSSStyleDeclaration(this); 
 }
 
 void StyledElement::attributeChanged(Attribute* attr)
 {
-    if (!(attr->name() == styleAttr && isSynchronizingStyleAttribute()))
-        parseAttribute(attr);
+    parseAttribute(attr);
 
-    if (isPresentationAttribute(attr)) {
+    if (isPresentationAttribute(attr->name())) {
         setAttributeStyleDirty();
         setNeedsStyleRecalc(InlineStyleChange);
     }
@@ -100,9 +129,9 @@ void StyledElement::parseAttribute(Attribute* attr)
         classAttributeChanged(attr->value());
     else if (attr->name() == styleAttr) {
         if (attr->isNull())
-            destroyInlineStyleDecl();
+            destroyInlineStyle();
         else if (document()->contentSecurityPolicy()->allowInlineStyle())
-            ensureInlineStyleDecl()->parseDeclaration(attr->value(), document()->elementSheet());
+            ensureAttributeData()->updateInlineStyleAvoidingMutation(this, attr->value());
         setIsStyleAttributeValid();
         setNeedsStyleRecalc();
         InspectorInstrumentation::didInvalidateStyleAttr(document(), this);
@@ -118,21 +147,21 @@ void StyledElement::inlineStyleChanged()
     
 bool StyledElement::setInlineStyleProperty(int propertyID, int identifier, bool important)
 {
-    ensureInlineStyleDecl()->setProperty(propertyID, document()->cssValuePool()->createIdentifierValue(identifier), important);
+    ensureAttributeData()->ensureMutableInlineStyle(this)->setProperty(propertyID, document()->cssValuePool()->createIdentifierValue(identifier), important);
     inlineStyleChanged();
     return true;
 }
 
 bool StyledElement::setInlineStyleProperty(int propertyID, double value, CSSPrimitiveValue::UnitTypes unit, bool important)
 {
-    ensureInlineStyleDecl()->setProperty(propertyID, document()->cssValuePool()->createValue(value, unit), important);
+    ensureAttributeData()->ensureMutableInlineStyle(this)->setProperty(propertyID, document()->cssValuePool()->createValue(value, unit), important);
     inlineStyleChanged();
     return true;
 }
 
 bool StyledElement::setInlineStyleProperty(int propertyID, const String& value, bool important)
 {
-    bool changes = ensureInlineStyleDecl()->setProperty(propertyID, value, important, document()->elementSheet());
+    bool changes = ensureAttributeData()->ensureMutableInlineStyle(this)->setProperty(propertyID, value, important, document()->elementSheet());
     if (changes)
         inlineStyleChanged();
     return changes;
@@ -140,7 +169,10 @@ bool StyledElement::setInlineStyleProperty(int propertyID, const String& value,
 
 bool StyledElement::removeInlineStyleProperty(int propertyID)
 {
-    bool changes = ensureInlineStyleDecl()->removeProperty(propertyID);
+    StylePropertySet* inlineStyle = attributeData() ? attributeData()->inlineStyle() : 0;
+    if (!inlineStyle)
+        return false;
+    bool changes = inlineStyle->removeProperty(propertyID);
     if (changes)
         inlineStyleChanged();
     return changes;
@@ -148,16 +180,78 @@ bool StyledElement::removeInlineStyleProperty(int propertyID)
 
 void StyledElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
-    if (StylePropertySet* inlineStyle = inlineStyleDecl())
+    if (StylePropertySet* inlineStyle = attributeData() ? attributeData()->inlineStyle() : 0)
         inlineStyle->addSubresourceStyleURLs(urls, document()->elementSheet());
 }
 
-void StyledElement::updateAttributeStyle()
+static inline bool attributeNameSort(const pair<AtomicStringImpl*, AtomicString>& p1, const pair<AtomicStringImpl*, AtomicString>& p2)
 {
-    RefPtr<StylePropertySet> style = StylePropertySet::create();
-    for (unsigned i = 0; i < attributeCount(); ++i) {
+    // Sort based on the attribute name pointers. It doesn't matter what the order is as long as it is always the same. 
+    return p1.first < p2.first;
+}
+
+void StyledElement::makePresentationAttributeCacheKey(PresentationAttributeCacheKey& result) const
+{    
+    // FIXME: Enable for SVG.
+    if (namespaceURI() != xhtmlNamespaceURI)
+        return;
+    // Interpretation of the size attributes on <input> depends on the type attribute.
+    if (hasTagName(inputTag))
+        return;
+    unsigned size = attributeCount();
+    for (unsigned i = 0; i < size; ++i) {
         Attribute* attribute = attributeItem(i);
-        collectStyleForAttribute(attribute, style.get());
+        if (!isPresentationAttribute(attribute->name()))
+            continue;
+        if (!attribute->namespaceURI().isNull())
+            return;
+        // FIXME: Background URL may depend on the base URL and can't be shared. Disallow caching.
+        if (attribute->name() == backgroundAttr)
+            return;
+        result.attributesAndValues.append(make_pair(attribute->localName().impl(), attribute->value()));
+    }
+    if (result.attributesAndValues.isEmpty())
+        return;
+    // Attribute order doesn't matter. Sort for easy equality comparison.
+    std::sort(result.attributesAndValues.begin(), result.attributesAndValues.end(), attributeNameSort);
+    // The cache key is non-null when the tagName is set.
+    result.tagName = localName().impl();
+}
+
+static unsigned computePresentationAttributeCacheHash(const PresentationAttributeCacheKey& key)
+{
+    if (!key.tagName)
+        return 0;
+    ASSERT(key.attributesAndValues.size());
+    unsigned attributeHash = StringHasher::hashMemory(key.attributesAndValues.data(), key.attributesAndValues.size() * sizeof(key.attributesAndValues[0]));
+    return WTF::intHash((static_cast<uint64_t>(key.tagName->existingHash()) << 32 | attributeHash));
+}
+
+void StyledElement::updateAttributeStyle()
+{
+    PresentationAttributeCacheKey cacheKey;
+    makePresentationAttributeCacheKey(cacheKey);
+
+    unsigned cacheHash = computePresentationAttributeCacheHash(cacheKey);
+
+    PresentationAttributeCache::iterator cacheIterator;
+    if (cacheHash) {
+        cacheIterator = presentationAttributeCache().add(cacheHash, nullptr).first;
+        if (cacheIterator->second && cacheIterator->second->key != cacheKey)
+            cacheHash = 0;
+    } else
+        cacheIterator = presentationAttributeCache().end();
+
+    RefPtr<StylePropertySet> style;
+    if (cacheHash && cacheIterator->second) 
+        style = cacheIterator->second->value;
+    else {
+        style = StylePropertySet::create();
+        unsigned size = attributeCount();
+        for (unsigned i = 0; i < size; ++i) {
+            Attribute* attribute = attributeItem(i);
+            collectStyleForAttribute(attribute, style.get());
+        }
     }
     clearAttributeStyleDirty();
 
@@ -165,8 +259,23 @@ void StyledElement::updateAttributeStyle()
         attributeData()->setAttributeStyle(0);
     else {
         style->shrinkToFit();
-        attributeData()->setAttributeStyle(style.release());
+        attributeData()->setAttributeStyle(style);
     }
+
+    if (!cacheHash || cacheIterator->second)
+        return;
+
+    OwnPtr<PresentationAttributeCacheEntry> newEntry = adoptPtr(new PresentationAttributeCacheEntry);
+    newEntry->key = cacheKey;
+    newEntry->value = style.release();
+
+    static const int presentationAttributeCacheMaximumSize = 128;
+    if (presentationAttributeCache().size() > presentationAttributeCacheMaximumSize) {
+        // Start building from scratch if the cache ever gets big.
+        presentationAttributeCache().clear();
+        presentationAttributeCache().set(cacheHash, newEntry.release());
+    } else
+        cacheIterator->second = newEntry.release();
 }
 
 void StyledElement::addPropertyToAttributeStyle(StylePropertySet* style, int propertyID, int identifier)
diff --git a/Source/WebCore/dom/StyledElement.h b/Source/WebCore/dom/StyledElement.h
index 2773e41c3..e2079d8e0 100644
--- a/Source/WebCore/dom/StyledElement.h
+++ b/Source/WebCore/dom/StyledElement.h
@@ -31,6 +31,7 @@
 namespace WebCore {
 
 class Attribute;
+struct PresentationAttributeCacheKey;
 
 class StyledElement : public Element {
 public:
@@ -39,8 +40,8 @@ public:
     virtual StylePropertySet* additionalAttributeStyle() { return 0; }
     void invalidateStyleAttribute();
 
-    StylePropertySet* inlineStyleDecl() const { return attributeData() ? attributeData()->inlineStyleDecl() : 0; }
-    StylePropertySet* ensureInlineStyleDecl() { return ensureAttributeData()->ensureInlineStyleDecl(this); }
+    const StylePropertySet* inlineStyle() const { return attributeData() ? attributeData()->inlineStyle() : 0; }
+    const StylePropertySet* ensureInlineStyle() { return ensureAttributeData()->ensureInlineStyle(this); }
     
     // Unlike StylePropertySet setters, these implement invalidation.
     bool setInlineStyleProperty(int propertyID, int identifier, bool important = false);
@@ -48,7 +49,7 @@ public:
     bool setInlineStyleProperty(int propertyID, const String& value, bool important = false);
     bool removeInlineStyleProperty(int propertyID);
     
-    virtual CSSStyleDeclaration* style() OVERRIDE { return ensureInlineStyleDecl()->ensureInlineCSSStyleDeclaration(this); }
+    virtual CSSStyleDeclaration* style() OVERRIDE;
 
     StylePropertySet* attributeStyle();
 
@@ -64,7 +65,7 @@ protected:
     virtual void parseAttribute(Attribute*);
     virtual void copyNonAttributeProperties(const Element*);
 
-    virtual bool isPresentationAttribute(Attribute*) const { return false; }
+    virtual bool isPresentationAttribute(const QualifiedName&) const { return false; }
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) { }
 
     void addPropertyToAttributeStyle(StylePropertySet*, int propertyID, int identifier);
@@ -82,12 +83,13 @@ private:
     virtual void updateStyleAttribute() const;
     void inlineStyleChanged();
 
+    void makePresentationAttributeCacheKey(PresentationAttributeCacheKey&) const;
     void updateAttributeStyle();
 
-    void destroyInlineStyleDecl()
+    void destroyInlineStyle()
     {
         if (attributeData())
-            attributeData()->destroyInlineStyleDecl(this);
+            attributeData()->destroyInlineStyle(this);
     }
 };
 
diff --git a/Source/WebCore/dom/Text.cpp b/Source/WebCore/dom/Text.cpp
index 6b5f7f7b4..1bcabae57 100644
--- a/Source/WebCore/dom/Text.cpp
+++ b/Source/WebCore/dom/Text.cpp
@@ -147,7 +147,7 @@ PassRefPtr<Text> Text::replaceWholeText(const String& newText, ExceptionCode&)
     RefPtr<Text> endText = const_cast<Text*>(latestLogicallyAdjacentTextNode(this));
 
     RefPtr<Text> protectedThis(this); // Mutation event handlers could cause our last ref to go away
-    ContainerNode* parent = parentNode(); // Protect against mutation handlers moving this node during traversal
+    RefPtr<ContainerNode> parent = parentNode(); // Protect against mutation handlers moving this node during traversal
     ExceptionCode ignored = 0;
     for (RefPtr<Node> n = startText; n && n != this && n->isTextNode() && n->parentNode() == parent;) {
         RefPtr<Node> nodeToRemove(n.release());
diff --git a/Source/WebCore/dom/TreeScope.cpp b/Source/WebCore/dom/TreeScope.cpp
index 71384462e..a75bd24ee 100644
--- a/Source/WebCore/dom/TreeScope.cpp
+++ b/Source/WebCore/dom/TreeScope.cpp
@@ -29,9 +29,13 @@
 #include "ContainerNode.h"
 #include "Document.h"
 #include "Element.h"
+#include "FocusController.h"
+#include "Frame.h"
 #include "HTMLAnchorElement.h"
+#include "HTMLFrameOwnerElement.h"
 #include "HTMLMapElement.h"
 #include "HTMLNames.h"
+#include "Page.h"
 #include "TreeScopeAdopter.h"
 #include <wtf/text/AtomicString.h>
 #include <wtf/text/CString.h>
@@ -151,5 +155,35 @@ void TreeScope::adoptIfNeeded(Node* node)
         adopter.execute();
 }
 
+static Node* focusedFrameOwnerElement(Frame* focusedFrame, Frame* currentFrame)
+{
+    for (; focusedFrame; focusedFrame = focusedFrame->tree()->parent()) {
+        if (focusedFrame->tree()->parent() == currentFrame)
+            return focusedFrame->ownerElement();
+    }
+    return 0;
+}
+
+Element* TreeScope::activeElement()
+{
+    Document* document = rootNode()->document();
+    Node* node = document->focusedNode();
+    if (!node && document->page())
+        node = focusedFrameOwnerElement(document->page()->focusController()->focusedFrame(), document->frame());
+    if (!node)
+        return document->body();
+
+    TreeScope* treeScope = node->treeScope();
+
+    while (treeScope != this && treeScope != document) {
+        node = treeScope->rootNode()->shadowHost();
+        treeScope = node->treeScope();
+    }
+
+    if (node->isElementNode())
+        return toElement(node);
+    return 0;
+}
+
 } // namespace WebCore
 
diff --git a/Source/WebCore/dom/TreeScope.h b/Source/WebCore/dom/TreeScope.h
index b58bbdc83..aa30a8ae3 100644
--- a/Source/WebCore/dom/TreeScope.h
+++ b/Source/WebCore/dom/TreeScope.h
@@ -47,6 +47,7 @@ public:
     TreeScope* parentTreeScope() const { return m_parentTreeScope; }
     void setParentTreeScope(TreeScope*);
 
+    Element* activeElement();
     Element* getElementById(const AtomicString&) const;
     bool hasElementWithId(AtomicStringImpl* id) const;
     bool containsMultipleElementsWithId(const AtomicString& id) const;
@@ -60,6 +61,7 @@ public:
     void addNodeListCache() { ++m_numNodeListCaches; }
     void removeNodeListCache() { ASSERT(m_numNodeListCaches > 0); --m_numNodeListCaches; }
     bool hasNodeListCaches() const { return m_numNodeListCaches; }
+    bool isShadowRoot() const;
 
     // Find first anchor with the given name.
     // First searches for an element with the given ID, but if that fails, then looks
diff --git a/Source/WebCore/dom/TreeScopeAdopter.cpp b/Source/WebCore/dom/TreeScopeAdopter.cpp
index e76209cc8..82ea47747 100644
--- a/Source/WebCore/dom/TreeScopeAdopter.cpp
+++ b/Source/WebCore/dom/TreeScopeAdopter.cpp
@@ -28,13 +28,13 @@
 #include "Document.h"
 #include "NodeRareData.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 
 namespace WebCore {
 
-static inline ShadowRoot* shadowRootFor(Node* node)
+static inline ShadowTree* shadowTreeFor(Node* node)
 {
-    return node->isElementNode() && toElement(node)->hasShadowRoot() ? toElement(node)->shadowRootList()->youngestShadowRoot() : 0;
+    return node->isElementNode() ? toElement(node)->shadowTree() : 0;
 }
 
 void TreeScopeAdopter::moveTreeToNewScope(Node* root) const
@@ -63,10 +63,10 @@ void TreeScopeAdopter::moveTreeToNewScope(Node* root) const
         if (willMoveToNewDocument)
             moveNodeToNewDocument(node, oldDocument, newDocument);
 
-        if (ShadowRoot* shadow = shadowRootFor(node)) {
-            shadow->setParentTreeScope(m_newScope);
+        if (ShadowTree* tree = shadowTreeFor(node)) {
+            tree->setParentTreeScope(m_newScope);
             if (willMoveToNewDocument)
-                moveTreeToNewDocument(shadow, oldDocument, newDocument);
+                moveShadowTreeToNewDocument(tree, oldDocument, newDocument);
         }
     }
 }
@@ -75,11 +75,17 @@ void TreeScopeAdopter::moveTreeToNewDocument(Node* root, Document* oldDocument,
 {
     for (Node* node = root; node; node = node->traverseNextNode(root)) {
         moveNodeToNewDocument(node, oldDocument, newDocument);
-        if (ShadowRoot* shadow = shadowRootFor(node))
-            moveTreeToNewDocument(shadow, oldDocument, newDocument);
+        if (ShadowTree* tree = shadowTreeFor(node))
+            moveShadowTreeToNewDocument(tree, oldDocument, newDocument);
     }
 }
 
+inline void TreeScopeAdopter::moveShadowTreeToNewDocument(ShadowTree* tree, Document* oldDocument, Document* newDocument) const
+{
+    for (ShadowRoot* root = tree->youngestShadowRoot(); root; root = root->olderShadowRoot())
+        moveTreeToNewDocument(root, oldDocument, newDocument);
+}
+
 #ifndef NDEBUG
 static bool didMoveToNewDocumentWasCalled = false;
 static Document* oldDocumentDidMoveToNewDocumentWasCalledWith = 0;
diff --git a/Source/WebCore/dom/TreeScopeAdopter.h b/Source/WebCore/dom/TreeScopeAdopter.h
index d2bd4d4f0..94255f479 100644
--- a/Source/WebCore/dom/TreeScopeAdopter.h
+++ b/Source/WebCore/dom/TreeScopeAdopter.h
@@ -46,6 +46,7 @@ private:
     void moveTreeToNewScope(Node*) const;
     void moveTreeToNewDocument(Node*, Document* oldDocument, Document* newDocument) const;
     void moveNodeToNewDocument(Node*, Document* oldDocument, Document* newDocument) const;
+    void moveShadowTreeToNewDocument(ShadowTree*, Document* oldDocument, Document* newDocument) const;
 
     Node* m_toAdopt;
     TreeScope* m_newScope;
diff --git a/Source/WebCore/dom/WebKitMutationObserver.cpp b/Source/WebCore/dom/WebKitMutationObserver.cpp
index 60153627c..330cdca46 100644
--- a/Source/WebCore/dom/WebKitMutationObserver.cpp
+++ b/Source/WebCore/dom/WebKitMutationObserver.cpp
@@ -89,6 +89,7 @@ void WebKitMutationObserver::observe(Node* node, MutationObserverOptions options
 
 void WebKitMutationObserver::disconnect()
 {
+    m_records.clear();
     HashSet<MutationObserverRegistration*> registrations(m_registrations);
     for (HashSet<MutationObserverRegistration*>::iterator iter = registrations.begin(); iter != registrations.end(); ++iter)
         (*iter)->unregister();
@@ -123,6 +124,9 @@ void WebKitMutationObserver::enqueueMutationRecord(PassRefPtr<MutationRecord> mu
 
 void WebKitMutationObserver::deliver()
 {
+    if (m_records.isEmpty())
+        return;
+
     MutationRecordArray records;
     records.swap(m_records);
 
diff --git a/Source/WebCore/dom/WebKitMutationObserver.idl b/Source/WebCore/dom/WebKitMutationObserver.idl
index 2c0e8faa6..cb760469d 100644
--- a/Source/WebCore/dom/WebKitMutationObserver.idl
+++ b/Source/WebCore/dom/WebKitMutationObserver.idl
@@ -31,7 +31,8 @@
 module core {
     interface [
         Conditional=MUTATION_OBSERVERS,
-        CustomConstructor
+        CustomConstructor,
+        ConstructorParameters=1
     ] WebKitMutationObserver {
         [Custom] void observe(in Node target, in MutationObserverOptions options)
             raises(DOMException);
diff --git a/Source/WebCore/dom/WebKitNamedFlow.cpp b/Source/WebCore/dom/WebKitNamedFlow.cpp
index bced96576..c36299430 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.cpp
+++ b/Source/WebCore/dom/WebKitNamedFlow.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +30,8 @@
 #include "config.h"
 #include "WebKitNamedFlow.h"
 
+#include "Node.h"
+#include "NodeList.h"
 #include "RenderFlowThread.h"
 
 namespace WebCore {
@@ -49,4 +51,13 @@ bool WebKitNamedFlow::overflow() const
     return m_parentFlowThread->overflow();
 }
 
+PassRefPtr<NodeList> WebKitNamedFlow::getRegionsByContentNode(Node* contentNode)
+{
+    if (!contentNode)
+        return 0;
+    m_parentFlowThread->document()->updateLayoutIgnorePendingStylesheets(); 
+    return contentNode->getRegionsByContentNode(m_parentFlowThread->flowThread());
+}
+
 } // namespace WebCore
+
diff --git a/Source/WebCore/dom/WebKitNamedFlow.h b/Source/WebCore/dom/WebKitNamedFlow.h
index e815f03f4..b6f58c12a 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.h
+++ b/Source/WebCore/dom/WebKitNamedFlow.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,6 +35,8 @@
 
 namespace WebCore {
 
+class Node;
+class NodeList;
 class RenderFlowThread;
 
 class WebKitNamedFlow : public RefCounted<WebKitNamedFlow> {
@@ -47,6 +49,8 @@ public:
     ~WebKitNamedFlow();
 
     bool overflow() const;
+    PassRefPtr<NodeList> getRegionsByContentNode(Node*);
+
 private:
     WebKitNamedFlow(RenderFlowThread*);
 
diff --git a/Source/WebCore/dom/WebKitNamedFlow.idl b/Source/WebCore/dom/WebKitNamedFlow.idl
index 2a065dd17..10a4d9e98 100644
--- a/Source/WebCore/dom/WebKitNamedFlow.idl
+++ b/Source/WebCore/dom/WebKitNamedFlow.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,5 +32,7 @@ module core {
         JSGenerateToJSObject
     ] WebKitNamedFlow {
         readonly attribute boolean overflow;
+        NodeList getRegionsByContentNode(in Node contentNode);
     };
 }
+
diff --git a/Source/WebCore/dom/make_names.pl b/Source/WebCore/dom/make_names.pl
index 90151e11b..c8ed58b57 100755
--- a/Source/WebCore/dom/make_names.pl
+++ b/Source/WebCore/dom/make_names.pl
@@ -179,12 +179,14 @@ sub defaultTagPropertyHash
     return (
         'constructorNeedsCreatedByParser' => 0,
         'constructorNeedsFormElement' => 0,
+        'noConstructor' => 0,
         'interfaceName' => defaultInterfaceName($_[0]),
         # By default, the JSInterfaceName is the same as the interfaceName.
         'JSInterfaceName' => defaultInterfaceName($_[0]),
         'mapToTagName' => '',
         'wrapperOnlyIfMediaIsAvailable' => 0,
-        'conditional' => 0
+        'conditional' => 0,
+        'runtimeConditional' => 0
     );
 }
 
@@ -367,12 +369,21 @@ sub printConstructorInterior
         print F <<END
     Settings* settings = document->settings();
     if (!MediaPlayer::isAvailable() || (settings && !settings->isMediaEnabled()))
-        return HTMLElement::create($constructorTagName, document);
+        return 0;
     
 END
 ;
     }
 
+    my $runtimeConditional = $enabledTags{$tagName}{runtimeConditional};
+    if ($runtimeConditional) {
+        print F <<END
+    if (!RuntimeEnabledFeatures::${runtimeConditional}Enabled())
+        return 0;
+END
+;
+    }
+
     # Call the constructor with the right parameters.
     print F "    return ${interfaceName}::create($constructorTagName, document";
     print F ", formElement" if $enabledTags{$tagName}{constructorNeedsFormElement};
@@ -393,6 +404,10 @@ sub printConstructors
         # Ignore the mapped tag
         # FIXME: It could be moved inside this loop but was split for readibility.
         next if (defined($uniqueTags{$interfaceName}) || $enabledTags{$tagName}{mapToTagName});
+        # Tags can have wrappers without constructors.
+        # This is useful to make user-agent shadow elements internally testable
+        # while keeping them from being avaialble in the HTML markup.
+        next if $enabledTags{$tagName}{noConstructor};
 
         $uniqueTags{$interfaceName} = '1';
 
@@ -426,6 +441,7 @@ sub printFunctionInits
     my %tagConstructorMap = %$tagConstructorMap;
 
     for my $tagName (sort keys %tagConstructorMap) {
+        next if $enabledTags{$tagName}{noConstructor};
 
         my $conditional = $enabledTags{$tagName}{conditional};
         if ($conditional) {
@@ -788,6 +804,8 @@ printConditionalElementIncludes($F);
 
 print F <<END
 
+#include "RuntimeEnabledFeatures.h"
+
 #if ENABLE(DASHBOARD_SUPPORT) || ENABLE(VIDEO)
 #include "Document.h"
 #include "Settings.h"
@@ -848,7 +866,7 @@ print F <<END
 END
 ;
 
-if ($parameters{namespace} ne "HTML") {
+if ($parameters{namespace} ne "HTML" and $parameters{namespace} ne "SVG") {
 print F <<END
 #if ENABLE(DASHBOARD_SUPPORT)
     Settings* settings = document->settings();
@@ -863,16 +881,22 @@ END
 print F <<END
     if (!gFunctionMap)
         createFunctionMap();
-    if (ConstructorFunction function = gFunctionMap->get(qName.localName().impl()))
+    if (ConstructorFunction function = gFunctionMap->get(qName.localName().impl())) {
 END
 ;
 
 if ($parameters{namespace} eq "HTML") {
-    print F "        return function(qName, document, formElement, createdByParser);\n";
+    print F "        if (PassRefPtr<$parameters{namespace}Element> element = function(qName, document, formElement, createdByParser))\n";
+    print F "            return element;\n";
 } else {
-    print F "        return function(qName, document, createdByParser);\n";
+    print F "        if (PassRefPtr<$parameters{namespace}Element> element = function(qName, document, createdByParser))\n";
+    print F "            return element;\n";
 }
+print F <<END
+    }
 
+END
+;
 print F "    return $parameters{fallbackInterfaceName}::create(qName, document);\n";
 
 print F <<END
@@ -984,6 +1008,20 @@ static JSDOMWrapper* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGloba
 
 END
 ;
+            } elsif ($enabledTags{$tagName}{runtimeConditional}) {
+                my $runtimeConditional = $enabledTags{$tagName}{runtimeConditional};
+                print F <<END
+static JSDOMWrapper* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
+{
+    if (!RuntimeEnabledFeatures::${runtimeConditional}Enabled()) {
+        ASSERT(!element || element->is$parameters{fallbackInterfaceName}());
+        return CREATE_DOM_WRAPPER(exec, globalObject, $parameters{fallbackInterfaceName}, element.get());
+    }
+
+    return CREATE_DOM_WRAPPER(exec, globalObject, ${JSInterfaceName}, element.get());
+}
+END
+;
             } else {
                 print F <<END
 static JSDOMWrapper* create${JSInterfaceName}Wrapper(ExecState* exec, JSDOMGlobalObject* globalObject, PassRefPtr<$parameters{namespace}Element> element)
@@ -1007,6 +1045,17 @@ static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespa
 
 END
 ;
+            } elsif ($enabledTags{$tagName}{runtimeConditional}) {
+                my $runtimeConditional = $enabledTags{$tagName}{runtimeConditional};
+                print F <<END
+static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element)
+{
+    if (!RuntimeEnabledFeatures::${runtimeConditional}Enabled())
+        return V8$parameters{fallbackInterfaceName}::wrap(to$parameters{fallbackInterfaceName}(element));
+    return toV8(static_cast<${JSInterfaceName}*>(element));
+}
+END
+;
             } elsif (${JSInterfaceName} eq "HTMLElement") {
                 print F <<END
 static v8::Handle<v8::Value> create${JSInterfaceName}Wrapper($parameters{namespace}Element* element)
@@ -1062,6 +1111,8 @@ sub printWrapperFactoryCppFile
 
     print F <<END
 
+#include "RuntimeEnabledFeatures.h"
+
 #if ENABLE(VIDEO)
 #include "Document.h"
 #include "Settings.h"
@@ -1161,7 +1212,7 @@ END
     } elsif ($wrapperFactoryType eq "V8") {
         print F <<END
         return createWrapperFunction(element);
-    return V8$parameters{fallbackInterfaceName}::wrap(static_cast<$parameters{fallbackInterfaceName}*>(element), forceNewObject);
+    return V8$parameters{fallbackInterfaceName}::wrap(to$parameters{fallbackInterfaceName}(element), forceNewObject);
 END
 ;
     }
diff --git a/Source/WebCore/editing/ApplyStyleCommand.cpp b/Source/WebCore/editing/ApplyStyleCommand.cpp
index 25444bb7d..7c6347c41 100644
--- a/Source/WebCore/editing/ApplyStyleCommand.cpp
+++ b/Source/WebCore/editing/ApplyStyleCommand.cpp
@@ -80,7 +80,7 @@ static bool hasNoAttributeOrOnlyStyleAttribute(const StyledElement* element, Sho
     if (element->getAttribute(classAttr) == styleSpanClassString())
         matchedAttributes++;
     if (element->hasAttribute(styleAttr) && (shouldStyleAttributeBeEmpty == AllowNonEmptyStyleAttribute
-        || !element->inlineStyleDecl() || element->inlineStyleDecl()->isEmpty()))
+        || !element->inlineStyle() || element->inlineStyle()->isEmpty()))
         matchedAttributes++;
 
     ASSERT(matchedAttributes <= element->attributeCount());
@@ -382,7 +382,7 @@ void ApplyStyleCommand::applyRelativeFontStyleChange(EditingStyle* style)
         }
         lastStyledNode = node;
 
-        StylePropertySet* inlineStyleDecl = element->ensureInlineStyleDecl();
+        RefPtr<StylePropertySet> inlineStyleDecl = element->ensureInlineStyle()->copy();
         float currentFontSize = computedFontSize(node);
         float desiredFontSize = max(MinimumFontSize, startingFontSizes.get(node) + style->fontSizeDelta());
         RefPtr<CSSValue> value = inlineStyleDecl->getPropertyCSSValue(CSSPropertyFontSize);
@@ -509,7 +509,7 @@ void ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock(Node* node, Node* unsp
             // other attributes, like we (should) do with B and I elements.
             removeNodeAttribute(element, dirAttr);
         } else {
-            RefPtr<StylePropertySet> inlineStyle = element->ensureInlineStyleDecl()->copy();
+            RefPtr<StylePropertySet> inlineStyle = element->ensureInlineStyle()->copy();
             inlineStyle->setProperty(CSSPropertyUnicodeBidi, CSSValueNormal);
             inlineStyle->removeProperty(CSSPropertyDirection);
             setNodeAttribute(element, styleAttr, inlineStyle->asText());
@@ -723,7 +723,7 @@ void ApplyStyleCommand::applyInlineStyleToNodeRange(EditingStyle* style, Node* n
                 break;
             // Add to this element's inline style and skip over its contents.
             HTMLElement* element = toHTMLElement(node);
-            RefPtr<StylePropertySet> inlineStyle = element->ensureInlineStyleDecl()->copy();
+            RefPtr<StylePropertySet> inlineStyle = element->ensureInlineStyle()->copy();
             inlineStyle->merge(style->style());
             setNodeAttribute(element, styleAttr, inlineStyle->asText());
             next = node->traverseNextSibling();
@@ -888,14 +888,12 @@ bool ApplyStyleCommand::removeCSSStyle(EditingStyle* style, HTMLElement* element
     if (!style->conflictsWithInlineStyleOfElement(element, extractedStyle, properties))
         return false;
 
-    StylePropertySet* inlineStyle = element->inlineStyleDecl();
-    ASSERT(inlineStyle);
     // FIXME: We should use a mass-removal function here but we don't have an undoable one yet.
     for (size_t i = 0; i < properties.size(); i++)
         removeCSSProperty(element, properties[i]);
 
     // No need to serialize <foo style=""> if we just removed the last css property
-    if (inlineStyle->isEmpty())
+    if (element->inlineStyle()->isEmpty())
         removeNodeAttribute(element, styleAttr);
 
     if (isSpanWithoutAttributesOrUnstyledStyleSpan(element))
@@ -932,7 +930,7 @@ void ApplyStyleCommand::applyInlineStyleToPushDown(Node* node, EditingStyle* sty
         return;
 
     RefPtr<EditingStyle> newInlineStyle = style;
-    if (node->isHTMLElement() && toHTMLElement(node)->inlineStyleDecl()) {
+    if (node->isHTMLElement() && toHTMLElement(node)->inlineStyle()) {
         newInlineStyle = style->copy();
         newInlineStyle->mergeInlineStyleOfElement(toHTMLElement(node), EditingStyle::OverrideValues);
     }
@@ -1308,7 +1306,7 @@ void ApplyStyleCommand::addBlockStyle(const StyleChange& styleChange, HTMLElemen
         return;
         
     String cssText = styleChange.cssStyle();
-    if (StylePropertySet* decl = block->inlineStyleDecl())
+    if (const StylePropertySet* decl = block->inlineStyle())
         cssText += decl->asText();
     setNodeAttribute(block, styleAttr, cssText);
 }
@@ -1373,7 +1371,7 @@ void ApplyStyleCommand::addInlineStyleIfNeeded(EditingStyle* style, PassRefPtr<N
 
     if (styleChange.cssStyle().length()) {
         if (styleContainer) {
-            if (StylePropertySet* existingStyle = styleContainer->inlineStyleDecl())
+            if (const StylePropertySet* existingStyle = styleContainer->inlineStyle())
                 setNodeAttribute(styleContainer, styleAttr, existingStyle->asText() + styleChange.cssStyle());
             else
                 setNodeAttribute(styleContainer, styleAttr, styleChange.cssStyle());
diff --git a/Source/WebCore/editing/CompositeEditCommand.cpp b/Source/WebCore/editing/CompositeEditCommand.cpp
index f57657137..830eacf6f 100644
--- a/Source/WebCore/editing/CompositeEditCommand.cpp
+++ b/Source/WebCore/editing/CompositeEditCommand.cpp
@@ -1032,8 +1032,15 @@ void CompositeEditCommand::cleanupAfterDeletion(VisiblePosition destination)
         // doesn't require a placeholder to prop itself open (like a bordered
         // div or an li), remove it during the move (the list removal code
         // expects this behavior).
-        else if (isBlock(node))
+        else if (isBlock(node)) {
+            // If caret position after deletion and destination position coincides,
+            // node should not be removed.
+            if (!position.rendersInDifferentPosition(destination.deepEquivalent())) {
+                prune(node);
+                return;
+            }
             removeNodeAndPruneAncestors(node);
+        }
         else if (lineBreakExistsAtPosition(position)) {
             // There is a preserved '\n' at caretAfterDelete.
             // We can safely assume this is a text node.
diff --git a/Source/WebCore/editing/DeleteSelectionCommand.cpp b/Source/WebCore/editing/DeleteSelectionCommand.cpp
index 9a94509ce..5f5dfcfbd 100644
--- a/Source/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/Source/WebCore/editing/DeleteSelectionCommand.cpp
@@ -363,7 +363,7 @@ void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
         // Make sure empty cell has some height, if a placeholder can be inserted.
         document()->updateLayoutIgnorePendingStylesheets();
         RenderObject *r = node->renderer();
-        if (r && r->isTableCell() && toRenderTableCell(r)->contentHeight() <= 0) {
+        if (r && r->isTableCell() && toRenderTableCell(r)->contentHeight(IncludeIntrinsicPadding) <= 0) {
             Position firstEditablePosition = firstEditablePositionInNode(node.get());
             if (firstEditablePosition.isNotNull())
                 insertBlockPlaceholder(firstEditablePosition);
diff --git a/Source/WebCore/editing/EditingStyle.cpp b/Source/WebCore/editing/EditingStyle.cpp
index 57291c1f5..3a360d8a9 100644
--- a/Source/WebCore/editing/EditingStyle.cpp
+++ b/Source/WebCore/editing/EditingStyle.cpp
@@ -44,6 +44,7 @@
 #include "QualifiedName.h"
 #include "RenderStyle.h"
 #include "StylePropertySet.h"
+#include "StyleRule.h"
 #include "StyledElement.h"
 #include "htmlediting.h"
 #include "visible_units.h"
@@ -124,7 +125,7 @@ public:
     virtual ~HTMLElementEquivalent() { }
     virtual bool matches(const Element* element) const { return !m_tagName || element->hasTagName(*m_tagName); }
     virtual bool hasAttribute() const { return false; }
-    virtual bool propertyExistsInStyle(StylePropertySet* style) const { return style && style->getPropertyCSSValue(m_propertyID); }
+    virtual bool propertyExistsInStyle(const StylePropertySet* style) const { return style && style->getPropertyCSSValue(m_propertyID); }
     virtual bool valueIsPresentInStyle(Element*, StylePropertySet*) const;
     virtual void addToStyle(Element*, EditingStyle*) const;
 
@@ -174,7 +175,7 @@ public:
     {
         return adoptPtr(new HTMLTextDecorationEquivalent(primitiveValue, tagName));
     }
-    virtual bool propertyExistsInStyle(StylePropertySet*) const;
+    virtual bool propertyExistsInStyle(const StylePropertySet*) const;
     virtual bool valueIsPresentInStyle(Element*, StylePropertySet*) const;
 
 private:
@@ -187,7 +188,7 @@ HTMLTextDecorationEquivalent::HTMLTextDecorationEquivalent(int primitiveValue, c
 {
 }
 
-bool HTMLTextDecorationEquivalent::propertyExistsInStyle(StylePropertySet* style) const
+bool HTMLTextDecorationEquivalent::propertyExistsInStyle(const StylePropertySet* style) const
 {
     return style->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect) || style->getPropertyCSSValue(CSSPropertyTextDecoration);
 }
@@ -663,7 +664,7 @@ bool EditingStyle::conflictsWithInlineStyleOfElement(StyledElement* element, Edi
     ASSERT(element);
     ASSERT(!conflictingProperties || conflictingProperties->isEmpty());
 
-    StylePropertySet* inlineStyle = element->inlineStyleDecl();
+    const StylePropertySet* inlineStyle = element->inlineStyle();
     if (!m_mutableStyle || !inlineStyle)
         return false;
 
@@ -849,7 +850,7 @@ bool EditingStyle::elementIsStyledSpanOrHTMLEquivalent(const HTMLElement* elemen
         matchedAttributes++;
 
     if (element->hasAttribute(HTMLNames::styleAttr)) {
-        if (StylePropertySet* style = element->inlineStyleDecl()) {
+        if (const StylePropertySet* style = element->inlineStyle()) {
             unsigned propertyCount = style->propertyCount();
             for (unsigned i = 0; i < propertyCount; ++i) {
                 if (!isEditingProperty(style->propertyAt(i).id()))
@@ -911,18 +912,18 @@ void EditingStyle::mergeTypingStyle(Document* document)
 void EditingStyle::mergeInlineStyleOfElement(StyledElement* element, CSSPropertyOverrideMode mode, PropertiesToInclude propertiesToInclude)
 {
     ASSERT(element);
-    if (!element->inlineStyleDecl())
+    if (!element->inlineStyle())
         return;
 
     switch (propertiesToInclude) {
     case AllProperties:
-        mergeStyle(element->inlineStyleDecl(), mode);
+        mergeStyle(element->inlineStyle(), mode);
         return;
     case OnlyEditingInheritableProperties:
-        mergeStyle(copyEditingProperties(element->inlineStyleDecl(), OnlyInheritableEditingProperties).get(), mode);
+        mergeStyle(copyEditingProperties(element->inlineStyle(), OnlyInheritableEditingProperties).get(), mode);
         return;
     case EditingPropertiesInEffect:
-        mergeStyle(copyEditingProperties(element->inlineStyleDecl(), AllEditingProperties).get(), mode);
+        mergeStyle(copyEditingProperties(element->inlineStyle(), AllEditingProperties).get(), mode);
         return;
     }
 }
@@ -930,7 +931,7 @@ void EditingStyle::mergeInlineStyleOfElement(StyledElement* element, CSSProperty
 static inline bool elementMatchesAndPropertyIsNotInInlineStyleDecl(const HTMLElementEquivalent* equivalent, const StyledElement* element,
     EditingStyle::CSSPropertyOverrideMode mode, StylePropertySet* style)
 {
-    return equivalent->matches(element) && !equivalent->propertyExistsInStyle(element->inlineStyleDecl())
+    return equivalent->matches(element) && !equivalent->propertyExistsInStyle(element->inlineStyle())
         && (mode == EditingStyle::OverrideValues || !equivalent->propertyExistsInStyle(style));
 }
 
@@ -996,7 +997,7 @@ static void mergeTextDecorationValues(CSSValueList* mergedValue, const CSSValueL
         mergedValue->append(lineThrough.get());
 }
 
-void EditingStyle::mergeStyle(StylePropertySet* style, CSSPropertyOverrideMode mode)
+void EditingStyle::mergeStyle(const StylePropertySet* style, CSSPropertyOverrideMode mode)
 {
     if (!style)
         return;
@@ -1032,7 +1033,7 @@ static PassRefPtr<StylePropertySet> styleFromMatchedRulesForElement(Element* ele
     if (matchedRules) {
         for (unsigned i = 0; i < matchedRules->length(); i++) {
             if (matchedRules->item(i)->type() == CSSRule::STYLE_RULE) {
-                RefPtr<StylePropertySet> s = static_cast<CSSStyleRule*>(matchedRules->item(i))->declaration();
+                RefPtr<StylePropertySet> s = static_cast<CSSStyleRule*>(matchedRules->item(i))->styleRule()->properties();
                 style->merge(s.get(), true);
             }
         }
@@ -1378,6 +1379,8 @@ void StyleChange::extractTextStyles(Document* document, StylePropertySet* style,
     }
 
     m_applyFontFace = style->getPropertyValue(CSSPropertyFontFamily);
+    // Remove single quotes for Outlook 2007 compatibility. See https://bugs.webkit.org/show_bug.cgi?id=79448
+    m_applyFontFace.replace('\'', "");
     style->removeProperty(CSSPropertyFontFamily);
 
     if (RefPtr<CSSValue> fontSize = style->getPropertyCSSValue(CSSPropertyFontSize)) {
diff --git a/Source/WebCore/editing/EditingStyle.h b/Source/WebCore/editing/EditingStyle.h
index 71dc652f0..c213036e1 100644
--- a/Source/WebCore/editing/EditingStyle.h
+++ b/Source/WebCore/editing/EditingStyle.h
@@ -161,7 +161,7 @@ private:
     TriState triStateOfStyle(CSSStyleDeclaration* styleToCompare, ShouldIgnoreTextOnlyProperties) const;
     bool conflictsWithInlineStyleOfElement(StyledElement*, EditingStyle* extractedStyle, Vector<CSSPropertyID>* conflictingProperties) const;
     void mergeInlineAndImplicitStyleOfElement(StyledElement*, CSSPropertyOverrideMode, PropertiesToInclude);
-    void mergeStyle(StylePropertySet*, CSSPropertyOverrideMode);
+    void mergeStyle(const StylePropertySet*, CSSPropertyOverrideMode);
 
     RefPtr<StylePropertySet> m_mutableStyle;
     bool m_shouldUseFixedDefaultFontSize;
diff --git a/Source/WebCore/editing/Editor.cpp b/Source/WebCore/editing/Editor.cpp
index 1ce24e538..72e21fa24 100644
--- a/Source/WebCore/editing/Editor.cpp
+++ b/Source/WebCore/editing/Editor.cpp
@@ -846,6 +846,7 @@ Editor::Editor(Frame* frame)
     , m_spellChecker(adoptPtr(new SpellChecker(frame)))
     , m_spellingCorrector(adoptPtr(new SpellingCorrectionController(frame)))
     , m_areMarkedTextMatchesHighlighted(false)
+    , m_defaultParagraphSeparator(EditorParagraphSeparatorIsDiv)
 {
 }
 
@@ -858,6 +859,7 @@ void Editor::clear()
     m_compositionNode = 0;
     m_customCompositionUnderlines.clear();
     m_shouldStyleWithCSS = false;
+    m_defaultParagraphSeparator = EditorParagraphSeparatorIsDiv;
 }
 
 bool Editor::insertText(const String& text, Event* triggeringEvent)
diff --git a/Source/WebCore/editing/Editor.h b/Source/WebCore/editing/Editor.h
index e398bbf3e..3c2544a71 100644
--- a/Source/WebCore/editing/Editor.h
+++ b/Source/WebCore/editing/Editor.h
@@ -80,6 +80,7 @@ struct CompositionUnderline {
 };
 
 enum EditorCommandSource { CommandFromMenuOrKeyBinding, CommandFromDOM, CommandFromDOMWithUserInterface };
+enum EditorParagraphSeparator { EditorParagraphSeparatorIsDiv, EditorParagraphSeparatorIsP };
 
 class Editor {
 public:
@@ -383,6 +384,9 @@ public:
 
     void deviceScaleFactorChanged();
 
+    EditorParagraphSeparator defaultParagraphSeparator() const { return m_defaultParagraphSeparator; }
+    void setDefaultParagraphSeparator(EditorParagraphSeparator separator) { m_defaultParagraphSeparator = separator; }
+
 private:
     Frame* m_frame;
     OwnPtr<DeleteButtonController> m_deleteButtonController;
@@ -400,6 +404,7 @@ private:
     OwnPtr<SpellingCorrectionController> m_spellingCorrector;
     VisibleSelection m_mark;
     bool m_areMarkedTextMatchesHighlighted;
+    EditorParagraphSeparator m_defaultParagraphSeparator;
 
     bool canDeleteRange(Range*) const;
     bool canSmartReplaceWithPasteboard(Pasteboard*);
diff --git a/Source/WebCore/editing/EditorCommand.cpp b/Source/WebCore/editing/EditorCommand.cpp
index a4137425d..b9f34b980 100644
--- a/Source/WebCore/editing/EditorCommand.cpp
+++ b/Source/WebCore/editing/EditorCommand.cpp
@@ -307,6 +307,16 @@ static bool executeCut(Frame* frame, Event*, EditorCommandSource source, const S
     return true;
 }
 
+static bool executeDefaultParagraphSeparator(Frame* frame, Event*, EditorCommandSource, const String& value)
+{
+    if (equalIgnoringCase(value, "div"))
+        frame->editor()->setDefaultParagraphSeparator(EditorParagraphSeparatorIsDiv);
+    else if (equalIgnoringCase(value, "p"))
+        frame->editor()->setDefaultParagraphSeparator(EditorParagraphSeparatorIsP);
+
+    return true;
+}
+
 static bool executeDelete(Frame* frame, Event*, EditorCommandSource source, const String&)
 {
     switch (source) {
@@ -1378,6 +1388,19 @@ static String valueBackColor(Frame* frame, Event*)
     return valueStyle(frame, CSSPropertyBackgroundColor);
 }
 
+static String valueDefaultParagraphSeparator(Frame* frame, Event*)
+{
+    switch (frame->editor()->defaultParagraphSeparator()) {
+    case EditorParagraphSeparatorIsDiv:
+        return divTag.localName();
+    case EditorParagraphSeparatorIsP:
+        return pTag.localName();
+    }
+
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
 static String valueFontName(Frame* frame, Event*)
 {
     return valueStyle(frame, CSSPropertyFontFamily);
@@ -1429,6 +1452,7 @@ static const CommandMap& createCommandMap()
         { "Copy", { executeCopy, supportedCopyCut, enabledCopy, stateNone, valueNull, notTextInsertion, allowExecutionWhenDisabled } },
         { "CreateLink", { executeCreateLink, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Cut", { executeCut, supportedCopyCut, enabledCut, stateNone, valueNull, notTextInsertion, allowExecutionWhenDisabled } },
+        { "DefaultParagraphSeparator", { executeDefaultParagraphSeparator, supported, enabled, stateNone, valueDefaultParagraphSeparator, notTextInsertion, doNotAllowExecutionWhenDisabled} },
         { "Delete", { executeDelete, supported, enabledDelete, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "DeleteBackward", { executeDeleteBackward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "DeleteBackwardByDecomposingPreviousCharacter", { executeDeleteBackwardByDecomposingPreviousCharacter, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
diff --git a/Source/WebCore/editing/RemoveCSSPropertyCommand.cpp b/Source/WebCore/editing/RemoveCSSPropertyCommand.cpp
index ca5baba4b..58ca6db61 100644
--- a/Source/WebCore/editing/RemoveCSSPropertyCommand.cpp
+++ b/Source/WebCore/editing/RemoveCSSPropertyCommand.cpp
@@ -43,7 +43,7 @@ RemoveCSSPropertyCommand::RemoveCSSPropertyCommand(Document* document, PassRefPt
 
 void RemoveCSSPropertyCommand::doApply()
 {
-    StylePropertySet* style = m_element->inlineStyleDecl();
+    const StylePropertySet* style = m_element->inlineStyle();
     m_oldValue = style->getPropertyValue(m_property);
     m_important = style->propertyIsImportant(m_property);
 
diff --git a/Source/WebCore/editing/RenderedPosition.cpp b/Source/WebCore/editing/RenderedPosition.cpp
index fb3bfb06a..8c900232a 100644
--- a/Source/WebCore/editing/RenderedPosition.cpp
+++ b/Source/WebCore/editing/RenderedPosition.cpp
@@ -100,14 +100,14 @@ RenderedPosition::RenderedPosition(const Position& position, EAffinity affinity)
 InlineBox* RenderedPosition::prevLeafChild() const
 {
     if (m_prevLeafChild == uncachedInlineBox())
-        m_prevLeafChild = m_inlineBox->prevLeafChild();
+        m_prevLeafChild = m_inlineBox->prevLeafChildIgnoringLineBreak();
     return m_prevLeafChild;
 }
 
 InlineBox* RenderedPosition::nextLeafChild() const
 {
     if (m_nextLeafChild == uncachedInlineBox())
-        m_nextLeafChild = m_inlineBox->nextLeafChild();
+        m_nextLeafChild = m_inlineBox->nextLeafChildIgnoringLineBreak();
     return m_nextLeafChild;
 }
 
@@ -137,7 +137,7 @@ RenderedPosition RenderedPosition::leftBoundaryOfBidiRun(unsigned char bidiLevel
 
     InlineBox* box = m_inlineBox;
     do {
-        InlineBox* prev = box->prevLeafChild();
+        InlineBox* prev = box->prevLeafChildIgnoringLineBreak();
         if (!prev || prev->bidiLevel() < bidiLevelOfRun)
             return RenderedPosition(box->renderer(), box, box->caretLeftmostOffset());
         box = prev;
@@ -154,7 +154,7 @@ RenderedPosition RenderedPosition::rightBoundaryOfBidiRun(unsigned char bidiLeve
 
     InlineBox* box = m_inlineBox;
     do {
-        InlineBox* next = box->nextLeafChild();
+        InlineBox* next = box->nextLeafChildIgnoringLineBreak();
         if (!next || next->bidiLevel() < bidiLevelOfRun)
             return RenderedPosition(box->renderer(), box, box->caretRightmostOffset());
         box = next;
diff --git a/Source/WebCore/editing/ReplaceSelectionCommand.cpp b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
index 95fdaf060..af5a8be13 100644
--- a/Source/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/Source/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -484,7 +484,7 @@ void ReplaceSelectionCommand::removeRedundantStylesAndKeepStyleSpanInline(Insert
 
         StyledElement* element = static_cast<StyledElement*>(node.get());
 
-        StylePropertySet* inlineStyle = element->inlineStyleDecl();
+        const StylePropertySet* inlineStyle = element->inlineStyle();
         RefPtr<EditingStyle> newInlineStyle = EditingStyle::create(inlineStyle);
         if (inlineStyle) {
             ContainerNode* context = element->parentNode();
@@ -703,7 +703,7 @@ void ReplaceSelectionCommand::handleStyleSpans(InsertedNodes& insertedNodes)
     if (!wrappingStyleSpan)
         return;
 
-    RefPtr<EditingStyle> style = EditingStyle::create(wrappingStyleSpan->ensureInlineStyleDecl());
+    RefPtr<EditingStyle> style = EditingStyle::create(wrappingStyleSpan->ensureInlineStyle());
     ContainerNode* context = wrappingStyleSpan->parentNode();
 
     // If Mail wraps the fragment with a Paste as Quotation blockquote, or if you're pasting into a quoted region,
diff --git a/Source/WebCore/editing/TextIterator.cpp b/Source/WebCore/editing/TextIterator.cpp
index aaeca4f9a..e0bf8c3a0 100644
--- a/Source/WebCore/editing/TextIterator.cpp
+++ b/Source/WebCore/editing/TextIterator.cpp
@@ -394,7 +394,8 @@ void TextIterator::advance()
                     m_handledNode = handleTextNode();
                 else if (renderer && (renderer->isImage() || renderer->isWidget() ||
                          (renderer->node() && renderer->node()->isElementNode() &&
-                          static_cast<Element*>(renderer->node())->isFormControlElement())))
+                          (static_cast<Element*>(renderer->node())->isFormControlElement()
+                          || static_cast<Element*>(renderer->node())->hasTagName(legendTag)))))
                     m_handledNode = handleReplacedElement();
                 else
                     m_handledNode = handleNonTextNode();
diff --git a/Source/WebCore/editing/htmlediting.cpp b/Source/WebCore/editing/htmlediting.cpp
index 07046100e..f4d91e9ce 100644
--- a/Source/WebCore/editing/htmlediting.cpp
+++ b/Source/WebCore/editing/htmlediting.cpp
@@ -29,6 +29,8 @@
 #include "AXObjectCache.h"
 #include "Document.h"
 #include "EditingText.h"
+#include "Editor.h"
+#include "Frame.h"
 #include "HTMLBRElement.h"
 #include "HTMLDivElement.h"
 #include "HTMLElementFactory.h"
@@ -38,6 +40,7 @@
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
 #include "HTMLOListElement.h"
+#include "HTMLParagraphElement.h"
 #include "HTMLUListElement.h"
 #include "PositionIterator.h"
 #include "RenderObject.h"
@@ -844,7 +847,15 @@ bool isEmptyTableCell(const Node* node)
 
 PassRefPtr<HTMLElement> createDefaultParagraphElement(Document* document)
 {
-    return HTMLDivElement::create(document);
+    switch (document->frame()->editor()->defaultParagraphSeparator()) {
+    case EditorParagraphSeparatorIsDiv:
+        return HTMLDivElement::create(document);
+    case EditorParagraphSeparatorIsP:
+        return HTMLParagraphElement::create(document);
+    }
+
+    ASSERT_NOT_REACHED();
+    return 0;
 }
 
 PassRefPtr<HTMLElement> createBreakElement(Document* document)
@@ -1142,22 +1153,15 @@ bool isRenderedAsNonInlineTableImageOrHR(const Node* node)
 
 bool areIdenticalElements(const Node* first, const Node* second)
 {
-    // check that tag name and all attribute names and values are identical
-
     if (!first->isElementNode() || !second->isElementNode())
         return false;
 
-    if (!toElement(first)->tagQName().matches(toElement(second)->tagQName()))
+    const Element* firstElement = toElement(first);
+    const Element* secondElement = toElement(second);
+    if (!firstElement->hasTagName(secondElement->tagQName()))
         return false;
 
-    NamedNodeMap* firstMap = toElement(first)->updatedAttributes();
-    NamedNodeMap* secondMap = toElement(second)->updatedAttributes();
-
-    if (firstMap)
-        return firstMap->mapsEquivalent(secondMap);
-    if (secondMap)
-        return secondMap->mapsEquivalent(firstMap);
-    return true;
+    return firstElement->hasEquivalentAttributes(secondElement);
 }
 
 bool isNonTableCellHTMLBlockElement(const Node* node)
diff --git a/Source/WebCore/editing/mac/EditorMac.mm b/Source/WebCore/editing/mac/EditorMac.mm
index 2f5833674..85133dd4f 100644
--- a/Source/WebCore/editing/mac/EditorMac.mm
+++ b/Source/WebCore/editing/mac/EditorMac.mm
@@ -74,7 +74,7 @@ void Editor::pasteWithPasteboard(Pasteboard* pasteboard, bool allowPlainText)
     RefPtr<Range> range = selectedRange();
     bool choosePlainText;
     
-    m_frame->editor()->client()->setInsertionPasteboard([NSPasteboard generalPasteboard]);
+    m_frame->editor()->client()->setInsertionPasteboard(NSGeneralPboard);
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
     RefPtr<DocumentFragment> fragment = pasteboard->documentFragment(m_frame, range, allowPlainText, choosePlainText);
     if (fragment && shouldInsertFragment(fragment, range, EditorInsertActionPasted))
@@ -94,7 +94,7 @@ void Editor::pasteWithPasteboard(Pasteboard* pasteboard, bool allowPlainText)
             pasteAsFragment(fragment, canSmartReplaceWithPasteboard(pasteboard), false);
     }
 #endif
-    m_frame->editor()->client()->setInsertionPasteboard(nil);
+    m_frame->editor()->client()->setInsertionPasteboard(String());
 }
 
 static RenderStyle* styleForSelectionStart(Frame* frame, Node *&nodeToRemove)
@@ -282,11 +282,10 @@ void Editor::takeFindStringFromSelection()
         return;
     }
 
-    NSString *nsSelectedText = m_frame->displayStringModifiedByEncoding(selectedText());
-
-    NSPasteboard *findPasteboard = [NSPasteboard pasteboardWithName:NSFindPboard];
-    [findPasteboard declareTypes:[NSArray arrayWithObject:NSStringPboardType] owner:nil];
-    [findPasteboard setString:nsSelectedText forType:NSStringPboardType];
+    Vector<String> types;
+    types.append(String(NSStringPboardType));
+    platformStrategies()->pasteboardStrategy()->setTypes(types, NSFindPboard);
+    platformStrategies()->pasteboardStrategy()->setStringForType(m_frame->displayStringModifiedByEncoding(selectedText()), NSStringPboardType, NSFindPboard);
 }
 
 void Editor::writeSelectionToPasteboard(const String& pasteboardName, const Vector<String>& pasteboardTypes)
diff --git a/Source/WebCore/editing/markup.cpp b/Source/WebCore/editing/markup.cpp
index c0c0bf4db..05cde4a63 100644
--- a/Source/WebCore/editing/markup.cpp
+++ b/Source/WebCore/editing/markup.cpp
@@ -39,10 +39,12 @@
 #include "CSSStyleSelector.h"
 #include "CSSValue.h"
 #include "CSSValueKeywords.h"
+#include "ChildListMutationScope.h"
 #include "DeleteButtonController.h"
 #include "DocumentFragment.h"
 #include "DocumentType.h"
 #include "Editor.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLBodyElement.h"
 #include "HTMLElement.h"
@@ -308,8 +310,8 @@ void StyledMarkupAccumulator::appendElement(StringBuilder& out, Element* element
         } else
             newInlineStyle = EditingStyle::create();
 
-        if (element->isStyledElement() && static_cast<StyledElement*>(element)->inlineStyleDecl())
-            newInlineStyle->overrideWithStyle(static_cast<StyledElement*>(element)->inlineStyleDecl());
+        if (element->isStyledElement() && static_cast<StyledElement*>(element)->inlineStyle())
+            newInlineStyle->overrideWithStyle(static_cast<StyledElement*>(element)->inlineStyle());
 
         if (shouldAnnotateOrForceInline) {
             if (shouldAnnotate())
@@ -493,7 +495,7 @@ static PassRefPtr<EditingStyle> styleFromMatchedRulesAndInlineDecl(const Node* n
     // FIXME: Having to const_cast here is ugly, but it is quite a bit of work to untangle
     // the non-const-ness of styleFromMatchedRulesForElement.
     HTMLElement* element = const_cast<HTMLElement*>(static_cast<const HTMLElement*>(node));
-    RefPtr<EditingStyle> style = EditingStyle::create(element->inlineStyleDecl());
+    RefPtr<EditingStyle> style = EditingStyle::create(element->inlineStyle());
     style->mergeStyleFromRules(element);
     return style.release();
 }
@@ -691,7 +693,7 @@ static bool findNodesSurroundingContext(Document* document, RefPtr<Node>& nodeBe
 static void trimFragment(DocumentFragment* fragment, Node* nodeBeforeContext, Node* nodeAfterContext)
 {
     ExceptionCode ec = 0;
-    Node* next;
+    RefPtr<Node> next;
     for (RefPtr<Node> node = fragment->firstChild(); node; node = next) {
         if (nodeBeforeContext->isDescendantOf(node.get())) {
             next = node->traverseNextNode();
@@ -705,9 +707,9 @@ static void trimFragment(DocumentFragment* fragment, Node* nodeBeforeContext, No
     }
 
     ASSERT(nodeAfterContext->parentNode());
-    for (Node* node = nodeAfterContext; node; node = next) {
+    for (RefPtr<Node> node = nodeAfterContext; node; node = next) {
         next = node->traverseNextSibling();
-        node->parentNode()->removeChild(node, ec);
+        node->parentNode()->removeChild(node.get(), ec);
         ASSERT(!ec);
     }
 }
@@ -990,4 +992,84 @@ String urlToMarkup(const KURL& url, const String& title)
     return markup.toString();
 }
 
+PassRefPtr<DocumentFragment> createFragmentFromSource(const String& markup, Element* contextElement, ExceptionCode& ec)
+{
+    Document* document = contextElement->document();
+    RefPtr<DocumentFragment> fragment = DocumentFragment::create(document);
+
+    if (document->isHTMLDocument()) {
+        fragment->parseHTML(markup, contextElement);
+        return fragment;
+    }
+
+    bool wasValid = fragment->parseXML(markup, contextElement);
+    if (!wasValid) {
+        ec = INVALID_STATE_ERR;
+        return 0;
+    }
+    return fragment.release();
+}
+
+static inline bool hasOneChild(ContainerNode* node)
+{
+    Node* firstChild = node->firstChild();
+    return firstChild && !firstChild->nextSibling();
+}
+
+static inline bool hasOneTextChild(ContainerNode* node)
+{
+    return hasOneChild(node) && node->firstChild()->isTextNode();
+}
+
+void replaceChildrenWithFragment(ContainerNode* container, PassRefPtr<DocumentFragment> fragment, ExceptionCode& ec)
+{
+    RefPtr<ContainerNode> containerNode(container);
+
+#if ENABLE(MUTATION_OBSERVERS)
+    ChildListMutationScope mutation(containerNode.get());
+#endif
+
+    if (!fragment->firstChild()) {
+        containerNode->removeChildren();
+        return;
+    }
+
+    if (hasOneTextChild(containerNode.get()) && hasOneTextChild(fragment.get())) {
+        toText(containerNode->firstChild())->setData(toText(fragment->firstChild())->data(), ec);
+        return;
+    }
+
+    if (hasOneChild(containerNode.get())) {
+        containerNode->replaceChild(fragment, containerNode->firstChild(), ec);
+        return;
+    }
+
+    containerNode->removeChildren();
+    containerNode->appendChild(fragment, ec);
+}
+
+void replaceChildrenWithText(ContainerNode* container, const String& text, ExceptionCode& ec)
+{
+    RefPtr<ContainerNode> containerNode(container);
+
+#if ENABLE(MUTATION_OBSERVERS)
+    ChildListMutationScope mutation(containerNode.get());
+#endif
+
+    if (hasOneTextChild(containerNode.get())) {
+        toText(containerNode->firstChild())->setData(text, ec);
+        return;
+    }
+
+    RefPtr<Text> textNode = Text::create(containerNode->document(), text);
+
+    if (hasOneChild(containerNode.get())) {
+        containerNode->replaceChild(textNode.release(), containerNode->firstChild(), ec);
+        return;
+    }
+
+    containerNode->removeChildren();
+    containerNode->appendChild(textNode.release(), ec);
+}
+
 }
diff --git a/Source/WebCore/editing/markup.h b/Source/WebCore/editing/markup.h
index f28715b22..918ae9b13 100644
--- a/Source/WebCore/editing/markup.h
+++ b/Source/WebCore/editing/markup.h
@@ -33,6 +33,7 @@
 
 namespace WebCore {
 
+    class ContainerNode;
     class Document;
     class DocumentFragment;
     class Element;
@@ -40,6 +41,8 @@ namespace WebCore {
     class Node;
     class Range;
 
+    typedef int ExceptionCode;
+
     enum EChildrenOnly { IncludeNode, ChildrenOnly };
     enum EAbsoluteURLs { DoNotResolveURLs, ResolveAllURLs, ResolveNonLocalURLs };
 
@@ -47,9 +50,14 @@ namespace WebCore {
     PassRefPtr<DocumentFragment> createFragmentFromMarkup(Document*, const String& markup, const String& baseURL, FragmentScriptingPermission = FragmentScriptingAllowed);
     PassRefPtr<DocumentFragment> createFragmentFromMarkupWithContext(Document*, const String& markup, unsigned fragmentStart, unsigned fragmentEnd, const String& baseURL, FragmentScriptingPermission);
     PassRefPtr<DocumentFragment> createFragmentFromNodes(Document*, const Vector<Node*>&);
+    PassRefPtr<DocumentFragment> createFragmentFromSource(const String&, Element*, ExceptionCode&);
 
     bool isPlainTextMarkup(Node *node);
 
+    // These methods are used by HTMLElement & ShadowRoot to replace the children with respected fragment/text.
+    void replaceChildrenWithFragment(ContainerNode*, PassRefPtr<DocumentFragment>, ExceptionCode&);
+    void replaceChildrenWithText(ContainerNode*, const String&, ExceptionCode&);
+
     String createMarkup(const Range*,
         Vector<Node*>* = 0, EAnnotateForInterchange = DoNotAnnotateForInterchange, bool convertBlocksToInlines = false, EAbsoluteURLs = DoNotResolveURLs);
     String createMarkup(const Node*, EChildrenOnly = IncludeNode, Vector<Node*>* = 0, EAbsoluteURLs = DoNotResolveURLs);
diff --git a/Source/WebCore/fileapi/FileStreamProxy.cpp b/Source/WebCore/fileapi/AsyncFileStream.cpp
index d43506566..1b035ccc3 100644
--- a/Source/WebCore/fileapi/FileStreamProxy.cpp
+++ b/Source/WebCore/fileapi/AsyncFileStream.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2010 Google Inc.  All rights reserved.
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -30,13 +31,14 @@
 
 #include "config.h"
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
-#include "FileStreamProxy.h"
+#include "AsyncFileStream.h"
 
 #include "Blob.h"
 #include "CrossThreadTask.h"
 #include "FileStream.h"
+#include "FileStreamClient.h"
 #include "FileThread.h"
 #include "FileThreadTask.h"
 #include "PlatformString.h"
@@ -44,44 +46,44 @@
 
 namespace WebCore {
 
-inline FileStreamProxy::FileStreamProxy(ScriptExecutionContext* context, FileStreamClient* client)
-    : AsyncFileStream(client)
-    , m_context(context)
+inline AsyncFileStream::AsyncFileStream(ScriptExecutionContext* context, FileStreamClient* client)
+    : m_context(context)
     , m_stream(FileStream::create())
+    , m_client(client)
 {
 }
 
-PassRefPtr<FileStreamProxy> FileStreamProxy::create(ScriptExecutionContext* context, FileStreamClient* client)
+PassRefPtr<AsyncFileStream> AsyncFileStream::create(ScriptExecutionContext* context, FileStreamClient* client)
 {
-    RefPtr<FileStreamProxy> proxy = adoptRef(new FileStreamProxy(context, client));
+    RefPtr<AsyncFileStream> proxy = adoptRef(new AsyncFileStream(context, client));
 
-    // Hold an ref so that the instance will not get deleted while there are tasks on the file thread.
+    // Hold a reference so that the instance will not get deleted while there are tasks on the file thread.
     // This is balanced by the deref in derefProxyOnContext below.
     proxy->ref();
 
-    proxy->fileThread()->postTask(createFileThreadTask(proxy.get(), &FileStreamProxy::startOnFileThread));
+    proxy->fileThread()->postTask(createFileThreadTask(proxy.get(), &AsyncFileStream::startOnFileThread));
 
     return proxy.release();
 }
 
-FileStreamProxy::~FileStreamProxy()
+AsyncFileStream::~AsyncFileStream()
 {
 }
 
-FileThread* FileStreamProxy::fileThread()
+FileThread* AsyncFileStream::fileThread()
 {
     ASSERT(m_context->isContextThread());
     ASSERT(m_context->fileThread());
     return m_context->fileThread();
 }
 
-static void didStart(ScriptExecutionContext*, FileStreamProxy* proxy)
+static void didStart(ScriptExecutionContext*, AsyncFileStream* proxy)
 {
     if (proxy->client())
         proxy->client()->didStart();
 }
 
-void FileStreamProxy::startOnFileThread()
+void AsyncFileStream::startOnFileThread()
 {
     if (!client())
         return;
@@ -89,132 +91,132 @@ void FileStreamProxy::startOnFileThread()
     m_context->postTask(createCallbackTask(&didStart, AllowCrossThreadAccess(this)));
 }
 
-void FileStreamProxy::stop()
+void AsyncFileStream::stop()
 {
     // Clear the client so that we won't be calling callbacks on the client.
     setClient(0);
 
     fileThread()->unscheduleTasks(m_stream.get());
-    fileThread()->postTask(createFileThreadTask(this, &FileStreamProxy::stopOnFileThread));
+    fileThread()->postTask(createFileThreadTask(this, &AsyncFileStream::stopOnFileThread));
 }
 
-static void derefProxyOnContext(ScriptExecutionContext*, FileStreamProxy* proxy)
+static void derefProxyOnContext(ScriptExecutionContext*, AsyncFileStream* proxy)
 {
     ASSERT(proxy->hasOneRef());
     proxy->deref();
 }
 
-void FileStreamProxy::stopOnFileThread()
+void AsyncFileStream::stopOnFileThread()
 {
     m_stream->stop();
     m_context->postTask(createCallbackTask(&derefProxyOnContext, AllowCrossThreadAccess(this)));
 }
 
-static void didGetSize(ScriptExecutionContext*, FileStreamProxy* proxy, long long size)
+static void didGetSize(ScriptExecutionContext*, AsyncFileStream* proxy, long long size)
 {
     if (proxy->client())
         proxy->client()->didGetSize(size);
 }
 
-void FileStreamProxy::getSize(const String& path, double expectedModificationTime)
+void AsyncFileStream::getSize(const String& path, double expectedModificationTime)
 {
-    fileThread()->postTask(createFileThreadTask(this, &FileStreamProxy::getSizeOnFileThread, path, expectedModificationTime));
+    fileThread()->postTask(createFileThreadTask(this, &AsyncFileStream::getSizeOnFileThread, path, expectedModificationTime));
 }
 
-void FileStreamProxy::getSizeOnFileThread(const String& path, double expectedModificationTime)
+void AsyncFileStream::getSizeOnFileThread(const String& path, double expectedModificationTime)
 {
     long long size = m_stream->getSize(path, expectedModificationTime);
     m_context->postTask(createCallbackTask(&didGetSize, AllowCrossThreadAccess(this), size));
 }
 
-static void didOpen(ScriptExecutionContext*, FileStreamProxy* proxy, bool success)
+static void didOpen(ScriptExecutionContext*, AsyncFileStream* proxy, bool success)
 {
     if (proxy->client())
         proxy->client()->didOpen(success);
 }
 
-void FileStreamProxy::openForRead(const String& path, long long offset, long long length)
+void AsyncFileStream::openForRead(const String& path, long long offset, long long length)
 {
-    fileThread()->postTask(createFileThreadTask(this, &FileStreamProxy::openForReadOnFileThread, path, offset, length));
+    fileThread()->postTask(createFileThreadTask(this, &AsyncFileStream::openForReadOnFileThread, path, offset, length));
 }
 
-void FileStreamProxy::openForReadOnFileThread(const String& path, long long offset, long long length)
+void AsyncFileStream::openForReadOnFileThread(const String& path, long long offset, long long length)
 {
     bool success = m_stream->openForRead(path, offset, length);
     m_context->postTask(createCallbackTask(&didOpen, AllowCrossThreadAccess(this), success));
 }
 
-void FileStreamProxy::openForWrite(const String& path)
+void AsyncFileStream::openForWrite(const String& path)
 {
     fileThread()->postTask(
         createFileThreadTask(this,
-                             &FileStreamProxy::openForWriteOnFileThread, path));
+                             &AsyncFileStream::openForWriteOnFileThread, path));
 }
 
-void FileStreamProxy::openForWriteOnFileThread(const String& path)
+void AsyncFileStream::openForWriteOnFileThread(const String& path)
 {
     bool success = m_stream->openForWrite(path);
     m_context->postTask(createCallbackTask(&didOpen, AllowCrossThreadAccess(this), success));
 }
 
-void FileStreamProxy::close()
+void AsyncFileStream::close()
 {
-    fileThread()->postTask(createFileThreadTask(this, &FileStreamProxy::closeOnFileThread));
+    fileThread()->postTask(createFileThreadTask(this, &AsyncFileStream::closeOnFileThread));
 }
 
-void FileStreamProxy::closeOnFileThread()
+void AsyncFileStream::closeOnFileThread()
 {
     m_stream->close();
 }
 
-static void didRead(ScriptExecutionContext*, FileStreamProxy* proxy, int bytesRead)
+static void didRead(ScriptExecutionContext*, AsyncFileStream* proxy, int bytesRead)
 {
     if (proxy->client())
         proxy->client()->didRead(bytesRead);
 }
 
-void FileStreamProxy::read(char* buffer, int length)
+void AsyncFileStream::read(char* buffer, int length)
 {
     fileThread()->postTask(
-        createFileThreadTask(this, &FileStreamProxy::readOnFileThread,
+        createFileThreadTask(this, &AsyncFileStream::readOnFileThread,
                              AllowCrossThreadAccess(buffer), length));
 }
 
-void FileStreamProxy::readOnFileThread(char* buffer, int length)
+void AsyncFileStream::readOnFileThread(char* buffer, int length)
 {
     int bytesRead = m_stream->read(buffer, length);
     m_context->postTask(createCallbackTask(&didRead, AllowCrossThreadAccess(this), bytesRead));
 }
 
-static void didWrite(ScriptExecutionContext*, FileStreamProxy* proxy, int bytesWritten)
+static void didWrite(ScriptExecutionContext*, AsyncFileStream* proxy, int bytesWritten)
 {
     if (proxy->client())
         proxy->client()->didWrite(bytesWritten);
 }
 
-void FileStreamProxy::write(const KURL& blobURL, long long position, int length)
+void AsyncFileStream::write(const KURL& blobURL, long long position, int length)
 {
-    fileThread()->postTask(createFileThreadTask(this, &FileStreamProxy::writeOnFileThread, blobURL, position, length));
+    fileThread()->postTask(createFileThreadTask(this, &AsyncFileStream::writeOnFileThread, blobURL, position, length));
 }
 
-void FileStreamProxy::writeOnFileThread(const KURL& blobURL, long long position, int length)
+void AsyncFileStream::writeOnFileThread(const KURL& blobURL, long long position, int length)
 {
     int bytesWritten = m_stream->write(blobURL, position, length);
     m_context->postTask(createCallbackTask(&didWrite, AllowCrossThreadAccess(this), bytesWritten));
 }
 
-static void didTruncate(ScriptExecutionContext*, FileStreamProxy* proxy, bool success)
+static void didTruncate(ScriptExecutionContext*, AsyncFileStream* proxy, bool success)
 {
     if (proxy->client())
         proxy->client()->didTruncate(success);
 }
 
-void FileStreamProxy::truncate(long long position)
+void AsyncFileStream::truncate(long long position)
 {
-    fileThread()->postTask(createFileThreadTask(this, &FileStreamProxy::truncateOnFileThread, position));
+    fileThread()->postTask(createFileThreadTask(this, &AsyncFileStream::truncateOnFileThread, position));
 }
 
-void FileStreamProxy::truncateOnFileThread(long long position)
+void AsyncFileStream::truncateOnFileThread(long long position)
 {
     bool success = m_stream->truncate(position);
     m_context->postTask(createCallbackTask(&didTruncate, AllowCrossThreadAccess(this), success));
@@ -222,4 +224,4 @@ void FileStreamProxy::truncateOnFileThread(long long position)
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
diff --git a/Source/WebCore/fileapi/FileStreamProxy.h b/Source/WebCore/fileapi/AsyncFileStream.h
index ce9a1054c..04be2db0c 100644
--- a/Source/WebCore/fileapi/FileStreamProxy.h
+++ b/Source/WebCore/fileapi/AsyncFileStream.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2010 Google Inc.  All rights reserved.
- * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,44 +29,45 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef FileStreamProxy_h
-#define FileStreamProxy_h
+#ifndef AsyncFileStream_h
+#define AsyncFileStream_h
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
-#include "AsyncFileStream.h"
 #include <wtf/Forward.h>
-#include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
+class FileStreamClient;
 class FileStream;
 class FileThread;
 class KURL;
 class ScriptExecutionContext;
 
-// A proxy module that asynchronously calls corresponding FileStream methods on the file thread.  Note: you must call stop() first and then release the reference to destruct the FileStreamProxy instance.
-class FileStreamProxy : public AsyncFileStream {
+class AsyncFileStream : public RefCounted<AsyncFileStream> {
 public:
-    static PassRefPtr<FileStreamProxy> create(ScriptExecutionContext*, FileStreamClient*);
-    virtual ~FileStreamProxy();
-
-    virtual void getSize(const String& path, double expectedModificationTime);
-    virtual void openForRead(const String& path, long long offset, long long length);
-    virtual void openForWrite(const String& path);
-    virtual void close();
-    virtual void read(char* buffer, int length);
-    virtual void write(const KURL& blobURL, long long position, int length);
-    virtual void truncate(long long position);
-
-    // Stops the proxy and scedules it to be destructed.  All the pending tasks will be aborted and the file stream will be closed.
+    static PassRefPtr<AsyncFileStream> create(ScriptExecutionContext*, FileStreamClient*);
+    ~AsyncFileStream();
+
+    void getSize(const String& path, double expectedModificationTime);
+    void openForRead(const String& path, long long offset, long long length);
+    void openForWrite(const String& path);
+    void close();
+    void read(char* buffer, int length);
+    void write(const KURL& blobURL, long long position, int length);
+    void truncate(long long position);
+
+    // Stops the proxy and schedules it to be destructed. All the pending tasks will be aborted and the file stream will be closed.
     // Note: the caller should deref the instance immediately after calling stop().
-    virtual void stop();
+    void stop();
+
+    FileStreamClient* client() const { return m_client; }
+    void setClient(FileStreamClient* client) { m_client = client; }
 
 private:
-    FileStreamProxy(ScriptExecutionContext*, FileStreamClient*);
+    AsyncFileStream(ScriptExecutionContext*, FileStreamClient*);
 
     FileThread* fileThread();
 
@@ -83,10 +84,12 @@ private:
 
     RefPtr<ScriptExecutionContext> m_context;
     RefPtr<FileStream> m_stream;
+
+    FileStreamClient* m_client;
 };
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
 
-#endif // FileStreamProxy_h
+#endif // AsyncFileStream_h
diff --git a/Source/WebCore/fileapi/DOMFileSystem.cpp b/Source/WebCore/fileapi/DOMFileSystem.cpp
index 9799e1207..b178f0c64 100644
--- a/Source/WebCore/fileapi/DOMFileSystem.cpp
+++ b/Source/WebCore/fileapi/DOMFileSystem.cpp
@@ -154,7 +154,7 @@ private:
 
 void DOMFileSystem::createFile(const FileEntry* fileEntry, PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
-    m_asyncFileSystem->readMetadata(fileEntry->fullPath(), GetPathCallback::create(this, fileEntry->name(), successCallback, errorCallback));
+    m_asyncFileSystem->createSnapshotFileAndReadMetadata(fileEntry->fullPath(), GetPathCallback::create(this, fileEntry->name(), successCallback, errorCallback));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/fileapi/DOMFileSystemSync.cpp b/Source/WebCore/fileapi/DOMFileSystemSync.cpp
index e7a8ca70b..8b772bb33 100644
--- a/Source/WebCore/fileapi/DOMFileSystemSync.cpp
+++ b/Source/WebCore/fileapi/DOMFileSystemSync.cpp
@@ -72,60 +72,35 @@ PassRefPtr<DirectoryEntrySync> DOMFileSystemSync::root()
 
 namespace {
 
-class GetPathHelper : public AsyncFileSystemCallbacks {
+class CreateFileHelper : public AsyncFileSystemCallbacks {
 public:
-    class GetPathResult : public RefCounted<GetPathResult> {
+    class CreateFileResult : public RefCounted<CreateFileResult> {
       public:
-        static PassRefPtr<GetPathResult> create()
+        static PassRefPtr<CreateFileResult> create()
         {
-            return adoptRef(new GetPathResult());
+            return adoptRef(new CreateFileResult());
         }
 
         bool m_failed;
         int m_code;
-        String m_path;
+        RefPtr<File> m_file;
 
       private:
-        GetPathResult()
+        CreateFileResult()
             : m_failed(false)
             , m_code(0)
         {
         }
 
-        ~GetPathResult()
+        ~CreateFileResult()
         {
         }
-        friend class WTF::RefCounted<GetPathResult>;
+        friend class WTF::RefCounted<CreateFileResult>;
     };
 
-    static PassOwnPtr<GetPathHelper> create(PassRefPtr<GetPathResult> result)
+    static PassOwnPtr<CreateFileHelper> create(PassRefPtr<CreateFileResult> result, const String& name)
     {
-        return adoptPtr(new GetPathHelper(result));
-    }
-
-    virtual void didSucceed()
-    {
-        ASSERT_NOT_REACHED();
-    }
-
-    virtual void didOpenFileSystem(const String&, PassOwnPtr<AsyncFileSystem>)
-    {
-        ASSERT_NOT_REACHED();
-    }
-
-    virtual void didReadDirectoryEntry(const String&, bool)
-    {
-        ASSERT_NOT_REACHED();
-    }
-
-    virtual void didReadDirectoryEntries(bool)
-    {
-        ASSERT_NOT_REACHED();
-    }
-
-    virtual void didCreateFileWriter(PassOwnPtr<AsyncFileWriter>, long long)
-    {
-        ASSERT_NOT_REACHED();
+        return adoptPtr(new CreateFileHelper(result, name));
     }
 
     virtual void didFail(int code)
@@ -134,21 +109,23 @@ public:
         m_result->m_code = code;
     }
 
-    virtual ~GetPathHelper()
+    virtual ~CreateFileHelper()
     {
     }
 
     void didReadMetadata(const FileMetadata& metadata)
     {
-        m_result->m_path = metadata.platformPath;
+        m_result->m_file = File::createWithName(metadata.platformPath, m_name);
     }
 private:
-    GetPathHelper(PassRefPtr<GetPathResult> result)
+    CreateFileHelper(PassRefPtr<CreateFileResult> result, const String& name)
         : m_result(result)
+        , m_name(name)
     {
     }
 
-    RefPtr<GetPathResult> m_result;
+    RefPtr<CreateFileResult> m_result;
+    String m_name;
 };
 
 } // namespace
@@ -156,8 +133,8 @@ private:
 PassRefPtr<File> DOMFileSystemSync::createFile(const FileEntrySync* fileEntry, ExceptionCode& ec)
 {
     ec = 0;
-    RefPtr<GetPathHelper::GetPathResult> result(GetPathHelper::GetPathResult::create());
-    m_asyncFileSystem->readMetadata(fileEntry->fullPath(), GetPathHelper::create(result));
+    RefPtr<CreateFileHelper::CreateFileResult> result(CreateFileHelper::CreateFileResult::create());
+    m_asyncFileSystem->createSnapshotFileAndReadMetadata(fileEntry->fullPath(), CreateFileHelper::create(result, fileEntry->name()));
     if (!m_asyncFileSystem->waitForOperationToComplete()) {
         ec = FileException::ABORT_ERR;
         return 0;
@@ -166,8 +143,7 @@ PassRefPtr<File> DOMFileSystemSync::createFile(const FileEntrySync* fileEntry, E
         ec = result->m_code;
         return 0;
     }
-    ASSERT(!result->m_path.isEmpty());
-    return File::createWithName(result->m_path, fileEntry->name());
+    return result->m_file;
 }
 
 namespace {
diff --git a/Source/WebCore/fileapi/DOMWindowFileSystem.idl b/Source/WebCore/fileapi/DOMWindowFileSystem.idl
index 79947cbd7..b6ef51319 100644
--- a/Source/WebCore/fileapi/DOMWindowFileSystem.idl
+++ b/Source/WebCore/fileapi/DOMWindowFileSystem.idl
@@ -1,20 +1,27 @@
 /*
- * Copyright (C) 2012 Google Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2011 Google Inc. All rights reserved.
  *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 module window {
diff --git a/Source/WebCore/fileapi/FileError.h b/Source/WebCore/fileapi/FileError.h
index 0597633e7..7678a5154 100644
--- a/Source/WebCore/fileapi/FileError.h
+++ b/Source/WebCore/fileapi/FileError.h
@@ -31,7 +31,7 @@
 #ifndef FileError_h
 #define FileError_h
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -70,6 +70,6 @@ private:
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
 
 #endif // FileError_h
diff --git a/Source/WebCore/fileapi/FileException.cpp b/Source/WebCore/fileapi/FileException.cpp
index 7e62ff355..5007f1cd5 100644
--- a/Source/WebCore/fileapi/FileException.cpp
+++ b/Source/WebCore/fileapi/FileException.cpp
@@ -28,7 +28,7 @@
 
 #include "config.h"
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include "FileException.h"
 
@@ -87,4 +87,4 @@ bool FileException::initializeDescription(ExceptionCode ec, ExceptionCodeDescrip
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
diff --git a/Source/WebCore/fileapi/FileException.h b/Source/WebCore/fileapi/FileException.h
index 38f1ed4ae..ccf7982df 100644
--- a/Source/WebCore/fileapi/FileException.h
+++ b/Source/WebCore/fileapi/FileException.h
@@ -31,7 +31,7 @@
 #ifndef FileException_h
 #define FileException_h
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include "ExceptionBase.h"
 
@@ -80,6 +80,6 @@ private:
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
 
 #endif // FileException_h
diff --git a/Source/WebCore/fileapi/FileSystemCallbacks.cpp b/Source/WebCore/fileapi/FileSystemCallbacks.cpp
index 06f3b9383..1e9a99d24 100644
--- a/Source/WebCore/fileapi/FileSystemCallbacks.cpp
+++ b/Source/WebCore/fileapi/FileSystemCallbacks.cpp
@@ -65,42 +65,6 @@ FileSystemCallbacksBase::~FileSystemCallbacksBase()
 {
 }
 
-void FileSystemCallbacksBase::didSucceed()
-{
-    // Each subclass must implement an appropriate one.
-    ASSERT_NOT_REACHED();
-}
-
-void FileSystemCallbacksBase::didOpenFileSystem(const String&, PassOwnPtr<AsyncFileSystem>)
-{
-    // Each subclass must implement an appropriate one.
-    ASSERT_NOT_REACHED();
-}
-
-void FileSystemCallbacksBase::didReadMetadata(const FileMetadata&)
-{
-    // Each subclass must implement an appropriate one.
-    ASSERT_NOT_REACHED();
-}
-
-void FileSystemCallbacksBase::didReadDirectoryEntries(bool)
-{
-    // Each subclass must implement an appropriate one.
-    ASSERT_NOT_REACHED();
-}
-
-void FileSystemCallbacksBase::didReadDirectoryEntry(const String&, bool)
-{
-    // Each subclass must implement an appropriate one.
-    ASSERT_NOT_REACHED();
-}
-
-void FileSystemCallbacksBase::didCreateFileWriter(PassOwnPtr<AsyncFileWriter>, long long)
-{
-    // Each subclass must implement an appropriate one.
-    ASSERT_NOT_REACHED();
-}
-
 void FileSystemCallbacksBase::didFail(int code)
 {
     if (m_errorCallback) {
@@ -268,7 +232,7 @@ MetadataCallbacks::MetadataCallbacks(PassRefPtr<MetadataCallback> successCallbac
 void MetadataCallbacks::didReadMetadata(const FileMetadata& metadata)
 {
     if (m_successCallback)
-        m_successCallback->handleEvent(Metadata::create(metadata.modificationTime).get());
+        m_successCallback->handleEvent(Metadata::create(metadata).get());
     m_successCallback.clear();
 }
 
diff --git a/Source/WebCore/fileapi/FileSystemCallbacks.h b/Source/WebCore/fileapi/FileSystemCallbacks.h
index 7f68625ac..e02deb9f0 100644
--- a/Source/WebCore/fileapi/FileSystemCallbacks.h
+++ b/Source/WebCore/fileapi/FileSystemCallbacks.h
@@ -59,25 +59,11 @@ class FileSystemCallbacksBase : public AsyncFileSystemCallbacks {
 public:
     virtual ~FileSystemCallbacksBase();
 
-    // For EntryCallbacks and VoidCallbacks.
-    virtual void didSucceed();
-
-    // For FileSystemCallbacks.
-    virtual void didOpenFileSystem(const String& name, PassOwnPtr<AsyncFileSystem>);
-
-    // For MetadataCallbacks.
-    virtual void didReadMetadata(const FileMetadata&);
-
-    // For EntriesCallbacks. didReadDirectoryEntry is called each time the API reads an entry, and didReadDirectoryDone is called when a chunk of entries have been read (i.e. good time to call back to the application).  If hasMore is true there can be more chunks.
-    virtual void didReadDirectoryEntry(const String& name, bool isDirectory);
-    virtual void didReadDirectoryEntries(bool hasMore);
-
-    // For createFileWriter.
-    virtual void didCreateFileWriter(PassOwnPtr<AsyncFileWriter>, long long length);
-
     // For ErrorCallback.
     virtual void didFail(int code);
 
+    // Other callback methods are implemented by each subclass.
+
 protected:
     FileSystemCallbacksBase(PassRefPtr<ErrorCallback> errorCallback);
     RefPtr<ErrorCallback> m_errorCallback;
diff --git a/Source/WebCore/fileapi/FileThread.cpp b/Source/WebCore/fileapi/FileThread.cpp
index 82bc686f6..4f4f473fd 100644
--- a/Source/WebCore/fileapi/FileThread.cpp
+++ b/Source/WebCore/fileapi/FileThread.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include "FileThread.h"
 
@@ -114,4 +114,4 @@ void FileThread::runLoop()
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
diff --git a/Source/WebCore/fileapi/FileThread.h b/Source/WebCore/fileapi/FileThread.h
index 6c3255b57..d4e24bca3 100644
--- a/Source/WebCore/fileapi/FileThread.h
+++ b/Source/WebCore/fileapi/FileThread.h
@@ -31,7 +31,7 @@
 #ifndef FileThread_h
 #define FileThread_h
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include <wtf/MessageQueue.h>
 #include <wtf/PassOwnPtr.h>
@@ -84,6 +84,6 @@ private:
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
 
 #endif // FileThread_h
diff --git a/Source/WebCore/fileapi/Metadata.h b/Source/WebCore/fileapi/Metadata.h
index b70806b09..7d1253a12 100644
--- a/Source/WebCore/fileapi/Metadata.h
+++ b/Source/WebCore/fileapi/Metadata.h
@@ -33,32 +33,34 @@
 
 #if ENABLE(FILE_SYSTEM)
 
+#include "FileMetadata.h"
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
 
 class Metadata : public RefCounted<Metadata> {
 public:
-    static PassRefPtr<Metadata> create(double modificationTime)
+    static PassRefPtr<Metadata> create(const FileMetadata& platformMetadata)
     {
-        return adoptRef(new Metadata(modificationTime));
+        return adoptRef(new Metadata(platformMetadata));
     }
 
     static PassRefPtr<Metadata> create(Metadata* metadata)
     {
-        return adoptRef(new Metadata(metadata->m_modificationTime));
+        return adoptRef(new Metadata(metadata->m_platformMetadata));
     }
 
-    // Needs to return epoch time in milliseconds for Date.
-    double modificationTime() const { return m_modificationTime * 1000.0; }
+    // Needs to return epoch time in milliseconds for Date while FileMetadata's modificationTime is in seconds.
+    double modificationTime() const { return m_platformMetadata.modificationTime * 1000.0; }
+    unsigned long long size() const { return static_cast<unsigned long long>(m_platformMetadata.length); }
 
 private:
-    Metadata(double modificationTime)
-        : m_modificationTime(modificationTime)
+    Metadata(const FileMetadata& platformMetadata)
+        : m_platformMetadata(platformMetadata)
     {
     }
 
-    double m_modificationTime;
+    FileMetadata m_platformMetadata;
 };
 
 } // namespace
diff --git a/Source/WebCore/fileapi/Metadata.idl b/Source/WebCore/fileapi/Metadata.idl
index ad477f771..ceaf21b5a 100644
--- a/Source/WebCore/fileapi/Metadata.idl
+++ b/Source/WebCore/fileapi/Metadata.idl
@@ -34,5 +34,6 @@ module storage {
         JSNoStaticTables
     ] Metadata {
         readonly attribute Date modificationTime;
+        readonly attribute unsigned long long size;
     };
 }
diff --git a/Source/WebCore/fileapi/OperationNotAllowedException.cpp b/Source/WebCore/fileapi/OperationNotAllowedException.cpp
index e97cfa035..2c9bc8e11 100644
--- a/Source/WebCore/fileapi/OperationNotAllowedException.cpp
+++ b/Source/WebCore/fileapi/OperationNotAllowedException.cpp
@@ -28,7 +28,7 @@
 
 #include "config.h"
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include "OperationNotAllowedException.h"
 
@@ -65,4 +65,4 @@ bool OperationNotAllowedException::initializeDescription(ExceptionCode ec, Excep
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
diff --git a/Source/WebCore/fileapi/OperationNotAllowedException.h b/Source/WebCore/fileapi/OperationNotAllowedException.h
index c3e95595e..5a0e9a1c5 100644
--- a/Source/WebCore/fileapi/OperationNotAllowedException.h
+++ b/Source/WebCore/fileapi/OperationNotAllowedException.h
@@ -31,7 +31,7 @@
 #ifndef OperationNotAllowedException_h
 #define OperationNotAllowedException_h
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include "ExceptionBase.h"
 
@@ -62,6 +62,6 @@ private:
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
 
 #endif // OperationNotAllowedException_h
diff --git a/Source/WebCore/fileapi/WorkerContextFileSystem.cpp b/Source/WebCore/fileapi/WorkerContextFileSystem.cpp
new file mode 100644
index 000000000..9651ef427
--- /dev/null
+++ b/Source/WebCore/fileapi/WorkerContextFileSystem.cpp
@@ -0,0 +1,142 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009, 2011 Google Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "WorkerContextFileSystem.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "AsyncFileSystem.h"
+#include "DOMFileSystem.h"
+#include "DOMFileSystemBase.h"
+#include "DOMFileSystemSync.h"
+#include "DirectoryEntrySync.h"
+#include "ErrorCallback.h"
+#include "FileEntrySync.h"
+#include "FileError.h"
+#include "FileException.h"
+#include "FileSystemCallback.h"
+#include "FileSystemCallbacks.h"
+#include "LocalFileSystem.h"
+#include "SecurityOrigin.h"
+#include "SyncCallbackHelper.h"
+#include "WorkerContext.h"
+
+namespace WebCore {
+
+void WorkerContextFileSystem::webkitRequestFileSystem(WorkerContext* worker, int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    ScriptExecutionContext* secureContext = worker->scriptExecutionContext();
+    if (!AsyncFileSystem::isAvailable() || !secureContext->securityOrigin()->canAccessFileSystem()) {
+        DOMFileSystem::scheduleCallback(worker, errorCallback, FileError::create(FileError::SECURITY_ERR));
+        return;
+    }
+
+    AsyncFileSystem::Type fileSystemType = static_cast<AsyncFileSystem::Type>(type);
+    if (!AsyncFileSystem::isValidType(fileSystemType)) {
+        DOMFileSystem::scheduleCallback(worker, errorCallback, FileError::create(FileError::INVALID_MODIFICATION_ERR));
+        return;
+    }
+
+    LocalFileSystem::localFileSystem().requestFileSystem(worker, fileSystemType, size, FileSystemCallbacks::create(successCallback, errorCallback, worker), false);
+}
+
+PassRefPtr<DOMFileSystemSync> WorkerContextFileSystem::webkitRequestFileSystemSync(WorkerContext* worker, int type, long long size, ExceptionCode& ec)
+{
+    ec = 0;
+    ScriptExecutionContext* secureContext = worker->scriptExecutionContext();
+    if (!AsyncFileSystem::isAvailable() || !secureContext->securityOrigin()->canAccessFileSystem()) {
+        ec = FileException::SECURITY_ERR;
+        return 0;
+    }
+
+    AsyncFileSystem::Type fileSystemType = static_cast<AsyncFileSystem::Type>(type);
+    if (!AsyncFileSystem::isValidType(fileSystemType)) {
+        ec = FileException::INVALID_MODIFICATION_ERR;
+        return 0;
+    }
+
+    FileSystemSyncCallbackHelper helper;
+    LocalFileSystem::localFileSystem().requestFileSystem(worker, fileSystemType, size, FileSystemCallbacks::create(helper.successCallback(), helper.errorCallback(), worker), true);
+    return helper.getResult(ec);
+}
+
+void WorkerContextFileSystem::webkitResolveLocalFileSystemURL(WorkerContext* worker, const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    KURL completedURL = worker->completeURL(url);
+    ScriptExecutionContext* secureContext = worker->scriptExecutionContext();
+    if (!AsyncFileSystem::isAvailable() || !secureContext->securityOrigin()->canAccessFileSystem() || !secureContext->securityOrigin()->canRequest(completedURL)) {
+        DOMFileSystem::scheduleCallback(worker, errorCallback, FileError::create(FileError::SECURITY_ERR));
+        return;
+    }
+
+    AsyncFileSystem::Type type;
+    String filePath;
+    if (!completedURL.isValid() || !AsyncFileSystem::crackFileSystemURL(completedURL, type, filePath)) {
+        DOMFileSystem::scheduleCallback(worker, errorCallback, FileError::create(FileError::ENCODING_ERR));
+        return;
+    }
+
+    LocalFileSystem::localFileSystem().readFileSystem(worker, type, ResolveURICallbacks::create(successCallback, errorCallback, worker, filePath));
+}
+
+PassRefPtr<EntrySync> WorkerContextFileSystem::webkitResolveLocalFileSystemSyncURL(WorkerContext* worker, const String& url, ExceptionCode& ec)
+{
+    ec = 0;
+    KURL completedURL = worker->completeURL(url);
+    ScriptExecutionContext* secureContext = worker->scriptExecutionContext();
+    if (!AsyncFileSystem::isAvailable() || !secureContext->securityOrigin()->canAccessFileSystem() || !secureContext->securityOrigin()->canRequest(completedURL)) {
+        ec = FileException::SECURITY_ERR;
+        return 0;
+    }
+
+    AsyncFileSystem::Type type;
+    String filePath;
+    if (!completedURL.isValid() || !AsyncFileSystem::crackFileSystemURL(completedURL, type, filePath)) {
+        ec = FileException::ENCODING_ERR;
+        return 0;
+    }
+
+    FileSystemSyncCallbackHelper readFileSystemHelper;
+    LocalFileSystem::localFileSystem().readFileSystem(worker, type, FileSystemCallbacks::create(readFileSystemHelper.successCallback(), readFileSystemHelper.errorCallback(), worker), true);
+    RefPtr<DOMFileSystemSync> fileSystem = readFileSystemHelper.getResult(ec);
+    if (!fileSystem)
+        return 0;
+
+    RefPtr<EntrySync> entry = fileSystem->root()->getDirectory(filePath, 0, ec);
+    if (ec == FileException::TYPE_MISMATCH_ERR)
+        return fileSystem->root()->getFile(filePath, 0, ec);
+
+    return entry.release();
+}
+
+COMPILE_ASSERT(static_cast<int>(WorkerContextFileSystem::TEMPORARY) == static_cast<int>(AsyncFileSystem::Temporary), enum_mismatch);
+COMPILE_ASSERT(static_cast<int>(WorkerContextFileSystem::PERSISTENT) == static_cast<int>(AsyncFileSystem::Persistent), enum_mismatch);
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/Source/WebCore/fileapi/WorkerContextFileSystem.h b/Source/WebCore/fileapi/WorkerContextFileSystem.h
new file mode 100644
index 000000000..c500f5e2e
--- /dev/null
+++ b/Source/WebCore/fileapi/WorkerContextFileSystem.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef WorkerContextFileSystem_h
+#define WorkerContextFileSystem_h
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "DOMFileSystemSync.h"
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class EntryCallback;
+class EntrySync;
+class ErrorCallback;
+class FileSystemCallback;
+class WorkerContext;
+
+class WorkerContextFileSystem {
+public:
+    enum FileSystemType {
+        TEMPORARY,
+        PERSISTENT,
+    };
+
+    static void webkitRequestFileSystem(WorkerContext*, int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback>);
+    static PassRefPtr<DOMFileSystemSync> webkitRequestFileSystemSync(WorkerContext*, int type, long long size, ExceptionCode&);
+    static void webkitResolveLocalFileSystemURL(WorkerContext*, const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback>);
+    static PassRefPtr<EntrySync> webkitResolveLocalFileSystemSyncURL(WorkerContext*, const String& url, ExceptionCode&);
+
+private:
+    WorkerContextFileSystem();
+    ~WorkerContextFileSystem();    
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
+
+#endif // WorkerContextFileSystem_h
diff --git a/Source/WebCore/fileapi/WorkerContextFileSystem.idl b/Source/WebCore/fileapi/WorkerContextFileSystem.idl
new file mode 100644
index 000000000..cb9c32849
--- /dev/null
+++ b/Source/WebCore/fileapi/WorkerContextFileSystem.idl
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module threads {
+
+    interface [
+        Conditional=FILE_SYSTEM,
+        Supplemental=WorkerContext
+    ] WorkerContextFileSystem {
+        const unsigned short TEMPORARY = 0;
+        const unsigned short PERSISTENT = 1;
+
+        [V8EnabledAtRuntime=FileSystem] void webkitRequestFileSystem(in unsigned short type, in long long size, in [Callback, Optional] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [V8EnabledAtRuntime=FileSystem] DOMFileSystemSync webkitRequestFileSystemSync(in unsigned short type, in long long size) raises (FileException);
+        [V8EnabledAtRuntime=FileSystem] void webkitResolveLocalFileSystemURL(in DOMString url, in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [V8EnabledAtRuntime=FileSystem] EntrySync webkitResolveLocalFileSystemSyncURL(in DOMString url) raises (FileException);
+
+        attribute [V8EnabledAtRuntime=FileSystem] FileErrorConstructor FileError;
+        attribute [V8EnabledAtRuntime=FileSystem] FileExceptionConstructor FileException;
+    };
+
+}
diff --git a/Source/WebCore/history/PageCache.cpp b/Source/WebCore/history/PageCache.cpp
index a0d5de4d9..9f1773cef 100644
--- a/Source/WebCore/history/PageCache.cpp
+++ b/Source/WebCore/history/PageCache.cpp
@@ -31,6 +31,7 @@
 #include "MemoryCache.h"
 #include "CachedPage.h"
 #include "DOMWindow.h"
+#include "DatabaseContext.h"
 #include "DeviceMotionController.h"
 #include "DeviceOrientationController.h"
 #include "Document.h"
@@ -39,6 +40,7 @@
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "FrameLoaderStateMachine.h"
+#include "HistogramSupport.h"
 #include "HistoryItem.h"
 #include "Logging.h"
 #include "Page.h"
@@ -55,32 +57,36 @@ namespace WebCore {
 
 static const double autoreleaseInterval = 3;
 
-#ifndef NDEBUG
+#if PLATFORM(CHROMIUM) || !defined(NDEBUG)
 
-static String& pageCacheLogPrefix(int indentLevel)
-{
-    static int previousIndent = -1;
-    DEFINE_STATIC_LOCAL(String, prefix, ());
-    
-    if (indentLevel != previousIndent) {    
-        previousIndent = indentLevel;
-        prefix.truncate(0);
-        for (int i = 0; i < previousIndent; ++i)
-            prefix += "    ";
-    }
+#define PCLOG(...) LOG(PageCache, "%*s%s", indentLevel*4, "", makeString(__VA_ARGS__).utf8().data())
     
-    return prefix;
-}
-
-static void pageCacheLog(const String& prefix, const String& message)
-{
-    LOG(PageCache, "%s%s", prefix.utf8().data(), message.utf8().data());
-}
-    
-#define PCLOG(...) pageCacheLog(pageCacheLogPrefix(indentLevel), makeString(__VA_ARGS__))
-    
-static bool logCanCacheFrameDecision(Frame* frame, int indentLevel)
+// Used in histograms, please only add at the end, and do not remove elements (renaming e.g. to "FooEnumUnused1" is fine).
+// This is because statistics may be gathered from histograms between versions over time, and re-using values causes collisions.
+enum ReasonFrameCannotBeInPageCache {
+    NoDocumentLoader = 0,
+    MainDocumentError,
+    IsErrorPage,
+    HasPlugins,
+    IsHttpsAndCacheControlled,
+    HasUnloadListener,
+    HasDatabaseHandles,
+    HasSharedWorkers,
+    NoHistoryItem,
+    QuickRedirectComing,
+    IsLoadingInAPISense,
+    IsStopping,
+    CanSuspendActiveDOMObjects,
+    DocumentLoaderUsesApplicationCache,
+    ClientDeniesCaching,
+    NumberOfReasonsFramesCannotBeInPageCache,
+};
+
+static unsigned logCanCacheFrameDecision(Frame* frame, int indentLevel)
 {
+#ifdef NDEBUG
+    UNUSED_PARAM(indentLevel);
+#endif
     // Only bother logging for frames that have actually loaded and have content.
     if (frame->loader()->stateMachine()->creatingInitialEmptyDocument())
         return false;
@@ -94,87 +100,110 @@ static bool logCanCacheFrameDecision(Frame* frame, int indentLevel)
         PCLOG(" Determining if frame can be cached navigating from (", currentURL.string(), ") to (", newURL.string(), "):");
     else
         PCLOG(" Determining if subframe with URL (", currentURL.string(), ") can be cached:");
+     
+    unsigned rejectReasons = 0;
     
-    bool cannotCache = false;
-    
-    do {
-        if (!frame->loader()->documentLoader()) {
-            PCLOG("   -There is no DocumentLoader object");
-            cannotCache = true;
-            break;
-        }
+    if (!frame->loader()->documentLoader()) {
+        PCLOG("   -There is no DocumentLoader object");
+        rejectReasons |= 1 << NoDocumentLoader;
+    } else {
         if (!frame->loader()->documentLoader()->mainDocumentError().isNull()) {
             PCLOG("   -Main document has an error");
-            cannotCache = true;
+            rejectReasons |= 1 << MainDocumentError;
+        }
+        if (frame->loader()->documentLoader()->substituteData().isValid() && frame->loader()->documentLoader()->substituteData().failingURL().isEmpty()) {
+            PCLOG("   -Frame is an error page");
+            rejectReasons |= 1 << IsErrorPage;
         }
         if (frame->loader()->subframeLoader()->containsPlugins() && !frame->page()->settings()->pageCacheSupportsPlugins()) {
             PCLOG("   -Frame contains plugins");
-            cannotCache = true;
+            rejectReasons |= 1 << HasPlugins;
         }
-        if (frame->document()->url().protocolIs("https")) {
-            PCLOG("   -Frame is HTTPS");
-            cannotCache = true;
+        if (frame->document()->url().protocolIs("https")
+            && (frame->loader()->documentLoader()->response().cacheControlContainsNoCache()
+                || frame->loader()->documentLoader()->response().cacheControlContainsNoStore())) {
+            PCLOG("   -Frame is HTTPS, and cache control prohibits caching or storing");
+            rejectReasons |= 1 << IsHttpsAndCacheControlled;
         }
         if (frame->domWindow() && frame->domWindow()->hasEventListeners(eventNames().unloadEvent)) {
             PCLOG("   -Frame has an unload event listener");
-            cannotCache = true;
+            rejectReasons |= 1 << HasUnloadListener;
         }
 #if ENABLE(SQL_DATABASE)
-        if (frame->document()->hasOpenDatabases()) {
+        if (DatabaseContext::hasOpenDatabases(frame->document())) {
             PCLOG("   -Frame has open database handles");
-            cannotCache = true;
+            rejectReasons |= 1 << HasDatabaseHandles;
         }
 #endif
 #if ENABLE(SHARED_WORKERS)
         if (SharedWorkerRepository::hasSharedWorkers(frame->document())) {
             PCLOG("   -Frame has associated SharedWorkers");
-            cannotCache = true;
+            rejectReasons |= 1 << HasSharedWorkers;
         }
 #endif
-        if (frame->document()->usingGeolocation()) {
-            PCLOG("   -Frame uses Geolocation");
-            cannotCache = true;
-        }
         if (!frame->loader()->history()->currentItem()) {
             PCLOG("   -No current history item");
-            cannotCache = true;
+            rejectReasons |= 1 << NoHistoryItem;
         }
         if (frame->loader()->quickRedirectComing()) {
             PCLOG("   -Quick redirect is coming");
-            cannotCache = true;
+            rejectReasons |= 1 << QuickRedirectComing;
         }
         if (frame->loader()->documentLoader()->isLoadingInAPISense()) {
             PCLOG("   -DocumentLoader is still loading in API sense");
-            cannotCache = true;
+            rejectReasons |= 1 << IsLoadingInAPISense;
         }
         if (frame->loader()->documentLoader()->isStopping()) {
             PCLOG("   -DocumentLoader is in the middle of stopping");
-            cannotCache = true;
+            rejectReasons |= 1 << IsStopping;
         }
         if (!frame->document()->canSuspendActiveDOMObjects()) {
             PCLOG("   -The document cannot suspect its active DOM Objects");
-            cannotCache = true;
+            rejectReasons |= 1 << CanSuspendActiveDOMObjects;
         }
         if (!frame->loader()->documentLoader()->applicationCacheHost()->canCacheInPageCache()) {
             PCLOG("   -The DocumentLoader uses an application cache");
-            cannotCache = true;
+            rejectReasons |= 1 << DocumentLoaderUsesApplicationCache;
         }
         if (!frame->loader()->client()->canCachePage()) {
             PCLOG("   -The client says this frame cannot be cached");
-            cannotCache = true; 
+            rejectReasons |= 1 << ClientDeniesCaching;
         }
-    } while (false);
-    
+    }
+
+    HistogramSupport::histogramEnumeration("PageCache.FrameCacheable", !rejectReasons, 2);
+    int reasonCount = 0;
+    for (int i = 0; i < NumberOfReasonsFramesCannotBeInPageCache; ++i) {
+        if (rejectReasons & (1 << i)) {
+            ++reasonCount;
+            HistogramSupport::histogramEnumeration("PageCache.FrameRejectReason", i, NumberOfReasonsFramesCannotBeInPageCache);
+        }
+    }
+    HistogramSupport::histogramEnumeration("PageCache.FrameRejectReasonCount", reasonCount, 1 + NumberOfReasonsFramesCannotBeInPageCache);
+
     for (Frame* child = frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        if (!logCanCacheFrameDecision(child, indentLevel + 1))
-            cannotCache = true;
+        rejectReasons |= logCanCacheFrameDecision(child, indentLevel + 1);
     
-    PCLOG(cannotCache ? " Frame CANNOT be cached" : " Frame CAN be cached");
+    PCLOG(rejectReasons ? " Frame CANNOT be cached" : " Frame CAN be cached");
     PCLOG("+---");
     
-    return !cannotCache;
+    return rejectReasons;
 }
-    
+
+// Used in histograms, please only add at the end, and do not remove elements (renaming e.g. to "FooEnumUnused1" is fine).
+// This is because statistics may be gathered from histograms between versions over time, and re-using values causes collisions.
+enum ReasonPageCannotBeInPageCache {
+    FrameCannotBeInPageCache = 0,
+    DisabledBackForwardList,
+    DisabledPageCache,
+    UsesDeviceMotion,
+    UsesDeviceOrientation,
+    IsReload,
+    IsReloadFromOrigin,
+    IsSameLoad,
+    NumberOfReasonsPagesCannotBeInPageCache,
+};
+
 static void logCanCachePageDecision(Page* page)
 {
     // Only bother logging for main frames that have actually loaded and have content.
@@ -187,41 +216,66 @@ static void logCanCachePageDecision(Page* page)
     int indentLevel = 0;    
     PCLOG("--------\n Determining if page can be cached:");
     
-    bool cannotCache = !logCanCacheFrameDecision(page->mainFrame(), 1);
+    unsigned rejectReasons = 0;
+    unsigned frameRejectReasons = logCanCacheFrameDecision(page->mainFrame(), indentLevel+1);
+    if (frameRejectReasons)
+        rejectReasons |= 1 << FrameCannotBeInPageCache;
     
-    FrameLoadType loadType = page->mainFrame()->loader()->loadType();
     if (!page->backForward()->isActive()) {
         PCLOG("   -The back/forward list is disabled or has 0 capacity");
-        cannotCache = true;
+        rejectReasons |= 1 << DisabledBackForwardList;
     }
     if (!page->settings()->usesPageCache()) {
         PCLOG("   -Page settings says b/f cache disabled");
-        cannotCache = true;
+        rejectReasons |= 1 << DisabledPageCache;
     }
 #if ENABLE(DEVICE_ORIENTATION)
     if (DeviceMotionController::isActiveAt(page)) {
         PCLOG("   -Page is using DeviceMotion");
-        cannotCache = true;
+        rejectReasons |= 1 << UsesDeviceMotion;
     }
     if (DeviceOrientationController::isActiveAt(page)) {
         PCLOG("   -Page is using DeviceOrientation");
-        cannotCache = true;
+        rejectReasons |= 1 << UsesDeviceOrientation;
     }
 #endif
+    FrameLoadType loadType = page->mainFrame()->loader()->loadType();
     if (loadType == FrameLoadTypeReload) {
         PCLOG("   -Load type is: Reload");
-        cannotCache = true;
+        rejectReasons |= 1 << IsReload;
     }
     if (loadType == FrameLoadTypeReloadFromOrigin) {
         PCLOG("   -Load type is: Reload from origin");
-        cannotCache = true;
+        rejectReasons |= 1 << IsReloadFromOrigin;
     }
     if (loadType == FrameLoadTypeSame) {
         PCLOG("   -Load type is: Same");
-        cannotCache = true;
+        rejectReasons |= 1 << IsSameLoad;
     }
     
-    PCLOG(cannotCache ? " Page CANNOT be cached\n--------" : " Page CAN be cached\n--------");
+    PCLOG(rejectReasons ? " Page CANNOT be cached\n--------" : " Page CAN be cached\n--------");
+
+    HistogramSupport::histogramEnumeration("PageCache.PageCacheable", !rejectReasons, 2);
+    int reasonCount = 0;
+    for (int i = 0; i < NumberOfReasonsPagesCannotBeInPageCache; ++i) {
+        if (rejectReasons & (1 << i)) {
+            ++reasonCount;
+            HistogramSupport::histogramEnumeration("PageCache.PageRejectReason", i, NumberOfReasonsPagesCannotBeInPageCache);
+        }
+    }
+    HistogramSupport::histogramEnumeration("PageCache.PageRejectReasonCount", reasonCount, 1 + NumberOfReasonsPagesCannotBeInPageCache);
+
+    // Report also on the frame reasons by page; this is distinct from the per frame statistics since it coalesces the
+    // causes from all subframes together.
+    HistogramSupport::histogramEnumeration("PageCache.FrameCacheableByPage", !frameRejectReasons, 2);
+    int frameReasonCount = 0;
+    for (int i = 0; i <= NumberOfReasonsFramesCannotBeInPageCache; ++i) {
+        if (frameRejectReasons & (1 << i)) {
+            ++frameReasonCount;
+            HistogramSupport::histogramEnumeration("PageCache.FrameRejectReasonByPage", i, NumberOfReasonsFramesCannotBeInPageCache);
+        }
+    }
+    HistogramSupport::histogramEnumeration("PageCache.FrameRejectReasonCountByPage", frameReasonCount, 1 + NumberOfReasonsFramesCannotBeInPageCache);
 }
 
 #endif 
@@ -263,12 +317,11 @@ bool PageCache::canCachePageContainingThisFrame(Frame* frame)
         && (!document->url().protocolIs("https") || (!documentLoader->response().cacheControlContainsNoCache() && !documentLoader->response().cacheControlContainsNoStore()))
         && (!frame->domWindow() || !frame->domWindow()->hasEventListeners(eventNames().unloadEvent))
 #if ENABLE(SQL_DATABASE)
-        && !document->hasOpenDatabases()
+        && !DatabaseContext::hasOpenDatabases(document)
 #endif
 #if ENABLE(SHARED_WORKERS)
         && !SharedWorkerRepository::hasSharedWorkers(document)
 #endif
-        && !document->usingGeolocation()
         && frameLoader->history()->currentItem()
         && !frameLoader->quickRedirectComing()
         && !documentLoader->isLoadingInAPISense()
@@ -285,7 +338,7 @@ bool PageCache::canCache(Page* page)
     if (!page)
         return false;
     
-#ifndef NDEBUG
+#if PLATFORM(CHROMIUM) || !defined(NDEBUG)
     logCanCachePageDecision(page);
 #endif
     
diff --git a/Source/WebCore/html/BaseButtonInputType.cpp b/Source/WebCore/html/BaseButtonInputType.cpp
index 9a1616fce..f7115019e 100644
--- a/Source/WebCore/html/BaseButtonInputType.cpp
+++ b/Source/WebCore/html/BaseButtonInputType.cpp
@@ -47,54 +47,11 @@ bool BaseButtonInputType::appendFormData(FormDataList&, bool) const
     return false;
 }
 
-void BaseButtonInputType::handleKeydownEvent(KeyboardEvent* event)
-{
-    const String& key = event->keyIdentifier();
-    if (key == "U+0020") {
-        element()->setActive(true, true);
-        // No setDefaultHandled(), because IE dispatches a keypress in this case
-        // and the caller will only dispatch a keypress if we don't call setDefaultHandled().
-    }
-}
-
-void BaseButtonInputType::handleKeypressEvent(KeyboardEvent* event)
-{
-    int charCode = event->charCode();
-    if (charCode == '\r') {
-        element()->dispatchSimulatedClick(event);
-        event->setDefaultHandled();
-        return;
-    }
-    if (charCode == ' ') {
-        // Prevent scrolling down the page.
-        event->setDefaultHandled();
-    }
-}
-
-void BaseButtonInputType::handleKeyupEvent(KeyboardEvent* event)
-{
-    const String& key = event->keyIdentifier();
-    if (key != "U+0020")
-        return;
-    // Simulate mouse click for spacebar for button types.
-    dispatchSimulatedClickIfActive(event);
-}
-
 RenderObject* BaseButtonInputType::createRenderer(RenderArena* arena, RenderStyle*) const
 {
     return new (arena) RenderButton(element());
 }
 
-// FIXME: Could share this with BaseCheckableInputType and RangeInputType if we had a common base class.
-void BaseButtonInputType::accessKeyAction(bool sendMouseEvents)
-{
-    InputType::accessKeyAction(sendMouseEvents);
-
-    // Send mouse button events if the caller specified sendMouseEvents.
-    // FIXME: The comment above is no good. It says what we do, but not why.
-    element()->dispatchSimulatedClick(0, sendMouseEvents);
-}
-
 bool BaseButtonInputType::storesValueSeparateFromAttribute()
 {
     return false;
diff --git a/Source/WebCore/html/BaseButtonInputType.h b/Source/WebCore/html/BaseButtonInputType.h
index 1b7543c05..cbd852fc9 100644
--- a/Source/WebCore/html/BaseButtonInputType.h
+++ b/Source/WebCore/html/BaseButtonInputType.h
@@ -31,22 +31,18 @@
 #ifndef BaseButtonInputType_h
 #define BaseButtonInputType_h
 
-#include "InputType.h"
+#include "BaseClickableWithKeyInputType.h"
 
 namespace WebCore {
 
 // Base of button, file, image, reset, and submit types.
-class BaseButtonInputType : public InputType {
+class BaseButtonInputType : public BaseClickableWithKeyInputType {
 protected:
-    BaseButtonInputType(HTMLInputElement* element) : InputType(element) { }
+    BaseButtonInputType(HTMLInputElement* element) : BaseClickableWithKeyInputType(element) { }
 
 private:
     virtual bool appendFormData(FormDataList&, bool) const OVERRIDE;
-    virtual void handleKeydownEvent(KeyboardEvent*) OVERRIDE;
-    virtual void handleKeypressEvent(KeyboardEvent*) OVERRIDE;
-    virtual void handleKeyupEvent(KeyboardEvent*) OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE;
-    virtual void accessKeyAction(bool sendMouseEvents) OVERRIDE;
     virtual bool storesValueSeparateFromAttribute() OVERRIDE;
     virtual void setValue(const String&, bool, TextFieldEventBehavior) OVERRIDE;
 };
diff --git a/Source/WebCore/html/BaseCheckableInputType.cpp b/Source/WebCore/html/BaseCheckableInputType.cpp
index ff28dae36..f578acbe7 100644
--- a/Source/WebCore/html/BaseCheckableInputType.cpp
+++ b/Source/WebCore/html/BaseCheckableInputType.cpp
@@ -48,7 +48,7 @@ bool BaseCheckableInputType::saveFormControlState(String& result) const
     return true;
 }
 
-void BaseCheckableInputType::restoreFormControlState(const String& state) const
+void BaseCheckableInputType::restoreFormControlState(const String& state)
 {
     element()->setChecked(state == "on");
 }
@@ -84,7 +84,7 @@ bool BaseCheckableInputType::canSetStringValue() const
     return false;
 }
 
-// FIXME: Could share this with BaseButtonInputType and RangeInputType if we had a common base class.
+// FIXME: Could share this with BaseClickableWithKeyInputType and RangeInputType if we had a common base class.
 void BaseCheckableInputType::accessKeyAction(bool sendMouseEvents)
 {
     InputType::accessKeyAction(sendMouseEvents);
diff --git a/Source/WebCore/html/BaseCheckableInputType.h b/Source/WebCore/html/BaseCheckableInputType.h
index 4211ad521..860d6fd90 100644
--- a/Source/WebCore/html/BaseCheckableInputType.h
+++ b/Source/WebCore/html/BaseCheckableInputType.h
@@ -43,7 +43,7 @@ protected:
 
 private:
     virtual bool saveFormControlState(String&) const OVERRIDE;
-    virtual void restoreFormControlState(const String&) const OVERRIDE;
+    virtual void restoreFormControlState(const String&) OVERRIDE;
     virtual bool appendFormData(FormDataList&, bool) const OVERRIDE;
     virtual void handleKeypressEvent(KeyboardEvent*) OVERRIDE;
     virtual bool canSetStringValue() const OVERRIDE;
diff --git a/Source/WebCore/html/BaseClickableWithKeyInputType.cpp b/Source/WebCore/html/BaseClickableWithKeyInputType.cpp
new file mode 100644
index 000000000..9bc56ea91
--- /dev/null
+++ b/Source/WebCore/html/BaseClickableWithKeyInputType.cpp
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2010, 2012 Google Inc. All rights reserved.
+ * Copyright (C) 2011 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BaseClickableWithKeyInputType.h"
+
+#include "HTMLInputElement.h"
+#include "KeyboardEvent.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+void BaseClickableWithKeyInputType::handleKeydownEvent(KeyboardEvent* event)
+{
+    const String& key = event->keyIdentifier();
+    if (key == "U+0020") {
+        element()->setActive(true, true);
+        // No setDefaultHandled(), because IE dispatches a keypress in this case
+        // and the caller will only dispatch a keypress if we don't call setDefaultHandled().
+    }
+}
+
+void BaseClickableWithKeyInputType::handleKeypressEvent(KeyboardEvent* event)
+{
+    int charCode = event->charCode();
+    if (charCode == '\r') {
+        element()->dispatchSimulatedClick(event);
+        event->setDefaultHandled();
+        return;
+    }
+    if (charCode == ' ') {
+        // Prevent scrolling down the page.
+        event->setDefaultHandled();
+    }
+}
+
+void BaseClickableWithKeyInputType::handleKeyupEvent(KeyboardEvent* event)
+{
+    const String& key = event->keyIdentifier();
+    if (key != "U+0020")
+        return;
+    // Simulate mouse click for spacebar for button types.
+    dispatchSimulatedClickIfActive(event);
+}
+
+// FIXME: Could share this with BaseCheckableInputType and RangeInputType if we had a common base class.
+void BaseClickableWithKeyInputType::accessKeyAction(bool sendMouseEvents)
+{
+    InputType::accessKeyAction(sendMouseEvents);
+
+    // Send mouse button events if the caller specified sendMouseEvents.
+    // FIXME: The comment above is no good. It says what we do, but not why.
+    element()->dispatchSimulatedClick(0, sendMouseEvents);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/storage/DOMWindowSQLDatabase.h b/Source/WebCore/html/BaseClickableWithKeyInputType.h
index 7af60be7a..5bb58cf4e 100644
--- a/Source/WebCore/storage/DOMWindowSQLDatabase.h
+++ b/Source/WebCore/html/BaseClickableWithKeyInputType.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Google Inc.  All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,34 +28,25 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef DOMWindowSQLDatabase_h
-#define DOMWindowSQLDatabase_h
+#ifndef BaseClickableWithKeyInputType_h
+#define BaseClickableWithKeyInputType_h
 
-#if ENABLE(SQL_DATABASE)
-#include "ExceptionCode.h"
-#include "PlatformString.h"
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-#include <wtf/RefPtr.h>
+#include "InputType.h"
 
 namespace WebCore {
 
-class DOMWindow;
-class Database;
-class DatabaseCallback;
-class Frame;
-
-class DOMWindowSQLDatabase {
-public:
-    static PassRefPtr<Database> openDatabase(DOMWindow*, const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode&);
+// Base of input types that dispatches a simulated click on space/return key.
+class BaseClickableWithKeyInputType : public InputType {
+protected:
+    BaseClickableWithKeyInputType(HTMLInputElement* element) : InputType(element) { }
 
 private:
-    DOMWindowSQLDatabase() { };
-    ~DOMWindowSQLDatabase() { };
+    virtual void handleKeydownEvent(KeyboardEvent*) OVERRIDE;
+    virtual void handleKeypressEvent(KeyboardEvent*) OVERRIDE;
+    virtual void handleKeyupEvent(KeyboardEvent*) OVERRIDE;
+    virtual void accessKeyAction(bool sendMouseEvents) OVERRIDE;
 };
 
 } // namespace WebCore
 
-#endif // ENABLE(SQL_DATABASE)
-
-#endif // DOMWindowSQLDatabase_h
+#endif // BaseClickableWithKeyInputType_h
diff --git a/Source/WebCore/html/CollectionType.h b/Source/WebCore/html/CollectionType.h
index fa348f9c3..4ed981998 100644
--- a/Source/WebCore/html/CollectionType.h
+++ b/Source/WebCore/html/CollectionType.h
@@ -51,6 +51,7 @@ enum CollectionType {
     TSectionRows, // all row elements in this table section
     TRCells,      // all cells in this row
     SelectOptions,
+    SelectedOptions,
     DataListOptions,
     MapAreas,
 
diff --git a/Source/WebCore/html/ColorInputType.cpp b/Source/WebCore/html/ColorInputType.cpp
index 83647ea6a..077b559da 100644
--- a/Source/WebCore/html/ColorInputType.cpp
+++ b/Source/WebCore/html/ColorInputType.cpp
@@ -39,6 +39,7 @@
 #include "MouseEvent.h"
 #include "ScriptController.h"
 #include "ShadowRoot.h"
+#include "ShadowTree.h"
 
 #include <wtf/PassOwnPtr.h>
 #include <wtf/text/WTFString.h>
@@ -116,7 +117,7 @@ void ColorInputType::createShadowSubtree()
     ExceptionCode ec = 0;
     wrapperElement->appendChild(colorSwatch.release(), ec);
     ASSERT(!ec);
-    element()->shadowRootList()->oldestShadowRoot()->appendChild(wrapperElement.release(), ec);
+    element()->shadowTree()->oldestShadowRoot()->appendChild(wrapperElement.release(), ec);
     ASSERT(!ec);
     
     updateColorSwatch();
@@ -185,7 +186,7 @@ void ColorInputType::updateColorSwatch()
 
 HTMLElement* ColorInputType::shadowColorSwatch() const
 {
-    ShadowRoot* shadow = element()->shadowRootList()->oldestShadowRoot();
+    ShadowRoot* shadow = element()->shadowTree()->oldestShadowRoot();
     return shadow ? toHTMLElement(shadow->firstChild()->firstChild()) : 0;
 }
 
diff --git a/Source/WebCore/html/ColorInputType.h b/Source/WebCore/html/ColorInputType.h
index f92b91ced..e1ed03601 100644
--- a/Source/WebCore/html/ColorInputType.h
+++ b/Source/WebCore/html/ColorInputType.h
@@ -31,14 +31,14 @@
 #ifndef ColorInputType_h
 #define ColorInputType_h
 
+#include "BaseClickableWithKeyInputType.h"
 #include "ColorChooserClient.h"
-#include "InputType.h"
 
 #if ENABLE(INPUT_COLOR)
 
 namespace WebCore {
 
-class ColorInputType : public InputType, public ColorChooserClient {
+class ColorInputType : public BaseClickableWithKeyInputType, public ColorChooserClient {
 public:
     static PassOwnPtr<InputType> create(HTMLInputElement*);
     virtual ~ColorInputType();
@@ -48,7 +48,7 @@ public:
     virtual void didEndChooser() OVERRIDE;
 
 private:
-    ColorInputType(HTMLInputElement* element) : InputType(element) { }
+    ColorInputType(HTMLInputElement* element) : BaseClickableWithKeyInputType(element) { }
     virtual bool isColorControl() const OVERRIDE;
     virtual const AtomicString& formControlType() const OVERRIDE;
     virtual bool supportsRequired() const OVERRIDE;
diff --git a/Source/WebCore/html/DOMFormData.idl b/Source/WebCore/html/DOMFormData.idl
index 4bab556be..73eaa6618 100644
--- a/Source/WebCore/html/DOMFormData.idl
+++ b/Source/WebCore/html/DOMFormData.idl
@@ -32,6 +32,7 @@ module html {
 
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         JSGenerateToNativeObject,
         JSGenerateToJSObject,
         InterfaceName=FormData
diff --git a/Source/WebCore/html/DOMURL.idl b/Source/WebCore/html/DOMURL.idl
index e929ca86f..df747c295 100644
--- a/Source/WebCore/html/DOMURL.idl
+++ b/Source/WebCore/html/DOMURL.idl
@@ -30,12 +30,13 @@ module html {
         Constructor,
         JSGenerateToNativeObject,
         JSGenerateToJSObject,
-        JSNoStaticTables
+        JSNoStaticTables,
+        InterfaceName=URL
     ] DOMURL {
 #if defined(ENABLE_MEDIA_STREAM) && ENABLE_MEDIA_STREAM
-        static [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Undefined] DOMString createObjectURL(in MediaStream stream);
+        [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Undefined] static DOMString createObjectURL(in MediaStream stream);
 #endif
-        static [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Undefined] DOMString createObjectURL(in Blob blob);
-        static [CallWith=ScriptExecutionContext] void revokeObjectURL(in DOMString url);
+        [CallWith=ScriptExecutionContext,TreatReturnedNullStringAs=Undefined] static DOMString createObjectURL(in Blob blob);
+        [CallWith=ScriptExecutionContext] static void revokeObjectURL(in DOMString url);
     };
 }
diff --git a/Source/WebCore/html/DOMWindowHTML.idl b/Source/WebCore/html/DOMWindowHTML.idl
deleted file mode 100644
index 889c3a00e..000000000
--- a/Source/WebCore/html/DOMWindowHTML.idl
+++ /dev/null
@@ -1,119 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-module window {
-
-    // FIXME: Most of this could/should be generated from make_names.pl/HTMLNames.in
-    // to reduce the chance that we forget a constructor when adding a new element.
-    interface [
-        Supplemental=DOMWindow
-    ] DOMWindowHTML {
-
-        attribute HTMLDocumentConstructor HTMLDocument;
-        attribute HTMLElementConstructor HTMLElement;
-        attribute HTMLAnchorElementConstructor HTMLAnchorElement;
-        attribute HTMLAppletElementConstructor HTMLAppletElement;
-        attribute HTMLAreaElementConstructor HTMLAreaElement;
-        attribute HTMLBRElementConstructor HTMLBRElement;
-        attribute HTMLBaseElementConstructor HTMLBaseElement;
-        attribute HTMLBaseFontElementConstructor HTMLBaseFontElement;
-        attribute HTMLBodyElementConstructor HTMLBodyElement;
-        attribute HTMLButtonElementConstructor HTMLButtonElement;
-        attribute HTMLCanvasElementConstructor HTMLCanvasElement;
-        attribute HTMLDListElementConstructor HTMLDListElement;
-        attribute HTMLDirectoryElementConstructor HTMLDirectoryElement;
-        attribute HTMLDivElementConstructor HTMLDivElement;
-        attribute HTMLEmbedElementConstructor HTMLEmbedElement;
-        attribute HTMLFieldSetElementConstructor HTMLFieldSetElement;
-        attribute HTMLFontElementConstructor HTMLFontElement;
-        attribute HTMLFormElementConstructor HTMLFormElement;
-        attribute HTMLFrameElementConstructor HTMLFrameElement;
-        attribute HTMLFrameSetElementConstructor HTMLFrameSetElement;
-        attribute HTMLHRElementConstructor HTMLHRElement;
-        attribute HTMLHeadElementConstructor HTMLHeadElement;
-        attribute HTMLHeadingElementConstructor HTMLHeadingElement;
-        attribute HTMLHtmlElementConstructor HTMLHtmlElement;
-        attribute HTMLIFrameElementConstructor HTMLIFrameElement;
-        attribute HTMLImageElementConstructor HTMLImageElement;
-        attribute HTMLInputElementConstructor HTMLInputElement;
-        attribute HTMLKeygenElementConstructor HTMLKeygenElement;
-        attribute HTMLLIElementConstructor HTMLLIElement;
-        attribute HTMLLabelElementConstructor HTMLLabelElement;
-        attribute HTMLLegendElementConstructor HTMLLegendElement;
-        attribute HTMLLinkElementConstructor HTMLLinkElement;
-        attribute HTMLMapElementConstructor HTMLMapElement;
-        attribute HTMLMarqueeElementConstructor HTMLMarqueeElement;
-        attribute HTMLMenuElementConstructor HTMLMenuElement;
-        attribute HTMLMetaElementConstructor HTMLMetaElement;
-#if defined(ENABLE_METER_TAG) && ENABLE_METER_TAG
-        attribute HTMLMeterElementConstructor HTMLMeterElement;
-#endif
-        attribute HTMLModElementConstructor HTMLModElement;
-        attribute HTMLOListElementConstructor HTMLOListElement;
-        attribute HTMLObjectElementConstructor HTMLObjectElement;
-        attribute HTMLOptGroupElementConstructor HTMLOptGroupElement;
-        attribute HTMLOptionElementConstructor HTMLOptionElement;
-        attribute HTMLOutputElementConstructor HTMLOutputElement;
-        attribute HTMLParagraphElementConstructor HTMLParagraphElement;
-        attribute HTMLParamElementConstructor HTMLParamElement;
-        attribute HTMLPreElementConstructor HTMLPreElement;
-#if defined(ENABLE_PROGRESS_TAG) && ENABLE_PROGRESS_TAG
-        attribute HTMLProgressElementConstructor HTMLProgressElement;
-#endif
-        attribute HTMLQuoteElementConstructor HTMLQuoteElement;
-        attribute HTMLScriptElementConstructor HTMLScriptElement;
-        attribute HTMLSelectElementConstructor HTMLSelectElement;
-        attribute HTMLSpanElementConstructor HTMLSpanElement;
-        attribute HTMLStyleElementConstructor HTMLStyleElement;
-        attribute HTMLTableCaptionElementConstructor HTMLTableCaptionElement;
-        attribute HTMLTableCellElementConstructor HTMLTableCellElement;
-        attribute HTMLTableColElementConstructor HTMLTableColElement;
-        attribute HTMLTableElementConstructor HTMLTableElement;
-        attribute HTMLTableRowElementConstructor HTMLTableRowElement;
-        attribute HTMLTableSectionElementConstructor HTMLTableSectionElement;
-        attribute HTMLTextAreaElementConstructor HTMLTextAreaElement;
-        attribute HTMLTitleElementConstructor HTMLTitleElement;
-        attribute HTMLUListElementConstructor HTMLUListElement;
-
-        attribute HTMLCollectionConstructor HTMLCollection;
-        attribute HTMLAllCollectionConstructor HTMLAllCollection;
-        attribute [Conditional=MICRODATA] HTMLPropertiesCollectionConstructor HTMLPropertiesCollection;
-        attribute HTMLUnknownElementConstructor HTMLUnknownElement;
-
-        attribute [JSCustomGetter, CustomConstructor] HTMLImageElementConstructorConstructor Image; // Usable with new operator
-        attribute [JSCustomGetter] HTMLOptionElementConstructorConstructor Option; // Usable with new operator
-
-        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] HTMLTrackElementConstructor HTMLTrackElement;
-        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackConstructor TextTrack;
-        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackCueConstructor TextTrackCue; // Usable with the new operator
-        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackCueListConstructor TextTrackCueList;
-        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackListConstructor TextTrackList;
-        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TrackEventConstructor TrackEvent;
-
-        attribute [JSCustomGetter, Conditional=VIDEO, V8EnabledAtRuntime] HTMLAudioElementConstructorConstructor Audio; // Usable with the new operator
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLAudioElementConstructor HTMLAudioElement;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLMediaElementConstructor HTMLMediaElement;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLVideoElementConstructor HTMLVideoElement;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] MediaErrorConstructor MediaError;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] TimeRangesConstructor TimeRanges;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLSourceElementConstructor HTMLSourceElement;
-        attribute [Conditional=VIDEO, V8EnabledAtRuntime] MediaControllerConstructor MediaController;
-    };
-
-}
diff --git a/Source/WebCore/html/FileInputType.cpp b/Source/WebCore/html/FileInputType.cpp
index 5759f6741..9cb39b667 100644
--- a/Source/WebCore/html/FileInputType.cpp
+++ b/Source/WebCore/html/FileInputType.cpp
@@ -36,7 +36,7 @@
 #include "RenderFileUploadControl.h"
 #include "ScriptController.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/text/StringBuilder.h>
 #include <wtf/text/WTFString.h>
@@ -84,7 +84,7 @@ const AtomicString& UploadButtonElement::shadowPseudoId() const
 }
 
 inline FileInputType::FileInputType(HTMLInputElement* element)
-    : BaseButtonInputType(element)
+    : BaseClickableWithKeyInputType(element)
     , m_fileList(FileList::create())
 {
 }
@@ -99,6 +99,26 @@ const AtomicString& FileInputType::formControlType() const
     return InputTypeNames::file();
 }
 
+bool FileInputType::saveFormControlState(String& result) const
+{
+    if (m_fileList->isEmpty())
+        return false;
+    result = String();
+    unsigned numFiles = m_fileList->length();
+    for (unsigned i = 0; i < numFiles; ++i) {
+        result.append(m_fileList->item(i)->path());
+        result.append('\0');
+    }
+    return true;
+}
+
+void FileInputType::restoreFormControlState(const String& state)
+{
+    Vector<String> files;
+    state.split('\0', files);
+    filesChosen(files);
+}
+
 bool FileInputType::appendFormData(FormDataList& encoding, bool multipart) const
 {
     FileList* fileList = element()->files();
@@ -213,11 +233,6 @@ bool FileInputType::getTypeSpecificValue(String& value)
     return true;
 }
 
-bool FileInputType::storesValueSeparateFromAttribute()
-{
-    return true;
-}
-
 void FileInputType::setValue(const String&, bool, TextFieldEventBehavior)
 {
     m_fileList->clear();
@@ -268,13 +283,13 @@ void FileInputType::createShadowSubtree()
 {
     ASSERT(element()->hasShadowRoot());
     ExceptionCode ec = 0;
-    element()->shadowRootList()->oldestShadowRoot()->appendChild(element()->multiple() ? UploadButtonElement::createForMultiple(element()->document()): UploadButtonElement::create(element()->document()), ec);
+    element()->shadowTree()->oldestShadowRoot()->appendChild(element()->multiple() ? UploadButtonElement::createForMultiple(element()->document()): UploadButtonElement::create(element()->document()), ec);
 }
 
 void FileInputType::multipleAttributeChanged()
 {
     ASSERT(element()->hasShadowRoot());
-    UploadButtonElement* button = static_cast<UploadButtonElement*>(element()->shadowRootList()->oldestShadowRoot()->firstChild());
+    UploadButtonElement* button = static_cast<UploadButtonElement*>(element()->shadowTree()->oldestShadowRoot()->firstChild());
     if (button)
         button->setValue(element()->multiple() ? fileButtonChooseMultipleFilesLabel() : fileButtonChooseFileLabel());
 }
diff --git a/Source/WebCore/html/FileInputType.h b/Source/WebCore/html/FileInputType.h
index 53575a420..00d362bda 100644
--- a/Source/WebCore/html/FileInputType.h
+++ b/Source/WebCore/html/FileInputType.h
@@ -32,7 +32,7 @@
 #ifndef FileInputType_h
 #define FileInputType_h
 
-#include "BaseButtonInputType.h"
+#include "BaseClickableWithKeyInputType.h"
 #include "FileChooser.h"
 #include "FileIconLoader.h"
 #include <wtf/RefPtr.h>
@@ -41,13 +41,15 @@ namespace WebCore {
 
 class FileList;
 
-class FileInputType : public BaseButtonInputType, private FileChooserClient, private FileIconLoaderClient {
+class FileInputType : public BaseClickableWithKeyInputType, private FileChooserClient, private FileIconLoaderClient {
 public:
     static PassOwnPtr<InputType> create(HTMLInputElement*);
 
 private:
     FileInputType(HTMLInputElement*);
     virtual const AtomicString& formControlType() const OVERRIDE;
+    virtual bool saveFormControlState(String&) const OVERRIDE;
+    virtual void restoreFormControlState(const String&) OVERRIDE;
     virtual bool appendFormData(FormDataList&, bool) const OVERRIDE;
     virtual bool valueMissing(const String&) const OVERRIDE;
     virtual String valueMissingText() const OVERRIDE;
@@ -58,7 +60,6 @@ private:
     virtual FileList* files() OVERRIDE;
     virtual bool canSetValue(const String&) OVERRIDE;
     virtual bool getTypeSpecificValue(String&) OVERRIDE; // Checked first, before internal storage or the value attribute.
-    virtual bool storesValueSeparateFromAttribute() OVERRIDE;
     virtual void setValue(const String&, bool valueChanged, TextFieldEventBehavior) OVERRIDE;
     virtual void receiveDroppedFiles(const Vector<String>&) OVERRIDE;
     virtual Icon* icon() const OVERRIDE;
diff --git a/Source/WebCore/html/HTMLBRElement.cpp b/Source/WebCore/html/HTMLBRElement.cpp
index 33f0c533c..57253af0e 100644
--- a/Source/WebCore/html/HTMLBRElement.cpp
+++ b/Source/WebCore/html/HTMLBRElement.cpp
@@ -25,6 +25,7 @@
 
 #include "Attribute.h"
 #include "CSSPropertyNames.h"
+#include "CSSValueKeywords.h"
 #include "HTMLNames.h"
 #include "RenderBR.h"
 
@@ -48,11 +49,11 @@ PassRefPtr<HTMLBRElement> HTMLBRElement::create(const QualifiedName& tagName, Do
     return adoptRef(new HTMLBRElement(tagName, document));
 }
 
-bool HTMLBRElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLBRElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == clearAttr)
+    if (name == clearAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLBRElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
@@ -62,7 +63,7 @@ void HTMLBRElement::collectStyleForAttribute(Attribute* attr, StylePropertySet*
         // <br clear> and <br clear=""> are just treated like <br> by Gecko, Mac IE, etc. -dwh
         if (!attr->isEmpty()) {
             if (equalIgnoringCase(attr->value(), "all"))
-                addPropertyToAttributeStyle(style, CSSPropertyClear, "both");
+                addPropertyToAttributeStyle(style, CSSPropertyClear, CSSValueBoth);
             else
                 addPropertyToAttributeStyle(style, CSSPropertyClear, attr->value());
         }
diff --git a/Source/WebCore/html/HTMLBRElement.h b/Source/WebCore/html/HTMLBRElement.h
index 16c1beae7..a7e60f321 100644
--- a/Source/WebCore/html/HTMLBRElement.h
+++ b/Source/WebCore/html/HTMLBRElement.h
@@ -38,7 +38,7 @@ public:
 private:
     HTMLBRElement(const QualifiedName&, Document*);
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/Source/WebCore/html/HTMLBodyElement.cpp b/Source/WebCore/html/HTMLBodyElement.cpp
index 34d2924fa..a6b5b219e 100644
--- a/Source/WebCore/html/HTMLBodyElement.cpp
+++ b/Source/WebCore/html/HTMLBodyElement.cpp
@@ -61,11 +61,11 @@ HTMLBodyElement::~HTMLBodyElement()
 {
 }
 
-bool HTMLBodyElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLBodyElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == backgroundAttr || attr->name() == marginwidthAttr || attr->name() == leftmarginAttr || attr->name() == marginheightAttr || attr->name() == topmarginAttr || attr->name() == bgcolorAttr || attr->name() == textAttr || attr->name() == bgpropertiesAttr)
+    if (name == backgroundAttr || name == marginwidthAttr || name == leftmarginAttr || name == marginheightAttr || name == topmarginAttr || name == bgcolorAttr || name == textAttr || name == bgpropertiesAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLBodyElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLBodyElement.h b/Source/WebCore/html/HTMLBodyElement.h
index 41ba4485c..a0dce1f15 100644
--- a/Source/WebCore/html/HTMLBodyElement.h
+++ b/Source/WebCore/html/HTMLBodyElement.h
@@ -71,7 +71,7 @@ private:
     HTMLBodyElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void insertedIntoDocument();
diff --git a/Source/WebCore/html/HTMLButtonElement.cpp b/Source/WebCore/html/HTMLButtonElement.cpp
index a79641a31..d91bd49aa 100644
--- a/Source/WebCore/html/HTMLButtonElement.cpp
+++ b/Source/WebCore/html/HTMLButtonElement.cpp
@@ -79,15 +79,15 @@ const AtomicString& HTMLButtonElement::formControlType() const
     return emptyAtom;
 }
 
-bool HTMLButtonElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLButtonElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == alignAttr) {
+    if (name == alignAttr) {
         // Don't map 'align' attribute.  This matches what Firefox and IE do, but not Opera.
         // See http://bugs.webkit.org/show_bug.cgi?id=12071
         return false;
     }
 
-    return HTMLFormControlElement::isPresentationAttribute(attr);
+    return HTMLFormControlElement::isPresentationAttribute(name);
 }
 
 void HTMLButtonElement::parseAttribute(Attribute* attr)
diff --git a/Source/WebCore/html/HTMLButtonElement.h b/Source/WebCore/html/HTMLButtonElement.h
index 00518ea4c..51ea71a1c 100644
--- a/Source/WebCore/html/HTMLButtonElement.h
+++ b/Source/WebCore/html/HTMLButtonElement.h
@@ -44,11 +44,12 @@ private:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void defaultEventHandler(Event*);
     virtual bool appendFormData(FormDataList&, bool);
 
     virtual bool isEnumeratable() const { return true; } 
+    virtual bool isLabelable() const OVERRIDE { return true; }
 
     virtual bool isSuccessfulSubmitButton() const;
     virtual bool isActivatedSubmit() const;
diff --git a/Source/WebCore/html/HTMLButtonElement.idl b/Source/WebCore/html/HTMLButtonElement.idl
index b9eafb0d5..692fd612a 100644
--- a/Source/WebCore/html/HTMLButtonElement.idl
+++ b/Source/WebCore/html/HTMLButtonElement.idl
@@ -21,34 +21,32 @@
 module html {
 
     interface HTMLButtonElement : HTMLElement {
+        attribute [Reflect] boolean autofocus;
+        attribute [Reflect] boolean disabled;
         readonly attribute HTMLFormElement form;
-
         attribute [Reflect, URL] DOMString formAction;
         attribute [TreatNullAs=NullString] DOMString formEnctype;
         attribute [TreatNullAs=NullString] DOMString formMethod;
         attribute [Reflect] boolean formNoValidate;
         attribute [Reflect] DOMString formTarget;
-        readonly attribute ValidityState validity;
-
-#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        attribute [Reflect] DOMString accessKey;
-#endif
-        attribute [Reflect] boolean disabled;
-        attribute [Reflect] boolean autofocus;
         attribute [Reflect] DOMString name;
         readonly attribute DOMString type;
         attribute [Reflect] DOMString value;
 
         readonly attribute boolean willValidate;
+        readonly attribute ValidityState validity;
         readonly attribute DOMString validationMessage;
         boolean checkValidity();
         void setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
 
+        readonly attribute NodeList labels;
+
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        void click();
+        attribute [Reflect] DOMString accessKey;
 #endif
 
-        readonly attribute NodeList labels;
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        void click();
+#endif
     };
-
 }
diff --git a/Source/WebCore/html/HTMLCanvasElement.cpp b/Source/WebCore/html/HTMLCanvasElement.cpp
index 7ed6e3d11..60d21ce48 100644
--- a/Source/WebCore/html/HTMLCanvasElement.cpp
+++ b/Source/WebCore/html/HTMLCanvasElement.cpp
@@ -490,7 +490,7 @@ void HTMLCanvasElement::createImageBuffer() const
 
     m_hasCreatedImageBuffer = true;
 
-    FloatSize logicalSize(width(), height());
+    FloatSize logicalSize = size();
     FloatSize deviceSize = convertLogicalToDevice(logicalSize);
     if (!deviceSize.isExpressibleAsIntSize())
         return;
@@ -513,7 +513,7 @@ void HTMLCanvasElement::createImageBuffer() const
         Unaccelerated;
 #endif
     DeferralMode deferralMode = shouldDefer() ? Deferred : NonDeferred;
-    m_imageBuffer = ImageBuffer::create(bufferSize, ColorSpaceDeviceRGB, renderingMode, deferralMode);
+    m_imageBuffer = ImageBuffer::create(bufferSize, 1, ColorSpaceDeviceRGB, renderingMode, deferralMode);
     if (!m_imageBuffer)
         return;
     m_imageBuffer->context()->scale(FloatSize(bufferSize.width() / logicalSize.width(), bufferSize.height() / logicalSize.height()));
@@ -523,7 +523,8 @@ void HTMLCanvasElement::createImageBuffer() const
 
 #if USE(JSC)
     JSC::JSLock lock(JSC::SilenceAssertionsOnly);
-    scriptExecutionContext()->globalData()->heap.reportExtraMemoryCost(m_imageBuffer->dataSize());
+    size_t numBytes = 4 * m_imageBuffer->internalSize().width() * m_imageBuffer->internalSize().height();
+    scriptExecutionContext()->globalData()->heap.reportExtraMemoryCost(numBytes);
 #endif
 
 #if USE(IOSURFACE_CANVAS_BACKING_STORE) || (ENABLE(ACCELERATED_2D_CANVAS) && USE(ACCELERATED_COMPOSITING))
@@ -571,7 +572,7 @@ void HTMLCanvasElement::clearCopiedImage()
 AffineTransform HTMLCanvasElement::baseTransform() const
 {
     ASSERT(m_hasCreatedImageBuffer);
-    FloatSize unscaledSize(width(), height());
+    FloatSize unscaledSize = size();
     FloatSize deviceSize = convertLogicalToDevice(unscaledSize);
     IntSize size(deviceSize.width(), deviceSize.height());
     AffineTransform transform;
diff --git a/Source/WebCore/html/HTMLCollection.cpp b/Source/WebCore/html/HTMLCollection.cpp
index 7d06308fc..d11fee121 100644
--- a/Source/WebCore/html/HTMLCollection.cpp
+++ b/Source/WebCore/html/HTMLCollection.cpp
@@ -61,6 +61,7 @@ bool HTMLCollection::shouldIncludeChildren(CollectionType type)
     case MapAreas:
     case OtherCollection:
     case SelectOptions:
+    case SelectedOptions:
     case DataListOptions:
     case WindowNamedItems:
 #if ENABLE(MICRODATA)
@@ -114,6 +115,13 @@ inline bool HTMLCollection::isAcceptableElement(Element* element) const
         return element->hasLocalName(trTag);
     case SelectOptions:
         return element->hasLocalName(optionTag);
+    case SelectedOptions:
+        if (element->hasLocalName(optionTag)) {
+            HTMLOptionElement* option = static_cast<HTMLOptionElement*>(element);
+            if (option->selected())
+                return true;
+        }
+        return false;
     case DataListOptions:
         if (element->hasLocalName(optionTag)) {
             HTMLOptionElement* option = static_cast<HTMLOptionElement*>(element);
diff --git a/Source/WebCore/html/HTMLDetailsElement.cpp b/Source/WebCore/html/HTMLDetailsElement.cpp
index d49daa4c6..332f1a740 100644
--- a/Source/WebCore/html/HTMLDetailsElement.cpp
+++ b/Source/WebCore/html/HTMLDetailsElement.cpp
@@ -29,9 +29,9 @@
 #include "LocalizedStrings.h"
 #include "MouseEvent.h"
 #include "NodeRenderingContext.h"
-#include "RenderDetails.h"
+#include "RenderBlock.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "Text.h"
 
 namespace WebCore {
@@ -50,7 +50,7 @@ public:
 
 private:
     DetailsContentElement(Document* document)
-        : HTMLContentElement(HTMLNames::divTag, document)
+        : HTMLContentElement(HTMLNames::webkitShadowContentTag, document)
     {
     }
 };
@@ -72,7 +72,7 @@ public:
 
 private:
     DetailsSummaryElement(Document* document)
-        : HTMLContentElement(HTMLNames::divTag, document)
+        : HTMLContentElement(HTMLNames::webkitShadowContentTag, document)
     {
         setSelect(summaryQuerySelector());
     }
@@ -105,7 +105,7 @@ HTMLDetailsElement::HTMLDetailsElement(const QualifiedName& tagName, Document* d
 
 RenderObject* HTMLDetailsElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    return new (arena) RenderDetails(this);
+    return new (arena) RenderBlock(this);
 }
 
 void HTMLDetailsElement::createShadowSubtree()
@@ -124,7 +124,7 @@ Element* HTMLDetailsElement::findMainSummary() const
             return toElement(child);
     }
 
-    return static_cast<DetailsSummaryElement*>(shadowRootList()->oldestShadowRoot()->firstChild())->fallbackSummary();
+    return static_cast<DetailsSummaryElement*>(shadowTree()->oldestShadowRoot()->firstChild())->fallbackSummary();
 }
 
 void HTMLDetailsElement::parseAttribute(Attribute* attr)
diff --git a/Source/WebCore/html/HTMLDivElement.cpp b/Source/WebCore/html/HTMLDivElement.cpp
index bd15ae239..24efd8646 100644
--- a/Source/WebCore/html/HTMLDivElement.cpp
+++ b/Source/WebCore/html/HTMLDivElement.cpp
@@ -48,11 +48,11 @@ PassRefPtr<HTMLDivElement> HTMLDivElement::create(const QualifiedName& tagName,
     return adoptRef(new HTMLDivElement(tagName, document));
 }
 
-bool HTMLDivElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLDivElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == alignAttr)
+    if (name == alignAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLDivElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLDivElement.h b/Source/WebCore/html/HTMLDivElement.h
index f8f4f7101..6a3dac3b3 100644
--- a/Source/WebCore/html/HTMLDivElement.h
+++ b/Source/WebCore/html/HTMLDivElement.h
@@ -36,7 +36,7 @@ protected:
     HTMLDivElement(const QualifiedName&, Document*);
 
 private:
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/HTMLDocument.cpp b/Source/WebCore/html/HTMLDocument.cpp
index b67eacd5a..f2e511eb0 100644
--- a/Source/WebCore/html/HTMLDocument.cpp
+++ b/Source/WebCore/html/HTMLDocument.cpp
@@ -136,30 +136,9 @@ void HTMLDocument::setDesignMode(const String& value)
     Document::setDesignMode(mode);
 }
 
-static Node* focusedFrameOwnerElement(Frame* focusedFrame, Frame* currentFrame)
-{
-    for (; focusedFrame; focusedFrame = focusedFrame->tree()->parent()) {
-        if (focusedFrame->tree()->parent() == currentFrame)
-            return focusedFrame->ownerElement();
-    }
-    return 0;
-}
-
 Element* HTMLDocument::activeElement()
 {
-    Node* node = focusedNode();
-    if (!node && page())
-        node = focusedFrameOwnerElement(page()->focusController()->focusedFrame(), frame());
-    if (!node)
-        return body();
-    ASSERT(node->document() == this);
-    while (node->treeScope() != this) {
-        node = node->parentOrHostNode();
-        ASSERT(node);
-    }
-    if (node->isElementNode())
-        return toElement(node);
-    return body();
+    return treeScope()->activeElement();
 }
 
 bool HTMLDocument::hasFocus()
diff --git a/Source/WebCore/html/HTMLDocument.idl b/Source/WebCore/html/HTMLDocument.idl
index 19420ee3d..de9b51d84 100644
--- a/Source/WebCore/html/HTMLDocument.idl
+++ b/Source/WebCore/html/HTMLDocument.idl
@@ -45,10 +45,8 @@ module html {
         void captureEvents();
         void releaseEvents();
 
-#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute long width;
         readonly attribute long height;
-#endif
                  attribute [TreatNullAs=NullString] DOMString dir;
                  attribute [TreatNullAs=NullString] DOMString designMode;
         readonly attribute DOMString compatMode;
diff --git a/Source/WebCore/html/HTMLElement.cpp b/Source/WebCore/html/HTMLElement.cpp
index 4e8da5c7d..d046814e3 100644
--- a/Source/WebCore/html/HTMLElement.cpp
+++ b/Source/WebCore/html/HTMLElement.cpp
@@ -159,18 +159,18 @@ void HTMLElement::mapLanguageAttributeToLocale(Attribute* attribute, StyleProper
     }
 }
 
-bool HTMLElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == alignAttr || attr->name() == contenteditableAttr || attr->name() == hiddenAttr || attr->name() == langAttr || attr->name().matches(XMLNames::langAttr) || attr->name() == draggableAttr || attr->name() == dirAttr)
+    if (name == alignAttr || name == contenteditableAttr || name == hiddenAttr || name == langAttr || name.matches(XMLNames::langAttr) || name == draggableAttr || name == dirAttr)
         return true;
-    return StyledElement::isPresentationAttribute(attr);
+    return StyledElement::isPresentationAttribute(name);
 }
 
 void HTMLElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
 {
     if (attr->name() == alignAttr) {
         if (equalIgnoringCase(attr->value(), "middle"))
-            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, "center");
+            addPropertyToAttributeStyle(style, CSSPropertyTextAlign, CSSValueCenter);
         else
             addPropertyToAttributeStyle(style, CSSPropertyTextAlign, attr->value());
     } else if (attr->name() == contenteditableAttr) {
@@ -234,7 +234,6 @@ void HTMLElement::parseAttribute(Attribute* attr)
         setItemRef(attr->value());
     } else if (attr->name() == itemtypeAttr) {
         setItemType(attr->value());
-        itemTypeAttributeChanged();
 #endif
     }
 // standard events
@@ -343,84 +342,6 @@ String HTMLElement::outerHTML() const
     return createMarkup(this);
 }
 
-static inline bool hasOneChild(ContainerNode* node)
-{
-    Node* firstChild = node->firstChild();
-    return firstChild && !firstChild->nextSibling();
-}
-
-static inline bool hasOneTextChild(ContainerNode* node)
-{
-    return hasOneChild(node) && node->firstChild()->isTextNode();
-}
-
-static void replaceChildrenWithFragment(HTMLElement* element, PassRefPtr<DocumentFragment> fragment, ExceptionCode& ec)
-{
-#if ENABLE(MUTATION_OBSERVERS)
-    ChildListMutationScope mutation(element);
-#endif
-
-    if (!fragment->firstChild()) {
-        element->removeChildren();
-        return;
-    }
-
-    if (hasOneTextChild(element) && hasOneTextChild(fragment.get())) {
-        toText(element->firstChild())->setData(toText(fragment->firstChild())->data(), ec);
-        return;
-    }
-
-    if (hasOneChild(element)) {
-        element->replaceChild(fragment, element->firstChild(), ec);
-        return;
-    }
-
-    element->removeChildren();
-    element->appendChild(fragment, ec);
-}
-
-static void replaceChildrenWithText(HTMLElement* element, const String& text, ExceptionCode& ec)
-{
-#if ENABLE(MUTATION_OBSERVERS)
-    ChildListMutationScope mutation(element);
-#endif
-
-    if (hasOneTextChild(element)) {
-        toText(element->firstChild())->setData(text, ec);
-        return;
-    }
-
-    RefPtr<Text> textNode = Text::create(element->document(), text);
-
-    if (hasOneChild(element)) {
-        element->replaceChild(textNode.release(), element->firstChild(), ec);
-        return;
-    }
-
-    element->removeChildren();
-    element->appendChild(textNode.release(), ec);
-}
-
-// We may want to move a version of this function into DocumentFragment.h/cpp
-static PassRefPtr<DocumentFragment> createFragmentFromSource(const String& markup, Element* contextElement, ExceptionCode& ec)
-{
-    Document* document = contextElement->document();
-    RefPtr<DocumentFragment> fragment;
-
-    fragment = DocumentFragment::create(document);
-    if (document->isHTMLDocument()) {
-        fragment->parseHTML(markup, contextElement);
-        return fragment;
-    }
-
-    bool wasValid = fragment->parseXML(markup, contextElement);
-    if (!wasValid) {
-        ec = INVALID_STATE_ERR;
-        return 0;
-    }
-    return fragment;
-}
-
 void HTMLElement::setInnerHTML(const String& html, ExceptionCode& ec)
 {
     RefPtr<DocumentFragment> fragment = createFragmentFromSource(html, this, ec);
@@ -1184,16 +1105,15 @@ void StyledElement::copyNonAttributeProperties(const Element* sourceElement)
     ASSERT(sourceElement->isStyledElement());
 
     const StyledElement* source = static_cast<const StyledElement*>(sourceElement);
-    if (!source->inlineStyleDecl())
+    if (!source->inlineStyle())
         return;
 
-    StylePropertySet* inlineStyle = ensureInlineStyleDecl();
-    inlineStyle->copyPropertiesFrom(*source->inlineStyleDecl());
-    inlineStyle->setStrictParsing(source->inlineStyleDecl()->useStrictParsing());
+    StylePropertySet* inlineStyle = ensureAttributeData()->ensureMutableInlineStyle(this);
+    inlineStyle->copyPropertiesFrom(*source->inlineStyle());
+    inlineStyle->setStrictParsing(source->inlineStyle()->useStrictParsing());
 
     setIsStyleAttributeValid(source->isStyleAttributeValid());
-    setIsSynchronizingStyleAttribute(source->isSynchronizingStyleAttribute());
-    
+
     Element::copyNonAttributeProperties(sourceElement);
 }
 
diff --git a/Source/WebCore/html/HTMLElement.h b/Source/WebCore/html/HTMLElement.h
index 9d463cd77..b92152c9f 100644
--- a/Source/WebCore/html/HTMLElement.h
+++ b/Source/WebCore/html/HTMLElement.h
@@ -97,6 +97,12 @@ public:
     PassRefPtr<MicroDataItemValue> itemValue() const;
 #endif
 
+#ifndef NDEBUG
+    virtual bool isHTMLUnknownElement() const { return false; }
+#endif
+
+    virtual bool isInsertionPoint() const { return false; }
+
 protected:
     HTMLElement(const QualifiedName& tagName, Document*);
 
@@ -107,7 +113,7 @@ protected:
     void applyBorderAttributeToStyle(Attribute*, StylePropertySet*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
diff --git a/Source/WebCore/html/HTMLElement.idl b/Source/WebCore/html/HTMLElement.idl
index 8d5a0688d..4f5f236f6 100644
--- a/Source/WebCore/html/HTMLElement.idl
+++ b/Source/WebCore/html/HTMLElement.idl
@@ -69,6 +69,7 @@ module html {
 
                  attribute boolean spellcheck;
 
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C // No Objective-C bindings yet.
                  attribute [Conditional=MICRODATA, Reflect] boolean itemScope;
         readonly attribute [Conditional=MICRODATA] DOMSettableTokenList itemType;
                  attribute [Conditional=MICRODATA, Reflect, URL] DOMString itemId;
@@ -79,6 +80,7 @@ module html {
 #if defined(ENABLE_MICRODATA) && ENABLE_MICRODATA
         readonly attribute [Conditional=MICRODATA] HTMLPropertiesCollection properties;
 #endif
+#endif
 
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
diff --git a/Source/WebCore/html/HTMLEmbedElement.cpp b/Source/WebCore/html/HTMLEmbedElement.cpp
index 06cb9b1e9..0fc0b17a1 100644
--- a/Source/WebCore/html/HTMLEmbedElement.cpp
+++ b/Source/WebCore/html/HTMLEmbedElement.cpp
@@ -74,11 +74,11 @@ RenderWidget* HTMLEmbedElement::renderWidgetForJSBindings()
     return findWidgetRenderer(this);
 }
 
-bool HTMLEmbedElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLEmbedElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == hiddenAttr)
+    if (name == hiddenAttr)
         return true;
-    return HTMLPlugInImageElement::isPresentationAttribute(attr);
+    return HTMLPlugInImageElement::isPresentationAttribute(name);
 }
 
 void HTMLEmbedElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
@@ -208,13 +208,6 @@ bool HTMLEmbedElement::rendererIsNeeded(const NodeRenderingContext& context)
     return HTMLPlugInImageElement::rendererIsNeeded(context);
 }
 
-void HTMLEmbedElement::insertedIntoDocument()
-{
-    HTMLPlugInImageElement::insertedIntoDocument();
-    if (!inDocument())
-        return;
-}
-
 bool HTMLEmbedElement::isURLAttribute(Attribute* attr) const
 {
     return attr->name() == srcAttr || HTMLPlugInImageElement::isURLAttribute(attr);
diff --git a/Source/WebCore/html/HTMLEmbedElement.h b/Source/WebCore/html/HTMLEmbedElement.h
index f0fca2224..86bf8eddc 100644
--- a/Source/WebCore/html/HTMLEmbedElement.h
+++ b/Source/WebCore/html/HTMLEmbedElement.h
@@ -35,11 +35,10 @@ private:
     HTMLEmbedElement(const QualifiedName&, Document*, bool createdByParser);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
-    virtual void insertedIntoDocument();
 
     virtual bool isURLAttribute(Attribute*) const;
     virtual const QualifiedName& imageSourceAttributeName() const;
diff --git a/Source/WebCore/html/HTMLFieldSetElement.idl b/Source/WebCore/html/HTMLFieldSetElement.idl
index dd699c0e8..0c34dee75 100644
--- a/Source/WebCore/html/HTMLFieldSetElement.idl
+++ b/Source/WebCore/html/HTMLFieldSetElement.idl
@@ -21,11 +21,14 @@ module html {
 
     interface HTMLFieldSetElement : HTMLElement {
         readonly attribute HTMLFormElement form;
-        readonly attribute ValidityState   validity;
+        attribute [Reflect] DOMString name;
+
+        readonly attribute DOMString type;
+
         readonly attribute boolean         willValidate;
+        readonly attribute ValidityState   validity;
         readonly attribute DOMString       validationMessage;
         boolean  checkValidity();
         void     setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
     };
-
 }
diff --git a/Source/WebCore/html/HTMLFontElement.cpp b/Source/WebCore/html/HTMLFontElement.cpp
index a7c2e950b..9c127419b 100644
--- a/Source/WebCore/html/HTMLFontElement.cpp
+++ b/Source/WebCore/html/HTMLFontElement.cpp
@@ -160,11 +160,11 @@ bool HTMLFontElement::cssValueFromFontSizeNumber(const String& s, int& size)
     return true;
 }
 
-bool HTMLFontElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLFontElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == sizeAttr || attr->name() == colorAttr || attr->name() == faceAttr)
+    if (name == sizeAttr || name == colorAttr || name == faceAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLFontElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLFontElement.h b/Source/WebCore/html/HTMLFontElement.h
index f24332c31..5ebbae9cb 100644
--- a/Source/WebCore/html/HTMLFontElement.h
+++ b/Source/WebCore/html/HTMLFontElement.h
@@ -37,7 +37,7 @@ public:
 private:
     HTMLFontElement(const QualifiedName&, Document*);
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/HTMLFormControlElement.cpp b/Source/WebCore/html/HTMLFormControlElement.cpp
index 8a72df061..0dad346f3 100644
--- a/Source/WebCore/html/HTMLFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLFormControlElement.cpp
@@ -26,16 +26,12 @@
 #include "HTMLFormControlElement.h"
 
 #include "Attribute.h"
-#include "Document.h"
-#include "ElementRareData.h"
 #include "Event.h"
 #include "EventHandler.h"
 #include "EventNames.h"
 #include "Frame.h"
 #include "HTMLFormElement.h"
 #include "HTMLInputElement.h"
-#include "HTMLNames.h"
-#include "LabelsNodeList.h"
 #include "RenderBox.h"
 #include "RenderTheme.h"
 #include "ScriptEventListener.h"
@@ -49,7 +45,7 @@ using namespace HTMLNames;
 using namespace std;
 
 HTMLFormControlElement::HTMLFormControlElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
-    : HTMLElement(tagName, document)
+    : LabelableElement(tagName, document)
     , m_disabled(false)
     , m_readOnly(false)
     , m_required(false)
@@ -467,33 +463,4 @@ bool HTMLFormControlElement::isDefaultButtonForForm() const
     return isSuccessfulSubmitButton() && form() && form()->defaultButton() == this;
 }
 
-bool HTMLFormControlElement::isLabelable() const
-{
-    // FIXME: Add meterTag and outputTag to the list once we support them.
-    return hasTagName(buttonTag) || hasTagName(inputTag) || hasTagName(keygenTag)
-#if ENABLE(METER_TAG)
-        || hasTagName(meterTag)
-#endif
-#if ENABLE(PROGRESS_TAG)
-        || hasTagName(progressTag)
-#endif
-        || hasTagName(selectTag) || hasTagName(textareaTag);
-}
-
-PassRefPtr<NodeList> HTMLFormControlElement::labels()
-{
-    if (!isLabelable())
-        return 0;
-    if (!document())
-        return 0;
-
-    NodeListsNodeData* nodeLists = Node::ensureRareData()->ensureNodeLists(this);
-    if (nodeLists->m_labelsNodeListCache)
-        return nodeLists->m_labelsNodeListCache;
-
-    RefPtr<LabelsNodeList> list = LabelsNodeList::create(this);
-    nodeLists->m_labelsNodeListCache = list.get();
-    return list.release();
-}
-
 } // namespace Webcore
diff --git a/Source/WebCore/html/HTMLFormControlElement.h b/Source/WebCore/html/HTMLFormControlElement.h
index 1bd485965..df07a8ba4 100644
--- a/Source/WebCore/html/HTMLFormControlElement.h
+++ b/Source/WebCore/html/HTMLFormControlElement.h
@@ -25,7 +25,7 @@
 #define HTMLFormControlElement_h
 
 #include "FormAssociatedElement.h"
-#include "HTMLElement.h"
+#include "LabelableElement.h"
 
 namespace WebCore {
 
@@ -37,7 +37,7 @@ class ValidityState;
 // HTMLFormControlElement is the default implementation of FormAssociatedElement,
 // and form-associated element implementations should use HTMLFormControlElement
 // unless there is a special reason.
-class HTMLFormControlElement : public HTMLElement, public FormAssociatedElement {
+class HTMLFormControlElement : public LabelableElement, public FormAssociatedElement {
 public:
     virtual ~HTMLFormControlElement();
 
@@ -100,9 +100,6 @@ public:
     void setNeedsValidityCheck();
     void setCustomValidity(const String&);
 
-    bool isLabelable() const;
-    PassRefPtr<NodeList> labels();
-
     bool readOnly() const { return m_readOnly; }
 
     bool hasAutofocused() { return m_hasAutofocused; }
diff --git a/Source/WebCore/html/HTMLFormElement.idl b/Source/WebCore/html/HTMLFormElement.idl
index 25386f5d9..b6a536c08 100644
--- a/Source/WebCore/html/HTMLFormElement.idl
+++ b/Source/WebCore/html/HTMLFormElement.idl
@@ -24,19 +24,19 @@ module html {
         IndexedGetter,
         CustomNamedGetter
     ] HTMLFormElement : HTMLElement {
-        readonly attribute HTMLCollection elements;
-        readonly attribute long length;
-
-        attribute [Reflect] DOMString name;
-        attribute [Reflect] boolean noValidate;
         attribute [Reflect=accept_charset] DOMString acceptCharset;
         attribute [Reflect, URL] DOMString action;
-        attribute [TreatNullAs=NullString] DOMString encoding;
+        attribute [Reflect] DOMString autocomplete;
         attribute [TreatNullAs=NullString] DOMString enctype;
+        attribute [TreatNullAs=NullString] DOMString encoding;
         attribute [TreatNullAs=NullString] DOMString method;
+        attribute [Reflect] DOMString name;
+        attribute [Reflect] boolean noValidate;
         attribute [Reflect] DOMString target;
-        attribute [Reflect] DOMString autocomplete;
-        
+
+        readonly attribute HTMLCollection elements;
+        readonly attribute long length;
+
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [ImplementedAs=submitFromJavaScript] void submit();
 #else
@@ -45,5 +45,4 @@ module html {
         void reset();
         boolean checkValidity();
     };
-
 }
diff --git a/Source/WebCore/html/HTMLFrameSetElement.cpp b/Source/WebCore/html/HTMLFrameSetElement.cpp
index d3fdb97a4..803a1b9c9 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.cpp
+++ b/Source/WebCore/html/HTMLFrameSetElement.cpp
@@ -64,11 +64,11 @@ PassRefPtr<HTMLFrameSetElement> HTMLFrameSetElement::create(const QualifiedName&
     return adoptRef(new HTMLFrameSetElement(tagName, document));
 }
 
-bool HTMLFrameSetElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLFrameSetElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == bordercolorAttr)
+    if (name == bordercolorAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLFrameSetElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLFrameSetElement.h b/Source/WebCore/html/HTMLFrameSetElement.h
index 1cd40a290..69c616205 100644
--- a/Source/WebCore/html/HTMLFrameSetElement.h
+++ b/Source/WebCore/html/HTMLFrameSetElement.h
@@ -68,7 +68,7 @@ private:
     HTMLFrameSetElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void attach();
diff --git a/Source/WebCore/html/HTMLHRElement.cpp b/Source/WebCore/html/HTMLHRElement.cpp
index 8f8b6e140..aaaa56ec8 100644
--- a/Source/WebCore/html/HTMLHRElement.cpp
+++ b/Source/WebCore/html/HTMLHRElement.cpp
@@ -49,11 +49,11 @@ PassRefPtr<HTMLHRElement> HTMLHRElement::create(const QualifiedName& tagName, Do
     return adoptRef(new HTMLHRElement(tagName, document));
 }
 
-bool HTMLHRElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLHRElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == alignAttr || attr->name() == widthAttr || attr->name() == colorAttr || attr->name() == noshadeAttr || attr->name() == sizeAttr)
+    if (name == alignAttr || name == widthAttr || name == colorAttr || name == noshadeAttr || name == sizeAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLHRElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLHRElement.h b/Source/WebCore/html/HTMLHRElement.h
index 728619ac5..89ae018bf 100644
--- a/Source/WebCore/html/HTMLHRElement.h
+++ b/Source/WebCore/html/HTMLHRElement.h
@@ -37,7 +37,7 @@ public:
 private:
     HTMLHRElement(const QualifiedName&, Document*);
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/HTMLIFrameElement.cpp b/Source/WebCore/html/HTMLIFrameElement.cpp
index a846fa432..2969cf9f9 100644
--- a/Source/WebCore/html/HTMLIFrameElement.cpp
+++ b/Source/WebCore/html/HTMLIFrameElement.cpp
@@ -48,11 +48,11 @@ PassRefPtr<HTMLIFrameElement> HTMLIFrameElement::create(const QualifiedName& tag
     return adoptRef(new HTMLIFrameElement(tagName, document));
 }
 
-bool HTMLIFrameElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLIFrameElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == alignAttr || attr->name() == frameborderAttr)
+    if (name == widthAttr || name == heightAttr || name == alignAttr || name == frameborderAttr)
         return true;
-    return HTMLFrameElementBase::isPresentationAttribute(attr);
+    return HTMLFrameElementBase::isPresentationAttribute(name);
 }
 
 void HTMLIFrameElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLIFrameElement.h b/Source/WebCore/html/HTMLIFrameElement.h
index 075841091..1882acd59 100644
--- a/Source/WebCore/html/HTMLIFrameElement.h
+++ b/Source/WebCore/html/HTMLIFrameElement.h
@@ -36,7 +36,7 @@ private:
     HTMLIFrameElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void insertedIntoDocument();
diff --git a/Source/WebCore/html/HTMLImageElement.cpp b/Source/WebCore/html/HTMLImageElement.cpp
index 583a23fc8..ff89c6e4f 100644
--- a/Source/WebCore/html/HTMLImageElement.cpp
+++ b/Source/WebCore/html/HTMLImageElement.cpp
@@ -78,11 +78,11 @@ PassRefPtr<HTMLImageElement> HTMLImageElement::createForJSConstructor(Document*
     return image.release();
 }
 
-bool HTMLImageElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLImageElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == borderAttr || attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == alignAttr || attr->name() == valignAttr)
+    if (name == widthAttr || name == heightAttr || name == borderAttr || name == vspaceAttr || name == hspaceAttr || name == alignAttr || name == valignAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLImageElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLImageElement.h b/Source/WebCore/html/HTMLImageElement.h
index 37a23775a..bfe10eec0 100644
--- a/Source/WebCore/html/HTMLImageElement.h
+++ b/Source/WebCore/html/HTMLImageElement.h
@@ -84,7 +84,7 @@ protected:
 
 private:
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void attach();
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
index 422ac8513..cd078d139 100644
--- a/Source/WebCore/html/HTMLInputElement.cpp
+++ b/Source/WebCore/html/HTMLInputElement.cpp
@@ -660,11 +660,11 @@ void HTMLInputElement::accessKeyAction(bool sendMouseEvents)
     m_inputType->accessKeyAction(sendMouseEvents);
 }
 
-bool HTMLInputElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLInputElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == alignAttr || attr->name() == widthAttr || attr->name() == heightAttr || (attr->name() == borderAttr && isImageButton()))
+    if (name == vspaceAttr || name == hspaceAttr || name == alignAttr || name == widthAttr || name == heightAttr || (name == borderAttr && isImageButton()))
         return true;
-    return HTMLTextFormControlElement::isPresentationAttribute(attr);
+    return HTMLTextFormControlElement::isPresentationAttribute(name);
 }
 
 void HTMLInputElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
@@ -1356,7 +1356,8 @@ void HTMLInputElement::setCanReceiveDroppedFiles(bool canReceiveDroppedFiles)
     if (m_canReceiveDroppedFiles == canReceiveDroppedFiles)
         return;
     m_canReceiveDroppedFiles = canReceiveDroppedFiles;
-    renderer()->updateFromElement();
+    if (renderer())
+        renderer()->updateFromElement();
 }
 
 String HTMLInputElement::visibleValue() const
@@ -1760,6 +1761,12 @@ bool HTMLInputElement::isEnumeratable() const
     return m_inputType->isEnumeratable();
 }
 
+bool HTMLInputElement::isLabelable() const
+{
+    // FIXME: We should return false for type="hidden".
+    return true;
+}
+
 bool HTMLInputElement::shouldAppearChecked() const
 {
     return checked() && m_inputType->isCheckable();
diff --git a/Source/WebCore/html/HTMLInputElement.h b/Source/WebCore/html/HTMLInputElement.h
index 39cb48ba6..6db5f776a 100644
--- a/Source/WebCore/html/HTMLInputElement.h
+++ b/Source/WebCore/html/HTMLInputElement.h
@@ -256,6 +256,7 @@ private:
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
     virtual bool isEnumeratable() const;
+    virtual bool isLabelable() const OVERRIDE;
     virtual void updateFocusAppearance(bool restorePreviousSelection);
     virtual void aboutToUnload();
     virtual bool shouldUseInputMethod();
@@ -276,7 +277,7 @@ private:
     virtual void accessKeyAction(bool sendMouseEvents);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual void finishParsingChildren();
 
diff --git a/Source/WebCore/html/HTMLInputElement.idl b/Source/WebCore/html/HTMLInputElement.idl
index 84beb8ac5..ad1c3154f 100644
--- a/Source/WebCore/html/HTMLInputElement.idl
+++ b/Source/WebCore/html/HTMLInputElement.idl
@@ -21,36 +21,33 @@
 module html {
 
     interface HTMLInputElement : HTMLElement {
-        attribute [TreatNullAs=NullString] DOMString defaultValue;
+        attribute [Reflect] DOMString accept;
+        attribute [Reflect] DOMString alt;
+        attribute [Reflect] DOMString autocomplete;
+        attribute [Reflect] boolean autofocus;
         attribute [Reflect=checked] boolean defaultChecked;
+        attribute boolean checked;
         attribute [Reflect] DOMString dirName;
+        attribute [Reflect] boolean disabled;
         readonly attribute HTMLFormElement form;
+        readonly attribute FileList files;
         attribute [Reflect, URL] DOMString formAction;
         attribute [TreatNullAs=NullString] DOMString formEnctype;
         attribute [TreatNullAs=NullString] DOMString formMethod;
         attribute [Reflect] boolean formNoValidate;
         attribute [Reflect] DOMString formTarget;
-        readonly attribute ValidityState validity;
-        attribute [Reflect] DOMString accept;
-        attribute [Reflect] DOMString align;
-        attribute [Reflect] DOMString alt;
-        attribute boolean checked;
-        attribute [Reflect] boolean disabled;
-        attribute [Reflect] boolean autofocus;
-        attribute [Reflect] DOMString autocomplete;
+        attribute boolean indeterminate;
         readonly attribute [Conditional=DATALIST] HTMLElement list;
         attribute [Reflect] DOMString max;
         attribute long maxLength setter raises(DOMException);
         attribute [Reflect] DOMString min;
         attribute [Reflect] boolean multiple;
-        attribute [Conditional=DIRECTORY_UPLOAD, Reflect] boolean webkitdirectory;
         attribute [Reflect] DOMString name;
         attribute [Reflect] DOMString pattern;
         attribute [Reflect] DOMString placeholder;
         attribute [Reflect] boolean readOnly;
         attribute [Reflect] boolean required;
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        attribute [Reflect] DOMString accessKey;
         attribute [ObjCImplementedAsUnsignedLong] DOMString size; // DOM level 2 changed this to a long, but ObjC API is a string
 #else
         attribute unsigned long size; // Changed string -> long -> unsigned long
@@ -58,39 +55,28 @@ module html {
         attribute [Reflect, URL] DOMString src;
         attribute [Reflect] DOMString step;
         attribute [TreatNullAs=NullString] DOMString type; // readonly dropped as part of DOM level 2
-        attribute [Reflect] DOMString useMap;
+        attribute [TreatNullAs=NullString] DOMString defaultValue;
         attribute [TreatNullAs=NullString] DOMString value;
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
         attribute Date valueAsDate setter raises(DOMException);
 #endif
         attribute double valueAsNumber setter raises(DOMException);
-        readonly attribute [Conditional=DATALIST] HTMLOptionElement selectedOption;
-        attribute [Reflect] boolean incremental;
 
         void stepUp(in [Optional] long n) raises(DOMException);
         void stepDown(in [Optional] long n) raises(DOMException);
 
         readonly attribute boolean willValidate;
+        readonly attribute ValidityState validity;
         readonly attribute DOMString validationMessage;
         boolean checkValidity();
         void setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
-        void select();
-
-#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        void click();
-#endif
-
-#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
-        void setValueForUser(in [TreatNullAs=NullString] DOMString value);
-#endif
 
-        // WinIE extension:
-        attribute boolean indeterminate;
+        readonly attribute NodeList labels;
 
+        void select();
         attribute [Custom] long selectionStart;
         attribute [Custom] long selectionEnd;
         attribute [Custom] DOMString selectionDirection;
-
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         [Custom] void setSelectionRange(in long start, in long end);
 #else
@@ -99,18 +85,33 @@ module html {
                                         in [Optional] DOMString direction);
 #endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+        // Non-standard attributes
+        attribute [Reflect] DOMString align;
+        attribute [Conditional=DIRECTORY_UPLOAD, Reflect] boolean webkitdirectory;
+        attribute [Reflect] DOMString useMap;
+        readonly attribute [Conditional=DATALIST] HTMLOptionElement selectedOption;
+        attribute [Reflect] boolean incremental;
+        attribute [Conditional=INPUT_SPEECH, Reflect, V8EnabledAtRuntime] boolean webkitSpeech;
+        attribute [Conditional=INPUT_SPEECH, Reflect, V8EnabledAtRuntime] boolean webkitGrammar;
+        attribute [Conditional=INPUT_SPEECH, NotEnumerable] EventListener onwebkitspeechchange;
+
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
+#endif
+
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        void click();
+#endif
+
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
+        void setValueForUser(in [TreatNullAs=NullString] DOMString value);
+#endif
+
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute DOMString altDisplayString;
         readonly attribute URL absoluteImageURL;
 #endif
 
-        readonly attribute FileList files;
-        readonly attribute NodeList labels;
-
-        attribute [Conditional=INPUT_SPEECH, Reflect, V8EnabledAtRuntime] boolean webkitSpeech;
-        attribute [Conditional=INPUT_SPEECH, Reflect, V8EnabledAtRuntime] boolean webkitGrammar;
-        attribute [Conditional=INPUT_SPEECH, NotEnumerable] EventListener onwebkitspeechchange;
     };
-
 }
diff --git a/Source/WebCore/html/HTMLKeygenElement.cpp b/Source/WebCore/html/HTMLKeygenElement.cpp
index e10079f64..80534419e 100644
--- a/Source/WebCore/html/HTMLKeygenElement.cpp
+++ b/Source/WebCore/html/HTMLKeygenElement.cpp
@@ -33,7 +33,7 @@
 #include "HTMLOptionElement.h"
 #include "SSLKeyGenerator.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "Text.h"
 #include <wtf/StdLibExtras.h>
 
@@ -132,7 +132,7 @@ void HTMLKeygenElement::reset()
 HTMLSelectElement* HTMLKeygenElement::shadowSelect() const
 {
     ASSERT(hasShadowRoot());
-    ShadowRoot* shadow = shadowRootList()->oldestShadowRoot();
+    ShadowRoot* shadow = shadowTree()->oldestShadowRoot();
     return shadow ? toHTMLSelectElement(shadow->firstChild()) : 0;
 }
 
diff --git a/Source/WebCore/html/HTMLKeygenElement.h b/Source/WebCore/html/HTMLKeygenElement.h
index c793cb120..04a9ed53c 100644
--- a/Source/WebCore/html/HTMLKeygenElement.h
+++ b/Source/WebCore/html/HTMLKeygenElement.h
@@ -48,6 +48,7 @@ private:
     virtual bool isOptionalFormControl() const { return false; }
 
     virtual bool isEnumeratable() const { return true; }
+    virtual bool isLabelable() const OVERRIDE { return true; }
 
     virtual void reset();
 
diff --git a/Source/WebCore/html/HTMLLIElement.cpp b/Source/WebCore/html/HTMLLIElement.cpp
index ec7824ea4..dd62dce9a 100644
--- a/Source/WebCore/html/HTMLLIElement.cpp
+++ b/Source/WebCore/html/HTMLLIElement.cpp
@@ -49,11 +49,11 @@ PassRefPtr<HTMLLIElement> HTMLLIElement::create(const QualifiedName& tagName, Do
     return adoptRef(new HTMLLIElement(tagName, document));
 }
 
-bool HTMLLIElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLLIElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == typeAttr)
+    if (name == typeAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLLIElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLLIElement.h b/Source/WebCore/html/HTMLLIElement.h
index c730408a7..9f7685aa3 100644
--- a/Source/WebCore/html/HTMLLIElement.h
+++ b/Source/WebCore/html/HTMLLIElement.h
@@ -36,7 +36,7 @@ private:
     HTMLLIElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void attach();
diff --git a/Source/WebCore/html/HTMLLegendElement.cpp b/Source/WebCore/html/HTMLLegendElement.cpp
index 61d2db31b..fd103d5ed 100644
--- a/Source/WebCore/html/HTMLLegendElement.cpp
+++ b/Source/WebCore/html/HTMLLegendElement.cpp
@@ -25,6 +25,7 @@
 #include "config.h"
 #include "HTMLLegendElement.h"
 
+#include "HTMLFormControlElement.h"
 #include "HTMLNames.h"
 #include <wtf/StdLibExtras.h>
 
@@ -32,26 +33,16 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-inline HTMLLegendElement::HTMLLegendElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
-    : HTMLFormControlElement(tagName, document, form)
-{
-    ASSERT(hasTagName(legendTag));
-}
 
-PassRefPtr<HTMLLegendElement> HTMLLegendElement::create(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
+inline HTMLLegendElement::HTMLLegendElement(const QualifiedName& tagName, Document* document)
+    : HTMLElement(tagName, document)
 {
-    return adoptRef(new HTMLLegendElement(tagName, document, form));
-}
-
-bool HTMLLegendElement::supportsFocus() const
-{
-    return HTMLElement::supportsFocus();
+    ASSERT(hasTagName(legendTag));
 }
 
-const AtomicString& HTMLLegendElement::formControlType() const
+PassRefPtr<HTMLLegendElement> HTMLLegendElement::create(const QualifiedName& tagName, Document* document)
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, legend, ("legend"));
-    return legend;
+    return adoptRef(new HTMLLegendElement(tagName, document));
 }
 
 HTMLFormControlElement* HTMLLegendElement::associatedControl()
@@ -69,7 +60,7 @@ HTMLFormControlElement* HTMLLegendElement::associatedControl()
     while ((node = node->traverseNextNode(fieldset))) {
         if (node->isElementNode()) {
             Element* element = static_cast<Element*>(node);
-            if (!element->hasLocalName(legendTag) && element->isFormControlElement())
+            if (element->isFormControlElement())
                 return static_cast<HTMLFormControlElement*>(element);
         }
     }
diff --git a/Source/WebCore/html/HTMLLegendElement.h b/Source/WebCore/html/HTMLLegendElement.h
index 24d8fce82..95129ec88 100644
--- a/Source/WebCore/html/HTMLLegendElement.h
+++ b/Source/WebCore/html/HTMLLegendElement.h
@@ -24,22 +24,22 @@
 #ifndef HTMLLegendElement_h
 #define HTMLLegendElement_h
 
-#include "HTMLFormControlElement.h"
+#include "HTMLElement.h"
 
 namespace WebCore {
 
-class HTMLLegendElement : public HTMLFormControlElement {
+class HTMLFormControlElement;
+
+class HTMLLegendElement : public HTMLElement {
 public:
-    static PassRefPtr<HTMLLegendElement> create(const QualifiedName&, Document*, HTMLFormElement*);
+    static PassRefPtr<HTMLLegendElement> create(const QualifiedName&, Document*);
 
 private:
-    HTMLLegendElement(const QualifiedName&, Document*, HTMLFormElement*);
+    HTMLLegendElement(const QualifiedName&, Document*);
 
     // Control in the legend's fieldset that gets focus and access key.
     HTMLFormControlElement* associatedControl();
 
-    virtual bool supportsFocus() const;
-    virtual const AtomicString& formControlType() const;
     virtual void accessKeyAction(bool sendMouseEvents);
     virtual void focus(bool restorePreviousSelection = true);
 };
diff --git a/Source/WebCore/html/HTMLLinkElement.cpp b/Source/WebCore/html/HTMLLinkElement.cpp
index 1d6536fc5..efe76155a 100644
--- a/Source/WebCore/html/HTMLLinkElement.cpp
+++ b/Source/WebCore/html/HTMLLinkElement.cpp
@@ -31,6 +31,7 @@
 #include "CachedResourceLoader.h"
 #include "CSSStyleSelector.h"
 #include "Document.h"
+#include "EventSender.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
@@ -51,6 +52,12 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+static LinkEventSender& linkLoadEventSender()
+{
+    DEFINE_STATIC_LOCAL(LinkEventSender, sharedLoadEventSender, (eventNames().loadEvent));
+    return sharedLoadEventSender;
+}
+
 inline HTMLLinkElement::HTMLLinkElement(const QualifiedName& tagName, Document* document, bool createdByParser)
     : HTMLElement(tagName, document)
     , m_linkLoader(this)
@@ -59,6 +66,8 @@ inline HTMLLinkElement::HTMLLinkElement(const QualifiedName& tagName, Document*
     , m_loading(false)
     , m_createdByParser(createdByParser)
     , m_isInShadowTree(false)
+    , m_firedLoad(false)
+    , m_loadedSheet(false)
     , m_pendingSheetType(None)
 {
     ASSERT(hasTagName(linkTag));
@@ -81,6 +90,8 @@ HTMLLinkElement::~HTMLLinkElement()
 
     if (inDocument())
         document()->removeStyleSheetCandidateNode(this);
+
+    linkLoadEventSender().cancelEvent(this);
 }
 
 void HTMLLinkElement::setDisabledState(bool disabled)
@@ -141,12 +152,10 @@ void HTMLLinkElement::parseAttribute(Attribute* attr)
         setDisabledState(!attr->isNull());
     else if (attr->name() == onbeforeloadAttr)
         setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
-#if ENABLE(LINK_PREFETCH)
     else if (attr->name() == onloadAttr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onerrorAttr)
         setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attr));
-#endif
     else {
         if (attr->name() == titleAttr && m_sheet)
             m_sheet->setTitle(attr->value());
@@ -330,6 +339,7 @@ void HTMLLinkElement::setCSSStyleSheet(const String& href, const KURL& baseURL,
     m_sheet->setMedia(media.get());
 
     m_loading = false;
+    m_sheet->notifyLoadedSheet(sheet);
     m_sheet->checkLoaded();
 }
 
@@ -361,6 +371,29 @@ bool HTMLLinkElement::sheetLoaded()
     return false;
 }
 
+void HTMLLinkElement::dispatchPendingLoadEvents()
+{
+    linkLoadEventSender().dispatchPendingEvents();
+}
+
+void HTMLLinkElement::dispatchPendingEvent(LinkEventSender* eventSender)
+{
+    ASSERT_UNUSED(eventSender, eventSender == &linkLoadEventSender());
+    if (m_loadedSheet)
+        linkLoaded();
+    else
+        linkLoadingErrored();
+}
+
+void HTMLLinkElement::notifyLoadedSheetAndAllCriticalSubresources(bool errorOccurred)
+{
+    if (m_firedLoad)
+        return;
+    m_loadedSheet = !errorOccurred;
+    linkLoadEventSender().dispatchEventSoon(this);
+    m_firedLoad = true;
+}
+
 void HTMLLinkElement::startLoadingDynamicSheet()
 {
     // We don't support multiple blocking sheets.
diff --git a/Source/WebCore/html/HTMLLinkElement.h b/Source/WebCore/html/HTMLLinkElement.h
index b99b62949..55c577728 100644
--- a/Source/WebCore/html/HTMLLinkElement.h
+++ b/Source/WebCore/html/HTMLLinkElement.h
@@ -37,8 +37,12 @@
 
 namespace WebCore {
 
+class HTMLLinkElement;
 class KURL;
 
+template<typename T> class EventSender;
+typedef EventSender<HTMLLinkElement> LinkEventSender;
+
 class HTMLLinkElement : public HTMLElement, public CachedStyleSheetClient, public LinkLoaderClient {
 public:
     static PassRefPtr<HTMLLinkElement> create(const QualifiedName&, Document*, bool createdByParser);
@@ -60,6 +64,9 @@ public:
     void setSizes(const String&);
     DOMSettableTokenList* sizes() const;
 
+    void dispatchPendingEvent(LinkEventSender*);
+    static void dispatchPendingLoadEvents();
+
 private:
     virtual void parseAttribute(Attribute*) OVERRIDE;
 
@@ -73,6 +80,7 @@ private:
     // from CachedResourceClient
     virtual void setCSSStyleSheet(const String& href, const KURL& baseURL, const String& charset, const CachedCSSStyleSheet* sheet);
     virtual bool sheetLoaded();
+    virtual void notifyLoadedSheetAndAllCriticalSubresources(bool errorOccurred);
     virtual void startLoadingDynamicSheet();
 
     virtual void linkLoaded();
@@ -119,7 +127,9 @@ private:
     bool m_loading;
     bool m_createdByParser;
     bool m_isInShadowTree;
-    
+    bool m_firedLoad;
+    bool m_loadedSheet;
+
     PendingSheetType m_pendingSheetType;
 };
 
diff --git a/Source/WebCore/html/HTMLMarqueeElement.cpp b/Source/WebCore/html/HTMLMarqueeElement.cpp
index a1445ad55..911fc8969 100644
--- a/Source/WebCore/html/HTMLMarqueeElement.cpp
+++ b/Source/WebCore/html/HTMLMarqueeElement.cpp
@@ -58,11 +58,11 @@ int HTMLMarqueeElement::minimumDelay() const
     return 0;
 }
 
-bool HTMLMarqueeElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLMarqueeElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == bgcolorAttr || attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == scrollamountAttr || attr->name() == scrolldelayAttr || attr->name() == loopAttr || attr->name() == behaviorAttr || attr->name() == directionAttr)
+    if (name == widthAttr || name == heightAttr || name == bgcolorAttr || name == vspaceAttr || name == hspaceAttr || name == scrollamountAttr || name == scrolldelayAttr || name == loopAttr || name == behaviorAttr || name == directionAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLMarqueeElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLMarqueeElement.h b/Source/WebCore/html/HTMLMarqueeElement.h
index 8ababa1d9..6c453662b 100644
--- a/Source/WebCore/html/HTMLMarqueeElement.h
+++ b/Source/WebCore/html/HTMLMarqueeElement.h
@@ -53,7 +53,7 @@ public:
 private:
     HTMLMarqueeElement(const QualifiedName&, Document*);
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     // ActiveDOMObject
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index b956d66d9..8033dc884 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -73,7 +73,7 @@
 #include "SecurityPolicy.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "TimeRanges.h"
 #include "UUID.h"
 #include <limits>
@@ -619,6 +619,8 @@ void HTMLMediaElement::load(ExceptionCode& ec)
         ec = INVALID_STATE_ERR;
     else {
         m_loadInitiatedByUserGesture = ScriptController::processingUserGesture();
+        if (m_loadInitiatedByUserGesture)
+            removeBehaviorsRestrictionsAfterFirstUserGesture();
         prepareForLoad();
         loadInternal();
     }
@@ -2073,6 +2075,8 @@ void HTMLMediaElement::play()
 
     if (userGestureRequiredForRateChange() && !ScriptController::processingUserGesture())
         return;
+    if (ScriptController::processingUserGesture())
+        removeBehaviorsRestrictionsAfterFirstUserGesture();
 
     Settings* settings = document()->settings();
     if (settings && settings->needsSiteSpecificQuirks() && m_dispatchingCanPlayEvent && !m_loadInitiatedByUserGesture) {
@@ -2754,6 +2758,7 @@ KURL HTMLMediaElement::selectNextSourceChild(ContentType *contentType, InvalidUR
     HTMLSourceElement* source = 0;
     bool lookingForStartNode = m_nextChildNodeToConsider;
     bool canUse = false;
+    String type;
 
     for (node = firstChild(); !canUse && node; node = node->nextSibling()) {
         if (lookingForStartNode && m_nextChildNodeToConsider != node)
@@ -2785,12 +2790,15 @@ KURL HTMLMediaElement::selectNextSourceChild(ContentType *contentType, InvalidUR
                 goto check_again;
         }
 
-        if (source->fastHasAttribute(typeAttr)) {
+        type = source->type();
+        if (type.isEmpty() && mediaURL.protocolIsData())
+            type = mimeTypeFromDataURL(mediaURL);
+        if (!type.isEmpty()) {
 #if !LOG_DISABLED
             if (shouldLog)
-                LOG(Media, "HTMLMediaElement::selectNextSourceChild - 'type' is %s", source->type().utf8().data());
+                LOG(Media, "HTMLMediaElement::selectNextSourceChild - 'type' is %s", type.utf8().data());
 #endif
-            if (!MediaPlayer::supportsType(ContentType(source->type())))
+            if (!MediaPlayer::supportsType(ContentType(type)))
                 goto check_again;
         }
 
@@ -2808,7 +2816,7 @@ check_again:
 
     if (canUse) {
         if (contentType)
-            *contentType = ContentType(source->type());
+            *contentType = ContentType(type);
         m_currentSourceNode = source;
         m_nextChildNodeToConsider = source->nextSibling();
         if (!m_nextChildNodeToConsider)
@@ -3400,12 +3408,13 @@ void HTMLMediaElement::stop()
 void HTMLMediaElement::suspend(ReasonForSuspension why)
 {
     LOG(Media, "HTMLMediaElement::suspend");
-    
+
     switch (why)
     {
         case DocumentWillBecomeInactive:
             stop();
             break;
+        case PageWillBeSuspended:
         case JavaScriptDebuggerPaused:
         case WillShowDialog:
             // Do nothing, we don't pause media playback in these cases.
@@ -3747,7 +3756,7 @@ void HTMLMediaElement::privateBrowsingStateDidChange()
 
 MediaControls* HTMLMediaElement::mediaControls()
 {
-    return toMediaControls(shadowRootList()->oldestShadowRoot()->firstChild());
+    return toMediaControls(shadowTree()->oldestShadowRoot()->firstChild());
 }
 
 bool HTMLMediaElement::hasMediaControls()
@@ -3755,7 +3764,7 @@ bool HTMLMediaElement::hasMediaControls()
     if (!hasShadowRoot())
         return false;
 
-    Node* node = shadowRootList()->oldestShadowRoot()->firstChild();
+    Node* node = shadowTree()->oldestShadowRoot()->firstChild();
     return node && node->isMediaControls();
 }
 
@@ -4053,5 +4062,20 @@ String HTMLMediaElement::mediaPlayerReferrer() const
     return SecurityPolicy::generateReferrerHeader(document()->referrerPolicy(), m_currentSrc, frame->loader()->outgoingReferrer());
 }
 
+String HTMLMediaElement::mediaPlayerUserAgent() const
+{
+    Frame* frame = document()->frame();
+    if (!frame)
+        return String();
+
+    return frame->loader()->userAgent(m_currentSrc);
+
+}
+
+void HTMLMediaElement::removeBehaviorsRestrictionsAfterFirstUserGesture()
+{
+    m_restrictions = NoRestrictions;
+}
+
 }
 #endif
diff --git a/Source/WebCore/html/HTMLMediaElement.h b/Source/WebCore/html/HTMLMediaElement.h
index 126b78f57..3f310fbc4 100644
--- a/Source/WebCore/html/HTMLMediaElement.h
+++ b/Source/WebCore/html/HTMLMediaElement.h
@@ -390,6 +390,7 @@ private:
 #endif
 
     virtual String mediaPlayerReferrer() const OVERRIDE;
+    virtual String mediaPlayerUserAgent() const OVERRIDE;
 
     void loadTimerFired(Timer<HTMLMediaElement>*);
     void progressEventTimerFired(Timer<HTMLMediaElement>*);
@@ -477,6 +478,8 @@ private:
 
     void changeNetworkStateFromLoadingToIdle();
 
+    void removeBehaviorsRestrictionsAfterFirstUserGesture();
+
 #if ENABLE(MICRODATA)
     virtual String itemValueText() const;
     virtual void setItemValueText(const String&, ExceptionCode&);
diff --git a/Source/WebCore/html/HTMLMediaElement.idl b/Source/WebCore/html/HTMLMediaElement.idl
index 55d06f3ca..9cb2df306 100644
--- a/Source/WebCore/html/HTMLMediaElement.idl
+++ b/Source/WebCore/html/HTMLMediaElement.idl
@@ -99,15 +99,15 @@ module html {
     [V8EnabledAtRuntime=webkitMediaSource] void webkitSourceAppend(in Uint8Array data) raises (DOMException);
 
     // Signals the end of stream.
-    const [V8EnabledAtRuntime=webkitMediaSource] unsigned short EOS_NO_ERROR = 0; // End of stream reached w/o error.
-    const [V8EnabledAtRuntime=webkitMediaSource] unsigned short EOS_NETWORK_ERR = 1; // A network error triggered end of stream.
-    const [V8EnabledAtRuntime=webkitMediaSource] unsigned short EOS_DECODE_ERR = 2; // A decode error triggered end of stream.
+    [V8EnabledAtRuntime=webkitMediaSource] const unsigned short EOS_NO_ERROR = 0; // End of stream reached w/o error.
+    [V8EnabledAtRuntime=webkitMediaSource] const unsigned short EOS_NETWORK_ERR = 1; // A network error triggered end of stream.
+    [V8EnabledAtRuntime=webkitMediaSource] const unsigned short EOS_DECODE_ERR = 2; // A decode error triggered end of stream.
     [V8EnabledAtRuntime=webkitMediaSource] void webkitSourceEndOfStream(in unsigned short status) raises (DOMException);
 
     // Indicates the current state of the media source.
-    const [V8EnabledAtRuntime=webkitMediaSource] unsigned short SOURCE_CLOSED = 0;
-    const [V8EnabledAtRuntime=webkitMediaSource] unsigned short SOURCE_OPEN = 1;
-    const [V8EnabledAtRuntime=webkitMediaSource] unsigned short SOURCE_ENDED = 2;
+    [V8EnabledAtRuntime=webkitMediaSource] const unsigned short SOURCE_CLOSED = 0;
+    [V8EnabledAtRuntime=webkitMediaSource] const unsigned short SOURCE_OPEN = 1;
+    [V8EnabledAtRuntime=webkitMediaSource] const unsigned short SOURCE_ENDED = 2;
     readonly attribute [V8EnabledAtRuntime=webkitMediaSource] unsigned short webkitSourceState;
 #endif
 
diff --git a/Source/WebCore/html/HTMLMeterElement.h b/Source/WebCore/html/HTMLMeterElement.h
index dc5e7ccf5..e2be97f71 100644
--- a/Source/WebCore/html/HTMLMeterElement.h
+++ b/Source/WebCore/html/HTMLMeterElement.h
@@ -65,6 +65,8 @@ private:
     HTMLMeterElement(const QualifiedName&, Document*, HTMLFormElement*);
     virtual ~HTMLMeterElement();
 
+    virtual bool isLabelable() const OVERRIDE { return true; }
+
     virtual bool supportsFocus() const;
 
     virtual bool recalcWillValidate() const { return false; }
diff --git a/Source/WebCore/html/HTMLOListElement.cpp b/Source/WebCore/html/HTMLOListElement.cpp
index 1f7e28dfe..816d6a8e5 100644
--- a/Source/WebCore/html/HTMLOListElement.cpp
+++ b/Source/WebCore/html/HTMLOListElement.cpp
@@ -54,11 +54,11 @@ PassRefPtr<HTMLOListElement> HTMLOListElement::create(const QualifiedName& tagNa
     return adoptRef(new HTMLOListElement(tagName, document));
 }
 
-bool HTMLOListElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLOListElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == typeAttr)
+    if (name == typeAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLOListElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLOListElement.h b/Source/WebCore/html/HTMLOListElement.h
index 9f0eafb0b..d78207d33 100644
--- a/Source/WebCore/html/HTMLOListElement.h
+++ b/Source/WebCore/html/HTMLOListElement.h
@@ -54,7 +54,7 @@ private:
     void recalculateItemCount();
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     int m_start;
diff --git a/Source/WebCore/html/HTMLObjectElement.cpp b/Source/WebCore/html/HTMLObjectElement.cpp
index 406a3eb3e..635042fee 100644
--- a/Source/WebCore/html/HTMLObjectElement.cpp
+++ b/Source/WebCore/html/HTMLObjectElement.cpp
@@ -77,11 +77,11 @@ RenderWidget* HTMLObjectElement::renderWidgetForJSBindings()
     return renderPart(); // This will return 0 if the renderer is not a RenderPart.
 }
 
-bool HTMLObjectElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLObjectElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == borderAttr)
+    if (name == borderAttr)
         return true;
-    return HTMLPlugInImageElement::isPresentationAttribute(attr);
+    return HTMLPlugInImageElement::isPresentationAttribute(name);
 }
 
 void HTMLObjectElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLObjectElement.h b/Source/WebCore/html/HTMLObjectElement.h
index 112dcc6af..a1ab97238 100644
--- a/Source/WebCore/html/HTMLObjectElement.h
+++ b/Source/WebCore/html/HTMLObjectElement.h
@@ -67,7 +67,7 @@ private:
     HTMLObjectElement(const QualifiedName&, Document*, HTMLFormElement*, bool createdByParser);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual void insertedIntoTree(bool deep);
diff --git a/Source/WebCore/html/HTMLOptGroupElement.cpp b/Source/WebCore/html/HTMLOptGroupElement.cpp
index 3213842f0..e09200062 100644
--- a/Source/WebCore/html/HTMLOptGroupElement.cpp
+++ b/Source/WebCore/html/HTMLOptGroupElement.cpp
@@ -38,15 +38,15 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-inline HTMLOptGroupElement::HTMLOptGroupElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
-    : HTMLFormControlElement(tagName, document, form)
+inline HTMLOptGroupElement::HTMLOptGroupElement(const QualifiedName& tagName, Document* document)
+    : HTMLElement(tagName, document)
 {
     ASSERT(hasTagName(optgroupTag));
 }
 
-PassRefPtr<HTMLOptGroupElement> HTMLOptGroupElement::create(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
+PassRefPtr<HTMLOptGroupElement> HTMLOptGroupElement::create(const QualifiedName& tagName, Document* document)
 {
-    return adoptRef(new HTMLOptGroupElement(tagName, document, form));
+    return adoptRef(new HTMLOptGroupElement(tagName, document));
 }
 
 bool HTMLOptGroupElement::supportsFocus() const
@@ -69,12 +69,12 @@ const AtomicString& HTMLOptGroupElement::formControlType() const
 void HTMLOptGroupElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     recalcSelectOptions();
-    HTMLFormControlElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
 
 void HTMLOptGroupElement::parseAttribute(Attribute* attr)
 {
-    HTMLFormControlElement::parseAttribute(attr);
+    HTMLElement::parseAttribute(attr);
     recalcSelectOptions();
 }
 
@@ -91,13 +91,13 @@ void HTMLOptGroupElement::attach()
 {
     if (parentNode()->renderStyle())
         setRenderStyle(styleForRenderer());
-    HTMLFormControlElement::attach();
+    HTMLElement::attach();
 }
 
 void HTMLOptGroupElement::detach()
 {
     m_style.clear();
-    HTMLFormControlElement::detach();
+    HTMLElement::detach();
 }
 
 void HTMLOptGroupElement::setRenderStyle(PassRefPtr<RenderStyle> newStyle)
diff --git a/Source/WebCore/html/HTMLOptGroupElement.h b/Source/WebCore/html/HTMLOptGroupElement.h
index 85d531e43..bfd6fe4dc 100644
--- a/Source/WebCore/html/HTMLOptGroupElement.h
+++ b/Source/WebCore/html/HTMLOptGroupElement.h
@@ -24,22 +24,22 @@
 #ifndef HTMLOptGroupElement_h
 #define HTMLOptGroupElement_h
 
-#include "HTMLFormControlElement.h"
+#include "HTMLElement.h"
 
 namespace WebCore {
     
 class HTMLSelectElement;
 
-class HTMLOptGroupElement : public HTMLFormControlElement {
+class HTMLOptGroupElement : public HTMLElement {
 public:
-    static PassRefPtr<HTMLOptGroupElement> create(const QualifiedName&, Document*, HTMLFormElement*);
+    static PassRefPtr<HTMLOptGroupElement> create(const QualifiedName&, Document*);
 
     HTMLSelectElement* ownerSelectElement() const;
     
     String groupLabelText() const;
 
 private:
-    HTMLOptGroupElement(const QualifiedName&, Document*, HTMLFormElement*);
+    HTMLOptGroupElement(const QualifiedName&, Document*);
 
     virtual const AtomicString& formControlType() const;
     virtual bool supportsFocus() const;
diff --git a/Source/WebCore/html/HTMLOptionElement.cpp b/Source/WebCore/html/HTMLOptionElement.cpp
index 9fef31841..1696e9bec 100644
--- a/Source/WebCore/html/HTMLOptionElement.cpp
+++ b/Source/WebCore/html/HTMLOptionElement.cpp
@@ -137,10 +137,12 @@ String HTMLOptionElement::text() const
 
 void HTMLOptionElement::setText(const String &text, ExceptionCode& ec)
 {
+    RefPtr<Node> protectFromMutationEvents(this);
+
     // Changing the text causes a recalc of a select's items, which will reset the selected
     // index to the first item if the select is single selection with a menu list. We attempt to
     // preserve the selected item.
-    HTMLSelectElement* select = ownerSelectElement();
+    RefPtr<HTMLSelectElement> select = ownerSelectElement();
     bool selectIsMenuList = select && select->usesMenuList();
     int oldSelectedIndex = selectIsMenuList ? select->selectedIndex() : -1;
 
@@ -297,7 +299,7 @@ String HTMLOptionElement::textIndentedToRespectGroupLabel() const
 
 bool HTMLOptionElement::disabled() const
 {
-    return ownElementDisabled() || (parentNode() && static_cast<HTMLFormControlElement*>(parentNode())->disabled());
+    return ownElementDisabled() || (parentNode() && parentNode()->isHTMLElement() && static_cast<HTMLElement*>(parentNode())->disabled());
 }
 
 void HTMLOptionElement::insertedIntoTree(bool deep)
diff --git a/Source/WebCore/html/HTMLOptionElement.idl b/Source/WebCore/html/HTMLOptionElement.idl
index 99681f2c1..b7b3489ea 100644
--- a/Source/WebCore/html/HTMLOptionElement.idl
+++ b/Source/WebCore/html/HTMLOptionElement.idl
@@ -25,18 +25,18 @@ module html {
         NamedConstructor=Option(in [Optional=DefaultIsNullString] DOMString data, in [Optional=DefaultIsNullString] DOMString value, in [Optional=DefaultIsUndefined] boolean defaultSelected, in [Optional=DefaultIsUndefined] boolean selected),
         ConstructorRaisesException
     ] HTMLOptionElement : HTMLElement {
+        attribute [Reflect] boolean disabled;
         readonly attribute HTMLFormElement form;
+        attribute DOMString label;
         attribute [Reflect=selected] boolean defaultSelected;
+        attribute boolean selected;
+        attribute DOMString value;
+
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         attribute DOMString text setter raises(DOMException);
 #else
         readonly attribute DOMString text;
 #endif
         readonly attribute long index;
-        attribute [Reflect] boolean disabled;
-        attribute DOMString label;
-        attribute boolean selected;
-        attribute DOMString value;
     };
-
 }
diff --git a/Source/WebCore/html/HTMLOutputElement.cpp b/Source/WebCore/html/HTMLOutputElement.cpp
index ccad10741..0e1155fd4 100644
--- a/Source/WebCore/html/HTMLOutputElement.cpp
+++ b/Source/WebCore/html/HTMLOutputElement.cpp
@@ -81,6 +81,8 @@ void HTMLOutputElement::setFor(const String& value)
 
 void HTMLOutputElement::childrenChanged(bool createdByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
+    HTMLFormControlElement::childrenChanged(createdByParser, beforeChange, afterChange, childCountDelta);
+
     if (createdByParser || m_isSetTextContentInProgress) {
         m_isSetTextContentInProgress = false;
         return;
@@ -88,7 +90,6 @@ void HTMLOutputElement::childrenChanged(bool createdByParser, Node* beforeChange
 
     if (m_isDefaultValueMode)
         m_defaultValue = textContent();
-    HTMLFormControlElement::childrenChanged(createdByParser, beforeChange, afterChange, childCountDelta);
 }
 
 void HTMLOutputElement::reset()
diff --git a/Source/WebCore/html/HTMLParagraphElement.cpp b/Source/WebCore/html/HTMLParagraphElement.cpp
index c8f6ad3ee..bc98710a1 100644
--- a/Source/WebCore/html/HTMLParagraphElement.cpp
+++ b/Source/WebCore/html/HTMLParagraphElement.cpp
@@ -39,16 +39,21 @@ inline HTMLParagraphElement::HTMLParagraphElement(const QualifiedName& tagName,
     ASSERT(hasTagName(pTag));
 }
 
+PassRefPtr<HTMLParagraphElement> HTMLParagraphElement::create(Document* document)
+{
+    return adoptRef(new HTMLParagraphElement(pTag, document));
+}
+
 PassRefPtr<HTMLParagraphElement> HTMLParagraphElement::create(const QualifiedName& tagName, Document* document)
 {
     return adoptRef(new HTMLParagraphElement(tagName, document));
 }
 
-bool HTMLParagraphElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLParagraphElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == alignAttr)
+    if (name == alignAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLParagraphElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLParagraphElement.h b/Source/WebCore/html/HTMLParagraphElement.h
index 86a85a63a..736567949 100644
--- a/Source/WebCore/html/HTMLParagraphElement.h
+++ b/Source/WebCore/html/HTMLParagraphElement.h
@@ -29,12 +29,13 @@ namespace WebCore {
 
 class HTMLParagraphElement : public HTMLElement {
 public:
+    static PassRefPtr<HTMLParagraphElement> create(Document*);
     static PassRefPtr<HTMLParagraphElement> create(const QualifiedName&, Document*);
 
 private:
     HTMLParagraphElement(const QualifiedName&, Document*);
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/HTMLParamElement.cpp b/Source/WebCore/html/HTMLParamElement.cpp
index c0f919951..39df4641e 100644
--- a/Source/WebCore/html/HTMLParamElement.cpp
+++ b/Source/WebCore/html/HTMLParamElement.cpp
@@ -42,37 +42,27 @@ PassRefPtr<HTMLParamElement> HTMLParamElement::create(const QualifiedName& tagNa
     return adoptRef(new HTMLParamElement(tagName, document));
 }
 
-bool HTMLParamElement::isURLParameter(const String& name)
+String HTMLParamElement::name() const
 {
-    return equalIgnoringCase(name, "data") || equalIgnoringCase(name, "movie") || equalIgnoringCase(name, "src");
+    if (hasName())
+        return getNameAttribute();
+    return document()->isHTMLDocument() ? emptyAtom : getIdAttribute();
 }
 
-void HTMLParamElement::parseAttribute(Attribute* attr)
+String HTMLParamElement::value() const
 {
-    if (isIdAttributeName(attr->name())) {
-        // Must call base class so that hasID bit gets set.
-        HTMLElement::parseAttribute(attr);
-        if (document()->isHTMLDocument())
-            return;
-        m_name = attr->value();
-    } else if (attr->name() == nameAttr) {
-        m_name = attr->value();
-    } else if (attr->name() == valueAttr) {
-        m_value = attr->value();
-    } else
-        HTMLElement::parseAttribute(attr);
+    return fastGetAttribute(valueAttr);
+}
+
+bool HTMLParamElement::isURLParameter(const String& name)
+{
+    return equalIgnoringCase(name, "data") || equalIgnoringCase(name, "movie") || equalIgnoringCase(name, "src");
 }
 
 bool HTMLParamElement::isURLAttribute(Attribute* attr) const
 {
-    if (attr->name() == valueAttr && hasAttributes()) {
-        Attribute* nameAttribute = getAttributeItem(nameAttr);
-        if (nameAttribute) {
-            const AtomicString& value = nameAttribute->value();
-            if (isURLParameter(value))
-                return true;
-        }
-    }
+    if (attr->name() == valueAttr && isURLParameter(name()))
+        return true;
     return HTMLElement::isURLAttribute(attr);
 }
 
diff --git a/Source/WebCore/html/HTMLParamElement.h b/Source/WebCore/html/HTMLParamElement.h
index eadec5440..09e2dfdc1 100644
--- a/Source/WebCore/html/HTMLParamElement.h
+++ b/Source/WebCore/html/HTMLParamElement.h
@@ -31,24 +31,17 @@ class HTMLParamElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLParamElement> create(const QualifiedName&, Document*);
 
-    String name() const { return m_name; }
-    String value() const { return m_value; }
+    String name() const;
+    String value() const;
 
     static bool isURLParameter(const String&);
 
 private:
     HTMLParamElement(const QualifiedName&, Document*);
 
-    virtual void parseAttribute(Attribute*) OVERRIDE;
-
     virtual bool isURLAttribute(Attribute*) const;
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
-
-    // FIXME: These don't need to be stored as members and instead
-    // name() value() could use getAttribute(nameAttr/valueAttr).
-    AtomicString m_name;
-    AtomicString m_value;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/HTMLPlugInElement.cpp b/Source/WebCore/html/HTMLPlugInElement.cpp
index 8c0f302a2..299e47b2e 100644
--- a/Source/WebCore/html/HTMLPlugInElement.cpp
+++ b/Source/WebCore/html/HTMLPlugInElement.cpp
@@ -140,11 +140,11 @@ Widget* HTMLPlugInElement::pluginWidget()
     return renderWidget->widget();
 }
 
-bool HTMLPlugInElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLPlugInElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == alignAttr)
+    if (name == widthAttr || name == heightAttr || name == vspaceAttr || name == hspaceAttr || name == alignAttr)
         return true;
-    return HTMLFrameOwnerElement::isPresentationAttribute(attr);
+    return HTMLFrameOwnerElement::isPresentationAttribute(name);
 }
 
 void HTMLPlugInElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLPlugInElement.h b/Source/WebCore/html/HTMLPlugInElement.h
index 10c1ea791..22b14c4e7 100644
--- a/Source/WebCore/html/HTMLPlugInElement.h
+++ b/Source/WebCore/html/HTMLPlugInElement.h
@@ -58,7 +58,7 @@ protected:
 
     virtual void detach();
     virtual void removedFromDocument();
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     bool m_inBeforeLoadEventHandler;
diff --git a/Source/WebCore/html/HTMLPreElement.cpp b/Source/WebCore/html/HTMLPreElement.cpp
index 09c08977a..839c52a3d 100644
--- a/Source/WebCore/html/HTMLPreElement.cpp
+++ b/Source/WebCore/html/HTMLPreElement.cpp
@@ -42,11 +42,11 @@ PassRefPtr<HTMLPreElement> HTMLPreElement::create(const QualifiedName& tagName,
     return adoptRef(new HTMLPreElement(tagName, document));
 }
 
-bool HTMLPreElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLPreElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == wrapAttr)
+    if (name == wrapAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLPreElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLPreElement.h b/Source/WebCore/html/HTMLPreElement.h
index 778204898..6c21afd59 100644
--- a/Source/WebCore/html/HTMLPreElement.h
+++ b/Source/WebCore/html/HTMLPreElement.h
@@ -34,7 +34,7 @@ public:
 private:
     HTMLPreElement(const QualifiedName&, Document*);
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/HTMLProgressElement.h b/Source/WebCore/html/HTMLProgressElement.h
index dfd006799..6ec91b93d 100644
--- a/Source/WebCore/html/HTMLProgressElement.h
+++ b/Source/WebCore/html/HTMLProgressElement.h
@@ -51,6 +51,8 @@ private:
     HTMLProgressElement(const QualifiedName&, Document*, HTMLFormElement*);
     virtual ~HTMLProgressElement();
 
+    virtual bool isLabelable() const OVERRIDE { return true; }
+
     virtual bool supportsFocus() const;
 
     virtual bool recalcWillValidate() const { return false; }
diff --git a/Source/WebCore/html/HTMLPropertiesCollection.cpp b/Source/WebCore/html/HTMLPropertiesCollection.cpp
index 6aac467ad..68045cbba 100644
--- a/Source/WebCore/html/HTMLPropertiesCollection.cpp
+++ b/Source/WebCore/html/HTMLPropertiesCollection.cpp
@@ -39,6 +39,7 @@
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "Node.h"
+#include "StaticNodeList.h"
 
 namespace WebCore {
 
@@ -172,6 +173,48 @@ PassRefPtr<DOMStringList> HTMLPropertiesCollection::names() const
     return m_propertyNames;
 }
 
+PassRefPtr<NodeList> HTMLPropertiesCollection::namedItem(const String& name) const
+{
+    if (!base()->isHTMLElement() || !toHTMLElement(base())->fastHasAttribute(itemscopeAttr))
+      return 0;
+
+    m_properties.clear();
+    Vector<RefPtr<Node> > namedItems;
+    findPropetiesOfAnItem(base());
+
+    std::sort(m_properties.begin(), m_properties.end(), compareTreeOrder);
+
+    // For each item properties, split the value of that itemprop attribute on spaces.
+    // Add element to namedItem that contains a property named name, with the order preserved.
+    for (size_t i = 0; i < m_properties.size(); ++i) {
+        DOMSettableTokenList* itemProperty = m_properties[i]->itemProp();
+        if (itemProperty->tokens().contains(name))
+            namedItems.append(m_properties[i]);
+    }
+
+    // FIXME: HTML5 specifies that this should return PropertyNodeList.
+    return namedItems.isEmpty() ? 0 : StaticNodeList::adopt(namedItems);
+}
+
+bool HTMLPropertiesCollection::hasNamedItem(const AtomicString& name) const
+{
+    if (!base()->isHTMLElement() || !toHTMLElement(base())->fastHasAttribute(itemscopeAttr))
+        return false;
+
+    m_properties.clear();
+    findPropetiesOfAnItem(base());
+
+    // For each item properties, split the value of that itemprop attribute on spaces.
+    // Return true if element contains a property named name.
+    for (size_t i = 0; i < m_properties.size(); ++i) {
+        DOMSettableTokenList* itemProperty = m_properties[i]->itemProp();
+        if (itemProperty->tokens().contains(name))
+            return true;
+    }
+
+    return false;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(MICRODATA)
diff --git a/Source/WebCore/html/HTMLPropertiesCollection.h b/Source/WebCore/html/HTMLPropertiesCollection.h
index 2572eebc4..46434e3a9 100644
--- a/Source/WebCore/html/HTMLPropertiesCollection.h
+++ b/Source/WebCore/html/HTMLPropertiesCollection.h
@@ -50,10 +50,14 @@ public:
 
     PassRefPtr<DOMStringList> names() const;
 
+    PassRefPtr<NodeList> namedItem(const String&) const;
+    bool hasNamedItem(const AtomicString&) const;
+
 private:
     HTMLPropertiesCollection(Node*);
 
     void findPropetiesOfAnItem(Node* current) const;
+    void getNamedItems(Vector<RefPtr<Node> >&, const String&) const;
 
     mutable Vector<Node*> m_properties;
     mutable RefPtr<DOMStringList> m_propertyNames;
diff --git a/Source/WebCore/html/HTMLPropertiesCollection.idl b/Source/WebCore/html/HTMLPropertiesCollection.idl
index 470ab2eec..ccf66422b 100644
--- a/Source/WebCore/html/HTMLPropertiesCollection.idl
+++ b/Source/WebCore/html/HTMLPropertiesCollection.idl
@@ -32,13 +32,15 @@ module html {
 
     interface [
         Conditional=MICRODATA,
-        IndexedGetter
+        IndexedGetter,
+        NamedGetter
     ] HTMLPropertiesCollection : HTMLCollection {
         readonly attribute unsigned long length;
         Node item(in unsigned long index);
 
         readonly attribute DOMStringList names;
 
-        // FIXME: override inherited namedItem()
+        // FIXME: HTML5 specifies that this should return PropertyNodeList.
+        NodeList namedItem(in DOMString name);
     };
 }
diff --git a/Source/WebCore/html/HTMLScriptElement.cpp b/Source/WebCore/html/HTMLScriptElement.cpp
index cabc21374..a1e6c8080 100644
--- a/Source/WebCore/html/HTMLScriptElement.cpp
+++ b/Source/WebCore/html/HTMLScriptElement.cpp
@@ -54,8 +54,8 @@ bool HTMLScriptElement::isURLAttribute(Attribute* attr) const
 
 void HTMLScriptElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    ScriptElement::childrenChanged();
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    ScriptElement::childrenChanged();
 }
 
 void HTMLScriptElement::parseAttribute(Attribute* attr)
@@ -82,6 +82,8 @@ void HTMLScriptElement::insertedIntoDocument()
 
 void HTMLScriptElement::setText(const String &value)
 {
+    RefPtr<Node> protectFromMutationEvents(this);
+
     ExceptionCode ec = 0;
     int numChildren = childNodeCount();
 
diff --git a/Source/WebCore/html/HTMLSelectElement.cpp b/Source/WebCore/html/HTMLSelectElement.cpp
index a2c31dcda..413b771a8 100644
--- a/Source/WebCore/html/HTMLSelectElement.cpp
+++ b/Source/WebCore/html/HTMLSelectElement.cpp
@@ -257,15 +257,15 @@ void HTMLSelectElement::setValue(const String &value)
     setSelectedIndex(-1);
 }
 
-bool HTMLSelectElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLSelectElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == alignAttr) {
+    if (name == alignAttr) {
         // Don't map 'align' attribute. This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=12072
         return false;
     }
 
-    return HTMLFormControlElementWithState::isPresentationAttribute(attr);
+    return HTMLFormControlElementWithState::isPresentationAttribute(name);
 }
 
 void HTMLSelectElement::parseAttribute(Attribute* attr)
@@ -331,6 +331,13 @@ bool HTMLSelectElement::childShouldCreateRenderer(const NodeRenderingContext& ch
     return childContext.isOnEncapsulationBoundary() && HTMLFormControlElementWithState::childShouldCreateRenderer(childContext);
 }
 
+HTMLCollection* HTMLSelectElement::selectedOptions()
+{
+    if (!m_selectedOptionsCollection)
+        m_selectedOptionsCollection = HTMLCollection::create(this, SelectedOptions);
+    return m_selectedOptionsCollection.get();
+}
+
 HTMLOptionsCollection* HTMLSelectElement::options()
 {
     if (!m_optionsCollection)
diff --git a/Source/WebCore/html/HTMLSelectElement.h b/Source/WebCore/html/HTMLSelectElement.h
index 77c081e6f..3ed61961c 100644
--- a/Source/WebCore/html/HTMLSelectElement.h
+++ b/Source/WebCore/html/HTMLSelectElement.h
@@ -63,6 +63,7 @@ public:
     void setValue(const String&);
 
     HTMLOptionsCollection* options();
+    HTMLCollection* selectedOptions();
 
     void optionElementChildrenChanged();
 
@@ -117,12 +118,13 @@ private:
     virtual bool canStartSelection() const { return false; }
 
     virtual bool isEnumeratable() const { return true; }
+    virtual bool isLabelable() const OVERRIDE { return true; }
 
     virtual bool saveFormControlState(String& value) const;
     virtual void restoreFormControlState(const String&);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
 
     virtual bool childShouldCreateRenderer(const NodeRenderingContext&) const OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle *);
@@ -177,6 +179,7 @@ private:
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
     OwnPtr<HTMLOptionsCollection> m_optionsCollection;
+    OwnPtr<HTMLCollection> m_selectedOptionsCollection;
 
     // m_listItems contains HTMLOptionElement, HTMLOptGroupElement, and HTMLHRElement objects.
     mutable Vector<HTMLElement*> m_listItems;
diff --git a/Source/WebCore/html/HTMLSelectElement.idl b/Source/WebCore/html/HTMLSelectElement.idl
index 4f0b82662..b86363694 100644
--- a/Source/WebCore/html/HTMLSelectElement.idl
+++ b/Source/WebCore/html/HTMLSelectElement.idl
@@ -24,37 +24,28 @@ module html {
         IndexedGetter,
         CustomIndexedSetter
     ] HTMLSelectElement : HTMLElement {
+        attribute [Reflect] boolean autofocus;
+        attribute [Reflect] boolean disabled;
+        readonly attribute HTMLFormElement form;
+        attribute boolean multiple;
+        attribute [TreatNullAs=NullString] DOMString name;
+        attribute [Reflect] boolean required;
+        attribute long size;
+
         readonly attribute DOMString type;
-        attribute long selectedIndex;
-        attribute [TreatNullAs=NullString] DOMString value;
-        
-        // Modified in DOM Level 2:
+
+        readonly attribute HTMLOptionsCollection options;
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        // DOM Level 2 changes type of length attribute to unsigned long, 
+        // for compatibility we keep DOM Level 1 definition.
         readonly attribute long length;
 #else
         attribute unsigned long length setter raises (DOMException);
 #endif
-
-        readonly attribute HTMLFormElement form;
-        readonly attribute ValidityState validity;
-        readonly attribute boolean willValidate;
-        readonly attribute DOMString validationMessage;
-        boolean checkValidity();
-        void setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
-
-        // Modified in DOM Level 2:
-        readonly attribute HTMLOptionsCollection options;
-
-        attribute [Reflect] boolean disabled;
-        attribute [Reflect] boolean autofocus;
-        attribute boolean multiple;
-        attribute [TreatNullAs=NullString] DOMString name;
-        attribute [Reflect] boolean required;
-        attribute long size;
-        
-        [ObjCLegacyUnnamedParameters] void add(in [Optional=DefaultIsUndefined] HTMLElement element, 
+        Node item(in [IsIndex,Optional=DefaultIsUndefined] unsigned long index);
+        Node namedItem(in [Optional=DefaultIsUndefined] DOMString name);
+        [ObjCLegacyUnnamedParameters] void add(in [Optional=DefaultIsUndefined] HTMLElement element,
                                 in [Optional=DefaultIsUndefined] HTMLElement before) raises(DOMException);
-
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // In JavaScript, we support both option index and option object parameters.
         // As of this writing this cannot be auto-generated.
@@ -62,12 +53,16 @@ module html {
 #else
         void remove(in long index);
 #endif
+        readonly attribute HTMLCollection selectedOptions;
+        attribute long selectedIndex;
+        attribute [TreatNullAs=NullString] DOMString value;
+
+        readonly attribute boolean willValidate;
+        readonly attribute ValidityState validity;
+        readonly attribute DOMString validationMessage;
+        boolean checkValidity();
+        void setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
 
-        // These methods are not in DOM Level 2 IDL, but are mentioned in the standard:
-        // "The contained options can be directly accessed through the select element as a collection."
-        Node item(in [IsIndex,Optional=DefaultIsUndefined] unsigned long index);
-        Node namedItem(in [Optional=DefaultIsUndefined] DOMString name);
         readonly attribute NodeList labels;
     };
-
 }
diff --git a/Source/WebCore/html/HTMLStyleElement.cpp b/Source/WebCore/html/HTMLStyleElement.cpp
index 2070d56ce..b91126299 100644
--- a/Source/WebCore/html/HTMLStyleElement.cpp
+++ b/Source/WebCore/html/HTMLStyleElement.cpp
@@ -26,6 +26,8 @@
 
 #include "Attribute.h"
 #include "Document.h"
+#include "Event.h"
+#include "EventSender.h"
 #include "HTMLNames.h"
 #include "RuntimeEnabledFeatures.h"
 #include "ScriptEventListener.h"
@@ -36,9 +38,17 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+static StyleEventSender& styleLoadEventSender()
+{
+    DEFINE_STATIC_LOCAL(StyleEventSender, sharedLoadEventSender, (eventNames().loadEvent));
+    return sharedLoadEventSender;
+}
+
 inline HTMLStyleElement::HTMLStyleElement(const QualifiedName& tagName, Document* document, bool createdByParser)
     : HTMLElement(tagName, document)
     , StyleElement(document, createdByParser)
+    , m_firedLoad(false)
+    , m_loadedSheet(false)
 #if ENABLE(STYLE_SCOPED)
     , m_isRegisteredWithScopingNode(false)
 #endif
@@ -51,6 +61,8 @@ HTMLStyleElement::~HTMLStyleElement()
     // During tear-down, willRemove isn't called, so m_isRegisteredWithScopingNode may still be set here.
     // Therefore we can't ASSERT(!m_isRegisteredWithScopingNode).
     StyleElement::clearDocumentData(document(), this);
+
+    styleLoadEventSender().cancelEvent(this);
 }
 
 PassRefPtr<HTMLStyleElement> HTMLStyleElement::create(const QualifiedName& tagName, Document* document, bool createdByParser)
@@ -62,6 +74,10 @@ void HTMLStyleElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == titleAttr && m_sheet)
         m_sheet->setTitle(attr->value());
+    else if (attr->name() == onloadAttr)
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
+    else if (attr->name() == onerrorAttr)
+        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attr));
 #if ENABLE(STYLE_SCOPED)
     else if (attr->name() == scopedAttr) {
         if (!attr->isNull() && !m_isRegisteredWithScopingNode && inDocument())
@@ -148,7 +164,10 @@ void HTMLStyleElement::insertedIntoDocument()
 void HTMLStyleElement::removedFromDocument()
 {
 #if ENABLE(STYLE_SCOPED)
-    ASSERT(!m_isRegisteredWithScopingNode);
+    // In come cases on teardown willRemove is not called - test here for unregistering again
+    // FIXME: Do we need to bother?
+    if (m_isRegisteredWithScopingNode)
+        unregisterWithScopingNode();
 #endif
     HTMLElement::removedFromDocument();
     StyleElement::removedFromDocument(document(), this);
@@ -171,8 +190,8 @@ void HTMLStyleElement::willRemove()
 
 void HTMLStyleElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    StyleElement::childrenChanged(this);
     HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    StyleElement::childrenChanged(this);
 }
 
 const AtomicString& HTMLStyleElement::media() const
@@ -212,6 +231,29 @@ Element* HTMLStyleElement::scopingElement() const
 }
 #endif // ENABLE(STYLE_SCOPED)
 
+void HTMLStyleElement::dispatchPendingLoadEvents()
+{
+    styleLoadEventSender().dispatchPendingEvents();
+}
+
+void HTMLStyleElement::dispatchPendingEvent(StyleEventSender* eventSender)
+{
+    ASSERT_UNUSED(eventSender, eventSender == &styleLoadEventSender());
+    if (m_loadedSheet)
+        dispatchEvent(Event::create(eventNames().loadEvent, false, false));
+    else
+        dispatchEvent(Event::create(eventNames().errorEvent, false, false));
+}
+
+void HTMLStyleElement::notifyLoadedSheetAndAllCriticalSubresources(bool errorOccurred)
+{
+    if (m_firedLoad)
+        return;
+    m_loadedSheet = !errorOccurred;
+    styleLoadEventSender().dispatchEventSoon(this);
+    m_firedLoad = true;
+}
+
 void HTMLStyleElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {    
     HTMLElement::addSubresourceAttributeURLs(urls);
diff --git a/Source/WebCore/html/HTMLStyleElement.h b/Source/WebCore/html/HTMLStyleElement.h
index 39d140067..47f6ac653 100644
--- a/Source/WebCore/html/HTMLStyleElement.h
+++ b/Source/WebCore/html/HTMLStyleElement.h
@@ -28,8 +28,12 @@
 
 namespace WebCore {
 
+class HTMLStyleElement;
 class StyleSheet;
 
+template<typename T> class EventSender;
+typedef EventSender<HTMLStyleElement> StyleEventSender;
+
 class HTMLStyleElement : public HTMLElement, private StyleElement {
 public:
     static PassRefPtr<HTMLStyleElement> create(const QualifiedName&, Document*, bool createdByParser);
@@ -48,6 +52,9 @@ public:
     bool disabled() const;
     void setDisabled(bool);
 
+    void dispatchPendingEvent(StyleEventSender*);
+    static void dispatchPendingLoadEvents();
+
 private:
     HTMLStyleElement(const QualifiedName&, Document*, bool createdByParser);
 
@@ -64,6 +71,7 @@ private:
 
     virtual bool isLoading() const { return StyleElement::isLoading(); }
     virtual bool sheetLoaded() { return StyleElement::sheetLoaded(document()); }
+    virtual void notifyLoadedSheetAndAllCriticalSubresources(bool errorOccurred);
     virtual void startLoadingDynamicSheet() { StyleElement::startLoadingDynamicSheet(document()); }
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
@@ -74,6 +82,9 @@ private:
     void registerWithScopingNode();
     void unregisterWithScopingNode();
 
+    bool m_firedLoad;
+    bool m_loadedSheet;
+
 #if ENABLE(STYLE_SCOPED)
     bool m_isRegisteredWithScopingNode;
 #endif
diff --git a/Source/WebCore/html/HTMLSummaryElement.cpp b/Source/WebCore/html/HTMLSummaryElement.cpp
index a3494af81..5557c4556 100644
--- a/Source/WebCore/html/HTMLSummaryElement.cpp
+++ b/Source/WebCore/html/HTMLSummaryElement.cpp
@@ -31,9 +31,9 @@
 #include "MouseEvent.h"
 #include "NodeRenderingContext.h"
 #include "PlatformMouseEvent.h"
-#include "RenderSummary.h"
+#include "RenderBlock.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 
 namespace WebCore {
 
@@ -45,7 +45,7 @@ public:
 
 private:
     SummaryContentElement(Document* document)
-        : HTMLContentElement(HTMLNames::divTag, document)
+        : HTMLContentElement(HTMLNames::webkitShadowContentTag, document)
     {
     }
 };
@@ -70,7 +70,7 @@ HTMLSummaryElement::HTMLSummaryElement(const QualifiedName& tagName, Document* d
 
 RenderObject* HTMLSummaryElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    return new (arena) RenderSummary(this);
+    return new (arena) RenderBlock(this);
 }
 
 bool HTMLSummaryElement::childShouldCreateRenderer(const NodeRenderingContext& childContext) const
@@ -120,7 +120,7 @@ bool HTMLSummaryElement::supportsFocus() const
 
 void HTMLSummaryElement::defaultEventHandler(Event* event)
 {
-    if (isMainSummary() && renderer() && renderer()->isSummary()) {
+    if (isMainSummary() && renderer()) {
         if (event->type() == eventNames().DOMActivateEvent && !isClickableControl(event->target()->toNode())) {
             if (HTMLDetailsElement* details = detailsElement())
                 details->toggleOpen();
diff --git a/Source/WebCore/html/HTMLTableCaptionElement.cpp b/Source/WebCore/html/HTMLTableCaptionElement.cpp
index c327d0f85..4e6445bb3 100644
--- a/Source/WebCore/html/HTMLTableCaptionElement.cpp
+++ b/Source/WebCore/html/HTMLTableCaptionElement.cpp
@@ -44,11 +44,11 @@ PassRefPtr<HTMLTableCaptionElement> HTMLTableCaptionElement::create(const Qualif
     return adoptRef(new HTMLTableCaptionElement(tagName, document));
 }
 
-bool HTMLTableCaptionElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLTableCaptionElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == alignAttr)
+    if (name == alignAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLTableCaptionElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLTableCaptionElement.h b/Source/WebCore/html/HTMLTableCaptionElement.h
index a43141f40..4d3c1d8c0 100644
--- a/Source/WebCore/html/HTMLTableCaptionElement.h
+++ b/Source/WebCore/html/HTMLTableCaptionElement.h
@@ -37,7 +37,7 @@ public:
 private:
     HTMLTableCaptionElement(const QualifiedName&, Document*);
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/HTMLTableCellElement.cpp b/Source/WebCore/html/HTMLTableCellElement.cpp
index 7664673f3..9bf0c91f4 100644
--- a/Source/WebCore/html/HTMLTableCellElement.cpp
+++ b/Source/WebCore/html/HTMLTableCellElement.cpp
@@ -75,11 +75,11 @@ int HTMLTableCellElement::cellIndex() const
     return index;
 }
 
-bool HTMLTableCellElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLTableCellElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == nowrapAttr || attr->name() == widthAttr || attr->name() == heightAttr)
+    if (name == nowrapAttr || name == widthAttr || name == heightAttr)
         return true;
-    return HTMLTablePartElement::isPresentationAttribute(attr);
+    return HTMLTablePartElement::isPresentationAttribute(name);
 }
 
 void HTMLTableCellElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLTableCellElement.h b/Source/WebCore/html/HTMLTableCellElement.h
index 7ca11271f..d1f74fd91 100644
--- a/Source/WebCore/html/HTMLTableCellElement.h
+++ b/Source/WebCore/html/HTMLTableCellElement.h
@@ -54,7 +54,7 @@ private:
     HTMLTableCellElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     virtual StylePropertySet* additionalAttributeStyle() OVERRIDE;
diff --git a/Source/WebCore/html/HTMLTableColElement.cpp b/Source/WebCore/html/HTMLTableColElement.cpp
index db75b2544..1f4a2ff6e 100644
--- a/Source/WebCore/html/HTMLTableColElement.cpp
+++ b/Source/WebCore/html/HTMLTableColElement.cpp
@@ -47,11 +47,11 @@ PassRefPtr<HTMLTableColElement> HTMLTableColElement::create(const QualifiedName&
     return adoptRef(new HTMLTableColElement(tagName, document));
 }
 
-bool HTMLTableColElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLTableColElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == widthAttr)
+    if (name == widthAttr)
         return true;
-    return HTMLTablePartElement::isPresentationAttribute(attr);
+    return HTMLTablePartElement::isPresentationAttribute(name);
 }
 
 void HTMLTableColElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLTableColElement.h b/Source/WebCore/html/HTMLTableColElement.h
index 960ee8448..6cff11624 100644
--- a/Source/WebCore/html/HTMLTableColElement.h
+++ b/Source/WebCore/html/HTMLTableColElement.h
@@ -43,7 +43,7 @@ private:
     HTMLTableColElement(const QualifiedName& tagName, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual StylePropertySet* additionalAttributeStyle() OVERRIDE;
 
diff --git a/Source/WebCore/html/HTMLTableElement.cpp b/Source/WebCore/html/HTMLTableElement.cpp
index 9420d9518..cf64b37da 100644
--- a/Source/WebCore/html/HTMLTableElement.cpp
+++ b/Source/WebCore/html/HTMLTableElement.cpp
@@ -30,6 +30,7 @@
 #include "CSSPropertyNames.h"
 #include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
+#include "CSSValuePool.h"
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
@@ -186,13 +187,15 @@ PassRefPtr<HTMLElement> HTMLTableElement::insertRow(int index, ExceptionCode& ec
         return 0;
     }
 
-    HTMLTableRowElement* lastRow = 0;
-    HTMLTableRowElement* row = 0;
+    RefPtr<Node> protectFromMutationEvents(this);
+
+    RefPtr<HTMLTableRowElement> lastRow = 0;
+    RefPtr<HTMLTableRowElement> row = 0;
     if (index == -1)
         lastRow = HTMLTableRowsCollection::lastRow(this);
     else {
         for (int i = 0; i <= index; ++i) {
-            row = HTMLTableRowsCollection::rowAfter(this, lastRow);
+            row = HTMLTableRowsCollection::rowAfter(this, lastRow.get());
             if (!row) {
                 if (i != index) {
                     ec = INDEX_SIZE_ERR;
@@ -204,7 +207,7 @@ PassRefPtr<HTMLElement> HTMLTableElement::insertRow(int index, ExceptionCode& ec
         }
     }
 
-    ContainerNode* parent;
+    RefPtr<ContainerNode> parent;
     if (lastRow)
         parent = row ? row->parentNode() : lastRow->parentNode();
     else {
@@ -219,7 +222,7 @@ PassRefPtr<HTMLElement> HTMLTableElement::insertRow(int index, ExceptionCode& ec
     }
 
     RefPtr<HTMLTableRowElement> newRow = HTMLTableRowElement::create(document());
-    parent->insertBefore(newRow, row, ec);
+    parent->insertBefore(newRow, row.get(), ec);
     return newRow.release();
 }
 
@@ -351,11 +354,11 @@ void HTMLTableElement::collectStyleForAttribute(Attribute* attr, StylePropertySe
         HTMLElement::collectStyleForAttribute(attr, style);
 }
 
-bool HTMLTableElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLTableElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == widthAttr || attr->name() == heightAttr || attr->name() == bgcolorAttr || attr->name() == backgroundAttr || attr->name() == valignAttr || attr->name() == vspaceAttr || attr->name() == hspaceAttr || attr->name() == alignAttr || attr->name() == cellspacingAttr || attr->name() == borderAttr || attr->name() == bordercolorAttr || attr->name() == frameAttr || attr->name() == rulesAttr)
+    if (name == widthAttr || name == heightAttr || name == bgcolorAttr || name == backgroundAttr || name == valignAttr || name == vspaceAttr || name == hspaceAttr || name == alignAttr || name == cellspacingAttr || name == borderAttr || name == bordercolorAttr || name == frameAttr || name == rulesAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLTableElement::parseAttribute(Attribute* attr)
@@ -461,49 +464,40 @@ PassRefPtr<StylePropertySet> HTMLTableElement::createSharedCellStyle()
 {
     RefPtr<StylePropertySet> style = StylePropertySet::create();
 
+    CSSValuePool* cssValuePool = document()->cssValuePool().get();
+
     switch (cellBorders()) {
     case SolidBordersColsOnly:
         style->setProperty(CSSPropertyBorderLeftWidth, CSSValueThin);
         style->setProperty(CSSPropertyBorderRightWidth, CSSValueThin);
         style->setProperty(CSSPropertyBorderLeftStyle, CSSValueSolid);
         style->setProperty(CSSPropertyBorderRightStyle, CSSValueSolid);
-        style->setProperty(CSSPropertyBorderColor, "inherit");
+        style->setProperty(CSSPropertyBorderColor, cssValuePool->createInheritedValue());
         break;
     case SolidBordersRowsOnly:
         style->setProperty(CSSPropertyBorderTopWidth, CSSValueThin);
         style->setProperty(CSSPropertyBorderBottomWidth, CSSValueThin);
         style->setProperty(CSSPropertyBorderTopStyle, CSSValueSolid);
         style->setProperty(CSSPropertyBorderBottomStyle, CSSValueSolid);
-        style->setProperty(CSSPropertyBorderColor, "inherit");
+        style->setProperty(CSSPropertyBorderColor, cssValuePool->createInheritedValue());
         break;
     case SolidBorders:
-        style->setProperty(CSSPropertyBorderWidth, "1px");
-        style->setProperty(CSSPropertyBorderTopStyle, CSSValueSolid);
-        style->setProperty(CSSPropertyBorderBottomStyle, CSSValueSolid);
-        style->setProperty(CSSPropertyBorderLeftStyle, CSSValueSolid);
-        style->setProperty(CSSPropertyBorderRightStyle, CSSValueSolid);
-        style->setProperty(CSSPropertyBorderColor, "inherit");
+        style->setProperty(CSSPropertyBorderWidth, cssValuePool->createValue(1, CSSPrimitiveValue::CSS_PX));
+        style->setProperty(CSSPropertyBorderStyle, cssValuePool->createIdentifierValue(CSSValueSolid));
+        style->setProperty(CSSPropertyBorderColor, cssValuePool->createInheritedValue());
         break;
     case InsetBorders:
-        style->setProperty(CSSPropertyBorderWidth, "1px");
-        style->setProperty(CSSPropertyBorderTopStyle, CSSValueInset);
-        style->setProperty(CSSPropertyBorderBottomStyle, CSSValueInset);
-        style->setProperty(CSSPropertyBorderLeftStyle, CSSValueInset);
-        style->setProperty(CSSPropertyBorderRightStyle, CSSValueInset);
-        style->setProperty(CSSPropertyBorderColor, "inherit");
+        style->setProperty(CSSPropertyBorderWidth, cssValuePool->createValue(1, CSSPrimitiveValue::CSS_PX));
+        style->setProperty(CSSPropertyBorderStyle, cssValuePool->createIdentifierValue(CSSValueInset));
+        style->setProperty(CSSPropertyBorderColor, cssValuePool->createInheritedValue());
         break;
     case NoBorders:
-        style->setProperty(CSSPropertyBorderWidth, "0");
+        style->setProperty(CSSPropertyBorderWidth, cssValuePool->createValue(0, CSSPrimitiveValue::CSS_PX));
         break;
     }
 
-    if (m_padding) {
-        String value = String::number(m_padding) + "px";
-        style->setProperty(CSSPropertyPaddingTop, value);
-        style->setProperty(CSSPropertyPaddingBottom, value);
-        style->setProperty(CSSPropertyPaddingLeft, value);
-        style->setProperty(CSSPropertyPaddingRight, value);
-    }
+    if (m_padding)
+        style->setProperty(CSSPropertyPadding, cssValuePool->createValue(m_padding, CSSPrimitiveValue::CSS_PX));
 
     return style.release();
 }
@@ -545,12 +539,6 @@ StylePropertySet* HTMLTableElement::additionalGroupStyle(bool rows)
     return columnBorderStyle;
 }
 
-void HTMLTableElement::attach()
-{
-    ASSERT(!attached());
-    HTMLElement::attach();
-}
-
 bool HTMLTableElement::isURLAttribute(Attribute *attr) const
 {
     return attr->name() == backgroundAttr || HTMLElement::isURLAttribute(attr);
diff --git a/Source/WebCore/html/HTMLTableElement.h b/Source/WebCore/html/HTMLTableElement.h
index d9b86a8fc..410c3c6fd 100644
--- a/Source/WebCore/html/HTMLTableElement.h
+++ b/Source/WebCore/html/HTMLTableElement.h
@@ -64,8 +64,6 @@ public:
     String rules() const;
     String summary() const;
 
-    virtual void attach();
-
     StylePropertySet* additionalCellStyle();
     StylePropertySet* additionalGroupStyle(bool rows);
 
@@ -73,7 +71,7 @@ private:
     HTMLTableElement(const QualifiedName&, Document*);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual bool isURLAttribute(Attribute*) const;
 
diff --git a/Source/WebCore/html/HTMLTablePartElement.cpp b/Source/WebCore/html/HTMLTablePartElement.cpp
index 8a39260af..c6fb149f5 100644
--- a/Source/WebCore/html/HTMLTablePartElement.cpp
+++ b/Source/WebCore/html/HTMLTablePartElement.cpp
@@ -38,11 +38,11 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-bool HTMLTablePartElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLTablePartElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == bgcolorAttr || attr->name() == backgroundAttr || attr->name() == bordercolorAttr || attr->name() == valignAttr || attr->name() == alignAttr || attr->name() == heightAttr)
+    if (name == bgcolorAttr || name == backgroundAttr || name == bordercolorAttr || name == valignAttr || name == alignAttr || name == heightAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLTablePartElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLTablePartElement.h b/Source/WebCore/html/HTMLTablePartElement.h
index 49f75b3d5..d07068379 100644
--- a/Source/WebCore/html/HTMLTablePartElement.h
+++ b/Source/WebCore/html/HTMLTablePartElement.h
@@ -39,7 +39,7 @@ protected:
     {
     }
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 
     HTMLTableElement* findParentTable() const;
diff --git a/Source/WebCore/html/HTMLTagNames.in b/Source/WebCore/html/HTMLTagNames.in
index 62ba50100..bdbf33824 100644
--- a/Source/WebCore/html/HTMLTagNames.in
+++ b/Source/WebCore/html/HTMLTagNames.in
@@ -31,7 +31,8 @@ code interfaceName=HTMLElement
 col interfaceName=HTMLTableColElement
 colgroup interfaceName=HTMLTableColElement
 command interfaceName=HTMLElement
-content interfaceName=HTMLContentElement, conditional=SHADOW_DOM
+content interfaceName=HTMLContentElement, conditional=SHADOW_DOM, runtimeConditional=shadowDOM
+webkitShadowContent interfaceName=HTMLElement, noConstructor
 datalist interfaceName=HTMLDataListElement, conditional=DATALIST
 dd interfaceName=HTMLElement
 del interfaceName=HTMLModElement
@@ -73,7 +74,7 @@ kbd interfaceName=HTMLElement
 keygen constructorNeedsFormElement
 label
 layer interfaceName=HTMLElement
-legend constructorNeedsFormElement
+legend
 li interfaceName=HTMLLIElement
 link constructorNeedsCreatedByParser
 listing interfaceName=HTMLPreElement
@@ -90,10 +91,10 @@ noframes interfaceName=HTMLElement
 nolayer interfaceName=HTMLElement
 object constructorNeedsFormElement, constructorNeedsCreatedByParser
 ol interfaceName=HTMLOListElement
-optgroup interfaceName=HTMLOptGroupElement, constructorNeedsFormElement
+optgroup interfaceName=HTMLOptGroupElement
 option constructorNeedsFormElement
 output constructorNeedsFormElement
-shadow interfaceName=HTMLShadowElement, conditional=SHADOW_DOM
+shadow interfaceName=HTMLShadowElement, conditional=SHADOW_DOM, runtimeConditional=shadowDOM
 p interfaceName=HTMLParagraphElement
 param
 plaintext interfaceName=HTMLElement
diff --git a/Source/WebCore/html/HTMLTextAreaElement.cpp b/Source/WebCore/html/HTMLTextAreaElement.cpp
index f110ef695..347eccf46 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.cpp
+++ b/Source/WebCore/html/HTMLTextAreaElement.cpp
@@ -38,7 +38,7 @@
 #include "HTMLNames.h"
 #include "RenderTextControlMultiLine.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "Text.h"
 #include "TextControlInnerElements.h"
 #include "TextIterator.h"
@@ -112,24 +112,24 @@ void HTMLTextAreaElement::restoreFormControlState(const String& state)
 
 void HTMLTextAreaElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
+    HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
     setLastChangeWasNotUserEdit();
     if (!m_isDirty)
         setNonDirtyValue(defaultValue());
     setInnerTextValue(value());
-    HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
 
-bool HTMLTextAreaElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLTextAreaElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == alignAttr) {
+    if (name == alignAttr) {
         // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=7075
         return false;
     }
 
-    if (attr->name() == wrapAttr)
+    if (name == wrapAttr)
         return true;
-    return HTMLTextFormControlElement::isPresentationAttribute(attr);
+    return HTMLTextFormControlElement::isPresentationAttribute(name);
 }
 
 void HTMLTextAreaElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
@@ -294,7 +294,7 @@ String HTMLTextAreaElement::sanitizeUserInputValue(const String& proposedValue,
 
 HTMLElement* HTMLTextAreaElement::innerTextElement() const
 {
-    Node* node = shadowRootList()->oldestShadowRoot()->firstChild();
+    Node* node = shadowTree()->oldestShadowRoot()->firstChild();
     ASSERT(!node || node->hasTagName(divTag));
     return toHTMLElement(node);
 }
@@ -384,8 +384,9 @@ String HTMLTextAreaElement::defaultValue() const
 
 void HTMLTextAreaElement::setDefaultValue(const String& defaultValue)
 {
-    // To preserve comments, remove only the text nodes, then add a single text node.
+    RefPtr<Node> protectFromMutationEvents(this);
 
+    // To preserve comments, remove only the text nodes, then add a single text node.
     Vector<RefPtr<Node> > textNodes;
     for (Node* n = firstChild(); n; n = n->nextSibling()) {
         if (n->isTextNode())
@@ -471,7 +472,7 @@ void HTMLTextAreaElement::updatePlaceholderText()
     String placeholderText = strippedPlaceholder();
     if (placeholderText.isEmpty()) {
         if (m_placeholder) {
-            shadowRootList()->oldestShadowRoot()->removeChild(m_placeholder.get(), ec);
+            shadowTree()->oldestShadowRoot()->removeChild(m_placeholder.get(), ec);
             ASSERT(!ec);
             m_placeholder.clear();
         }
@@ -480,7 +481,7 @@ void HTMLTextAreaElement::updatePlaceholderText()
     if (!m_placeholder) {
         m_placeholder = HTMLDivElement::create(document());
         m_placeholder->setShadowPseudoId("-webkit-input-placeholder");
-        shadowRootList()->oldestShadowRoot()->insertBefore(m_placeholder, shadowRootList()->oldestShadowRoot()->firstChild()->nextSibling(), ec);
+        shadowTree()->oldestShadowRoot()->insertBefore(m_placeholder, shadowTree()->oldestShadowRoot()->firstChild()->nextSibling(), ec);
         ASSERT(!ec);
     }
     m_placeholder->setInnerText(placeholderText, ec);
diff --git a/Source/WebCore/html/HTMLTextAreaElement.h b/Source/WebCore/html/HTMLTextAreaElement.h
index 615af2585..d07c7a583 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.h
+++ b/Source/WebCore/html/HTMLTextAreaElement.h
@@ -84,6 +84,7 @@ private:
     virtual void subtreeHasChanged();
 
     virtual bool isEnumeratable() const { return true; }
+    virtual bool isLabelable() const OVERRIDE { return true; }
 
     virtual const AtomicString& formControlType() const;
 
@@ -94,7 +95,7 @@ private:
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     virtual bool appendFormData(FormDataList&, bool);
diff --git a/Source/WebCore/html/HTMLTextAreaElement.idl b/Source/WebCore/html/HTMLTextAreaElement.idl
index f6ed37503..f9d80b5ad 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.idl
+++ b/Source/WebCore/html/HTMLTextAreaElement.idl
@@ -22,13 +22,11 @@
 module html {
 
     interface HTMLTextAreaElement : HTMLElement {
-        attribute [TreatNullAs=NullString] DOMString defaultValue;
-        readonly attribute HTMLFormElement form;
-        readonly attribute ValidityState validity;
+        attribute [Reflect] boolean autofocus;
         attribute long cols;
         attribute [Reflect] DOMString dirName;
         attribute [Reflect] boolean disabled;
-        attribute [Reflect] boolean autofocus;
+        readonly attribute HTMLFormElement form;
         attribute long maxLength setter raises(DOMException);
         attribute [TreatNullAs=NullString] DOMString name;
         attribute [Reflect] DOMString placeholder;
@@ -36,32 +34,34 @@ module html {
         attribute [Reflect] boolean required;
         attribute long rows;
         attribute [Reflect] DOMString wrap;
+
         readonly attribute DOMString type;
+        attribute [TreatNullAs=NullString] DOMString defaultValue;
         attribute [TreatNullAs=NullString] DOMString value;
         readonly attribute unsigned long textLength;
 
-#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        attribute [Reflect] DOMString accessKey;
-#endif
-        void select();
-
         readonly attribute boolean willValidate;
+        readonly attribute ValidityState validity;
         readonly attribute DOMString validationMessage;
         boolean checkValidity();
         void setCustomValidity(in [TreatNullAs=NullString, TreatUndefinedAs=NullString] DOMString error);
 
-        // WinIE & FireFox extension:
+        readonly attribute NodeList labels;
+
+        void select();
         attribute long selectionStart;
         attribute long selectionEnd;
         attribute DOMString selectionDirection;
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         void setSelectionRange(in long start, in long end);
 #else
-        void setSelectionRange(in [Optional=DefaultIsUndefined] long start, 
-                               in [Optional=DefaultIsUndefined] long end, 
+        void setSelectionRange(in [Optional=DefaultIsUndefined] long start,
+                               in [Optional=DefaultIsUndefined] long end,
                                in [Optional] DOMString direction);
 #endif
-        readonly attribute NodeList labels;
-    };
 
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
+        attribute [Reflect] DOMString accessKey;
+#endif
+    };
 }
diff --git a/Source/WebCore/html/HTMLTitleElement.cpp b/Source/WebCore/html/HTMLTitleElement.cpp
index 6e7884b8b..f4889174c 100644
--- a/Source/WebCore/html/HTMLTitleElement.cpp
+++ b/Source/WebCore/html/HTMLTitleElement.cpp
@@ -58,10 +58,10 @@ void HTMLTitleElement::removedFromDocument()
 
 void HTMLTitleElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
+    HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
     m_title = textWithDirection();
     if (inDocument())
         document()->setTitleElement(m_title, this);
-    HTMLElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
 
 String HTMLTitleElement::text() const
@@ -88,12 +88,14 @@ StringWithDirection HTMLTitleElement::textWithDirection()
 
 void HTMLTitleElement::setText(const String &value)
 {
+    RefPtr<Node> protectFromMutationEvents(this);
+
     ExceptionCode ec = 0;
     int numChildren = childNodeCount();
     
     if (numChildren == 1 && firstChild()->isTextNode())
         toText(firstChild())->setData(value, ec);
-    else {  
+    else {
         // We make a copy here because entity of "value" argument can be Document::m_title,
         // which goes empty during removeChildren() invocation below,
         // which causes HTMLTitleElement::childrenChanged(), which ends up Document::setTitle().
diff --git a/Source/WebCore/html/HTMLTrackElement.idl b/Source/WebCore/html/HTMLTrackElement.idl
index cee39d3b8..0107df5a3 100644
--- a/Source/WebCore/html/HTMLTrackElement.idl
+++ b/Source/WebCore/html/HTMLTrackElement.idl
@@ -32,13 +32,13 @@ module html {
         attribute DOMString kind;
         attribute DOMString srclang;
         attribute DOMString label;
-        attribute [Reflect=default] boolean isDefault;
+        attribute [Reflect] boolean default;
 
         const unsigned short NONE = 0;
         const unsigned short LOADING = 1;
         const unsigned short LOADED = 2;
         // Reflect is used for ERROR because it conflicts with a windows define.
-        const [Reflect=TRACK_ERROR] unsigned short ERROR = 3;
+        [Reflect=TRACK_ERROR] const unsigned short ERROR = 3;
         readonly attribute unsigned short readyState;
 
         readonly attribute TextTrack track;
diff --git a/Source/WebCore/html/HTMLUListElement.cpp b/Source/WebCore/html/HTMLUListElement.cpp
index e18d2a71c..6e9a405ef 100644
--- a/Source/WebCore/html/HTMLUListElement.cpp
+++ b/Source/WebCore/html/HTMLUListElement.cpp
@@ -47,11 +47,11 @@ PassRefPtr<HTMLUListElement> HTMLUListElement::create(const QualifiedName& tagNa
     return adoptRef(new HTMLUListElement(tagName, document));
 }
 
-bool HTMLUListElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLUListElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == typeAttr)
+    if (name == typeAttr)
         return true;
-    return HTMLElement::isPresentationAttribute(attr);
+    return HTMLElement::isPresentationAttribute(name);
 }
 
 void HTMLUListElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/html/HTMLUListElement.h b/Source/WebCore/html/HTMLUListElement.h
index ea6510da0..0f27514c6 100644
--- a/Source/WebCore/html/HTMLUListElement.h
+++ b/Source/WebCore/html/HTMLUListElement.h
@@ -35,7 +35,7 @@ public:
 private:
     HTMLUListElement(const QualifiedName&, Document*);
 
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
 
diff --git a/Source/WebCore/html/HTMLUnknownElement.h b/Source/WebCore/html/HTMLUnknownElement.h
index b1259c580..28ca8378d 100644
--- a/Source/WebCore/html/HTMLUnknownElement.h
+++ b/Source/WebCore/html/HTMLUnknownElement.h
@@ -41,6 +41,10 @@ public:
         return adoptRef(new HTMLUnknownElement(tagName, document));
     }
 
+#ifndef NDEBUG
+    virtual bool isHTMLUnknownElement() const OVERRIDE { return true; }
+#endif
+
 private:
     HTMLUnknownElement(const QualifiedName& tagName, Document* document)
         : HTMLElement(tagName, document)
@@ -48,6 +52,12 @@ private:
     }
 };
 
+inline HTMLUnknownElement* toHTMLUnknownElement(HTMLElement* element)
+{
+    ASSERT(!element || element->isHTMLUnknownElement());
+    return static_cast<HTMLUnknownElement*>(element);
+}
+
 } // namespace
 
 #endif
diff --git a/Source/WebCore/html/HTMLVideoElement.cpp b/Source/WebCore/html/HTMLVideoElement.cpp
index 64428d815..d6d74565a 100644
--- a/Source/WebCore/html/HTMLVideoElement.cpp
+++ b/Source/WebCore/html/HTMLVideoElement.cpp
@@ -105,11 +105,11 @@ void HTMLVideoElement::collectStyleForAttribute(Attribute* attr, StylePropertySe
         HTMLMediaElement::collectStyleForAttribute(attr, style);
 }
 
-bool HTMLVideoElement::isPresentationAttribute(Attribute* attr) const
+bool HTMLVideoElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == widthAttr || attr->name() == heightAttr)
+    if (name == widthAttr || name == heightAttr)
         return true;
-    return HTMLMediaElement::isPresentationAttribute(attr);
+    return HTMLMediaElement::isPresentationAttribute(name);
 }
 
 void HTMLVideoElement::parseAttribute(Attribute* attr)
diff --git a/Source/WebCore/html/HTMLVideoElement.h b/Source/WebCore/html/HTMLVideoElement.h
index 59efd882b..056b83561 100644
--- a/Source/WebCore/html/HTMLVideoElement.h
+++ b/Source/WebCore/html/HTMLVideoElement.h
@@ -76,7 +76,7 @@ private:
     virtual void attach();
     virtual void detach();
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual bool isVideo() const { return true; }
     virtual bool hasVideo() const { return player() && player()->hasVideo(); }
diff --git a/Source/WebCore/html/HiddenInputType.cpp b/Source/WebCore/html/HiddenInputType.cpp
index 951b6d826..4efb8d60f 100644
--- a/Source/WebCore/html/HiddenInputType.cpp
+++ b/Source/WebCore/html/HiddenInputType.cpp
@@ -57,7 +57,7 @@ bool HiddenInputType::saveFormControlState(String& result) const
     return true;
 }
 
-void HiddenInputType::restoreFormControlState(const String& string) const
+void HiddenInputType::restoreFormControlState(const String& string)
 {
     element()->setAttribute(valueAttr, string);
 }
diff --git a/Source/WebCore/html/HiddenInputType.h b/Source/WebCore/html/HiddenInputType.h
index 9e8982c54..40af7d75f 100644
--- a/Source/WebCore/html/HiddenInputType.h
+++ b/Source/WebCore/html/HiddenInputType.h
@@ -43,7 +43,7 @@ private:
     HiddenInputType(HTMLInputElement* element) : InputType(element) { }
     virtual const AtomicString& formControlType() const OVERRIDE;
     virtual bool saveFormControlState(String&) const OVERRIDE;
-    virtual void restoreFormControlState(const String&) const OVERRIDE;
+    virtual void restoreFormControlState(const String&) OVERRIDE;
     virtual bool supportsValidation() const OVERRIDE;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const OVERRIDE;
     virtual void accessKeyAction(bool sendMouseEvents) OVERRIDE;
diff --git a/Source/WebCore/html/InputType.cpp b/Source/WebCore/html/InputType.cpp
index f34b93b5f..136638292 100644
--- a/Source/WebCore/html/InputType.cpp
+++ b/Source/WebCore/html/InputType.cpp
@@ -56,7 +56,7 @@
 #include "ResetInputType.h"
 #include "SearchInputType.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "SubmitInputType.h"
 #include "TelephoneInputType.h"
 #include "TextInputType.h"
@@ -160,7 +160,7 @@ bool InputType::saveFormControlState(String& result) const
     return true;
 }
 
-void InputType::restoreFormControlState(const String& state) const
+void InputType::restoreFormControlState(const String& state)
 {
     element()->setValue(state);
 }
@@ -382,7 +382,7 @@ void InputType::destroyShadowSubtree()
     if (!element()->hasShadowRoot())
         return;
 
-    if (ShadowRoot* root = element()->shadowRootList()->oldestShadowRoot())
+    if (ShadowRoot* root = element()->shadowTree()->oldestShadowRoot())
         root->removeAllChildren();
 }
 
diff --git a/Source/WebCore/html/InputType.h b/Source/WebCore/html/InputType.h
index 6b0f9c15a..04b580cb8 100644
--- a/Source/WebCore/html/InputType.h
+++ b/Source/WebCore/html/InputType.h
@@ -115,7 +115,7 @@ public:
     // Form value functions
 
     virtual bool saveFormControlState(String&) const;
-    virtual void restoreFormControlState(const String&) const;
+    virtual void restoreFormControlState(const String&);
     virtual bool isFormDataAppendable() const;
     virtual bool appendFormData(FormDataList&, bool multipart) const;
 
diff --git a/Source/WebCore/html/LabelableElement.cpp b/Source/WebCore/html/LabelableElement.cpp
new file mode 100644
index 000000000..45b41b0eb
--- /dev/null
+++ b/Source/WebCore/html/LabelableElement.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ *           (C) 2001 Dirk Mueller (mueller@kde.org)
+ * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "LabelableElement.h"
+
+#include "ElementRareData.h"
+#include "LabelsNodeList.h"
+#include "RenderStyle.h"
+
+namespace WebCore {
+
+LabelableElement::LabelableElement(const QualifiedName& tagName, Document* document)
+    : HTMLElement(tagName, document)
+{
+}
+
+LabelableElement::~LabelableElement()
+{
+}
+
+PassRefPtr<NodeList> LabelableElement::labels()
+{
+    if (!isLabelable())
+        return 0;
+    if (!document())
+        return 0;
+
+    NodeListsNodeData* nodeLists = Node::ensureRareData()->ensureNodeLists(this);
+    if (nodeLists->m_labelsNodeListCache)
+        return nodeLists->m_labelsNodeListCache;
+
+    RefPtr<LabelsNodeList> list = LabelsNodeList::create(this);
+    nodeLists->m_labelsNodeListCache = list.get();
+    return list.release();
+}
+
+} // namespace Webcore
diff --git a/Source/WebCore/html/LabelableElement.h b/Source/WebCore/html/LabelableElement.h
new file mode 100644
index 000000000..918307fce
--- /dev/null
+++ b/Source/WebCore/html/LabelableElement.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LabelableElement_h
+#define LabelableElement_h
+
+#include "HTMLElement.h"
+
+namespace WebCore {
+
+// LabelableElement represents "labelable element" defined in the HTML
+// specification, and provides the implementation of the "labels" attribute.
+class LabelableElement : public HTMLElement {
+public:
+    virtual ~LabelableElement();
+    virtual bool isLabelable() const { return false; }
+    PassRefPtr<NodeList> labels();
+
+protected:
+    LabelableElement(const QualifiedName& tagName, Document*);
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/html/PasswordInputType.cpp b/Source/WebCore/html/PasswordInputType.cpp
index c11d3c63d..88bb842b6 100644
--- a/Source/WebCore/html/PasswordInputType.cpp
+++ b/Source/WebCore/html/PasswordInputType.cpp
@@ -54,7 +54,7 @@ bool PasswordInputType::saveFormControlState(String&) const
     return false;
 }
 
-void PasswordInputType::restoreFormControlState(const String&) const
+void PasswordInputType::restoreFormControlState(const String&)
 {
     // Should never save/restore password fields.
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/html/PasswordInputType.h b/Source/WebCore/html/PasswordInputType.h
index 10680acb2..5267dde63 100644
--- a/Source/WebCore/html/PasswordInputType.h
+++ b/Source/WebCore/html/PasswordInputType.h
@@ -43,7 +43,7 @@ private:
     PasswordInputType(HTMLInputElement* element) : BaseTextInputType(element) { }
     virtual const AtomicString& formControlType() const OVERRIDE;
     virtual bool saveFormControlState(String&) const OVERRIDE;
-    virtual void restoreFormControlState(const String&) const OVERRIDE;
+    virtual void restoreFormControlState(const String&) OVERRIDE;
     virtual bool shouldUseInputMethod() const OVERRIDE;
     virtual bool shouldResetOnDocumentActivation() OVERRIDE;
     virtual bool shouldRespectListAttribute() OVERRIDE;
diff --git a/Source/WebCore/html/RangeInputType.cpp b/Source/WebCore/html/RangeInputType.cpp
index a174ce7af..4faf786e6 100644
--- a/Source/WebCore/html/RangeInputType.cpp
+++ b/Source/WebCore/html/RangeInputType.cpp
@@ -42,7 +42,7 @@
 #include "PlatformMouseEvent.h"
 #include "RenderSlider.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "SliderThumbElement.h"
 #include "StepRange.h"
 #include <limits>
@@ -161,7 +161,7 @@ void RangeInputType::handleMouseDownEvent(MouseEvent* event)
     if (event->button() != LeftButton || !targetNode)
         return;
     ASSERT(element()->hasShadowRoot());
-    if (targetNode != element() && !targetNode->isDescendantOf(element()->shadowRootList()->oldestShadowRoot()))
+    if (targetNode != element() && !targetNode->isDescendantOf(element()->shadowTree()->oldestShadowRoot()))
         return;
     SliderThumbElement* thumb = sliderThumbElementOf(element());
     if (targetNode == thumb)
@@ -247,7 +247,7 @@ void RangeInputType::createShadowSubtree()
     RefPtr<HTMLElement> container = SliderContainerElement::create(document);
     container->appendChild(track.release(), ec);
     container->appendChild(TrackLimiterElement::create(document), ec);
-    element()->shadowRootList()->oldestShadowRoot()->appendChild(container.release(), ec);
+    element()->shadowTree()->oldestShadowRoot()->appendChild(container.release(), ec);
 }
 
 RenderObject* RangeInputType::createRenderer(RenderArena* arena, RenderStyle*) const
@@ -271,7 +271,7 @@ String RangeInputType::serialize(double value) const
     return serializeForNumberType(value);
 }
 
-// FIXME: Could share this with BaseButtonInputType and BaseCheckableInputType if we had a common base class.
+// FIXME: Could share this with BaseClickableWithKeyInputType and BaseCheckableInputType if we had a common base class.
 void RangeInputType::accessKeyAction(bool sendMouseEvents)
 {
     InputType::accessKeyAction(sendMouseEvents);
diff --git a/Source/WebCore/html/TextFieldInputType.cpp b/Source/WebCore/html/TextFieldInputType.cpp
index d56f47d4e..a149b6957 100644
--- a/Source/WebCore/html/TextFieldInputType.cpp
+++ b/Source/WebCore/html/TextFieldInputType.cpp
@@ -43,7 +43,7 @@
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "TextControlInnerElements.h"
 #include "TextEvent.h"
 #include "TextIterator.h"
@@ -226,11 +226,11 @@ void TextFieldInputType::createShadowSubtree()
     ExceptionCode ec = 0;
     m_innerText = TextControlInnerTextElement::create(document);
     if (!createsContainer) {
-        element()->shadowRootList()->oldestShadowRoot()->appendChild(m_innerText, ec);
+        element()->shadowTree()->oldestShadowRoot()->appendChild(m_innerText, ec);
         return;
     }
 
-    ShadowRoot* shadowRoot = element()->shadowRootList()->oldestShadowRoot();
+    ShadowRoot* shadowRoot = element()->shadowTree()->oldestShadowRoot();
     m_container = HTMLDivElement::create(document);
     m_container->setShadowPseudoId("-webkit-textfield-decoration-container");
     shadowRoot->appendChild(m_container, ec);
@@ -392,7 +392,7 @@ void TextFieldInputType::updatePlaceholderText()
     if (!m_placeholder) {
         m_placeholder = HTMLDivElement::create(element()->document());
         m_placeholder->setShadowPseudoId("-webkit-input-placeholder");
-        element()->shadowRootList()->oldestShadowRoot()->insertBefore(m_placeholder, m_container ? m_container->nextSibling() : innerTextElement()->nextSibling(), ec);
+        element()->shadowTree()->oldestShadowRoot()->insertBefore(m_placeholder, m_container ? m_container->nextSibling() : innerTextElement()->nextSibling(), ec);
         ASSERT(!ec);
     }
     m_placeholder->setInnerText(placeholderText, ec);
diff --git a/Source/WebCore/html/ValidationMessage.cpp b/Source/WebCore/html/ValidationMessage.cpp
index 7653951b0..9700f844e 100644
--- a/Source/WebCore/html/ValidationMessage.cpp
+++ b/Source/WebCore/html/ValidationMessage.cpp
@@ -44,7 +44,7 @@
 #include "RenderObject.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "Text.h"
 #include <wtf/PassOwnPtr.h>
 
@@ -187,7 +187,7 @@ void ValidationMessage::deleteBubbleTree(Timer<ValidationMessage>*)
         m_messageBody = 0;
         HTMLElement* host = toHTMLElement(m_element);
         ExceptionCode ec;
-        host->shadowRootList()->oldestShadowRoot()->removeChild(m_bubble.get(), ec);
+        host->shadowTree()->oldestShadowRoot()->removeChild(m_bubble.get(), ec);
         m_bubble = 0;
     }
     m_message = String();
diff --git a/Source/WebCore/html/canvas/ArrayBuffer.idl b/Source/WebCore/html/canvas/ArrayBuffer.idl
index a631b138c..26dd341bb 100644
--- a/Source/WebCore/html/canvas/ArrayBuffer.idl
+++ b/Source/WebCore/html/canvas/ArrayBuffer.idl
@@ -28,6 +28,7 @@ module html {
     interface [
         JSGenerateIsReachable=Impl,
         CustomConstructor,
+        ConstructorParameters=1,
         JSNoStaticTables
     ] ArrayBuffer {
         readonly attribute int byteLength;
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index 0d195ac50..279b2a1c3 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -1365,7 +1365,7 @@ void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* sourceCanvas, const
         c->drawImageBuffer(buffer, ColorSpaceDeviceRGB, dstRect, bufferSrcRect, state().m_globalComposite);
         didDrawEntireCanvas();
     } else if (isFullCanvasCompositeMode(state().m_globalComposite)) {
-        fullCanvasCompositedDrawImage(buffer, ColorSpaceDeviceRGB, bufferSrcRect, srcRect, state().m_globalComposite);
+        fullCanvasCompositedDrawImage(buffer, ColorSpaceDeviceRGB, dstRect, bufferSrcRect, state().m_globalComposite);
         didDrawEntireCanvas();
     } else if (state().m_globalComposite == CompositeCopy) {
         clearCanvas();
@@ -1521,7 +1521,7 @@ template<class T> IntRect CanvasRenderingContext2D::calculateCompositingBufferRe
 PassOwnPtr<ImageBuffer> CanvasRenderingContext2D::createCompositingBuffer(const IntRect& bufferRect)
 {
     RenderingMode renderMode = isAccelerated() ? Accelerated : Unaccelerated;
-    return ImageBuffer::create(bufferRect.size(), ColorSpaceDeviceRGB, renderMode);
+    return ImageBuffer::create(bufferRect.size(), 1, ColorSpaceDeviceRGB, renderMode);
 }
 
 void CanvasRenderingContext2D::compositeBuffer(ImageBuffer* buffer, const IntRect& bufferRect, CompositeOperator op)
@@ -1883,7 +1883,7 @@ void CanvasRenderingContext2D::putImageData(ImageData* data, float dx, float dy,
     IntSize destOffset(static_cast<int>(dx), static_cast<int>(dy));
     IntRect destRect = enclosingIntRect(clipRect);
     destRect.move(destOffset);
-    destRect.intersect(IntRect(IntPoint(), buffer->size()));
+    destRect.intersect(IntRect(IntPoint(), buffer->internalSize()));
     if (destRect.isEmpty())
         return;
     IntRect sourceRect(destRect);
@@ -2028,7 +2028,7 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
     RenderStyle* computedStyle = canvas()->computedStyle();
     TextDirection direction = computedStyle ? computedStyle->direction() : LTR;
     bool isRTL = direction == RTL;
-    bool override = computedStyle ? computedStyle->unicodeBidi() == Override : false;
+    bool override = computedStyle ? isOverride(computedStyle->unicodeBidi()) : false;
 
     unsigned length = text.length();
     const UChar* string = text.characters();
@@ -2089,9 +2089,9 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
         IntRect maskRect = enclosingIntRect(textRect);
 
 #if USE(IOSURFACE_CANVAS_BACKING_STORE)
-        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), ColorSpaceDeviceRGB, Accelerated);
+        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), 1, ColorSpaceDeviceRGB, Accelerated);
 #else
-        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size());
+        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), 1);
 #endif
 
         GraphicsContext* maskImageContext = maskImage->context();
diff --git a/Source/WebCore/html/canvas/CanvasStyle.cpp b/Source/WebCore/html/canvas/CanvasStyle.cpp
index 3ed1fee58..26e310ecd 100644
--- a/Source/WebCore/html/canvas/CanvasStyle.cpp
+++ b/Source/WebCore/html/canvas/CanvasStyle.cpp
@@ -69,7 +69,7 @@ RGBA32 currentColor(HTMLCanvasElement* canvas)
     if (!canvas || !canvas->inDocument())
         return Color::black;
     RGBA32 rgba = Color::black;
-    CSSParser::parseColor(rgba, canvas->ensureInlineStyleDecl()->getPropertyValue(CSSPropertyColor));
+    CSSParser::parseColor(rgba, canvas->ensureInlineStyle()->getPropertyValue(CSSPropertyColor));
     return rgba;
 }
 
diff --git a/Source/WebCore/html/canvas/DOMWindowWebGL.idl b/Source/WebCore/html/canvas/DOMWindowWebGL.idl
deleted file mode 100644
index 92056d3da..000000000
--- a/Source/WebCore/html/canvas/DOMWindowWebGL.idl
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-module window {
-
-    interface [
-        Conditional=WEBGL,
-        Supplemental=DOMWindow
-    ] DOMWindowWebGL {
-        attribute WebGLActiveInfoConstructor WebGLActiveInfo;
-        attribute WebGLBufferConstructor WebGLBuffer;
-        attribute WebGLFramebufferConstructor WebGLFramebuffer;
-        attribute WebGLProgramConstructor WebGLProgram;
-        attribute WebGLRenderbufferConstructor WebGLRenderbuffer;
-        attribute WebGLRenderingContextConstructor WebGLRenderingContext;
-        attribute WebGLShaderConstructor WebGLShader;
-        attribute WebGLTextureConstructor WebGLTexture;
-        attribute WebGLUniformLocationConstructor WebGLUniformLocation;
-    };
-
-}
diff --git a/Source/WebCore/html/canvas/DataView.idl b/Source/WebCore/html/canvas/DataView.idl
index 27bad0e47..3f4dcdf4d 100755
--- a/Source/WebCore/html/canvas/DataView.idl
+++ b/Source/WebCore/html/canvas/DataView.idl
@@ -27,6 +27,7 @@ module html {
 
     interface [
         CustomConstructor,
+        ConstructorParameters=3,
         CustomToJSObject,
         JSNoStaticTables
     ] DataView : ArrayBufferView {
diff --git a/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.cpp b/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.cpp
new file mode 100644
index 000000000..26538e94e
--- /dev/null
+++ b/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEBGL)
+
+#include "EXTTextureFilterAnisotropic.h"
+
+namespace WebCore {
+
+EXTTextureFilterAnisotropic::EXTTextureFilterAnisotropic(WebGLRenderingContext* context)
+    : WebGLExtension(context)
+{
+}
+
+EXTTextureFilterAnisotropic::~EXTTextureFilterAnisotropic()
+{
+}
+
+WebGLExtension::ExtensionName EXTTextureFilterAnisotropic::getName() const
+{
+    return EXTTextureFilterAnisotropicName;
+}
+
+PassOwnPtr<EXTTextureFilterAnisotropic> EXTTextureFilterAnisotropic::create(WebGLRenderingContext* context)
+{
+    return adoptPtr(new EXTTextureFilterAnisotropic(context));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.h b/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.h
new file mode 100644
index 000000000..bf0d37c9c
--- /dev/null
+++ b/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef EXTTextureFilterAnisotropic_h
+#define EXTTextureFilterAnisotropic_h
+
+#include "WebGLExtension.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class EXTTextureFilterAnisotropic : public WebGLExtension {
+public:
+    static PassOwnPtr<EXTTextureFilterAnisotropic> create(WebGLRenderingContext*);
+
+    virtual ~EXTTextureFilterAnisotropic();
+    virtual ExtensionName getName() const;
+
+private:
+    EXTTextureFilterAnisotropic(WebGLRenderingContext*);
+};
+
+} // namespace WebCore
+
+#endif // EXTTextureFilterAnisotropic_h
diff --git a/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.idl b/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.idl
new file mode 100644
index 000000000..568aa9a3d
--- /dev/null
+++ b/Source/WebCore/html/canvas/EXTTextureFilterAnisotropic.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+    interface [
+        Conditional=WEBGL,
+        JSGenerateIsReachable=ImplContext,
+        OmitConstructor,
+        DoNotCheckConstants
+    ] EXTTextureFilterAnisotropic {
+        const unsigned int TEXTURE_MAX_ANISOTROPY_EXT = 0x84FE;
+        const unsigned int MAX_TEXTURE_MAX_ANISOTROPY_EXT = 0x84FF;
+    };
+}
diff --git a/Source/WebCore/html/canvas/Float32Array.idl b/Source/WebCore/html/canvas/Float32Array.idl
index 5e619a7ea..55491b11b 100644
--- a/Source/WebCore/html/canvas/Float32Array.idl
+++ b/Source/WebCore/html/canvas/Float32Array.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/Float64Array.idl b/Source/WebCore/html/canvas/Float64Array.idl
index f4c448a45..e9d7ef01a 100644
--- a/Source/WebCore/html/canvas/Float64Array.idl
+++ b/Source/WebCore/html/canvas/Float64Array.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/Int16Array.idl b/Source/WebCore/html/canvas/Int16Array.idl
index b7ddc1e7c..8616846f9 100644
--- a/Source/WebCore/html/canvas/Int16Array.idl
+++ b/Source/WebCore/html/canvas/Int16Array.idl
@@ -26,6 +26,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/Int32Array.idl b/Source/WebCore/html/canvas/Int32Array.idl
index 950437aec..3f928fe7d 100644
--- a/Source/WebCore/html/canvas/Int32Array.idl
+++ b/Source/WebCore/html/canvas/Int32Array.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/Int8Array.idl b/Source/WebCore/html/canvas/Int8Array.idl
index da0c8f166..0d4fb8272 100644
--- a/Source/WebCore/html/canvas/Int8Array.idl
+++ b/Source/WebCore/html/canvas/Int8Array.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/Uint16Array.idl b/Source/WebCore/html/canvas/Uint16Array.idl
index 33627bfce..72fa9b3ed 100644
--- a/Source/WebCore/html/canvas/Uint16Array.idl
+++ b/Source/WebCore/html/canvas/Uint16Array.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/Uint32Array.idl b/Source/WebCore/html/canvas/Uint32Array.idl
index 7bb4ca39b..b56c0e53d 100644
--- a/Source/WebCore/html/canvas/Uint32Array.idl
+++ b/Source/WebCore/html/canvas/Uint32Array.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/Uint8Array.idl b/Source/WebCore/html/canvas/Uint8Array.idl
index fbbafc320..3e4141ca6 100644
--- a/Source/WebCore/html/canvas/Uint8Array.idl
+++ b/Source/WebCore/html/canvas/Uint8Array.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/Uint8ClampedArray.idl b/Source/WebCore/html/canvas/Uint8ClampedArray.idl
index fd006e455..6c3587a30 100644
--- a/Source/WebCore/html/canvas/Uint8ClampedArray.idl
+++ b/Source/WebCore/html/canvas/Uint8ClampedArray.idl
@@ -27,6 +27,7 @@
 module html {
     interface [
         CustomConstructor,
+        ConstructorParameters=1,
         NumericIndexedGetter,
         CustomIndexedSetter,
         JSGenerateToNativeObject,
diff --git a/Source/WebCore/html/canvas/WebGLExtension.h b/Source/WebCore/html/canvas/WebGLExtension.h
index ff482facd..a4d397029 100644
--- a/Source/WebCore/html/canvas/WebGLExtension.h
+++ b/Source/WebCore/html/canvas/WebGLExtension.h
@@ -35,6 +35,7 @@ public:
     // Extension names are needed to properly wrap instances in JavaScript objects.
     enum ExtensionName {
         WebKitWebGLLoseContextName, // WEBKIT_ prefix until extension is official
+        EXTTextureFilterAnisotropicName,
         OESTextureFloatName,
         OESStandardDerivativesName,
         OESVertexArrayObjectName,
diff --git a/Source/WebCore/html/canvas/WebGLObject.cpp b/Source/WebCore/html/canvas/WebGLObject.cpp
index 6d7b9d8cf..c71806dae 100644
--- a/Source/WebCore/html/canvas/WebGLObject.cpp
+++ b/Source/WebCore/html/canvas/WebGLObject.cpp
@@ -29,6 +29,7 @@
 
 #include "WebGLObject.h"
 
+#include "EXTTextureFilterAnisotropic.h"
 #include "OESStandardDerivatives.h"
 #include "OESTextureFloat.h"
 #include "OESVertexArrayObject.h"
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
index cfb6505a9..4ded9781d 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -34,6 +34,7 @@
 #include "CheckedInt.h"
 #include "Console.h"
 #include "DOMWindow.h"
+#include "EXTTextureFilterAnisotropic.h"
 #include "ExceptionCode.h"
 #include "Extensions3D.h"
 #include "Frame.h"
@@ -82,6 +83,7 @@
 namespace WebCore {
 
 const double secondsBetweenRestoreAttempts = 1.0;
+const int maxGLErrorsAllowedToConsole = 10;
 
 namespace {
 
@@ -378,7 +380,7 @@ private:
 class WebGLRenderingContextErrorMessageCallback : public GraphicsContext3D::ErrorMessageCallback {
 public:
     explicit WebGLRenderingContextErrorMessageCallback(WebGLRenderingContext* cb) : m_context(cb) { }
-    virtual void onErrorMessage(const String& message, GC3Dint) { m_context->printWarningToConsole(message); }
+    virtual void onErrorMessage(const String& message, GC3Dint) { m_context->printGLErrorToConsole(message); }
     virtual ~WebGLRenderingContextErrorMessageCallback() { }
 private:
     WebGLRenderingContext* m_context;
@@ -401,6 +403,7 @@ PassOwnPtr<WebGLRenderingContext> WebGLRenderingContext::create(HTMLCanvasElemen
 #else
     attributes.shareResources = false;
 #endif
+    attributes.preferDiscreteGPU = true;
 
 
     RefPtr<GraphicsContext3D> context(GraphicsContext3D::create(attributes, hostWindow));
@@ -426,6 +429,7 @@ WebGLRenderingContext::WebGLRenderingContext(HTMLCanvasElement* passedCanvas, Pa
     , m_contextLostMode(SyntheticLostContext)
     , m_attributes(attributes)
     , m_synthesizedErrorsToConsole(false)
+    , m_numGLErrorsToConsoleAllowed(maxGLErrorsAllowedToConsole)
 {
     ASSERT(m_context);
     m_contextGroup = WebGLContextGroup::create();
@@ -466,6 +470,7 @@ void WebGLRenderingContext::initializeNewContext()
     m_stencilFuncMask = 0xFFFFFFFF;
     m_stencilFuncMaskBack = 0xFFFFFFFF;
     m_layerCleared = false;
+    m_numGLErrorsToConsoleAllowed = maxGLErrorsAllowedToConsole;
     
     m_clearColor[0] = m_clearColor[1] = m_clearColor[2] = m_clearColor[3] = 0;
     m_scissorEnabled = false;
@@ -2208,6 +2213,14 @@ WebGLExtension* WebGLRenderingContext::getExtension(const String& name)
     if (isContextLost())
         return 0;
 
+    if (equalIgnoringCase(name, "WEBKIT_EXT_texture_filter_anisotropic")
+        && m_context->getExtensions()->supports("GL_EXT_texture_filter_anisotropic")) {
+        if (!m_extTextureFilterAnisotropic) {
+            m_context->getExtensions()->ensureEnabled("GL_EXT_texture_filter_anisotropic");
+            m_extTextureFilterAnisotropic = EXTTextureFilterAnisotropic::create(this);
+        }
+        return m_extTextureFilterAnisotropic.get();
+    }
     if (equalIgnoringCase(name, "OES_standard_derivatives")
         && m_context->getExtensions()->supports("GL_OES_standard_derivatives")) {
         if (!m_oesStandardDerivatives) {
@@ -2519,6 +2532,11 @@ WebGLGetInfo WebGLRenderingContext::getParameter(GC3Denum pname, ExceptionCode&
         }
         synthesizeGLError(GraphicsContext3D::INVALID_ENUM, "getParameter", "invalid parameter name, OES_vertex_array_object not enabled");
         return WebGLGetInfo();
+    case Extensions3D::MAX_TEXTURE_MAX_ANISOTROPY_EXT: // EXT_texture_filter_anisotropic
+        if (m_extTextureFilterAnisotropic)
+            return getUnsignedIntParameter(Extensions3D::MAX_TEXTURE_MAX_ANISOTROPY_EXT);
+        synthesizeGLError(GraphicsContext3D::INVALID_ENUM, "getParameter", "invalid parameter name, EXT_texture_filter_anisotropic not enabled");
+        return WebGLGetInfo();
     default:
         synthesizeGLError(GraphicsContext3D::INVALID_ENUM, "getParameter", "invalid parameter name");
         return WebGLGetInfo();
@@ -2680,6 +2698,8 @@ Vector<String> WebGLRenderingContext::getSupportedExtensions()
         result.append("OES_texture_float");
     if (m_context->getExtensions()->supports("GL_OES_standard_derivatives"))
         result.append("OES_standard_derivatives");
+    if (m_context->getExtensions()->supports("GL_EXT_texture_filter_anisotropic"))
+        result.append("WEBKIT_EXT_texture_filter_anisotropic");
     if (m_context->getExtensions()->supports("GL_OES_vertex_array_object"))
         result.append("OES_vertex_array_object");
     result.append("WEBKIT_WEBGL_lose_context");
@@ -2712,6 +2732,13 @@ WebGLGetInfo WebGLRenderingContext::getTexParameter(GC3Denum target, GC3Denum pn
     case GraphicsContext3D::TEXTURE_WRAP_T:
         m_context->getTexParameteriv(target, pname, &value);
         return WebGLGetInfo(static_cast<unsigned int>(value));
+    case Extensions3D::TEXTURE_MAX_ANISOTROPY_EXT: // EXT_texture_filter_anisotropic
+        if (m_extTextureFilterAnisotropic) {
+            m_context->getTexParameteriv(target, pname, &value);
+            return WebGLGetInfo(static_cast<unsigned int>(value));
+        }
+        synthesizeGLError(GraphicsContext3D::INVALID_ENUM, "getTexParameter", "invalid parameter name, EXT_texture_filter_anisotropic not enabled");
+        return WebGLGetInfo();
     default:
         synthesizeGLError(GraphicsContext3D::INVALID_ENUM, "getTexParameter", "invalid parameter name");
         return WebGLGetInfo();
@@ -3535,6 +3562,12 @@ void WebGLRenderingContext::texParameter(GC3Denum target, GC3Denum pname, GC3Dfl
             return;
         }
         break;
+    case Extensions3D::TEXTURE_MAX_ANISOTROPY_EXT: // EXT_texture_filter_anisotropic
+        if (!m_extTextureFilterAnisotropic) {
+            synthesizeGLError(GraphicsContext3D::INVALID_ENUM, "texParameter", "invalid parameter, EXT_texture_filter_anisotropic not enabled");
+            return;
+        }
+        break;
     default:
         synthesizeGLError(GraphicsContext3D::INVALID_ENUM, "texParameter", "invalid parameter name");
         return;
@@ -3716,7 +3749,7 @@ void WebGLRenderingContext::uniform1fv(const WebGLUniformLocation* location, Flo
     if (isContextLost() || !validateUniformParameters("uniform1fv", location, v, 1))
         return;
 
-    m_context->uniform1fv(location->location(), v->data(), v->length());
+    m_context->uniform1fv(location->location(), v->length(), v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3726,7 +3759,7 @@ void WebGLRenderingContext::uniform1fv(const WebGLUniformLocation* location, GC3
     if (isContextLost() || !validateUniformParameters("uniform1fv", location, v, size, 1))
         return;
 
-    m_context->uniform1fv(location->location(), v, size);
+    m_context->uniform1fv(location->location(), size, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3751,7 +3784,7 @@ void WebGLRenderingContext::uniform1iv(const WebGLUniformLocation* location, Int
     if (isContextLost() || !validateUniformParameters("uniform1iv", location, v, 1))
         return;
 
-    m_context->uniform1iv(location->location(), v->data(), v->length());
+    m_context->uniform1iv(location->location(), v->length(), v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3761,7 +3794,7 @@ void WebGLRenderingContext::uniform1iv(const WebGLUniformLocation* location, GC3
     if (isContextLost() || !validateUniformParameters("uniform1iv", location, v, size, 1))
         return;
 
-    m_context->uniform1iv(location->location(), v, size);
+    m_context->uniform1iv(location->location(), size, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3786,7 +3819,7 @@ void WebGLRenderingContext::uniform2fv(const WebGLUniformLocation* location, Flo
     if (isContextLost() || !validateUniformParameters("uniform2fv", location, v, 2))
         return;
 
-    m_context->uniform2fv(location->location(), v->data(), v->length() / 2);
+    m_context->uniform2fv(location->location(), v->length() / 2, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3796,7 +3829,7 @@ void WebGLRenderingContext::uniform2fv(const WebGLUniformLocation* location, GC3
     if (isContextLost() || !validateUniformParameters("uniform2fv", location, v, size, 2))
         return;
 
-    m_context->uniform2fv(location->location(), v, size / 2);
+    m_context->uniform2fv(location->location(), size / 2, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3821,7 +3854,7 @@ void WebGLRenderingContext::uniform2iv(const WebGLUniformLocation* location, Int
     if (isContextLost() || !validateUniformParameters("uniform2iv", location, v, 2))
         return;
 
-    m_context->uniform2iv(location->location(), v->data(), v->length() / 2);
+    m_context->uniform2iv(location->location(), v->length() / 2, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3831,7 +3864,7 @@ void WebGLRenderingContext::uniform2iv(const WebGLUniformLocation* location, GC3
     if (isContextLost() || !validateUniformParameters("uniform2iv", location, v, size, 2))
         return;
 
-    m_context->uniform2iv(location->location(), v, size / 2);
+    m_context->uniform2iv(location->location(), size / 2, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3856,7 +3889,7 @@ void WebGLRenderingContext::uniform3fv(const WebGLUniformLocation* location, Flo
     if (isContextLost() || !validateUniformParameters("uniform3fv", location, v, 3))
         return;
 
-    m_context->uniform3fv(location->location(), v->data(), v->length() / 3);
+    m_context->uniform3fv(location->location(), v->length() / 3, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3866,7 +3899,7 @@ void WebGLRenderingContext::uniform3fv(const WebGLUniformLocation* location, GC3
     if (isContextLost() || !validateUniformParameters("uniform3fv", location, v, size, 3))
         return;
 
-    m_context->uniform3fv(location->location(), v, size / 3);
+    m_context->uniform3fv(location->location(), size / 3, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3891,7 +3924,7 @@ void WebGLRenderingContext::uniform3iv(const WebGLUniformLocation* location, Int
     if (isContextLost() || !validateUniformParameters("uniform3iv", location, v, 3))
         return;
 
-    m_context->uniform3iv(location->location(), v->data(), v->length() / 3);
+    m_context->uniform3iv(location->location(), v->length() / 3, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3901,7 +3934,7 @@ void WebGLRenderingContext::uniform3iv(const WebGLUniformLocation* location, GC3
     if (isContextLost() || !validateUniformParameters("uniform3iv", location, v, size, 3))
         return;
 
-    m_context->uniform3iv(location->location(), v, size / 3);
+    m_context->uniform3iv(location->location(), size / 3, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3926,7 +3959,7 @@ void WebGLRenderingContext::uniform4fv(const WebGLUniformLocation* location, Flo
     if (isContextLost() || !validateUniformParameters("uniform4fv", location, v, 4))
         return;
 
-    m_context->uniform4fv(location->location(), v->data(), v->length() / 4);
+    m_context->uniform4fv(location->location(), v->length() / 4, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3936,7 +3969,7 @@ void WebGLRenderingContext::uniform4fv(const WebGLUniformLocation* location, GC3
     if (isContextLost() || !validateUniformParameters("uniform4fv", location, v, size, 4))
         return;
 
-    m_context->uniform4fv(location->location(), v, size / 4);
+    m_context->uniform4fv(location->location(), size / 4, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3961,7 +3994,7 @@ void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, Int
     if (isContextLost() || !validateUniformParameters("uniform4iv", location, v, 4))
         return;
 
-    m_context->uniform4iv(location->location(), v->data(), v->length() / 4);
+    m_context->uniform4iv(location->location(), v->length() / 4, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3971,7 +4004,7 @@ void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, GC3
     if (isContextLost() || !validateUniformParameters("uniform4iv", location, v, size, 4))
         return;
 
-    m_context->uniform4iv(location->location(), v, size / 4);
+    m_context->uniform4iv(location->location(), size / 4, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3980,7 +4013,7 @@ void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* locatio
     UNUSED_PARAM(ec);
     if (isContextLost() || !validateUniformMatrixParameters("uniformMatrix2fv", location, transpose, v, 4))
         return;
-    m_context->uniformMatrix2fv(location->location(), transpose, v->data(), v->length() / 4);
+    m_context->uniformMatrix2fv(location->location(), v->length() / 4, transpose, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3989,7 +4022,7 @@ void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* locatio
     UNUSED_PARAM(ec);
     if (isContextLost() || !validateUniformMatrixParameters("uniformMatrix2fv", location, transpose, v, size, 4))
         return;
-    m_context->uniformMatrix2fv(location->location(), transpose, v, size / 4);
+    m_context->uniformMatrix2fv(location->location(), size / 4, transpose, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3998,7 +4031,7 @@ void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* locatio
     UNUSED_PARAM(ec);
     if (isContextLost() || !validateUniformMatrixParameters("uniformMatrix3fv", location, transpose, v, 9))
         return;
-    m_context->uniformMatrix3fv(location->location(), transpose, v->data(), v->length() / 9);
+    m_context->uniformMatrix3fv(location->location(), v->length() / 9, transpose, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -4007,7 +4040,7 @@ void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* locatio
     UNUSED_PARAM(ec);
     if (isContextLost() || !validateUniformMatrixParameters("uniformMatrix3fv", location, transpose, v, size, 9))
         return;
-    m_context->uniformMatrix3fv(location->location(), transpose, v, size / 9);
+    m_context->uniformMatrix3fv(location->location(), size / 9, transpose, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -4016,7 +4049,7 @@ void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* locatio
     UNUSED_PARAM(ec);
     if (isContextLost() || !validateUniformMatrixParameters("uniformMatrix4fv", location, transpose, v, 16))
         return;
-    m_context->uniformMatrix4fv(location->location(), transpose, v->data(), v->length() / 16);
+    m_context->uniformMatrix4fv(location->location(), v->length() / 16, transpose, v->data());
     cleanupAfterGraphicsCall(false);
 }
 
@@ -4025,7 +4058,7 @@ void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* locatio
     UNUSED_PARAM(ec);
     if (isContextLost() || !validateUniformMatrixParameters("uniformMatrix4fv", location, transpose, v, size, 16))
         return;
-    m_context->uniformMatrix4fv(location->location(), transpose, v, size / 16);
+    m_context->uniformMatrix4fv(location->location(), size / 16, transpose, v);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -4883,6 +4916,18 @@ bool WebGLRenderingContext::validateStencilFunc(const char* functionName, GC3Den
     }
 }
 
+void WebGLRenderingContext::printGLErrorToConsole(const String& message)
+{
+    if (!m_numGLErrorsToConsoleAllowed)
+        return;
+
+    --m_numGLErrorsToConsoleAllowed;
+    printWarningToConsole(message);
+
+    if (!m_numGLErrorsToConsoleAllowed)
+        printWarningToConsole("WebGL: too many errors, no more errors will be reported to the console for this context.");
+}
+
 void WebGLRenderingContext::printWarningToConsole(const String& message)
 {
     if (!canvas())
@@ -5315,13 +5360,13 @@ ImageBuffer* WebGLRenderingContext::LRUImageBufferCache::imageBuffer(const IntSi
         ImageBuffer* buf = m_buffers[i].get();
         if (!buf)
             break;
-        if (buf->size() != size)
+        if (buf->logicalSize() != size)
             continue;
         bubbleToFront(i);
         return buf;
     }
 
-    OwnPtr<ImageBuffer> temp = ImageBuffer::create(size);
+    OwnPtr<ImageBuffer> temp = ImageBuffer::create(size, 1);
     if (!temp)
         return 0;
     i = std::min(m_capacity - 1, i);
@@ -5366,7 +5411,7 @@ void WebGLRenderingContext::synthesizeGLError(GC3Denum error, const char* functi
 {
     if (m_synthesizedErrorsToConsole) {
       String str = String("WebGL: ") + GetErrorString(error) +  ": " + String(functionName) + ": " + String(description);
-      printWarningToConsole(str);
+      printGLErrorToConsole(str);
     }
     m_context->synthesizeGLError(error);
 }
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.h b/Source/WebCore/html/canvas/WebGLRenderingContext.h
index be9c8cf3c..4ebd60b6e 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.h
@@ -40,6 +40,7 @@
 
 namespace WebCore {
 
+class EXTTextureFilterAnisotropic;
 class HTMLImageElement;
 class HTMLVideoElement;
 class ImageBuffer;
@@ -496,8 +497,10 @@ public:
     bool m_isDepthStencilSupported;
 
     bool m_synthesizedErrorsToConsole;
+    int m_numGLErrorsToConsoleAllowed;
 
     // Enabled extension objects.
+    OwnPtr<EXTTextureFilterAnisotropic> m_extTextureFilterAnisotropic;
     OwnPtr<OESTextureFloat> m_oesTextureFloat;
     OwnPtr<OESStandardDerivatives> m_oesStandardDerivatives;
     OwnPtr<OESVertexArrayObject> m_oesVertexArrayObject;
@@ -622,6 +625,9 @@ public:
     // Helper function for texParameterf and texParameteri.
     void texParameter(GC3Denum target, GC3Denum pname, GC3Dfloat parami, GC3Dint paramf, bool isFloat);
 
+    // Helper function to print GL errors to console.
+    void printGLErrorToConsole(const String&);
+
     // Helper function to print warnings to console. Currently
     // used only to warn about use of obsolete functions.
     void printWarningToConsole(const String&);
diff --git a/Source/WebCore/html/parser/HTMLConstructionSite.cpp b/Source/WebCore/html/parser/HTMLConstructionSite.cpp
index e551c2ff5..9fa5d3760 100644
--- a/Source/WebCore/html/parser/HTMLConstructionSite.cpp
+++ b/Source/WebCore/html/parser/HTMLConstructionSite.cpp
@@ -194,7 +194,7 @@ void HTMLConstructionSite::dispatchDocumentElementAvailableIfNeeded()
 void HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML(AtomicHTMLToken& token)
 {
     RefPtr<HTMLHtmlElement> element = HTMLHtmlElement::create(m_document);
-    element->parserSetAttributeMap(token.takeAttributes(), m_fragmentScriptingPermission);
+    element->parserSetAttributes(token.takeAttributes(), m_fragmentScriptingPermission);
     attachLater(m_attachmentRoot, element);
     m_openElements.pushHTMLHtmlElement(element);
 
@@ -208,8 +208,8 @@ void HTMLConstructionSite::mergeAttributesFromTokenIntoElement(AtomicHTMLToken&
     if (!token.attributes())
         return;
 
-    NamedNodeMap* attributes = element->ensureUpdatedAttributes();
-    for (unsigned i = 0; i < token.attributes()->length(); ++i) {
+    ElementAttributeData* attributes = element->ensureAttributeData();
+    for (unsigned i = 0; i < token.attributes()->size(); ++i) {
         Attribute* attribute = token.attributes()->attributeItem(i);
         if (!attributes->getAttributeItem(attribute->name()))
             element->setAttribute(attribute->name(), attribute->value());
@@ -336,7 +336,7 @@ void HTMLConstructionSite::insertScriptElement(AtomicHTMLToken& token)
 {
     RefPtr<HTMLScriptElement> element = HTMLScriptElement::create(scriptTag, currentNode()->document(), true);
     if (m_fragmentScriptingPermission == FragmentScriptingAllowed)
-        element->parserSetAttributeMap(token.takeAttributes(), m_fragmentScriptingPermission);
+        element->parserSetAttributes(token.takeAttributes(), m_fragmentScriptingPermission);
     attachLater(currentNode(), element);
     m_openElements.push(element.release());
 }
@@ -399,7 +399,7 @@ PassRefPtr<Element> HTMLConstructionSite::createElement(AtomicHTMLToken& token,
 {
     QualifiedName tagName(nullAtom, token.name(), namespaceURI);
     RefPtr<Element> element = currentNode()->document()->createElement(tagName, true);
-    element->parserSetAttributeMap(token.takeAttributes(), m_fragmentScriptingPermission);
+    element->parserSetAttributes(token.takeAttributes(), m_fragmentScriptingPermission);
     return element.release();
 }
 
@@ -410,7 +410,7 @@ PassRefPtr<Element> HTMLConstructionSite::createHTMLElement(AtomicHTMLToken& tok
     // have to pass the current form element.  We should rework form association
     // to occur after construction to allow better code sharing here.
     RefPtr<Element> element = HTMLElementFactory::createHTMLElement(tagName, currentNode()->document(), form(), true);
-    element->parserSetAttributeMap(token.takeAttributes(), m_fragmentScriptingPermission);
+    element->parserSetAttributes(token.takeAttributes(), m_fragmentScriptingPermission);
     ASSERT(element->isHTMLElement());
     return element.release();
 }
@@ -423,17 +423,17 @@ PassRefPtr<Element> HTMLConstructionSite::createHTMLElementFromElementRecord(HTM
 namespace {
 
 // FIXME: Move this function to the top of the file.
-inline PassOwnPtr<NamedNodeMap> cloneAttributes(Element* element)
+inline PassOwnPtr<AttributeVector> cloneAttributes(Element* element)
 {
-    NamedNodeMap* attributes = element->updatedAttributes();
+    ElementAttributeData* attributes = element->updatedAttributeData();
     if (!attributes)
         return nullptr;
 
-    OwnPtr<NamedNodeMap> newAttributes = NamedNodeMap::create();
+    OwnPtr<AttributeVector> newAttributes = AttributeVector::create();
     for (size_t i = 0; i < attributes->length(); ++i) {
         Attribute* attribute = attributes->attributeItem(i);
         RefPtr<Attribute> clone = Attribute::create(attribute->name(), attribute->value());
-        newAttributes->addAttribute(clone);
+        newAttributes->append(clone);
     }
     return newAttributes.release();
 }
diff --git a/Source/WebCore/html/parser/HTMLToken.h b/Source/WebCore/html/parser/HTMLToken.h
index c17828434..a391d3409 100644
--- a/Source/WebCore/html/parser/HTMLToken.h
+++ b/Source/WebCore/html/parser/HTMLToken.h
@@ -86,7 +86,7 @@ class AtomicHTMLToken : public AtomicMarkupTokenBase<HTMLToken> {
 public:
     AtomicHTMLToken(HTMLToken& token) : AtomicMarkupTokenBase<HTMLToken>(&token) { }
 
-    AtomicHTMLToken(HTMLTokenTypes::Type type, AtomicString name, PassOwnPtr<NamedNodeMap> attributes = nullptr)
+    AtomicHTMLToken(HTMLTokenTypes::Type type, AtomicString name, PassOwnPtr<AttributeVector> attributes = nullptr)
         : AtomicMarkupTokenBase<HTMLToken>(type, name, attributes)
     {
     }
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
index 3b5414913..797e583d9 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -531,7 +531,7 @@ void HTMLTreeBuilder::processDoctypeToken(AtomicHTMLToken& token)
     parseError(token);
 }
 
-void HTMLTreeBuilder::processFakeStartTag(const QualifiedName& tagName, PassOwnPtr<NamedNodeMap> attributes)
+void HTMLTreeBuilder::processFakeStartTag(const QualifiedName& tagName, PassOwnPtr<AttributeVector> attributes)
 {
     // FIXME: We'll need a fancier conversion than just "localName" for SVG/MathML tags.
     AtomicHTMLToken fakeToken(HTMLTokenTypes::StartTag, tagName.localName(), attributes);
@@ -560,11 +560,11 @@ void HTMLTreeBuilder::processFakePEndTagIfPInButtonScope()
     processEndTag(endP);
 }
 
-PassOwnPtr<NamedNodeMap> HTMLTreeBuilder::attributesForIsindexInput(AtomicHTMLToken& token)
+PassOwnPtr<AttributeVector> HTMLTreeBuilder::attributesForIsindexInput(AtomicHTMLToken& token)
 {
-    OwnPtr<NamedNodeMap> attributes = token.takeAttributes();
+    OwnPtr<AttributeVector> attributes = token.takeAttributes();
     if (!attributes)
-        attributes = NamedNodeMap::create();
+        attributes = AttributeVector::create();
     else {
         attributes->removeAttribute(nameAttr);
         attributes->removeAttribute(actionAttr);
@@ -572,7 +572,7 @@ PassOwnPtr<NamedNodeMap> HTMLTreeBuilder::attributesForIsindexInput(AtomicHTMLTo
     }
 
     RefPtr<Attribute> mappedAttribute = Attribute::create(nameAttr, isindexTag.localName());
-    attributes->insertAttribute(mappedAttribute.release(), false);
+    attributes->insertAttribute(mappedAttribute.release());
     return attributes.release();
 }
 
@@ -679,11 +679,11 @@ void adjustAttributes(AtomicHTMLToken& token)
         mapLoweredLocalNameToName(caseMap, attrs, length);
     }
 
-    NamedNodeMap* attributes = token.attributes();
+    AttributeVector* attributes = token.attributes();
     if (!attributes)
         return;
 
-    for (unsigned x = 0; x < attributes->length(); ++x) {
+    for (unsigned x = 0; x < attributes->size(); ++x) {
         Attribute* attribute = attributes->attributeItem(x);
         const QualifiedName& casedName = caseMap->get(attribute->localName());
         if (!casedName.localName().isNull())
@@ -728,11 +728,11 @@ void adjustForeignAttributes(AtomicHTMLToken& token)
         map->add("xmlns:xlink", QualifiedName("xmlns", "xlink", XMLNSNames::xmlnsNamespaceURI));
     }
 
-    NamedNodeMap* attributes = token.attributes();
+    AttributeVector* attributes = token.attributes();
     if (!attributes)
         return;
 
-    for (unsigned x = 0; x < attributes->length(); ++x) {
+    for (unsigned x = 0; x < attributes->size(); ++x) {
         Attribute* attribute = attributes->attributeItem(x);
         const QualifiedName& name = map->get(attribute->localName());
         if (!name.localName().isNull())
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.h b/Source/WebCore/html/parser/HTMLTreeBuilder.h
index 0183d20ca..35024f888 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.h
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.h
@@ -151,7 +151,7 @@ private:
     void processCharacterBuffer(ExternalCharacterTokenBuffer&);
     inline void processCharacterBufferForInBody(ExternalCharacterTokenBuffer&);
 
-    void processFakeStartTag(const QualifiedName&, PassOwnPtr<NamedNodeMap> attributes = nullptr);
+    void processFakeStartTag(const QualifiedName&, PassOwnPtr<AttributeVector> attributes = nullptr);
     void processFakeEndTag(const QualifiedName&);
     void processFakeCharacters(const String&);
     void processFakePEndTagIfPInButtonScope();
@@ -172,7 +172,7 @@ private:
     inline bool shouldProcessTokenInForeignContent(AtomicHTMLToken&);
     void processTokenInForeignContent(AtomicHTMLToken&);
 
-    PassOwnPtr<NamedNodeMap> attributesForIsindexInput(AtomicHTMLToken&);
+    PassOwnPtr<AttributeVector> attributesForIsindexInput(AtomicHTMLToken&);
 
     HTMLElementStack::ElementRecord* furthestBlockForFormattingElement(Element*);
     void callTheAdoptionAgency(AtomicHTMLToken&);
diff --git a/Source/WebCore/html/parser/TextDocumentParser.cpp b/Source/WebCore/html/parser/TextDocumentParser.cpp
index f4601de6a..3589c3f5f 100644
--- a/Source/WebCore/html/parser/TextDocumentParser.cpp
+++ b/Source/WebCore/html/parser/TextDocumentParser.cpp
@@ -61,8 +61,8 @@ void TextDocumentParser::insertFakePreElement()
     // distrubing the line/column number calculations.
 
     RefPtr<Attribute> styleAttribute = Attribute::create("style", "word-wrap: break-word; white-space: pre-wrap;");
-    OwnPtr<NamedNodeMap> attributes = NamedNodeMap::create();
-    attributes->insertAttribute(styleAttribute.release(), false);
+    OwnPtr<AttributeVector> attributes = AttributeVector::create();
+    attributes->insertAttribute(styleAttribute.release());
     AtomicHTMLToken fakePre(HTMLTokenTypes::StartTag, preTag.localName(), attributes.release());
 
     treeBuilder()->constructTreeFromAtomicToken(fakePre);
diff --git a/Source/WebCore/html/parser/XSSAuditor.cpp b/Source/WebCore/html/parser/XSSAuditor.cpp
index 8fde1a5d7..3812cd9d5 100644
--- a/Source/WebCore/html/parser/XSSAuditor.cpp
+++ b/Source/WebCore/html/parser/XSSAuditor.cpp
@@ -313,16 +313,10 @@ void XSSAuditor::filterEndToken(HTMLToken& token)
 bool XSSAuditor::filterCharacterToken(HTMLToken& token)
 {
     ASSERT(m_scriptTagNestingLevel);
-    TextResourceDecoder* decoder = m_parser->document()->decoder();
-    if (isContainedInRequest(fullyDecodeString(m_cachedSnippet, decoder))) {
-        int start = 0;
-        int end = token.endIndex() - token.startIndex();
-        String snippet = snippetForJavaScript(snippetForRange(token, start, end));
-        if (isContainedInRequest(fullyDecodeString(snippet, decoder))) {
-            token.eraseCharacters();
-            token.appendToCharacter(' '); // Technically, character tokens can't be empty.
-            return true;
-        }
+    if (isContainedInRequest(m_cachedDecodedSnippet) && isContainedInRequest(decodedSnippetForJavaScript(token))) {
+        token.eraseCharacters();
+        token.appendToCharacter(' '); // Technically, character tokens can't be empty.
+        return true;
     }
     return false;
 }
@@ -332,11 +326,12 @@ bool XSSAuditor::filterScriptToken(HTMLToken& token)
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, scriptTag));
 
-    if (eraseAttributeIfInjected(token, srcAttr, blankURL().string(), SrcLikeAttribute))
-        return true;
-
-    m_cachedSnippet = m_parser->sourceForToken(token);
+    m_cachedDecodedSnippet = stripLeadingAndTrailingHTMLSpaces(decodedSnippetForToken(token));
     m_shouldAllowCDATA = m_parser->tokenizer()->shouldAllowCDATA();
+
+    if (isContainedInRequest(decodedSnippetForName(token)))
+        return eraseAttributeIfInjected(token, srcAttr, blankURL().string(), SrcLikeAttribute);
+
     return false;
 }
 
@@ -346,11 +341,11 @@ bool XSSAuditor::filterObjectToken(HTMLToken& token)
     ASSERT(hasName(token, objectTag));
 
     bool didBlockScript = false;
-
-    didBlockScript |= eraseAttributeIfInjected(token, dataAttr, blankURL().string(), SrcLikeAttribute);
-    didBlockScript |= eraseAttributeIfInjected(token, typeAttr);
-    didBlockScript |= eraseAttributeIfInjected(token, classidAttr);
-
+    if (isContainedInRequest(decodedSnippetForName(token))) {
+        didBlockScript |= eraseAttributeIfInjected(token, dataAttr, blankURL().string(), SrcLikeAttribute);
+        didBlockScript |= eraseAttributeIfInjected(token, typeAttr);
+        didBlockScript |= eraseAttributeIfInjected(token, classidAttr);
+    }
     return didBlockScript;
 }
 
@@ -378,11 +373,11 @@ bool XSSAuditor::filterEmbedToken(HTMLToken& token)
     ASSERT(hasName(token, embedTag));
 
     bool didBlockScript = false;
-
-    didBlockScript |= eraseAttributeIfInjected(token, codeAttr, String(), SrcLikeAttribute);
-    didBlockScript |= eraseAttributeIfInjected(token, srcAttr, blankURL().string(), SrcLikeAttribute);
-    didBlockScript |= eraseAttributeIfInjected(token, typeAttr);
-
+    if (isContainedInRequest(decodedSnippetForName(token))) {
+        didBlockScript |= eraseAttributeIfInjected(token, codeAttr, String(), SrcLikeAttribute);
+        didBlockScript |= eraseAttributeIfInjected(token, srcAttr, blankURL().string(), SrcLikeAttribute);
+        didBlockScript |= eraseAttributeIfInjected(token, typeAttr);
+    }
     return didBlockScript;
 }
 
@@ -392,10 +387,10 @@ bool XSSAuditor::filterAppletToken(HTMLToken& token)
     ASSERT(hasName(token, appletTag));
 
     bool didBlockScript = false;
-
-    didBlockScript |= eraseAttributeIfInjected(token, codeAttr, String(), SrcLikeAttribute);
-    didBlockScript |= eraseAttributeIfInjected(token, objectAttr);
-
+    if (isContainedInRequest(decodedSnippetForName(token))) {
+        didBlockScript |= eraseAttributeIfInjected(token, codeAttr, String(), SrcLikeAttribute);
+        didBlockScript |= eraseAttributeIfInjected(token, objectAttr);
+    }
     return didBlockScript;
 }
 
@@ -404,7 +399,10 @@ bool XSSAuditor::filterIframeToken(HTMLToken& token)
     ASSERT(token.type() == HTMLTokenTypes::StartTag);
     ASSERT(hasName(token, iframeTag));
 
-    return eraseAttributeIfInjected(token, srcAttr, String(), SrcLikeAttribute);
+    if (isContainedInRequest(decodedSnippetForName(token)))
+        return eraseAttributeIfInjected(token, srcAttr, String(), SrcLikeAttribute);
+
+    return false;
 }
 
 bool XSSAuditor::filterMetaToken(HTMLToken& token)
@@ -494,11 +492,17 @@ bool XSSAuditor::eraseAttributeIfInjected(HTMLToken& token, const QualifiedName&
     return false;
 }
 
-String XSSAuditor::snippetForRange(const HTMLToken& token, int start, int end)
+String XSSAuditor::decodedSnippetForToken(const HTMLToken& token)
+{
+    String snippet = m_parser->sourceForToken(token);
+    return fullyDecodeString(snippet, m_parser->document()->decoder());
+}
+
+String XSSAuditor::decodedSnippetForName(const HTMLToken& token)
 {
-    // FIXME: There's an extra allocation here that we could save by
-    //        passing the range to the parser.
-    return m_parser->sourceForToken(token).substring(start, end - start);
+    // Grab a fixed number of characters equal to the length of the token's
+    // name plus one (to account for the "<").
+    return decodedSnippetForToken(token).substring(0, token.name().size() + 1);
 }
 
 String XSSAuditor::decodedSnippetForAttribute(const HTMLToken& token, const HTMLToken::Attribute& attribute, AttributeKind treatment)
@@ -509,7 +513,7 @@ String XSSAuditor::decodedSnippetForAttribute(const HTMLToken& token, const HTML
     // FIXME: We should grab one character before the name also.
     int start = attribute.m_nameRange.m_start - token.startIndex();
     int end = attribute.m_valueRange.m_end - token.startIndex();
-    String decodedSnippet = fullyDecodeString(snippetForRange(token, start, end), m_parser->document()->decoder());
+    String decodedSnippet = fullyDecodeString(m_parser->sourceForToken(token).substring(start, end - start), m_parser->document()->decoder());
     decodedSnippet.truncate(kMaximumFragmentLengthTarget);
     if (treatment == SrcLikeAttribute) {
         int slashCount;
@@ -528,31 +532,9 @@ String XSSAuditor::decodedSnippetForAttribute(const HTMLToken& token, const HTML
     return decodedSnippet;
 }
 
-bool XSSAuditor::isContainedInRequest(const String& decodedSnippet)
-{
-    if (decodedSnippet.isEmpty())
-        return false;
-    if (m_decodedURL.find(decodedSnippet, 0, false) != notFound)
-        return true;
-    if (m_decodedHTTPBodySuffixTree && !m_decodedHTTPBodySuffixTree->mightContain(decodedSnippet))
-        return false;
-    return m_decodedHTTPBody.find(decodedSnippet, 0, false) != notFound;
-}
-
-bool XSSAuditor::isSameOriginResource(const String& url)
-{
-    // If the resource is loaded from the same URL as the enclosing page, it's
-    // probably not an XSS attack, so we reduce false positives by allowing the
-    // request. If the resource has a query string, we're more suspicious,
-    // however, because that's pretty rare and the attacker might be able to
-    // trick a server-side script into doing something dangerous with the query
-    // string.
-    KURL resourceURL(m_parser->document()->url(), url);
-    return (m_parser->document()->url().host() == resourceURL.host() && resourceURL.query().isEmpty());
-}
-
-String XSSAuditor::snippetForJavaScript(const String& string)
+String XSSAuditor::decodedSnippetForJavaScript(const HTMLToken& token)
 {
+    String string = m_parser->sourceForToken(token);
     size_t startPosition = 0;
     size_t endPosition = string.length();
     size_t foundPosition = notFound;
@@ -605,7 +587,30 @@ String XSSAuditor::snippetForJavaScript(const String& string)
         }
     }
 
-    return string.substring(startPosition, endPosition - startPosition);
+    return fullyDecodeString(string.substring(startPosition, endPosition - startPosition), m_parser->document()->decoder());
+}
+
+bool XSSAuditor::isContainedInRequest(const String& decodedSnippet)
+{
+    if (decodedSnippet.isEmpty())
+        return false;
+    if (m_decodedURL.find(decodedSnippet, 0, false) != notFound)
+        return true;
+    if (m_decodedHTTPBodySuffixTree && !m_decodedHTTPBodySuffixTree->mightContain(decodedSnippet))
+        return false;
+    return m_decodedHTTPBody.find(decodedSnippet, 0, false) != notFound;
+}
+
+bool XSSAuditor::isSameOriginResource(const String& url)
+{
+    // If the resource is loaded from the same URL as the enclosing page, it's
+    // probably not an XSS attack, so we reduce false positives by allowing the
+    // request. If the resource has a query string, we're more suspicious,
+    // however, because that's pretty rare and the attacker might be able to
+    // trick a server-side script into doing something dangerous with the query
+    // string.
+    KURL resourceURL(m_parser->document()->url(), url);
+    return (m_parser->document()->url().host() == resourceURL.host() && resourceURL.query().isEmpty());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/parser/XSSAuditor.h b/Source/WebCore/html/parser/XSSAuditor.h
index 713cd0b6f..fb5ab67ac 100644
--- a/Source/WebCore/html/parser/XSSAuditor.h
+++ b/Source/WebCore/html/parser/XSSAuditor.h
@@ -72,9 +72,10 @@ private:
     bool eraseDangerousAttributesIfInjected(HTMLToken&);
     bool eraseAttributeIfInjected(HTMLToken&, const QualifiedName&, const String& replacementValue = String(), AttributeKind treatment = NormalAttribute);
 
-    String snippetForRange(const HTMLToken&, int start, int end);
-    String snippetForJavaScript(const String&);
+    String decodedSnippetForToken(const HTMLToken&);
+    String decodedSnippetForName(const HTMLToken&);
     String decodedSnippetForAttribute(const HTMLToken&, const HTMLToken::Attribute&, AttributeKind treatment = NormalAttribute);
+    String decodedSnippetForJavaScript(const HTMLToken&);
 
     bool isContainedInRequest(const String&);
     bool isSameOriginResource(const String& url);
@@ -88,7 +89,7 @@ private:
     OwnPtr<SuffixTree<ASCIICodebook> > m_decodedHTTPBodySuffixTree;
 
     State m_state;
-    String m_cachedSnippet;
+    String m_cachedDecodedSnippet;
     bool m_shouldAllowCDATA;
     unsigned m_scriptTagNestingLevel;
     bool m_notifiedClient;
diff --git a/Source/WebCore/html/shadow/ContentSelectorQuery.cpp b/Source/WebCore/html/shadow/ContentSelectorQuery.cpp
index e346d772a..0424a5fa8 100644
--- a/Source/WebCore/html/shadow/ContentSelectorQuery.cpp
+++ b/Source/WebCore/html/shadow/ContentSelectorQuery.cpp
@@ -29,23 +29,23 @@
 
 #include "CSSParser.h"
 #include "CSSSelectorList.h"
-#include "HTMLContentElement.h"
+#include "InsertionPoint.h"
 
 namespace WebCore {
 
-ContentSelectorQuery::ContentSelectorQuery(const HTMLContentElement* element)
-    : m_contentElement(element)
-    , m_selectorChecker(element->document(), !element->document()->inQuirksMode())
+ContentSelectorQuery::ContentSelectorQuery(const InsertionPoint* insertionPoint)
+    : m_insertionPoint(insertionPoint)
+    , m_selectorChecker(insertionPoint->document(), !insertionPoint->document()->inQuirksMode())
 {
     m_selectorChecker.setCollectingRulesOnly(true);
 
-    if (element->select().isNull() || element->select().isEmpty()) {
+    if (insertionPoint->select().isNull() || insertionPoint->select().isEmpty()) {
         m_isValidSelector = true;
         return;
     }
 
     CSSParser parser(true);
-    parser.parseSelector(element->select(), element->document(), m_selectorList);
+    parser.parseSelector(insertionPoint->select(), insertionPoint->document(), m_selectorList);
 
     m_isValidSelector = ContentSelectorQuery::validateSelectorList();
     if (m_isValidSelector)
@@ -63,9 +63,9 @@ bool ContentSelectorQuery::matches(Node* node) const
     if (!node)
         return false;
 
-    ASSERT(node->parentNode() == m_contentElement->shadowTreeRootNode()->shadowHost());
+    ASSERT(node->parentNode() == m_insertionPoint->shadowTreeRootNode()->shadowHost());
 
-    if (m_contentElement->select().isNull() || m_contentElement->select().isEmpty())
+    if (m_insertionPoint->select().isNull() || m_insertionPoint->select().isEmpty())
         return true;
 
     if (!m_isValidSelector)
diff --git a/Source/WebCore/html/shadow/ContentSelectorQuery.h b/Source/WebCore/html/shadow/ContentSelectorQuery.h
index 527aa4905..94fa3efcc 100644
--- a/Source/WebCore/html/shadow/ContentSelectorQuery.h
+++ b/Source/WebCore/html/shadow/ContentSelectorQuery.h
@@ -41,19 +41,19 @@ namespace WebCore {
 
 class Document;
 class Node;
-class HTMLContentElement;
+class InsertionPoint;
 
 class ContentSelectorQuery {
     WTF_MAKE_NONCOPYABLE(ContentSelectorQuery);
 public:
-    explicit ContentSelectorQuery(const HTMLContentElement*);
+    explicit ContentSelectorQuery(const InsertionPoint*);
 
     bool isValidSelector() const;
     bool matches(Node*) const;
 private:
     bool validateSelectorList();
 
-    const HTMLContentElement* m_contentElement;
+    const InsertionPoint* m_insertionPoint;
     SelectorDataList m_selectors;
     CSSSelectorList m_selectorList;
     SelectorChecker m_selectorChecker;
diff --git a/Source/WebCore/html/shadow/HTMLContentElement.cpp b/Source/WebCore/html/shadow/HTMLContentElement.cpp
index 989acaee6..2443d155d 100644
--- a/Source/WebCore/html/shadow/HTMLContentElement.cpp
+++ b/Source/WebCore/html/shadow/HTMLContentElement.cpp
@@ -31,8 +31,9 @@
 #include "HTMLContentSelector.h"
 #include "HTMLNames.h"
 #include "QualifiedName.h"
+#include "RuntimeEnabledFeatures.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -42,10 +43,11 @@ using HTMLNames::selectAttr;
 static const QualifiedName& contentTagName()
 {
 #if ENABLE(SHADOW_DOM)
+    if (!RuntimeEnabledFeatures::shadowDOMEnabled())
+        return HTMLNames::webkitShadowContentTag;
     return HTMLNames::contentTag;
 #else
-    DEFINE_STATIC_LOCAL(QualifiedName, tagName, (nullAtom, "webkitShadowContent", HTMLNames::divTag.namespaceURI()));
-    return tagName;
+    return HTMLNames::webkitShadowContentTag;
 #endif
 }
 
@@ -68,40 +70,6 @@ HTMLContentElement::~HTMLContentElement()
 {
 }
 
-void HTMLContentElement::attach()
-{
-    ShadowRoot* root = toShadowRoot(shadowTreeRootNode());
-
-    // Before calling StyledElement::attach, selector must be calculated.
-    if (root) {
-        HTMLContentSelector* selector = root->list()->ensureSelector();
-        selector->unselect(&m_selections);
-        selector->select(this, &m_selections);
-    }
-
-    InsertionPoint::attach();
-
-    if (root) {
-        for (HTMLContentSelection* selection = m_selections.first(); selection; selection = selection->next())
-            selection->node()->attach();
-    }
-}
-
-void HTMLContentElement::detach()
-{
-    if (ShadowRoot* root = toShadowRoot(shadowTreeRootNode())) {
-        if (HTMLContentSelector* selector = root->list()->selector())
-            selector->unselect(&m_selections);
-
-        // When content element is detached, shadow tree should be recreated to re-calculate selector for
-        // other content elements.
-        root->list()->setNeedsReattachHostChildrenAndShadow();
-    }
-
-    ASSERT(m_selections.isEmpty());
-    InsertionPoint::detach();
-}
-
 const AtomicString& HTMLContentElement::select() const
 {
     return getAttribute(selectAttr);
@@ -122,7 +90,7 @@ void HTMLContentElement::parseAttribute(Attribute* attr)
 {
     if (attr->name() == selectAttr) {
         if (ShadowRoot* root = toShadowRoot(shadowTreeRootNode()))
-            root->list()->setNeedsReattachHostChildrenAndShadow();
+            root->tree()->setNeedsReattachHostChildrenAndShadow();
     } else
         InsertionPoint::parseAttribute(attr);
 }
diff --git a/Source/WebCore/html/shadow/HTMLContentElement.h b/Source/WebCore/html/shadow/HTMLContentElement.h
index c2a1c1e36..bf143528b 100644
--- a/Source/WebCore/html/shadow/HTMLContentElement.h
+++ b/Source/WebCore/html/shadow/HTMLContentElement.h
@@ -36,45 +36,26 @@
 
 namespace WebCore {
 
-// NOTE: Current implementation doesn't support dynamic insertion/deletion of HTMLContentElement.
-// You should create HTMLContentElement during the host construction.
 class HTMLContentElement : public InsertionPoint {
 public:
     static PassRefPtr<HTMLContentElement> create(const QualifiedName&, Document*);
     static PassRefPtr<HTMLContentElement> create(Document*);
 
     virtual ~HTMLContentElement();
-    virtual void attach();
-    virtual void detach();
 
     const AtomicString& select() const;
-
-    // FIXME: Currently this constructor accepts wider query than shadow dom spec.
-    // For example, a selector query should not include contextual selectors.
-    // See https://bugs.webkit.org/show_bug.cgi?id=75946
-    // FIXME: Currently we don't support setting select value dynamically.
-    // See https://bugs.webkit.org/show_bug.cgi?id=76261
     void setSelect(const AtomicString&);
-
     virtual bool isSelectValid() const;
 
+    bool doesSelectFromHostChildren() const { return true; }
+
 protected:
     HTMLContentElement(const QualifiedName&, Document*);
 
 private:
-    virtual bool isContentElement() const { return true; }
-    virtual bool rendererIsNeeded(const NodeRenderingContext&) { return false; }
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) { return 0; }
-
     virtual void parseAttribute(Attribute*) OVERRIDE;
 };
 
-inline HTMLContentElement* toHTMLContentElement(Node* node)
-{
-    ASSERT(!node || node->isContentElement());
-    return static_cast<HTMLContentElement*>(node);
-}
-
 }
 
 #endif
diff --git a/Source/WebCore/html/shadow/HTMLContentSelector.cpp b/Source/WebCore/html/shadow/HTMLContentSelector.cpp
index 5c30ff6e1..95395bc8b 100644
--- a/Source/WebCore/html/shadow/HTMLContentSelector.cpp
+++ b/Source/WebCore/html/shadow/HTMLContentSelector.cpp
@@ -108,11 +108,12 @@ HTMLContentSelector::~HTMLContentSelector()
     ASSERT(m_candidates.isEmpty());
 }
 
-void HTMLContentSelector::select(HTMLContentElement* contentElement, HTMLContentSelectionList* selections)
+void HTMLContentSelector::select(InsertionPoint* insertionPoint, HTMLContentSelectionList* selections)
 {
     ASSERT(selections->isEmpty());
 
-    ContentSelectorQuery query(contentElement);
+    ContentSelectorQuery query(insertionPoint);
+
     for (size_t i = 0; i < m_candidates.size(); ++i) {
         Node* child = m_candidates[i].get();
         if (!child)
@@ -120,7 +121,7 @@ void HTMLContentSelector::select(HTMLContentElement* contentElement, HTMLContent
         if (!query.matches(child))
             continue;
 
-        RefPtr<HTMLContentSelection> selection = HTMLContentSelection::create(contentElement, child);
+        RefPtr<HTMLContentSelection> selection = HTMLContentSelection::create(insertionPoint, child);
 
         selections->append(selection);
         m_selectionSet.add(selection.get());
diff --git a/Source/WebCore/html/shadow/HTMLContentSelector.h b/Source/WebCore/html/shadow/HTMLContentSelector.h
index 29bd6163f..14ea057a0 100644
--- a/Source/WebCore/html/shadow/HTMLContentSelector.h
+++ b/Source/WebCore/html/shadow/HTMLContentSelector.h
@@ -130,7 +130,7 @@ public:
     HTMLContentSelector();
     ~HTMLContentSelector();
 
-    void select(HTMLContentElement*, HTMLContentSelectionList*);
+    void select(InsertionPoint*, HTMLContentSelectionList*);
     void unselect(HTMLContentSelectionList*);
     HTMLContentSelection* findFor(Node* key) const;
 
diff --git a/Source/WebCore/html/shadow/HTMLShadowElement.cpp b/Source/WebCore/html/shadow/HTMLShadowElement.cpp
index cb01cd21f..69c93629f 100644
--- a/Source/WebCore/html/shadow/HTMLShadowElement.cpp
+++ b/Source/WebCore/html/shadow/HTMLShadowElement.cpp
@@ -29,19 +29,18 @@
  */
 
 #include "config.h"
-
-#if ENABLE(SHADOW_DOM)
-
 #include "HTMLShadowElement.h"
 
 #include "HTMLNames.h"
+#include "ShadowRoot.h"
+#include <wtf/text/AtomicString.h>
 
 namespace WebCore {
 
 class Document;
 
 inline HTMLShadowElement::HTMLShadowElement(const QualifiedName& tagName, Document* document)
-    : HTMLElement(tagName, document)
+    : InsertionPoint(tagName, document)
 {
     ASSERT(hasTagName(HTMLNames::shadowTag));
 }
@@ -55,6 +54,18 @@ HTMLShadowElement::~HTMLShadowElement()
 {
 }
 
-} // namespace WebCore
+const AtomicString& HTMLShadowElement::select() const
+{
+     return nullAtom;
+}
 
-#endif // ENABLE(SHADOW_DOM)
+bool HTMLShadowElement::doesSelectFromHostChildren() const
+{
+    TreeScope* scope = treeScope();
+
+    if (scope->isShadowRoot())
+        return toShadowRoot(scope)->isOldest();
+    return false;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/html/shadow/HTMLShadowElement.h b/Source/WebCore/html/shadow/HTMLShadowElement.h
index 151c7a2ab..a4ecdb3ad 100644
--- a/Source/WebCore/html/shadow/HTMLShadowElement.h
+++ b/Source/WebCore/html/shadow/HTMLShadowElement.h
@@ -31,25 +31,25 @@
 #ifndef HTMLShadowElement_h
 #define HTMLShadowElement_h
 
-#if ENABLE(SHADOW_DOM)
-
-#include "HTMLElement.h"
+#include "InsertionPoint.h"
+#include <wtf/Forward.h>
 
 namespace WebCore {
 
-class HTMLShadowElement : public HTMLElement {
+class HTMLShadowElement : public InsertionPoint {
 public:
     static PassRefPtr<HTMLShadowElement> create(const QualifiedName&, Document*);
 
     virtual ~HTMLShadowElement();
 
+    const AtomicString& select() const;
+    bool isSelectValid() const OVERRIDE { return true; }
+    bool doesSelectFromHostChildren() const;
+
 private:
     HTMLShadowElement(const QualifiedName&, Document*);
-    virtual bool isShadowElement() const { return true; }
 };
 
 } // namespace WebCore
 
-#endif // ENABLE(SHADOW_DOM)
-
 #endif // HTMLShadowElement_h
diff --git a/Source/WebCore/html/shadow/InsertionPoint.cpp b/Source/WebCore/html/shadow/InsertionPoint.cpp
index e99dc26d2..ebd4b28c4 100644
--- a/Source/WebCore/html/shadow/InsertionPoint.cpp
+++ b/Source/WebCore/html/shadow/InsertionPoint.cpp
@@ -31,6 +31,9 @@
 #include "config.h"
 #include "InsertionPoint.h"
 
+#include "ShadowRoot.h"
+#include "ShadowTree.h"
+
 namespace WebCore {
 
 InsertionPoint::InsertionPoint(const QualifiedName& tagName, Document* document)
@@ -43,4 +46,98 @@ InsertionPoint::~InsertionPoint()
 {
 }
 
+void InsertionPoint::attach()
+{
+    TreeScope* scope = treeScope();
+    if (scope->isShadowRoot()) {
+        ShadowRoot* root = toShadowRoot(scope);
+        if (doesSelectFromHostChildren()) {
+            distributeHostChildren(root->tree());
+            attachDistributedNode();
+        } else if (!root->olderShadowRoot()->assignedTo()) {
+            ASSERT(!root->olderShadowRoot()->attached());
+            assignShadowRoot(root->olderShadowRoot());
+            root->olderShadowRoot()->attach();
+        }
+    }
+
+    HTMLElement::attach();
+}
+
+void InsertionPoint::detach()
+{
+    if (ShadowRoot* root = toShadowRoot(shadowTreeRootNode())) {
+        ShadowTree* tree = root->tree();
+
+        if (doesSelectFromHostChildren())
+            clearDistribution(tree);
+        else if (ShadowRoot* assignedShadowRoot = assignedFrom())
+            clearAssignment(assignedShadowRoot);
+
+        // When shadow element is detached, shadow tree should be recreated to re-calculate selector for
+        // other insertion points.
+        tree->setNeedsReattachHostChildrenAndShadow();
+    }
+
+    ASSERT(m_selections.isEmpty());
+    HTMLElement::detach();
+}
+
+ShadowRoot* InsertionPoint::assignedFrom() const
+{
+    TreeScope* scope = treeScope();
+    if (!scope->isShadowRoot())
+        return 0;
+
+    ShadowRoot* olderShadowRoot = toShadowRoot(scope)->olderShadowRoot();
+    if (olderShadowRoot && olderShadowRoot->assignedTo() == this)
+        return olderShadowRoot;
+    return 0;
+}
+
+bool InsertionPoint::isShadowBoundary() const
+{
+    if (TreeScope* scope = treeScope())
+        return scope->isShadowRoot();
+    return false;
+}
+
+bool InsertionPoint::rendererIsNeeded(const NodeRenderingContext& context)
+{
+    return !isShadowBoundary() && HTMLElement::rendererIsNeeded(context);
+}
+
+inline void InsertionPoint::distributeHostChildren(ShadowTree* tree)
+{
+    HTMLContentSelector* selector = tree->ensureSelector();
+    selector->unselect(&m_selections);
+    selector->select(this, &m_selections);
+}
+
+inline void InsertionPoint::clearDistribution(ShadowTree* tree)
+{
+    if (HTMLContentSelector* selector = tree->selector())
+        selector->unselect(&m_selections);
+}
+
+inline void InsertionPoint::attachDistributedNode()
+{
+    for (HTMLContentSelection* selection = m_selections.first(); selection; selection = selection->next())
+        selection->node()->attach();
+}
+
+inline void InsertionPoint::assignShadowRoot(ShadowRoot* shadowRoot)
+{
+    shadowRoot->setAssignedTo(this);
+    m_selections.clear();
+    for (Node* node = shadowRoot->firstChild(); node; node = node->nextSibling())
+        m_selections.append(HTMLContentSelection::create(this, node));
+}
+
+inline void InsertionPoint::clearAssignment(ShadowRoot* shadowRoot)
+{
+    shadowRoot->setAssignedTo(0);
+    m_selections.clear();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/html/shadow/InsertionPoint.h b/Source/WebCore/html/shadow/InsertionPoint.h
index 292439032..b5282cddc 100644
--- a/Source/WebCore/html/shadow/InsertionPoint.h
+++ b/Source/WebCore/html/shadow/InsertionPoint.h
@@ -33,6 +33,8 @@
 
 #include "HTMLContentSelector.h"
 #include "HTMLElement.h"
+#include "HTMLNames.h"
+#include <wtf/Forward.h>
 
 namespace WebCore {
 
@@ -42,17 +44,39 @@ public:
 
     const HTMLContentSelectionList* selections() const { return &m_selections; }
     bool hasSelection() const { return m_selections.first(); }
+    bool isShadowBoundary() const;
+
+    virtual const AtomicString& select() const = 0;
+    virtual bool isSelectValid() const = 0;
+    virtual bool doesSelectFromHostChildren() const = 0;
+
+    virtual void attach();
+    virtual void detach();
+
+    virtual bool isInsertionPoint() const OVERRIDE { return true; }
+    ShadowRoot* assignedFrom() const;
 
 protected:
     InsertionPoint(const QualifiedName&, Document*);
+    virtual bool rendererIsNeeded(const NodeRenderingContext&) OVERRIDE;
+
+private:
+    void distributeHostChildren(ShadowTree*);
+    void clearDistribution(ShadowTree*);
+    void attachDistributedNode();
+
+    void assignShadowRoot(ShadowRoot*);
+    void clearAssignment(ShadowRoot*);
+
     HTMLContentSelectionList m_selections;
 };
 
 inline bool isInsertionPoint(Node* node)
 {
-    // FIXME: <shadow> should also be InsertionPoint.
-    // https://bugs.webkit.org/show_bug.cgi?id=78596
-    if (!node || node->isContentElement())
+    if (!node)
+        return true;
+
+    if (node->isHTMLElement() && toHTMLElement(node)->isInsertionPoint())
         return true;
 
     return false;
@@ -64,6 +88,13 @@ inline InsertionPoint* toInsertionPoint(Node* node)
     return static_cast<InsertionPoint*>(node);
 }
 
+inline bool isShadowBoundary(Node* node)
+{
+    if (!isInsertionPoint(node))
+        return false;
+    return toInsertionPoint(node)->isShadowBoundary();
+}
+
 } // namespace WebCore
 
 #endif // InsertionPoint_h
diff --git a/Source/WebCore/html/shadow/MediaControlElements.cpp b/Source/WebCore/html/shadow/MediaControlElements.cpp
index 1f69e3cc6..011adff79 100644
--- a/Source/WebCore/html/shadow/MediaControlElements.cpp
+++ b/Source/WebCore/html/shadow/MediaControlElements.cpp
@@ -40,6 +40,7 @@
 #include "Frame.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
+#include "HTMLVideoElement.h"
 #include "LocalizedStrings.h"
 #include "MediaControls.h"
 #include "MouseEvent.h"
@@ -52,6 +53,7 @@
 #include "RenderView.h"
 #include "ScriptController.h"
 #include "Settings.h"
+#include "Text.h"
 
 namespace WebCore {
 
@@ -107,6 +109,7 @@ inline MediaControlPanelElement::MediaControlPanelElement(Document* document)
     , m_canBeDragged(false)
     , m_isBeingDragged(false)
     , m_opaque(true)
+    , m_transitionTimer(this, &MediaControlPanelElement::transitionTimerFired)
 {
 }
 
@@ -173,6 +176,32 @@ void MediaControlPanelElement::endDrag()
     frame->eventHandler()->setCapturingMouseEventsNode(0);
 }
 
+void MediaControlPanelElement::startTimer()
+{
+    stopTimer();
+
+    // The timer is required to set the property display:'none' on the panel,
+    // such that captions are correctly displayed at the bottom of the video
+    // at the end of the fadeout transition.
+    double duration = document()->page() ? document()->page()->theme()->mediaControlsFadeOutDuration() : 0;
+    m_transitionTimer.startOneShot(duration);
+}
+
+void MediaControlPanelElement::stopTimer()
+{
+    if (m_transitionTimer.isActive())
+        m_transitionTimer.stop();
+}
+
+
+void MediaControlPanelElement::transitionTimerFired(Timer<MediaControlPanelElement>*)
+{
+    if (!m_opaque)
+        hide();
+
+    stopTimer();
+}
+
 void MediaControlPanelElement::setPosition(const LayoutPoint& position)
 {
     double left = position.x();
@@ -212,6 +241,8 @@ void MediaControlPanelElement::makeOpaque()
     setInlineStyleProperty(CSSPropertyOpacity, 1.0, CSSPrimitiveValue::CSS_NUMBER);
 
     m_opaque = true;
+
+    show();
 }
 
 void MediaControlPanelElement::makeTransparent()
@@ -224,6 +255,8 @@ void MediaControlPanelElement::makeTransparent()
     setInlineStyleProperty(CSSPropertyOpacity, 0.0, CSSPrimitiveValue::CSS_NUMBER);
 
     m_opaque = false;
+
+    startTimer();
 }
 
 void MediaControlPanelElement::defaultEventHandler(Event* event)
@@ -1165,7 +1198,6 @@ void RenderTextTrackContainerElement::layout()
 inline MediaControlTextTrackContainerElement::MediaControlTextTrackContainerElement(Document* document)
     : MediaControlElement(document)
     , m_fontSize(0)
-    , m_bottom(0)
 {
 }
 
@@ -1187,16 +1219,89 @@ const AtomicString& MediaControlTextTrackContainerElement::shadowPseudoId() cons
     return id;
 }
 
+void MediaControlTextTrackContainerElement::updateDisplay()
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(this);
+
+    // 1. If the media element is an audio element, or is another playback
+    // mechanism with no rendering area, abort these steps. There is nothing to
+    // render.
+    if (!mediaElement->isVideo())
+        return;
+
+    // 2. Let video be the media element or other playback mechanism.
+    HTMLVideoElement* video = static_cast<HTMLVideoElement*>(mediaElement);
+
+    // 3. Let output be an empty list of absolutely positioned CSS block boxes.
+    Vector<RefPtr<HTMLDivElement> > output;
+
+    // 4. If the user agent is exposing a user interface for video, add to
+    // output one or more completely transparent positioned CSS block boxes that
+    // cover the same region as the user interface.
+
+    // 5. If the last time these rules were run, the user agent was not exposing
+    // a user interface for video, but now it is, let reset be true. Otherwise,
+    // let reset be false.
+
+    // There is nothing to be done explicitly for 4th and 5th steps, as
+    // everything is handled through CSS. The caption box is on top of the
+    // controls box, in a container set with the -webkit-box display property.
+
+    // 6. Let tracks be the subset of video's list of text tracks that have as
+    // their rules for updating the text track rendering these rules for
+    // updating the display of WebVTT text tracks, and whose text track mode is
+    // showing or showing by default.
+    // 7. Let cues be an empty list of text track cues.
+    // 8. For each track track in tracks, append to cues all the cues from
+    // track's list of cues that have their text track cue active flag set.
+    CueList activeCues = video->currentlyActiveCues();
+
+    // 9. If reset is false, then, for each text track cue cue in cues: if cue's
+    // text track cue display state has a set of CSS boxes, then add those boxes
+    // to output, and remove cue from cues.
+
+    // There is nothing explicitly to be done here, as all the caching occurs
+    // within the TextTrackCue instance itself. If parameters of the cue change,
+    // the display tree is cleared.
+
+    // 10. For each text track cue cue in cues that has not yet had
+    // corresponding CSS boxes added to output, in text track cue order, run the
+    // following substeps:
+
+    // Simple renderer for now.
+    for (size_t i = 0; i < activeCues.size(); ++i) {
+        TextTrackCue* cue = activeCues[i].data();
+
+        ASSERT(cue->isActive());
+        if (!cue->track() || cue->track()->mode() != TextTrack::SHOWING)
+            continue;
+
+        RefPtr<HTMLDivElement> displayTree = cue->getDisplayTree();
+
+        // Append only new display trees.
+        if (displayTree->hasChildNodes() && !contains(displayTree.get()))
+            appendChild(displayTree, ASSERT_NO_EXCEPTION, true);
+
+        // The display tree of a cue is removed when the active flag of the cue is unset.
+
+        // FIXME(BUG 79750): Render the TextTrackCue when snap-to-lines is set.
+        // FIXME(BUG 79751): Render the TextTrackCue when snap-to-lines is not set.
+    }
+
+    // 11. Return output.
+    hasChildNodes() ? show() : hide();
+}
+
 static const float mimimumFontSize = 16;
 static const float videoHeightFontSizePercentage = .05;
 static const float trackBottomMultiplier = .9;
-    
+
 void MediaControlTextTrackContainerElement::updateSizes()
 {
     HTMLMediaElement* mediaElement = toParentMediaElement(this);
     if (!mediaElement || !mediaElement->renderer() || !mediaElement->renderer()->isVideo())
         return;
-    
+
     IntRect videoBox = toRenderVideo(mediaElement->renderer())->videoBox();
     if (m_videoDisplaySize == videoBox)
         return;
@@ -1207,33 +1312,9 @@ void MediaControlTextTrackContainerElement::updateSizes()
         m_fontSize = fontSize;
         setInlineStyleProperty(CSSPropertyFontSize, String::number(fontSize) + "px");
     }
-
-    LayoutUnit bottom = static_cast<LayoutUnit>(m_videoDisplaySize.y() + m_videoDisplaySize.height() - (m_videoDisplaySize.height() * trackBottomMultiplier));
-    if (bottom != m_bottom) {
-        m_bottom = bottom;
-        setInlineStyleProperty(CSSPropertyBottom, String::number(bottom) + "px");
-    }
 }
 
-// ----------------------------
-
-MediaControlTextTrackDisplayElement::MediaControlTextTrackDisplayElement(Document* document)
-    : MediaControlElement(document)
-{
-}
-
-PassRefPtr<MediaControlTextTrackDisplayElement> MediaControlTextTrackDisplayElement::create(Document* document)
-{
-    return adoptRef(new MediaControlTextTrackDisplayElement(document));
-}
-
-const AtomicString& MediaControlTextTrackDisplayElement::shadowPseudoId() const
-{
-    DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-text-track-display"));
-    return id;
-}
-
-#endif
+#endif // ENABLE(VIDEO_TRACK)
 
 // ----------------------------
 
diff --git a/Source/WebCore/html/shadow/MediaControlElements.h b/Source/WebCore/html/shadow/MediaControlElements.h
index 8e67d0039..dce26c1c8 100644
--- a/Source/WebCore/html/shadow/MediaControlElements.h
+++ b/Source/WebCore/html/shadow/MediaControlElements.h
@@ -68,6 +68,8 @@ enum MediaControlElementType {
     MediaVolumeSliderContainer,
     MediaVolumeSlider,
     MediaVolumeSliderThumb,
+    MediaFullScreenVolumeSlider,
+    MediaFullScreenVolumeSliderThumb,
     MediaVolumeSliderMuteButton,
     MediaTextTrackDisplayContainer,
     MediaTextTrackDisplay,
@@ -120,6 +122,10 @@ private:
     void continueDrag(const LayoutPoint& eventLocation);
     void endDrag();
 
+    void startTimer();
+    void stopTimer();
+    void transitionTimerFired(Timer<MediaControlPanelElement>*);
+
     void setPosition(const LayoutPoint&);
 
     bool m_canBeDragged;
@@ -127,6 +133,8 @@ private:
     bool m_opaque;
     LayoutPoint m_dragStartPosition;
     LayoutPoint m_dragStartEventLocation;
+
+    Timer<MediaControlPanelElement> m_transitionTimer;
 };
 
 // ----------------------------
@@ -489,9 +497,9 @@ private:
 #if ENABLE(VIDEO_TRACK)
 class MediaControlTextTrackContainerElement : public MediaControlElement {
 public:
-    
     static PassRefPtr<MediaControlTextTrackContainerElement> create(Document*);
-    
+
+    void updateDisplay();
     void updateSizes();
 
 private:
@@ -503,23 +511,9 @@ private:
 
     IntRect m_videoDisplaySize;
     float m_fontSize;
-    LayoutUnit m_bottom;
 };
 
-// ----------------------------
-
-class MediaControlTextTrackDisplayElement : public MediaControlElement {
-public:
-    static PassRefPtr<MediaControlTextTrackDisplayElement> create(Document*);
-
-private:
-    MediaControlTextTrackDisplayElement(Document*);
-
-    virtual MediaControlElementType displayType() const { return MediaTextTrackDisplay; }
-    virtual const AtomicString& shadowPseudoId() const;
-};
 #endif
-
 // ----------------------------
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/shadow/MediaControlRootElement.cpp b/Source/WebCore/html/shadow/MediaControlRootElement.cpp
index a358bd0b7..2383200f3 100644
--- a/Source/WebCore/html/shadow/MediaControlRootElement.cpp
+++ b/Source/WebCore/html/shadow/MediaControlRootElement.cpp
@@ -73,7 +73,6 @@ MediaControlRootElement::MediaControlRootElement(Document* document)
     , m_panel(0)
 #if ENABLE(VIDEO_TRACK)
     , m_textDisplayContainer(0)
-    , m_textTrackDisplay(0)
 #endif
     , m_hideFullscreenControlsTimer(this, &MediaControlRootElement::hideFullscreenControlsTimerFired)
     , m_isMouseOverControls(false)
@@ -277,8 +276,6 @@ void MediaControlRootElement::setMediaController(MediaControllerInterface* contr
 #if ENABLE(VIDEO_TRACK)
     if (m_textDisplayContainer)
         m_textDisplayContainer->setMediaController(controller);
-    if (m_textTrackDisplay)
-        m_textTrackDisplay->setMediaController(controller);
 #endif
     reset();
 }
@@ -343,6 +340,9 @@ void MediaControlRootElement::reset()
     m_playButton->updateDisplayType();
 
 #if ENABLE(FULLSCREEN_API)
+    if (m_fullScreenVolumeSlider)
+        m_fullScreenVolumeSlider->setVolume(m_mediaController->volume());
+
     if (document()->webkitIsFullScreen() && document()->webkitCurrentFullScreenElement() == toParentMediaElement(this)) {
         if (m_mediaController->isLiveStream()) {
             m_seekBackButton->hide();
@@ -601,16 +601,8 @@ void MediaControlRootElement::createTextTrackDisplay()
     RefPtr<MediaControlTextTrackContainerElement> textDisplayContainer = MediaControlTextTrackContainerElement::create(document());
     m_textDisplayContainer = textDisplayContainer.get();
 
-    RefPtr<MediaControlTextTrackDisplayElement> textDisplay = MediaControlTextTrackDisplayElement::create(document());
-    m_textDisplayContainer->hide();
-    m_textTrackDisplay = textDisplay.get();
-
-    ExceptionCode ec;
-    textDisplayContainer->appendChild(textDisplay.release(), ec, true);
-    if (ec)
-        return;
-
     // Insert it before the first controller element so it always displays behind the controls.
+    ExceptionCode ec;
     insertBefore(textDisplayContainer.release(), m_panel, ec, true);
 }
 
@@ -633,28 +625,8 @@ void MediaControlRootElement::updateTextTrackDisplay()
     if (!m_textDisplayContainer)
         createTextTrackDisplay();
 
-    CueList activeCues = toParentMediaElement(m_textDisplayContainer)->currentlyActiveCues();
-    m_textTrackDisplay->removeChildren();
-    bool nothingToDisplay = true;
-    for (size_t i = 0; i < activeCues.size(); ++i) {
-        TextTrackCue* cue = activeCues[i].data();
-        ASSERT(cue->isActive());
-        if (!cue->track() || cue->track()->mode() != TextTrack::SHOWING)
-            continue;
-
-        String cueText = cue->text();
-        if (!cueText.isEmpty()) {
-            if (!nothingToDisplay)
-                m_textTrackDisplay->appendChild(document()->createElement(HTMLNames::brTag, false), ASSERT_NO_EXCEPTION);
-            m_textTrackDisplay->appendChild(document()->createTextNode(cueText), ASSERT_NO_EXCEPTION);
-            nothingToDisplay = false;
-        }
-    }
+    m_textDisplayContainer->updateDisplay();
 
-    if (!nothingToDisplay)
-        m_textDisplayContainer->show();
-    else
-        m_textDisplayContainer->hide();
 }
 #endif
 
diff --git a/Source/WebCore/html/shadow/MediaControlRootElementChromium.cpp b/Source/WebCore/html/shadow/MediaControlRootElementChromium.cpp
index e69d818d3..663e51f80 100644
--- a/Source/WebCore/html/shadow/MediaControlRootElementChromium.cpp
+++ b/Source/WebCore/html/shadow/MediaControlRootElementChromium.cpp
@@ -58,7 +58,6 @@ MediaControlRootElementChromium::MediaControlRootElementChromium(Document* docum
     , m_panel(0)
 #if ENABLE(VIDEO_TRACK)
     , m_textDisplayContainer(0)
-    , m_textTrackDisplay(0)
 #endif
     , m_opaque(true)
     , m_isMouseOverControls(false)
@@ -158,8 +157,6 @@ void MediaControlRootElementChromium::setMediaController(MediaControllerInterfac
 #if ENABLE(VIDEO_TRACK)
     if (m_textDisplayContainer)
         m_textDisplayContainer->setMediaController(controller);
-    if (m_textTrackDisplay)
-        m_textTrackDisplay->setMediaController(controller);
 #endif
     reset();
 }
@@ -335,16 +332,8 @@ void MediaControlRootElementChromium::createTextTrackDisplay()
     RefPtr<MediaControlTextTrackContainerElement> textDisplayContainer = MediaControlTextTrackContainerElement::create(document());
     m_textDisplayContainer = textDisplayContainer.get();
 
-    RefPtr<MediaControlTextTrackDisplayElement> textDisplay = MediaControlTextTrackDisplayElement::create(document());
-    m_textDisplayContainer->hide();
-    m_textTrackDisplay = textDisplay.get();
-
-    ExceptionCode ec;
-    textDisplayContainer->appendChild(textDisplay.release(), ec, true);
-    if (ec)
-        return;
-
     // Insert it before the first controller element so it always displays behind the controls.
+    ExceptionCode ec;
     insertBefore(textDisplayContainer.release(), m_panel, ec, true);
 }
 
@@ -367,31 +356,10 @@ void MediaControlRootElementChromium::updateTextTrackDisplay()
     if (!m_textDisplayContainer)
         createTextTrackDisplay();
 
-    CueList activeCues = toParentMediaElement(m_textDisplayContainer)->currentlyActiveCues();
-    m_textTrackDisplay->removeChildren();
-    bool nothingToDisplay = true;
-    for (size_t i = 0; i < activeCues.size(); ++i) {
-        TextTrackCue* cue = activeCues[i].data();
-        ASSERT(cue->isActive());
-        if (!cue->track() || cue->track()->mode() != TextTrack::SHOWING)
-            continue;
-
-        String cueText = cue->text();
-        if (!cueText.isEmpty()) {
-            if (!nothingToDisplay)
-                m_textTrackDisplay->appendChild(document()->createElement(HTMLNames::brTag, false), ASSERT_NO_EXCEPTION);
-            m_textTrackDisplay->appendChild(document()->createTextNode(cueText), ASSERT_NO_EXCEPTION);
-            nothingToDisplay = false;
-        }
-    }
-
-    if (!nothingToDisplay)
-        m_textDisplayContainer->show();
-    else
-        m_textDisplayContainer->hide();
+    m_textDisplayContainer->updateDisplay();
 }
 #endif
-    
+
 const AtomicString& MediaControlRootElementChromium::shadowPseudoId() const
 {
     DEFINE_STATIC_LOCAL(AtomicString, id, ("-webkit-media-controls"));
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.cpp b/Source/WebCore/html/shadow/SliderThumbElement.cpp
index 7558924ce..164cbfbd0 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.cpp
+++ b/Source/WebCore/html/shadow/SliderThumbElement.cpp
@@ -43,7 +43,7 @@
 #include "RenderSlider.h"
 #include "RenderTheme.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "StepRange.h"
 #include <wtf/MathExtras.h>
 
@@ -67,7 +67,7 @@ inline static bool hasVerticalAppearance(HTMLInputElement* input)
 SliderThumbElement* sliderThumbElementOf(Node* node)
 {
     ASSERT(node);
-    ShadowRoot* shadow = node->toInputElement()->shadowRootList()->oldestShadowRoot();
+    ShadowRoot* shadow = node->toInputElement()->shadowTree()->oldestShadowRoot();
     ASSERT(shadow);
     Node* thumb = shadow->firstChild()->firstChild()->firstChild();
     ASSERT(thumb);
@@ -91,6 +91,8 @@ void RenderSliderThumb::updateAppearance(RenderStyle* parentStyle)
         style()->setAppearance(MediaSliderThumbPart);
     else if (parentStyle->appearance() == MediaVolumeSliderPart)
         style()->setAppearance(MediaVolumeSliderThumbPart);
+    else if (parentStyle->appearance() == MediaFullScreenVolumeSliderPart)
+        style()->setAppearance(MediaFullScreenVolumeSliderThumbPart);
     if (style()->hasAppearance())
         theme()->adjustSliderThumbSize(style());
 }
@@ -142,7 +144,7 @@ void RenderSliderContainer::layout()
     Length inputHeight = input->renderer()->style()->height();
     RenderObject* trackRenderer = node()->firstChild()->renderer();
     if (!isVertical && input->renderer()->isSlider() && !inputHeight.isFixed() && !inputHeight.isPercent()) {
-        RenderObject* thumbRenderer = input->shadowRootList()->oldestShadowRoot()->firstChild()->firstChild()->firstChild()->renderer();
+        RenderObject* thumbRenderer = input->shadowTree()->oldestShadowRoot()->firstChild()->firstChild()->firstChild()->renderer();
         if (thumbRenderer) {
             style()->setHeight(thumbRenderer->style()->height());
             if (trackRenderer)
@@ -356,7 +358,7 @@ TrackLimiterElement* trackLimiterElementOf(Node* node)
 {
     ASSERT(node);
     ASSERT(node->toInputElement()->hasShadowRoot());
-    ShadowRoot* shadow = node->toInputElement()->shadowRootList()->oldestShadowRoot();
+    ShadowRoot* shadow = node->toInputElement()->shadowTree()->oldestShadowRoot();
     ASSERT(shadow);
     Node* limiter = shadow->firstChild()->lastChild();
     ASSERT(limiter);
diff --git a/Source/WebCore/html/shadow/TextControlInnerElements.cpp b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
index 2fc35f20e..c9fb732e6 100644
--- a/Source/WebCore/html/shadow/TextControlInnerElements.cpp
+++ b/Source/WebCore/html/shadow/TextControlInnerElements.cpp
@@ -294,10 +294,11 @@ void SpinButtonElement::defaultEventHandler(Event* event)
             input->focus();
             input->select();
             if (renderer()) {
-                ASSERT(m_upDownState != Indeterminate);
-                input->stepUpFromRenderer(m_upDownState == Up ? 1 : -1);
-                if (renderer())
-                    startRepeatingTimer();
+                if (m_upDownState != Indeterminate) {
+                    input->stepUpFromRenderer(m_upDownState == Up ? 1 : -1);
+                    if (renderer())
+                        startRepeatingTimer();
+                }
             }
             event->setDefaultHandled();
         }
@@ -365,7 +366,8 @@ void SpinButtonElement::step(int amount)
     
 void SpinButtonElement::repeatingTimerFired(Timer<SpinButtonElement>*)
 {
-    step(m_upDownState == Up ? 1 : -1);
+    if (m_upDownState != Indeterminate)
+        step(m_upDownState == Up ? 1 : -1);
 }
 
 void SpinButtonElement::setHovered(bool flag)
diff --git a/Source/WebCore/html/track/TextTrackCue.cpp b/Source/WebCore/html/track/TextTrackCue.cpp
index 59c3f3ea0..00ebb21a9 100644
--- a/Source/WebCore/html/track/TextTrackCue.cpp
+++ b/Source/WebCore/html/track/TextTrackCue.cpp
@@ -35,8 +35,12 @@
 
 #include "TextTrackCue.h"
 
-#include "Event.h"
+#include "CSSPropertyNames.h"
+#include "CSSValueKeywords.h"
 #include "DocumentFragment.h"
+#include "Event.h"
+#include "HTMLDivElement.h"
+#include "Text.h"
 #include "TextTrack.h"
 #include "TextTrackCueList.h"
 #include "WebVTTParser.h"
@@ -46,57 +50,75 @@ namespace WebCore {
 
 static const int invalidCueIndex = -1;
 
-static const AtomicString& startKeyword()
+static const String& startKeyword()
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, start, ("start"));
+    DEFINE_STATIC_LOCAL(const String, start, ("start"));
     return start;
 }
 
-static const AtomicString& middleKeyword()
+static const String& middleKeyword()
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, middle, ("middle"));
+    DEFINE_STATIC_LOCAL(const String, middle, ("middle"));
     return middle;
 }
 
-static const AtomicString& endKeyword()
+static const String& endKeyword()
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, end, ("end"));
+    DEFINE_STATIC_LOCAL(const String, end, ("end"));
     return end;
 }
 
-static const AtomicString& horizontalKeyword()
+static const String& horizontalKeyword()
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, horizontal, ("horizontal"));
-    return horizontal;
+    return emptyString();
 }
 
-static const AtomicString& verticalKeyword()
+static const String& verticalGrowingLeftKeyword()
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, vertical, ("vertical"));
+    DEFINE_STATIC_LOCAL(const String, vertical, ("rl"));
     return vertical;
 }
-static const AtomicString& verticallrKeyword()
+
+static const String& verticalGrowingRightKeyword()
 {
-    DEFINE_STATIC_LOCAL(const AtomicString, verticallr, ("vertical-lr"));
+    DEFINE_STATIC_LOCAL(const String, verticallr, ("lr"));
+    return verticallr;
+}
+
+// FIXME: remove this once https://bugs.webkit.org/show_bug.cgi?id=78706 has been fixed.
+static const String& verticalKeywordOLD()
+{
+    DEFINE_STATIC_LOCAL(const String, vertical, ("vertical"));
+    return vertical;
+}
+
+// FIXME: remove this once https://bugs.webkit.org/show_bug.cgi?id=78706 has been fixed.
+static const String& verticallrKeywordOLD()
+{
+    DEFINE_STATIC_LOCAL(const String, verticallr, ("vertical-lr"));
     return verticallr;
 }
     
+
 TextTrackCue::TextTrackCue(ScriptExecutionContext* context, const String& id, double start, double end, const String& content, const String& settings, bool pauseOnExit)
     : m_id(id)
     , m_startTime(start)
     , m_endTime(end)
     , m_content(content)
-    , m_writingDirection(Horizontal)
     , m_linePosition(-1)
     , m_textPosition(50)
     , m_cueSize(100)
     , m_cueIndex(invalidCueIndex)
+    , m_writingDirection(Horizontal)
     , m_cueAlignment(Middle)
     , m_scriptExecutionContext(context)
     , m_isActive(false)
     , m_pauseOnExit(pauseOnExit)
     , m_snapToLines(true)
+    , m_displayTreeShouldChange(true)
+    , m_displayTree(HTMLDivElement::create(static_cast<Document*>(context)))
 {
+    ASSERT(m_scriptExecutionContext->isDocument());
     parseSettings(settings);
 }
 
@@ -114,6 +136,8 @@ void TextTrackCue::cueDidChange()
 {
     if (m_track)
         m_track->cueDidChange(this);
+
+    m_displayTreeShouldChange = true;
 }
 
 TextTrack* TextTrackCue::track() const
@@ -166,35 +190,35 @@ void TextTrackCue::setPauseOnExit(bool value)
     cueDidChange();
 }
 
-const String& TextTrackCue::direction() const
+const String& TextTrackCue::vertical() const
 {
     switch (m_writingDirection) {
     case Horizontal: 
         return horizontalKeyword();
     case VerticalGrowingLeft:
-        return verticalKeyword();
+        return verticalGrowingLeftKeyword();
     case VerticalGrowingRight:
-        return verticallrKeyword();
+        return verticalGrowingRightKeyword();
     default:
         ASSERT_NOT_REACHED();
         return emptyString();
     }
 }
 
-void TextTrackCue::setDirection(const String& value, ExceptionCode& ec)
+void TextTrackCue::setVertical(const String& value, ExceptionCode& ec)
 {
-    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrackcue-direction
+    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrackcue-vertical
     // On setting, the text track cue writing direction must be set to the value given 
     // in the first cell of the row in the table above whose second cell is a 
     // case-sensitive match for the new value, if any. If none of the values match, then
     // the user agent must instead throw a SyntaxError exception.
     
-    Direction direction = m_writingDirection;
+    WritingDirection direction = m_writingDirection;
     if (value == horizontalKeyword())
         direction = Horizontal;
-    else if (value == verticalKeyword())
+    else if (value == verticalGrowingLeftKeyword())
         direction = VerticalGrowingLeft;
-    else if (value == verticallrKeyword())
+    else if (value == verticalGrowingRightKeyword())
         direction = VerticalGrowingRight;
     else
         ec = SYNTAX_ERR;
@@ -217,9 +241,9 @@ void TextTrackCue::setSnapToLines(bool value)
     cueDidChange();
 }
 
-void TextTrackCue::setLinePosition(int position, ExceptionCode& ec)
+void TextTrackCue::setLine(int position, ExceptionCode& ec)
 {
-    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrackcue-lineposition
+    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrackcue-line
     // On setting, if the text track cue snap-to-lines flag is not set, and the new
     // value is negative or greater than 100, then throw an IndexSizeError exception.
     if (!m_snapToLines && (position < 0 || position > 100)) {
@@ -236,9 +260,9 @@ void TextTrackCue::setLinePosition(int position, ExceptionCode& ec)
     cueDidChange();
 }
 
-void TextTrackCue::setTextPosition(int position, ExceptionCode& ec)
+void TextTrackCue::setPosition(int position, ExceptionCode& ec)
 {
-    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrackcue-lineposition
+    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrackcue-position
     // On setting, if the new value is negative or greater than 100, then throw an IndexSizeError exception.
     // Otherwise, set the text track cue text position to the new value.
     if (position < 0 || position > 100) {
@@ -274,7 +298,7 @@ void TextTrackCue::setSize(int size, ExceptionCode& ec)
     cueDidChange();
 }
 
-const String& TextTrackCue::alignment() const
+const String& TextTrackCue::align() const
 {
     switch (m_cueAlignment) {
     case Start:
@@ -289,9 +313,9 @@ const String& TextTrackCue::alignment() const
     }
 }
 
-void TextTrackCue::setAlignment(const String& value, ExceptionCode& ec)
+void TextTrackCue::setAlign(const String& value, ExceptionCode& ec)
 {
-    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrackcue-alignment
+    // http://www.whatwg.org/specs/web-apps/current-work/multipage/the-video-element.html#dom-texttrackcue-align
     // On setting, the text track cue alignment must be set to the value given in the 
     // first cell of the row in the table above whose second cell is a case-sensitive
     // match for the new value, if any. If none of the values match, then the user
@@ -343,15 +367,18 @@ void TextTrackCue::invalidateCueIndex()
 
 PassRefPtr<DocumentFragment> TextTrackCue::getCueAsHTML()
 {
+    RefPtr<DocumentFragment> clonedFragment;
+    Document* document;
+
     if (!m_documentFragment)
         m_documentFragment = WebVTTParser::create(0, m_scriptExecutionContext)->createDocumentFragmentFromCueText(m_content);
 
-    return m_documentFragment;
-}
+    document = static_cast<Document*>(m_scriptExecutionContext);
 
-void TextTrackCue::setCueHTML(PassRefPtr<DocumentFragment> fragment)
-{
-    m_documentFragment = fragment;
+    clonedFragment = DocumentFragment::create(document);
+    m_documentFragment->cloneChildNodes(clonedFragment.get());
+
+    return clonedFragment.release();
 }
 
 bool TextTrackCue::dispatchEvent(PassRefPtr<Event> event)
@@ -376,6 +403,63 @@ bool TextTrackCue::isActive()
 void TextTrackCue::setIsActive(bool active)
 {
     m_isActive = active;
+
+    if (!active) {
+        // Remove the display tree as soon as the cue becomes inactive.
+        ExceptionCode ec;
+        m_displayTree->remove(ec);
+    }
+}
+
+void TextTrackCue::determineDisplayParameters()
+{
+    // FIXME(BUG 79749): Determine the text direction using the BIDI algorithm.
+    // Steps 10.2, 10.3
+
+    // FIXME(BUG 79747): Determine the display parameters from the rules.
+    // Steps 10.1, 10.4 - 10.10
+}
+
+PassRefPtr<HTMLDivElement> TextTrackCue::getDisplayTree()
+{
+    if (!m_displayTreeShouldChange)
+        return m_displayTree;
+
+    // 10.1 - 10.10
+    determineDisplayParameters();
+
+    // 10.11. Apply the terms of the CSS specifications to nodes within the
+    // following constraints, thus obtaining a set of CSS boxes positioned
+    // relative to an initial containing block:
+    m_displayTree->removeChildren();
+
+    // The document tree is the tree of WebVTT Node Objects rooted at nodes.
+
+    // The children of the nodes must be wrapped in an anonymous box whose
+    // 'display' property has the value 'inline'. This is the WebVTT cue
+    // background box.
+    m_displayTree->setShadowPseudoId(AtomicString("-webkit-media-text-track-display"), ASSERT_NO_EXCEPTION);
+    m_displayTree->appendChild(getCueAsHTML(), ASSERT_NO_EXCEPTION, true);
+
+    // FIXME(BUG 79916): Runs of children of WebVTT Ruby Objects that are not
+    // WebVTT Ruby Text Objects must be wrapped in anonymous boxes whose
+    // 'display' property has the value 'ruby-base'.
+
+    // FIXME(BUG 79916): Text runs must be wrapped according to the CSS
+    // line-wrapping rules, except that additionally, regardless of the value of
+    // the 'white-space' property, lines must be wrapped at the edge of their
+    // containing blocks, even if doing so requires splitting a word where there
+    // is no line breaking opportunity. (Thus, normally text wraps as needed,
+    // but if there is a particularly long word, it does not overflow as it
+    // normally would in CSS, it is instead forcibly wrapped at the box's edge.)
+
+    // FIXME(BUG 79750, 79751): Steps 10.12 - 10.14
+
+    m_displayTreeShouldChange = false;
+
+    // 10.15. Let cue's text track cue display state have the CSS boxes in
+    // boxes.
+    return m_displayTree;
 }
 
 void TextTrackCue::parseSettings(const String& input)
@@ -405,9 +489,9 @@ void TextTrackCue::parseSettings(const String& input)
             {
             // 1-3 - Collect the next word and set the writing direction accordingly.
             String writingDirection = WebVTTParser::collectWord(input, &position);
-            if (writingDirection == verticalKeyword())
+            if (writingDirection == verticalKeywordOLD())
                 m_writingDirection = VerticalGrowingLeft;
-            else if (writingDirection == verticallrKeyword())
+            else if (writingDirection == verticallrKeywordOLD())
                 m_writingDirection = VerticalGrowingRight;
             }
             break;
diff --git a/Source/WebCore/html/track/TextTrackCue.h b/Source/WebCore/html/track/TextTrackCue.h
index b3e0f32a5..401132d96 100644
--- a/Source/WebCore/html/track/TextTrackCue.h
+++ b/Source/WebCore/html/track/TextTrackCue.h
@@ -43,6 +43,7 @@ namespace WebCore {
 class DocumentFragment;
 class ScriptExecutionContext;
 class TextTrack;
+class HTMLDivElement;
 
 class TextTrackCue : public RefCounted<TextTrackCue>, public EventTarget {
 public:
@@ -51,9 +52,6 @@ public:
         return adoptRef(new TextTrackCue(context, id, start, end, content, settings, pauseOnExit));
     }
 
-    enum Direction { Horizontal, VerticalGrowingLeft, VerticalGrowingRight };
-    enum Alignment { Start, Middle, End };
-
     virtual ~TextTrackCue();
 
     TextTrack* track() const;
@@ -71,23 +69,23 @@ public:
     bool pauseOnExit() const { return m_pauseOnExit; }
     void setPauseOnExit(bool);
 
-    const String& direction() const;
-    void setDirection(const String&, ExceptionCode&);
+    const String& vertical() const;
+    void setVertical(const String&, ExceptionCode&);
 
     bool snapToLines() const { return m_snapToLines; }
     void setSnapToLines(bool);
 
-    int linePosition() const { return m_linePosition; }
-    void setLinePosition(int, ExceptionCode&);
+    int line() const { return m_linePosition; }
+    void setLine(int, ExceptionCode&);
 
-    int textPosition() const { return m_textPosition; }
-    void setTextPosition(int, ExceptionCode&);
+    int position() const { return m_textPosition; }
+    void setPosition(int, ExceptionCode&);
 
     int size() const { return m_cueSize; }
     void setSize(int, ExceptionCode&);
 
-    const String& alignment() const;
-    void setAlignment(const String&, ExceptionCode&);
+    const String& align() const;
+    void setAlign(const String&, ExceptionCode&);
 
     const String& text() const { return m_content; }
     void setText(const String&);
@@ -96,7 +94,6 @@ public:
     void invalidateCueIndex();
 
     PassRefPtr<DocumentFragment> getCueAsHTML();
-    void setCueHTML(PassRefPtr<DocumentFragment>);
 
     virtual bool dispatchEvent(PassRefPtr<Event>);
     bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
@@ -104,6 +101,8 @@ public:
     bool isActive();
     void setIsActive(bool);
 
+    PassRefPtr<HTMLDivElement> getDisplayTree();
+
     virtual const AtomicString& interfaceName() const;
     virtual ScriptExecutionContext* scriptExecutionContext() const;
 
@@ -114,7 +113,6 @@ public:
     using RefCounted<TextTrackCue>::deref;
 
 protected:
-
     virtual EventTargetData* eventTargetData();
     virtual EventTargetData* ensureEventTargetData();
 
@@ -122,6 +120,8 @@ private:
     TextTrackCue(ScriptExecutionContext*, const String& id, double start, double end, const String& content, const String& settings, bool pauseOnExit);
 
     void parseSettings(const String&);
+    void determineDisplayParameters();
+
     void cueWillChange();
     void cueDidChange();
 
@@ -132,13 +132,17 @@ private:
     double m_startTime;
     double m_endTime;
     String m_content;
-    Direction m_writingDirection;
     int m_linePosition;
     int m_textPosition;
     int m_cueSize;
     int m_cueIndex;
 
+    enum WritingDirection { Horizontal, VerticalGrowingLeft, VerticalGrowingRight };
+    WritingDirection m_writingDirection;
+
+    enum Alignment { Start, Middle, End };
     Alignment m_cueAlignment;
+
     RefPtr<DocumentFragment> m_documentFragment;
     RefPtr<TextTrack> m_track;
 
@@ -148,6 +152,9 @@ private:
     bool m_isActive;
     bool m_pauseOnExit;
     bool m_snapToLines;
+
+    bool m_displayTreeShouldChange;
+    RefPtr<HTMLDivElement> m_displayTree;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/track/TextTrackCue.idl b/Source/WebCore/html/track/TextTrackCue.idl
index 12a827959..d552525a4 100644
--- a/Source/WebCore/html/track/TextTrackCue.idl
+++ b/Source/WebCore/html/track/TextTrackCue.idl
@@ -42,16 +42,16 @@ module html {
         attribute double endTime;
         attribute boolean pauseOnExit;
 
-        attribute DOMString direction
+        attribute DOMString vertical
             setter raises (DOMException);
         attribute boolean snapToLines;
-        attribute long linePosition
+        attribute long line
             setter raises (DOMException);
-        attribute long textPosition
+        attribute long position
             setter raises (DOMException);
         attribute long size
             setter raises (DOMException);
-        attribute DOMString alignment
+        attribute DOMString align
             setter raises (DOMException);
 
         attribute DOMString text;
@@ -71,4 +71,4 @@ module html {
             raises(EventException);
     };
 
-}
\ No newline at end of file
+}
diff --git a/Source/WebCore/html/track/TextTrackCueList.idl b/Source/WebCore/html/track/TextTrackCueList.idl
index 551840fe9..380e59a31 100644
--- a/Source/WebCore/html/track/TextTrackCueList.idl
+++ b/Source/WebCore/html/track/TextTrackCueList.idl
@@ -35,4 +35,4 @@ module html {
         TextTrackCue getCueById(in DOMString id);
     };
 
-}
\ No newline at end of file
+}
diff --git a/Source/WebCore/html/track/WebVTTParser.cpp b/Source/WebCore/html/track/WebVTTParser.cpp
index 050fb2754..dde2b2408 100644
--- a/Source/WebCore/html/track/WebVTTParser.cpp
+++ b/Source/WebCore/html/track/WebVTTParser.cpp
@@ -273,10 +273,8 @@ void WebVTTParser::createNewCue()
     if (!m_currentContent.length())
         return;
 
-    RefPtr<DocumentFragment> attachmentRoot = createDocumentFragmentFromCueText(m_currentContent.toString());
-    
     RefPtr<TextTrackCue> cue = TextTrackCue::create(m_scriptExecutionContext, m_currentId, m_currentStartTime, m_currentEndTime, m_currentContent.toString(), m_currentSettings, false);
-    cue->setCueHTML(attachmentRoot);
+
     m_cuelist.append(cue);
     if (m_client)
         m_client->newCuesParsed();
diff --git a/Source/WebCore/inspector/ContentSearchUtils.cpp b/Source/WebCore/inspector/ContentSearchUtils.cpp
index 5d678c5fe..d0e128b23 100644
--- a/Source/WebCore/inspector/ContentSearchUtils.cpp
+++ b/Source/WebCore/inspector/ContentSearchUtils.cpp
@@ -153,8 +153,8 @@ static String findMagicComment(const String& content, const String& name)
     ASSERT(pattern.m_numSubpatterns == 1);
     Vector<int, 4> matches;
     matches.resize(4);
-    int result = JSC::Yarr::interpret(bytecodePattern.get(), JSC::UString(content.impl()), 0, content.length(), matches.data());
-    if (result < 0)
+    unsigned result = JSC::Yarr::interpret(bytecodePattern.get(), JSC::UString(content.impl()), 0, content.length(), reinterpret_cast<unsigned*>(matches.data()));
+    if (result == JSC::Yarr::offsetNoMatch)
         return String();
     ASSERT(matches[2] > 0 && matches[3] > 0);
     return content.substring(matches[2], matches[3] - matches[2]);
diff --git a/Source/WebCore/inspector/DOMNodeHighlighter.cpp b/Source/WebCore/inspector/DOMNodeHighlighter.cpp
index 70578c72a..c13fc324b 100644
--- a/Source/WebCore/inspector/DOMNodeHighlighter.cpp
+++ b/Source/WebCore/inspector/DOMNodeHighlighter.cpp
@@ -414,7 +414,7 @@ static void getOrDrawNodeHighlight(GraphicsContext* context, HighlightData* high
             borderBox = LayoutRect(paddingBox.x() - renderBox->borderLeft(), paddingBox.y() - renderBox->borderTop(),
                     paddingBox.width() + renderBox->borderLeft() + renderBox->borderRight(), paddingBox.height() + renderBox->borderTop() + renderBox->borderBottom());
             marginBox = LayoutRect(borderBox.x() - renderBox->marginLeft(), borderBox.y() - renderBox->marginTop(),
-                    borderBox.width() + renderBox->marginLeft() + renderBox->marginRight(), borderBox.height() + renderBox->marginTop() + renderBox->marginBottom());
+                    borderBox.width() + renderBox->marginWidth(), borderBox.height() + renderBox->marginHeight());
         } else {
             RenderInline* renderInline = toRenderInline(renderer);
 
@@ -426,7 +426,7 @@ static void getOrDrawNodeHighlight(GraphicsContext* context, HighlightData* high
                     paddingBox.width() - renderInline->paddingLeft() - renderInline->paddingRight(), paddingBox.height() - renderInline->paddingTop() - renderInline->paddingBottom());
             // Ignore marginTop and marginBottom for inlines.
             marginBox = LayoutRect(borderBox.x() - renderInline->marginLeft(), borderBox.y(),
-                    borderBox.width() + renderInline->marginLeft() + renderInline->marginRight(), borderBox.height());
+                    borderBox.width() + renderInline->marginWidth(), borderBox.height());
         }
 
         FloatQuad absContentQuad = renderer->localToAbsoluteQuad(FloatRect(contentBox));
diff --git a/Source/WebCore/inspector/DOMPatchSupport.h b/Source/WebCore/inspector/DOMPatchSupport.h
index 4d040f08b..dd67a6311 100644
--- a/Source/WebCore/inspector/DOMPatchSupport.h
+++ b/Source/WebCore/inspector/DOMPatchSupport.h
@@ -44,7 +44,6 @@ namespace WebCore {
 class ContainerNode;
 class DOMEditor;
 class Document;
-class NamedNodeMap;
 class Node;
 
 #if ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InjectedScript.cpp b/Source/WebCore/inspector/InjectedScript.cpp
index 7a0abd70f..1732a7ef3 100644
--- a/Source/WebCore/inspector/InjectedScript.cpp
+++ b/Source/WebCore/inspector/InjectedScript.cpp
@@ -218,8 +218,8 @@ bool InjectedScript::canAccessInspectedWindow() const
 
 ScriptValue InjectedScript::callFunctionWithEvalEnabled(ScriptFunctionCall& function, bool& hadException) const
 {
-    DOMWindow* domWindow = domWindowFromScriptState(m_injectedScriptObject.scriptState());
-    InspectorInstrumentationCookie cookie = domWindow && domWindow->frame() ? InspectorInstrumentation::willCallFunction(domWindow->frame()->page(), "InjectedScript", 1) : InspectorInstrumentationCookie();
+    ScriptExecutionContext* scriptExecutionContext = scriptExecutionContextFromScriptState(m_injectedScriptObject.scriptState());
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willCallFunction(scriptExecutionContext, "InjectedScript", 1);
 
     ScriptState* scriptState = m_injectedScriptObject.scriptState();
     bool evalIsDisabled = false;
diff --git a/Source/WebCore/inspector/Inspector.json b/Source/WebCore/inspector/Inspector.json
index 24ec72ec9..ba1d7bdc1 100644
--- a/Source/WebCore/inspector/Inspector.json
+++ b/Source/WebCore/inspector/Inspector.json
@@ -1298,7 +1298,8 @@
                     { "name": "xmlVersion", "type": "string", "optional": true, "description": "<code>Document</code>'s XML version in case of XML documents." },
                     { "name": "name", "type": "string", "optional": true, "description": "<code>Attr</code>'s name." },
                     { "name": "value", "type": "string", "optional": true, "description": "<code>Attr</code>'s value." },
-                    { "name": "contentDocument", "$ref": "Node", "optional": true, "description": "Content document for frame owner elements." }
+                    { "name": "contentDocument", "$ref": "Node", "optional": true, "description": "Content document for frame owner elements." },
+                    { "name": "shadowRoots", "type": "array", "optional": true, "items": { "$ref": "Node" }, "description": "Shadow root list for given element host." }
                 ],
                 "description": "DOM interaction is implemented in terms of mirror objects that represent the actual DOM nodes. DOMNode is a base node mirror type."
             },
@@ -1682,6 +1683,24 @@
                     { "name": "nodeId", "$ref": "NodeId", "description": "Id of the node that has been removed." }
                 ],
                 "description": "Mirrors <code>DOMNodeRemoved</code> event."
+            },
+            {
+                "name": "shadowRootPushed",
+                "parameters": [
+                    { "name": "hostId", "$ref": "NodeId", "description": "Host element id." },
+                    { "name": "root", "$ref": "Node", "description": "Shadow root." }
+                ],
+                "description": "Called when shadow root is pushed into the element.",
+                "hidden": true
+            },
+            {
+                "name": "shadowRootPopped",
+                "parameters": [
+                    { "name": "hostId", "$ref": "NodeId", "description": "Host element id." },
+                    { "name": "rootId", "$ref": "NodeId", "description": "Shadow root id." }
+                ],
+                "description": "Called when shadow root is popped from the element.",
+                "hidden": true
             }
         ]
     },
diff --git a/Source/WebCore/inspector/InspectorAgent.cpp b/Source/WebCore/inspector/InspectorAgent.cpp
index 31d516603..06d146f0f 100644
--- a/Source/WebCore/inspector/InspectorAgent.cpp
+++ b/Source/WebCore/inspector/InspectorAgent.cpp
@@ -159,50 +159,6 @@ bool InspectorAgent::isMainResourceLoader(DocumentLoader* loader, const KURL& re
 }
 
 #if ENABLE(WORKERS)
-class PostWorkerNotificationToFrontendTask : public ScriptExecutionContext::Task {
-public:
-    static PassOwnPtr<PostWorkerNotificationToFrontendTask> create(PassRefPtr<InspectorWorkerResource> worker, InspectorAgent::WorkerAction action)
-    {
-        return adoptPtr(new PostWorkerNotificationToFrontendTask(worker, action));
-    }
-
-private:
-    PostWorkerNotificationToFrontendTask(PassRefPtr<InspectorWorkerResource> worker, InspectorAgent::WorkerAction action)
-        : m_worker(worker)
-        , m_action(action)
-    {
-    }
-
-    virtual void performTask(ScriptExecutionContext* scriptContext)
-    {
-        if (scriptContext->isDocument()) {
-            if (InspectorAgent* inspectorAgent = static_cast<Document*>(scriptContext)->page()->inspectorController()->m_inspectorAgent)
-                inspectorAgent->postWorkerNotificationToFrontend(*m_worker, m_action);
-        }
-    }
-
-private:
-    RefPtr<InspectorWorkerResource> m_worker;
-    InspectorAgent::WorkerAction m_action;
-};
-
-void InspectorAgent::postWorkerNotificationToFrontend(const InspectorWorkerResource& worker, InspectorAgent::WorkerAction action)
-{
-    if (!m_frontend || !m_state->getBoolean(InspectorAgentState::inspectorAgentEnabled))
-        return;
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    switch (action) {
-    case InspectorAgent::WorkerCreated:
-        m_frontend->inspector()->didCreateWorker(worker.id(), worker.url(), worker.isSharedWorker());
-        break;
-    case InspectorAgent::WorkerDestroyed:
-        m_frontend->inspector()->didDestroyWorker(worker.id());
-        break;
-    }
-#endif
-}
-
 void InspectorAgent::didCreateWorker(intptr_t id, const String& url, bool isSharedWorker)
 {
     if (!developerExtrasEnabled())
@@ -210,8 +166,10 @@ void InspectorAgent::didCreateWorker(intptr_t id, const String& url, bool isShar
 
     RefPtr<InspectorWorkerResource> workerResource(InspectorWorkerResource::create(id, url, isSharedWorker));
     m_workers.set(id, workerResource);
+#if ENABLE(JAVASCRIPT_DEBUGGER)
     if (m_inspectedPage && m_frontend && m_state->getBoolean(InspectorAgentState::inspectorAgentEnabled))
-        m_inspectedPage->mainFrame()->document()->postTask(PostWorkerNotificationToFrontendTask::create(workerResource, InspectorAgent::WorkerCreated));
+        m_frontend->inspector()->didCreateWorker(id, url, isSharedWorker);
+#endif
 }
 
 void InspectorAgent::didDestroyWorker(intptr_t id)
@@ -222,8 +180,10 @@ void InspectorAgent::didDestroyWorker(intptr_t id)
     WorkersMap::iterator workerResource = m_workers.find(id);
     if (workerResource == m_workers.end())
         return;
+#if ENABLE(JAVASCRIPT_DEBUGGER)
     if (m_inspectedPage && m_frontend && m_state->getBoolean(InspectorAgentState::inspectorAgentEnabled))
-        m_inspectedPage->mainFrame()->document()->postTask(PostWorkerNotificationToFrontendTask::create(workerResource->second, InspectorAgent::WorkerDestroyed));
+        m_frontend->inspector()->didDestroyWorker(id);
+#endif
     m_workers.remove(workerResource);
 }
 #endif // ENABLE(WORKERS)
diff --git a/Source/WebCore/inspector/InspectorAgent.h b/Source/WebCore/inspector/InspectorAgent.h
index a38be21ee..5c2861caa 100644
--- a/Source/WebCore/inspector/InspectorAgent.h
+++ b/Source/WebCore/inspector/InspectorAgent.h
@@ -83,9 +83,6 @@ public:
     void emitCommitLoadIfNeeded();
 
 #if ENABLE(WORKERS)
-    enum WorkerAction { WorkerCreated, WorkerDestroyed };
-
-    void postWorkerNotificationToFrontend(const InspectorWorkerResource&, WorkerAction);
     void didCreateWorker(intptr_t, const String& url, bool isSharedWorker);
     void didDestroyWorker(intptr_t);
 #endif
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.cpp b/Source/WebCore/inspector/InspectorCSSAgent.cpp
index 1f4f713a8..bd9c33584 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.cpp
+++ b/Source/WebCore/inspector/InspectorCSSAgent.cpp
@@ -36,6 +36,7 @@
 #include "CSSStyleRule.h"
 #include "CSSStyleSelector.h"
 #include "CSSStyleSheet.h"
+#include "ContentSecurityPolicy.h"
 #include "DOMWindow.h"
 #include "HTMLHeadElement.h"
 #include "InspectorDOMAgent.h"
@@ -46,6 +47,7 @@
 #include "Node.h"
 #include "NodeList.h"
 #include "StylePropertySet.h"
+#include "StyleRule.h"
 #include "StyleSheetList.h"
 
 #include <wtf/CurrentTime.h>
@@ -168,7 +170,7 @@ inline void SelectorProfile::startSelector(const CSSStyleRule* rule)
             url = InspectorDOMAgent::documentURLString(styleSheet->findDocument());
     }
     m_currentMatchData.url = url;
-    m_currentMatchData.lineNumber = rule->sourceLine();
+    m_currentMatchData.lineNumber = rule->styleRule()->sourceLine();
     m_currentMatchData.startTime = WTF::currentTimeMS();
 }
 
@@ -895,13 +897,15 @@ InspectorStyleSheet* InspectorCSSAgent::viaInspectorStyleSheet(Document* documen
             targetNode = document->body();
         else
             return 0;
+
+        InlineStyleOverrideScope overrideScope(document);
         targetNode->appendChild(styleElement, ec);
     }
     if (ec)
         return 0;
     StyleSheetList* styleSheets = document->styleSheets();
     StyleSheet* styleSheet = styleSheets->item(styleSheets->length() - 1);
-    if (!styleSheet->isCSSStyleSheet())
+    if (!styleSheet || !styleSheet->isCSSStyleSheet())
         return 0;
     CSSStyleSheet* cssStyleSheet = static_cast<CSSStyleSheet*>(styleSheet);
     String id = String::number(m_lastStyleSheetId++);
@@ -984,10 +988,8 @@ void InspectorCSSAgent::didRemoveDOMNode(Node* node)
     if (!node)
         return;
 
-    if (m_lastElementWithPseudoState.get() == node) {
+    if (m_lastElementWithPseudoState.get() == node)
         clearPseudoState(false);
-        return;
-    }
 
     NodeToInspectorStyleSheet::iterator it = m_nodeToInspectorStyleSheet.find(node);
     if (it == m_nodeToInspectorStyleSheet.end())
diff --git a/Source/WebCore/inspector/InspectorCSSAgent.h b/Source/WebCore/inspector/InspectorCSSAgent.h
index e7ee76572..2f9ddf4b1 100644
--- a/Source/WebCore/inspector/InspectorCSSAgent.h
+++ b/Source/WebCore/inspector/InspectorCSSAgent.h
@@ -26,12 +26,14 @@
 #define InspectorCSSAgent_h
 
 #include "CSSSelector.h"
+#include "ContentSecurityPolicy.h"
 #include "Document.h"
 #include "InspectorBaseAgent.h"
 #include "InspectorDOMAgent.h"
 #include "InspectorStyleSheet.h"
 #include "InspectorValues.h"
 #include "PlatformString.h"
+#include "SecurityContext.h"
 
 #include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
@@ -61,6 +63,23 @@ class InspectorCSSAgent
     , public InspectorStyleSheet::Listener {
     WTF_MAKE_NONCOPYABLE(InspectorCSSAgent);
 public:
+    class InlineStyleOverrideScope {
+    public:
+        InlineStyleOverrideScope(SecurityContext* context)
+            : m_contentSecurityPolicy(context->contentSecurityPolicy())
+        {
+            m_contentSecurityPolicy->setOverrideAllowInlineStyle(true);
+        }
+
+        ~InlineStyleOverrideScope()
+        {
+            m_contentSecurityPolicy->setOverrideAllowInlineStyle(false);
+        }
+
+    private:
+        ContentSecurityPolicy* m_contentSecurityPolicy;
+    };
+
     static CSSStyleRule* asCSSStyleRule(CSSRule*);
 
     static PassOwnPtr<InspectorCSSAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state, InspectorDOMAgent* domAgent)
diff --git a/Source/WebCore/inspector/InspectorClient.h b/Source/WebCore/inspector/InspectorClient.h
index 53b55c5ea..e4da688e3 100644
--- a/Source/WebCore/inspector/InspectorClient.h
+++ b/Source/WebCore/inspector/InspectorClient.h
@@ -34,7 +34,7 @@
 namespace WebCore {
 
 class InspectorController;
-class Node;
+class Frame;
 class Page;
 
 class InspectorClient : public InspectorFrontendChannel, public InspectorStateClient {
@@ -46,6 +46,7 @@ public:
     virtual void openInspectorFrontend(InspectorController*) = 0;
     virtual void closeInspectorFrontend() = 0;
     virtual void bringFrontendToFront() = 0;
+    virtual void didResizeMainFrame(Frame*) { }
 
     virtual void highlight() = 0;
     virtual void hideHighlight() = 0;
diff --git a/Source/WebCore/inspector/InspectorController.cpp b/Source/WebCore/inspector/InspectorController.cpp
index c08721d9b..cc9682bf4 100644
--- a/Source/WebCore/inspector/InspectorController.cpp
+++ b/Source/WebCore/inspector/InspectorController.cpp
@@ -111,7 +111,7 @@ InspectorController::InspectorController(Page* page, InspectorClient* inspectorC
     InspectorDOMStorageAgent* domStorageAgent = domStorageAgentPtr.get();
     m_agents.append(domStorageAgentPtr.release());
     m_agents.append(InspectorMemoryAgent::create(m_instrumentingAgents.get(), m_state.get(), m_page, m_domAgent));
-    m_agents.append(InspectorTimelineAgent::create(m_instrumentingAgents.get(), m_state.get()));
+    m_agents.append(InspectorTimelineAgent::create(m_instrumentingAgents.get(), m_state.get(), InspectorTimelineAgent::PageInspector));
     m_agents.append(InspectorApplicationCacheAgent::create(m_instrumentingAgents.get(), m_state.get(), pageAgent));
 
     OwnPtr<InspectorResourceAgent> resourceAgentPtr(InspectorResourceAgent::create(m_instrumentingAgents.get(), pageAgent, inspectorClient, m_state.get()));
@@ -361,7 +361,6 @@ void InspectorController::resume()
         m_debuggerAgent->resume(&error);
     }
 }
-
 #endif
 
 void InspectorController::setResourcesDataSizeLimitsFromInternals(int maximumResourcesContentSize, int maximumSingleResourceContentSize)
diff --git a/Source/WebCore/inspector/InspectorController.h b/Source/WebCore/inspector/InspectorController.h
index 5ee2330e1..98aef7776 100644
--- a/Source/WebCore/inspector/InspectorController.h
+++ b/Source/WebCore/inspector/InspectorController.h
@@ -108,6 +108,7 @@ public:
 
     void setResourcesDataSizeLimitsFromInternals(int maximumResourcesContentSize, int maximumSingleResourceContentSize);
 
+    InspectorClient* inspectorClient() const { return m_inspectorClient; }
     InspectorPageAgent* pageAgent() const { return m_pageAgent; }
 
 private:
diff --git a/Source/WebCore/inspector/InspectorCounters.cpp b/Source/WebCore/inspector/InspectorCounters.cpp
index 70697077b..d17e289da 100644
--- a/Source/WebCore/inspector/InspectorCounters.cpp
+++ b/Source/WebCore/inspector/InspectorCounters.cpp
@@ -30,6 +30,7 @@
 
 #include "config.h"
 #include "InspectorCounters.h"
+#include "ThreadGlobalData.h"
 
 #if ENABLE(INSPECTOR)
 
@@ -42,6 +43,22 @@ int InspectorCounters::counterValue(CounterType type)
     return s_counters[type];
 }
 
+ThreadLocalInspectorCounters::ThreadLocalInspectorCounters()
+{
+    for (size_t i = 0; i < CounterTypeLength; i++)
+        m_counters[i] = 0;
+}
+
+int ThreadLocalInspectorCounters::counterValue(CounterType type)
+{
+    return m_counters[type];
+}
+
+ThreadLocalInspectorCounters& ThreadLocalInspectorCounters::current()
+{
+    return threadGlobalData().inspectorCounters();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorCounters.h b/Source/WebCore/inspector/InspectorCounters.h
index 03dc11072..3becf76c1 100644
--- a/Source/WebCore/inspector/InspectorCounters.h
+++ b/Source/WebCore/inspector/InspectorCounters.h
@@ -31,6 +31,10 @@
 #ifndef InspectorCounters_h
 #define InspectorCounters_h
 
+#if !ASSERT_DISABLED
+#include <wtf/MainThread.h>
+#endif
+
 namespace WebCore {
 
 class InspectorCounters {
@@ -45,6 +49,7 @@ public:
     static inline void incrementCounter(CounterType type)
     {
 #if ENABLE(INSPECTOR)
+        ASSERT(isMainThread());
         ++s_counters[type];
 #endif
     }
@@ -52,6 +57,7 @@ public:
     static inline void decrementCounter(CounterType type)
     {
 #if ENABLE(INSPECTOR)
+        ASSERT(isMainThread());
         --s_counters[type];
 #endif
     }
@@ -68,6 +74,35 @@ private:
 #endif
 };
 
+
+#if ENABLE(INSPECTOR)
+class ThreadLocalInspectorCounters {
+public:
+    enum CounterType {
+        JSEventListenerCounter,
+        CounterTypeLength
+    };
+    ThreadLocalInspectorCounters();
+
+    inline void incrementCounter(CounterType type)
+    {
+        ++m_counters[type];
+    }
+
+    inline void decrementCounter(CounterType type)
+    {
+        --m_counters[type];
+    }
+
+    int counterValue(CounterType);
+
+    static ThreadLocalInspectorCounters& current();
+
+private:
+    int m_counters[CounterTypeLength];
+};
+#endif
+
 } // namespace WebCore
 
 #endif // !defined(InspectorCounters_h)
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.cpp b/Source/WebCore/inspector/InspectorDOMAgent.cpp
index 0dea859fa..9a3480d52 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/Source/WebCore/inspector/InspectorDOMAgent.cpp
@@ -81,6 +81,8 @@
 #include "RenderStyleConstants.h"
 #include "ScriptEventListener.h"
 #include "Settings.h"
+#include "ShadowRoot.h"
+#include "ShadowTree.h"
 #include "StylePropertySet.h"
 #include "StyleSheetList.h"
 #include "Text.h"
@@ -335,6 +337,11 @@ void InspectorDOMAgent::unbind(Node* node, NodeToIdMap* nodesMap)
         unbind(frameOwner->contentDocument(), nodesMap);
     }
 
+    if (node->isElementNode() && toElement(node)->hasShadowRoot()) {
+        for (ShadowRoot* root = toElement(node)->shadowTree()->youngestShadowRoot(); root; root = root->olderShadowRoot())
+            unbind(root, nodesMap);
+    }
+
     nodesMap->remove(node);
     bool childrenRequested = m_childrenRequested.contains(id);
     if (childrenRequested) {
@@ -371,18 +378,31 @@ Element* InspectorDOMAgent::assertElement(ErrorString* errorString, int nodeId)
     return toElement(node);
 }
 
+Node* InspectorDOMAgent::assertEditableNode(ErrorString* errorString, int nodeId)
+{
+    Node* node = assertNode(errorString, nodeId);
+    if (!node)
+        return 0;
+
+    if (node->isInShadowTree()) {
+        *errorString = "Can not edit nodes from shadow trees";
+        return 0;
+    }
+
+    return node;
+}
 
-HTMLElement* InspectorDOMAgent::assertHTMLElement(ErrorString* errorString, int nodeId)
+Element* InspectorDOMAgent::assertEditableElement(ErrorString* errorString, int nodeId)
 {
     Element* element = assertElement(errorString, nodeId);
     if (!element)
         return 0;
 
-    if (!element->isHTMLElement()) {
-        *errorString = "Node is not an HTML Element";
+    if (element->isInShadowTree()) {
+        *errorString = "Can not edit elements from shadow trees";
         return 0;
     }
-    return toHTMLElement(element);
+    return element;
 }
 
 void InspectorDOMAgent::getDocument(ErrorString*, RefPtr<InspectorObject>& root)
@@ -403,7 +423,7 @@ void InspectorDOMAgent::getDocument(ErrorString*, RefPtr<InspectorObject>& root)
 void InspectorDOMAgent::pushChildNodesToFrontend(int nodeId)
 {
     Node* node = nodeForId(nodeId);
-    if (!node || (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE && node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE) || node->isShadowRoot())
+    if (!node || (node->nodeType() != Node::ELEMENT_NODE && node->nodeType() != Node::DOCUMENT_NODE && node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE))
         return;
     if (m_childrenRequested.contains(nodeId))
         return;
@@ -534,7 +554,7 @@ int InspectorDOMAgent::boundNodeId(Node* node)
 
 void InspectorDOMAgent::setAttributeValue(ErrorString* errorString, int elementId, const String& name, const String& value)
 {
-    Element* element = assertElement(errorString, elementId);
+    Element* element = assertEditableElement(errorString, elementId);
     if (!element)
         return;
 
@@ -543,7 +563,7 @@ void InspectorDOMAgent::setAttributeValue(ErrorString* errorString, int elementI
 
 void InspectorDOMAgent::setAttributesAsText(ErrorString* errorString, int elementId, const String& text, const String* const name)
 {
-    Element* element = assertElement(errorString, elementId);
+    Element* element = assertEditableElement(errorString, elementId);
     if (!element)
         return;
 
@@ -588,7 +608,7 @@ void InspectorDOMAgent::setAttributesAsText(ErrorString* errorString, int elemen
 
 void InspectorDOMAgent::removeAttribute(ErrorString* errorString, int elementId, const String& name)
 {
-    Element* element = assertElement(errorString, elementId);
+    Element* element = assertEditableElement(errorString, elementId);
     if (!element)
         return;
 
@@ -597,7 +617,7 @@ void InspectorDOMAgent::removeAttribute(ErrorString* errorString, int elementId,
 
 void InspectorDOMAgent::removeNode(ErrorString* errorString, int nodeId)
 {
-    Node* node = assertNode(errorString, nodeId);
+    Node* node = assertEditableNode(errorString, nodeId);
     if (!node)
         return;
 
@@ -662,7 +682,7 @@ void InspectorDOMAgent::setOuterHTML(ErrorString* errorString, int nodeId, const
         return;
     }
 
-    Node* node = assertNode(errorString, nodeId);
+    Node* node = assertEditableNode(errorString, nodeId);
     if (!node)
         return;
 
@@ -690,7 +710,7 @@ void InspectorDOMAgent::setOuterHTML(ErrorString* errorString, int nodeId, const
 
 void InspectorDOMAgent::setNodeValue(ErrorString* errorString, int nodeId, const String& value)
 {
-    Node* node = assertNode(errorString, nodeId);
+    Node* node = assertEditableNode(errorString, nodeId);
     if (!node)
         return;
 
@@ -1038,17 +1058,17 @@ void InspectorDOMAgent::hideHighlight(ErrorString*)
 
 void InspectorDOMAgent::moveTo(ErrorString* errorString, int nodeId, int targetElementId, const int* const anchorNodeId, int* newNodeId)
 {
-    Node* node = assertNode(errorString, nodeId);
+    Node* node = assertEditableNode(errorString, nodeId);
     if (!node)
         return;
 
-    Element* targetElement = assertElement(errorString, targetElementId);
+    Element* targetElement = assertEditableElement(errorString, targetElementId);
     if (!targetElement)
         return;
 
     Node* anchorNode = 0;
     if (anchorNodeId && *anchorNodeId) {
-        anchorNode = assertNode(errorString, *anchorNodeId);
+        anchorNode = assertEditableNode(errorString, *anchorNodeId);
         if (!anchorNode)
             return;
         if (anchorNode->parentNode() != targetElement) {
@@ -1159,9 +1179,6 @@ PassRefPtr<InspectorObject> InspectorDOMAgent::buildObjectForNode(Node* node, in
         localName = node->localName();
         break;
     case Node::DOCUMENT_FRAGMENT_NODE:
-        if (!node->isShadowRoot())
-            break;
-        // Fall through
     case Node::DOCUMENT_NODE:
     case Node::ELEMENT_NODE:
     default:
@@ -1194,6 +1211,12 @@ PassRefPtr<InspectorObject> InspectorDOMAgent::buildObjectForNode(Node* node, in
             if (doc)
                 value->setContentDocument(buildObjectForNode(doc, 0, nodesMap));
         }
+        if (element->hasShadowRoot()) {
+            RefPtr<InspectorArray> shadowRoots = InspectorArray::create();
+            for (ShadowRoot* root = element->shadowTree()->youngestShadowRoot(); root; root = root->olderShadowRoot())
+                shadowRoots->pushObject(buildObjectForNode(root, 0, nodesMap));
+            value->setShadowRoots(shadowRoots);
+        }
     } else if (node->isDocumentNode()) {
         Document* document = static_cast<Document*>(node);
         value->setDocumentURL(documentURLString(document));
@@ -1475,6 +1498,21 @@ void InspectorDOMAgent::didInvalidateStyleAttr(Node* node)
     m_revalidateStyleAttrTask->scheduleFor(static_cast<Element*>(node));
 }
 
+void InspectorDOMAgent::didPushShadowRoot(Element* host, ShadowRoot* root)
+{
+    int hostId = m_documentNodeToIdMap.get(host);
+    if (hostId)
+        m_frontend->shadowRootPushed(hostId, buildObjectForNode(root, 0, &m_documentNodeToIdMap));
+}
+
+void InspectorDOMAgent::willPopShadowRoot(Element* host, ShadowRoot* root)
+{
+    int hostId = m_documentNodeToIdMap.get(host);
+    int rootId = m_documentNodeToIdMap.get(root);
+    if (hostId && rootId)
+        m_frontend->shadowRootPopped(hostId, rootId);
+}
+
 Node* InspectorDOMAgent::nodeForPath(const String& path)
 {
     // The path is of form "1,HTML,2,BODY,1,DIV"
diff --git a/Source/WebCore/inspector/InspectorDOMAgent.h b/Source/WebCore/inspector/InspectorDOMAgent.h
index e45d4636a..5a15001f8 100644
--- a/Source/WebCore/inspector/InspectorDOMAgent.h
+++ b/Source/WebCore/inspector/InspectorDOMAgent.h
@@ -69,6 +69,7 @@ class NameNodeMap;
 class Node;
 class RevalidateStyleAttributeTask;
 class ScriptValue;
+class ShadowRoot;
 
 struct Highlight;
 struct HighlightData;
@@ -167,6 +168,8 @@ public:
     void styleAttributeInvalidated(const Vector<Element*>& elements);
     void characterDataModified(CharacterData*);
     void didInvalidateStyleAttr(Node*);
+    void didPushShadowRoot(Element* host, ShadowRoot*);
+    void willPopShadowRoot(Element* host, ShadowRoot*);
 
     Node* nodeForId(int nodeId);
     int boundNodeId(Node*);
@@ -207,8 +210,10 @@ private:
     typedef HashMap<RefPtr<Node>, int> NodeToIdMap;
     int bind(Node*, NodeToIdMap*);
     void unbind(Node*, NodeToIdMap*);
+
     Element* assertElement(ErrorString*, int nodeId);
-    HTMLElement* assertHTMLElement(ErrorString*, int nodeId);
+    Node* assertEditableNode(ErrorString*, int nodeId);
+    Element* assertEditableElement(ErrorString*, int nodeId);
 
     int pushNodePathToFrontend(Node*);
     void pushChildNodesToFrontend(int nodeId);
diff --git a/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp b/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
index 9841e2002..d31a0a2b3 100644
--- a/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
+++ b/Source/WebCore/inspector/InspectorFrontendClientLocal.cpp
@@ -138,6 +138,7 @@ void InspectorFrontendClientLocal::windowObjectCleared()
 void InspectorFrontendClientLocal::frontendLoaded()
 {
     bringToFront();
+    setDockingUnavailable(!canAttachWindow());
     m_frontendLoaded = true;
     for (Vector<String>::iterator it = m_evaluateOnLoad.begin(); it != m_evaluateOnLoad.end(); ++it)
         evaluateOnLoad(*it);
@@ -168,6 +169,11 @@ bool InspectorFrontendClientLocal::canAttachWindow()
     return minimumAttachedHeight <= maximumAttachedHeight && !isInspectorPage;
 }
 
+void InspectorFrontendClientLocal::setDockingUnavailable(bool unavailable)
+{
+    evaluateOnLoad(String::format("[\"setDockingUnavailable\", %s]", unavailable ? "true" : "false"));
+}
+
 void InspectorFrontendClientLocal::changeAttachedWindowHeight(unsigned height)
 {
     unsigned totalHeight = m_frontendPage->mainFrame()->view()->visibleHeight() + m_inspectorController->inspectedPage()->mainFrame()->view()->visibleHeight();
@@ -205,7 +211,7 @@ void InspectorFrontendClientLocal::moveWindowBy(float x, float y)
 
 void InspectorFrontendClientLocal::setAttachedWindow(bool attached)
 {
-    evaluateAsBoolean(String::format("InspectorFrontendAPI.setAttachedWindow(%s)", attached ? "true" : "false"));
+    evaluateOnLoad(String::format("[\"setAttachedWindow\", %s]", attached ? "true" : "false"));
 }
 
 void InspectorFrontendClientLocal::restoreAttachedWindowHeight()
diff --git a/Source/WebCore/inspector/InspectorFrontendClientLocal.h b/Source/WebCore/inspector/InspectorFrontendClientLocal.h
index 8292d2289..c49e5783e 100644
--- a/Source/WebCore/inspector/InspectorFrontendClientLocal.h
+++ b/Source/WebCore/inspector/InspectorFrontendClientLocal.h
@@ -77,6 +77,7 @@ public:
     virtual void sendMessageToBackend(const String& message);
 
     bool canAttachWindow();
+    void setDockingUnavailable(bool);
 
     static unsigned constrainedAttachedWindowHeight(unsigned preferredHeight, unsigned totalWindowHeight);
 
diff --git a/Source/WebCore/inspector/InspectorFrontendHost.cpp b/Source/WebCore/inspector/InspectorFrontendHost.cpp
index 01705e8c3..8872abd17 100644
--- a/Source/WebCore/inspector/InspectorFrontendHost.cpp
+++ b/Source/WebCore/inspector/InspectorFrontendHost.cpp
@@ -181,6 +181,11 @@ void InspectorFrontendHost::bringToFront()
         m_client->bringToFront();
 }
 
+void InspectorFrontendHost::setZoomFactor(float zoom)
+{
+    m_frontendPage->mainFrame()->setPageAndTextZoomFactors(zoom, 1);
+}
+
 void InspectorFrontendHost::inspectedURLChanged(const String& newURL)
 {
     if (m_client)
diff --git a/Source/WebCore/inspector/InspectorFrontendHost.h b/Source/WebCore/inspector/InspectorFrontendHost.h
index 5886885be..17d9d3276 100644
--- a/Source/WebCore/inspector/InspectorFrontendHost.h
+++ b/Source/WebCore/inspector/InspectorFrontendHost.h
@@ -63,6 +63,7 @@ public:
     void requestSetDockSide(const String&);
     void closeWindow();
     void bringToFront();
+    void setZoomFactor(float);
     void inspectedURLChanged(const String&);
 
     void setAttachedWindowHeight(unsigned height);
diff --git a/Source/WebCore/inspector/InspectorFrontendHost.idl b/Source/WebCore/inspector/InspectorFrontendHost.idl
index 5a0572035..1127c3b83 100644
--- a/Source/WebCore/inspector/InspectorFrontendHost.idl
+++ b/Source/WebCore/inspector/InspectorFrontendHost.idl
@@ -37,6 +37,7 @@ module core {
         void loaded();
         void closeWindow();
         void bringToFront();
+        void setZoomFactor(in float zoom);
         void inspectedURLChanged(in DOMString newURL);
 
         void requestAttachWindow();
diff --git a/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp b/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
index d767ff656..1cac012da 100644
--- a/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
+++ b/Source/WebCore/inspector/InspectorIndexedDBAgent.cpp
@@ -58,6 +58,7 @@
 #include "InstrumentingAgents.h"
 #include "Page.h"
 #include "PageGroup.h"
+#include "PageGroupIndexedDatabase.h"
 #include "SecurityOrigin.h"
 
 #include <wtf/Vector.h>
@@ -633,7 +634,7 @@ static Document* assertDocument(ErrorString* errorString, const String& frameId,
 static IDBFactoryBackendInterface* assertIDBFactory(ErrorString* errorString, Document* document)
 {
     Page* page = document ? document->page() : 0;
-    IDBFactoryBackendInterface* idbFactory = page ? page->group().idbFactory() : 0;
+    IDBFactoryBackendInterface* idbFactory = page ? PageGroupIndexedDatabase::from(page->group())->factoryBackend() : 0;
 
     if (!idbFactory)
         *errorString = "No IndexedDB factory for given frame found";
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.cpp b/Source/WebCore/inspector/InspectorInstrumentation.cpp
index 532eb8665..27b742c2e 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.cpp
+++ b/Source/WebCore/inspector/InspectorInstrumentation.cpp
@@ -63,6 +63,7 @@
 #include "ScriptArguments.h"
 #include "ScriptCallStack.h"
 #include "ScriptProfile.h"
+#include "StyleRule.h"
 #include "WorkerContext.h"
 #include "WorkerThread.h"
 #include "XMLHttpRequest.h"
@@ -201,6 +202,18 @@ void InspectorInstrumentation::mediaQueryResultChangedImpl(InstrumentingAgents*
         cssAgent->mediaQueryResultChanged();
 }
 
+void InspectorInstrumentation::didPushShadowRootImpl(InstrumentingAgents* instrumentingAgents, Element* host, ShadowRoot* root)
+{
+    if (InspectorDOMAgent* domAgent = instrumentingAgents->inspectorDOMAgent())
+        domAgent->didPushShadowRoot(host, root);
+}
+
+void InspectorInstrumentation::willPopShadowRootImpl(InstrumentingAgents* instrumentingAgents, Element* host, ShadowRoot* root)
+{
+    if (InspectorDOMAgent* domAgent = instrumentingAgents->inspectorDOMAgent())
+        domAgent->willPopShadowRoot(host, root);
+}
+
 void InspectorInstrumentation::mouseDidMoveOverElementImpl(InstrumentingAgents* instrumentingAgents, const HitTestResult& result, unsigned modifierFlags)
 {
     if (InspectorDOMAgent* domAgent = instrumentingAgents->inspectorDOMAgent())
@@ -369,6 +382,12 @@ void InspectorInstrumentation::didFireTimerImpl(const InspectorInstrumentationCo
         timelineAgent->didFireTimer();
 }
 
+void InspectorInstrumentation::didBeginFrameImpl(InstrumentingAgents* instrumentingAgents)
+{
+    if (InspectorTimelineAgent* timelineAgent = instrumentingAgents->inspectorTimelineAgent())
+        timelineAgent->didBeginFrame();
+}
+
 InspectorInstrumentationCookie InspectorInstrumentation::willLayoutImpl(InstrumentingAgents* instrumentingAgents)
 {
     int timelineAgentId = 0;
@@ -452,11 +471,11 @@ void InspectorInstrumentation::didScheduleStyleRecalculationImpl(InstrumentingAg
         resourceAgent->didScheduleStyleRecalculation(document);
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willMatchRuleImpl(InstrumentingAgents* instrumentingAgents, const CSSStyleRule* rule)
+InspectorInstrumentationCookie InspectorInstrumentation::willMatchRuleImpl(InstrumentingAgents* instrumentingAgents, const StyleRule* rule)
 {
     InspectorCSSAgent* cssAgent = instrumentingAgents->inspectorCSSAgent();
     if (cssAgent) {
-        cssAgent->willMatchRule(rule);
+        cssAgent->willMatchRule(rule->ensureCSSStyleRule());
         return InspectorInstrumentationCookie(instrumentingAgents, 1);
     }
 
@@ -470,14 +489,11 @@ void InspectorInstrumentation::didMatchRuleImpl(const InspectorInstrumentationCo
         cssAgent->didMatchRule(matched);
 }
 
-InspectorInstrumentationCookie InspectorInstrumentation::willProcessRuleImpl(InstrumentingAgents* instrumentingAgents, const CSSRule* rule)
+InspectorInstrumentationCookie InspectorInstrumentation::willProcessRuleImpl(InstrumentingAgents* instrumentingAgents, const StyleRule* rule)
 {
-    if (!rule->isStyleRule())
-        return InspectorInstrumentationCookie();
-
     InspectorCSSAgent* cssAgent = instrumentingAgents->inspectorCSSAgent();
     if (cssAgent) {
-        cssAgent->willProcessRule(static_cast<const CSSStyleRule*>(rule));
+        cssAgent->willProcessRule(rule->ensureCSSStyleRule());
         return InspectorInstrumentationCookie(instrumentingAgents, 1);
     }
 
@@ -1051,6 +1067,13 @@ InstrumentingAgents* InspectorInstrumentation::instrumentingAgentsForWorkerConte
         return 0;
     return instrumentationForWorkerContext(workerContext);
 }
+
+InstrumentingAgents* InspectorInstrumentation::instrumentingAgentsForNonDocumentContext(ScriptExecutionContext* context)
+{
+    if (context->isWorkerContext())
+        return instrumentationForWorkerContext(static_cast<WorkerContext*>(context));
+    return 0;
+}
 #endif
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/InspectorInstrumentation.h b/Source/WebCore/inspector/InspectorInstrumentation.h
index 5d5c2d3d3..2ac74dac0 100644
--- a/Source/WebCore/inspector/InspectorInstrumentation.h
+++ b/Source/WebCore/inspector/InspectorInstrumentation.h
@@ -42,7 +42,6 @@
 namespace WebCore {
 
 class CSSRule;
-class CSSStyleRule;
 class CharacterData;
 class DOMFileSystem;
 class DOMWindow;
@@ -64,7 +63,9 @@ class ScriptArguments;
 class ScriptCallStack;
 class ScriptExecutionContext;
 class ScriptProfile;
+class ShadowRoot;
 class StorageArea;
+class StyleRule;
 class WorkerContext;
 class WorkerContextProxy;
 class XMLHttpRequest;
@@ -93,6 +94,8 @@ public:
     static void didInvalidateStyleAttr(Document*, Node*);
     static void frameWindowDiscarded(Frame*, DOMWindow*);
     static void mediaQueryResultChanged(Document*);
+    static void didPushShadowRoot(Element* host, ShadowRoot*);
+    static void willPopShadowRoot(Element* host, ShadowRoot*);
 
     static void mouseDidMoveOverElement(Page*, const HitTestResult&, unsigned modifierFlags);
     static bool handleMousePress(Page*);
@@ -103,7 +106,7 @@ public:
     static void didInstallTimer(ScriptExecutionContext*, int timerId, int timeout, bool singleShot);
     static void didRemoveTimer(ScriptExecutionContext*, int timerId);
 
-    static InspectorInstrumentationCookie willCallFunction(Page*, const String& scriptName, int scriptLine);
+    static InspectorInstrumentationCookie willCallFunction(ScriptExecutionContext*, const String& scriptName, int scriptLine);
     static void didCallFunction(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willChangeXHRReadyState(ScriptExecutionContext*, XMLHttpRequest* request);
     static void didChangeXHRReadyState(const InspectorInstrumentationCookie&);
@@ -117,6 +120,7 @@ public:
     static void didEvaluateScript(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willFireTimer(ScriptExecutionContext*, int timerId);
     static void didFireTimer(const InspectorInstrumentationCookie&);
+    static void didBeginFrame(Page*);
     static InspectorInstrumentationCookie willLayout(Frame*);
     static void didLayout(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willLoadXHR(ScriptExecutionContext*, XMLHttpRequest*);
@@ -126,9 +130,9 @@ public:
     static InspectorInstrumentationCookie willRecalculateStyle(Document*);
     static void didRecalculateStyle(const InspectorInstrumentationCookie&);
     static void didScheduleStyleRecalculation(Document*);
-    static InspectorInstrumentationCookie willMatchRule(Document*, const CSSStyleRule*);
+    static InspectorInstrumentationCookie willMatchRule(Document*, const StyleRule*);
     static void didMatchRule(const InspectorInstrumentationCookie&, bool matched);
-    static InspectorInstrumentationCookie willProcessRule(Document*, const CSSRule*);
+    static InspectorInstrumentationCookie willProcessRule(Document*, const StyleRule*);
     static void didProcessRule(const InspectorInstrumentationCookie&);
 
     static void applyUserAgentOverride(Frame*, String*);
@@ -243,6 +247,8 @@ private:
     static void didInvalidateStyleAttrImpl(InstrumentingAgents*, Node*);
     static void frameWindowDiscardedImpl(InstrumentingAgents*, DOMWindow*);
     static void mediaQueryResultChangedImpl(InstrumentingAgents*);
+    static void didPushShadowRootImpl(InstrumentingAgents*, Element* host, ShadowRoot*);
+    static void willPopShadowRootImpl(InstrumentingAgents*, Element* host, ShadowRoot*);
 
     static void mouseDidMoveOverElementImpl(InstrumentingAgents*, const HitTestResult&, unsigned modifierFlags);
     static bool handleMousePressImpl(InstrumentingAgents*);
@@ -267,6 +273,7 @@ private:
     static void didEvaluateScriptImpl(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willFireTimerImpl(InstrumentingAgents*, int timerId);
     static void didFireTimerImpl(const InspectorInstrumentationCookie&);
+    static void didBeginFrameImpl(InstrumentingAgents*);
     static InspectorInstrumentationCookie willLayoutImpl(InstrumentingAgents*);
     static void didLayoutImpl(const InspectorInstrumentationCookie&);
     static InspectorInstrumentationCookie willLoadXHRImpl(InstrumentingAgents*, XMLHttpRequest*);
@@ -276,9 +283,9 @@ private:
     static InspectorInstrumentationCookie willRecalculateStyleImpl(InstrumentingAgents*);
     static void didRecalculateStyleImpl(const InspectorInstrumentationCookie&);
     static void didScheduleStyleRecalculationImpl(InstrumentingAgents*, Document*);
-    static InspectorInstrumentationCookie willMatchRuleImpl(InstrumentingAgents*, const CSSStyleRule*);
+    static InspectorInstrumentationCookie willMatchRuleImpl(InstrumentingAgents*, const StyleRule*);
     static void didMatchRuleImpl(const InspectorInstrumentationCookie&, bool matched);
-    static InspectorInstrumentationCookie willProcessRuleImpl(InstrumentingAgents*, const CSSRule*);
+    static InspectorInstrumentationCookie willProcessRuleImpl(InstrumentingAgents*, const StyleRule*);
     static void didProcessRuleImpl(const InspectorInstrumentationCookie&);
 
     static void applyUserAgentOverrideImpl(InstrumentingAgents*, String*);
@@ -367,6 +374,7 @@ private:
     static InstrumentingAgents* instrumentingAgentsForDocument(Document*);
 #if ENABLE(WORKERS)
     static InstrumentingAgents* instrumentingAgentsForWorkerContext(WorkerContext*);
+    static InstrumentingAgents* instrumentingAgentsForNonDocumentContext(ScriptExecutionContext*);
 #endif
 
     static bool collectingHTMLParseErrors(InstrumentingAgents*);
@@ -478,6 +486,24 @@ inline void InspectorInstrumentation::mediaQueryResultChanged(Document* document
 #endif
 }
 
+inline void InspectorInstrumentation::didPushShadowRoot(Element* host, ShadowRoot* root)
+{
+#if ENABLE(INSPECTOR)
+    FAST_RETURN_IF_NO_FRONTENDS(void());
+    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForDocument(host->ownerDocument()))
+        didPushShadowRootImpl(instrumentingAgents, host, root);
+#endif
+}
+
+inline void InspectorInstrumentation::willPopShadowRoot(Element* host, ShadowRoot* root)
+{
+#if ENABLE(INSPECTOR)
+    FAST_RETURN_IF_NO_FRONTENDS(void());
+    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForDocument(host->ownerDocument()))
+        willPopShadowRootImpl(instrumentingAgents, host, root);
+#endif
+}
+
 inline void InspectorInstrumentation::mouseDidMoveOverElement(Page* page, const HitTestResult& result, unsigned modifierFlags)
 {
 #if ENABLE(INSPECTOR)
@@ -552,16 +578,17 @@ inline void InspectorInstrumentation::didRemoveTimer(ScriptExecutionContext* con
 #endif
 }
 
-inline InspectorInstrumentationCookie InspectorInstrumentation::willCallFunction(Page* page, const String& scriptName, int scriptLine)
+inline InspectorInstrumentationCookie InspectorInstrumentation::willCallFunction(ScriptExecutionContext* context, const String& scriptName, int scriptLine)
 {
 #if ENABLE(INSPECTOR)
     FAST_RETURN_IF_NO_FRONTENDS(InspectorInstrumentationCookie());
-    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForPage(page))
+    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForContext(context))
         return willCallFunctionImpl(instrumentingAgents, scriptName, scriptLine);
 #endif
     return InspectorInstrumentationCookie();
 }
 
+
 inline void InspectorInstrumentation::didCallFunction(const InspectorInstrumentationCookie& cookie)
 {
 #if ENABLE(INSPECTOR)
@@ -685,6 +712,15 @@ inline void InspectorInstrumentation::didFireTimer(const InspectorInstrumentatio
 #endif
 }
 
+inline void InspectorInstrumentation::didBeginFrame(Page* page)
+{
+#if ENABLE(INSPECTOR)
+    FAST_RETURN_IF_NO_FRONTENDS(void());
+    if (InstrumentingAgents* instrumentingAgents = instrumentingAgentsForPage(page))
+        didBeginFrameImpl(instrumentingAgents);
+#endif
+}
+
 inline InspectorInstrumentationCookie InspectorInstrumentation::willLayout(Frame* frame)
 {
 #if ENABLE(INSPECTOR)
@@ -770,7 +806,7 @@ inline void InspectorInstrumentation::didScheduleStyleRecalculation(Document* do
 #endif
 }
 
-inline InspectorInstrumentationCookie InspectorInstrumentation::willMatchRule(Document* document, const CSSStyleRule* rule)
+inline InspectorInstrumentationCookie InspectorInstrumentation::willMatchRule(Document* document, const StyleRule* rule)
 {
 #if ENABLE(INSPECTOR)
     FAST_RETURN_IF_NO_FRONTENDS(InspectorInstrumentationCookie());
@@ -789,7 +825,7 @@ inline void InspectorInstrumentation::didMatchRule(const InspectorInstrumentatio
 #endif
 }
 
-inline InspectorInstrumentationCookie InspectorInstrumentation::willProcessRule(Document* document, const CSSRule* rule)
+inline InspectorInstrumentationCookie InspectorInstrumentation::willProcessRule(Document* document, const StyleRule* rule)
 {
 #if ENABLE(INSPECTOR)
     FAST_RETURN_IF_NO_FRONTENDS(InspectorInstrumentationCookie());
@@ -1218,9 +1254,15 @@ inline bool InspectorInstrumentation::collectingHTMLParseErrors(Page* page)
 
 inline InstrumentingAgents* InspectorInstrumentation::instrumentingAgentsForContext(ScriptExecutionContext* context)
 {
-    if (context && context->isDocument())
+    if (!context)
+        return 0;
+    if (context->isDocument())
         return instrumentingAgentsForPage(static_cast<Document*>(context)->page());
+#if ENABLE(WORKERS)
+    return instrumentingAgentsForNonDocumentContext(context);
+#else
     return 0;
+#endif
 }
 
 inline InstrumentingAgents* InspectorInstrumentation::instrumentingAgentsForFrame(Frame* frame)
diff --git a/Source/WebCore/inspector/InspectorPageAgent.cpp b/Source/WebCore/inspector/InspectorPageAgent.cpp
index 8e8b25abf..55384f2a2 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.cpp
+++ b/Source/WebCore/inspector/InspectorPageAgent.cpp
@@ -131,20 +131,18 @@ static bool hasTextContent(CachedResource* cachedResource)
     return type == InspectorPageAgent::StylesheetResource || type == InspectorPageAgent::ScriptResource || type == InspectorPageAgent::XHRResource;
 }
 
-// static
-PassRefPtr<TextResourceDecoder> InspectorPageAgent::createDecoder(const String& mimeType, const String& textEncodingName)
+static PassRefPtr<TextResourceDecoder> createXHRTextDecoder(const String& mimeType, const String& textEncodingName)
 {
     RefPtr<TextResourceDecoder> decoder;
     if (!textEncodingName.isEmpty())
         decoder = TextResourceDecoder::create("text/plain", textEncodingName);
-    else if (mimeType == "text/plain")
-        decoder = TextResourceDecoder::create("text/plain", "ISO-8859-1");
-    else if (mimeType == "text/html")
-        decoder = TextResourceDecoder::create("text/html", "UTF-8");
-    else if (DOMImplementation::isXMLMIMEType(mimeType)) {
+    else if (DOMImplementation::isXMLMIMEType(mimeType.lower())) {
         decoder = TextResourceDecoder::create("application/xml");
         decoder->useLenientXMLDecoding();
-    }
+    } else if (equalIgnoringCase(mimeType, "text/html"))
+        decoder = TextResourceDecoder::create("text/html", "UTF-8");
+    else
+        decoder = TextResourceDecoder::create("text/plain", "UTF-8");
     return decoder;
 }
 
@@ -174,7 +172,7 @@ bool InspectorPageAgent::cachedResourceContent(CachedResource* cachedResource, S
     if (cachedResource) {
         switch (cachedResource->type()) {
         case CachedResource::CSSStyleSheet:
-            *result = static_cast<CachedCSSStyleSheet*>(cachedResource)->sheetText();
+            *result = static_cast<CachedCSSStyleSheet*>(cachedResource)->sheetText(false);
             return true;
         case CachedResource::Script:
             *result = static_cast<CachedScript*>(cachedResource)->script();
@@ -183,7 +181,7 @@ bool InspectorPageAgent::cachedResourceContent(CachedResource* cachedResource, S
             SharedBuffer* buffer = cachedResource->data();
             if (!buffer)
                 return false;
-            RefPtr<TextResourceDecoder> decoder = InspectorPageAgent::createDecoder(cachedResource->response().mimeType(), cachedResource->response().textEncodingName());
+            RefPtr<TextResourceDecoder> decoder = createXHRTextDecoder(cachedResource->response().mimeType(), cachedResource->response().textEncodingName());
             // We show content for raw resources only for certain mime types (text, html and xml). Otherwise decoder will be null.
             if (!decoder)
                 return false;
diff --git a/Source/WebCore/inspector/InspectorPageAgent.h b/Source/WebCore/inspector/InspectorPageAgent.h
index 8fd7b4208..df95ee20f 100644
--- a/Source/WebCore/inspector/InspectorPageAgent.h
+++ b/Source/WebCore/inspector/InspectorPageAgent.h
@@ -78,7 +78,6 @@ public:
 
     static PassOwnPtr<InspectorPageAgent> create(InstrumentingAgents*, Page*, InspectorState*, InjectedScriptManager*, InspectorClient*);
 
-    static PassRefPtr<TextResourceDecoder> createDecoder(const String& mimeType, const String& textEncodingName);
     static bool cachedResourceContent(CachedResource*, String* result, bool* base64Encoded);
     static bool sharedBufferContent(PassRefPtr<SharedBuffer>, const String& textEncodingName, bool withBase64Encode, String* result);
     static void resourceContent(ErrorString*, Frame*, const KURL&, String* result, bool* base64Encoded);
diff --git a/Source/WebCore/inspector/InspectorProfilerAgent.cpp b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
index 08e9ea63a..388653fcd 100644
--- a/Source/WebCore/inspector/InspectorProfilerAgent.cpp
+++ b/Source/WebCore/inspector/InspectorProfilerAgent.cpp
@@ -50,10 +50,6 @@
 #include <wtf/OwnPtr.h>
 #include <wtf/text/StringConcatenate.h>
 
-#if USE(JSC)
-#include "JSDOMWindow.h"
-#endif
-
 namespace WebCore {
 
 namespace ProfilerAgentState {
@@ -65,15 +61,63 @@ static const char* const UserInitiatedProfileName = "org.webkit.profiles.user-in
 static const char* const CPUProfileType = "CPU";
 static const char* const HeapProfileType = "HEAP";
 
+
+class PageProfilerAgent : public InspectorProfilerAgent {
+public:
+    PageProfilerAgent(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, Page* inspectedPage, InspectorState* state, InjectedScriptManager* injectedScriptManager)
+        : InspectorProfilerAgent(instrumentingAgents, consoleAgent, state, injectedScriptManager), m_inspectedPage(inspectedPage) { }
+    virtual ~PageProfilerAgent() { }
+
+private:
+    virtual void startProfiling(const String& title)
+    {
+        ScriptProfiler::startForPage(m_inspectedPage, title);
+    }
+
+    virtual PassRefPtr<ScriptProfile> stopProfiling(const String& title)
+    {
+        return ScriptProfiler::stopForPage(m_inspectedPage, title);
+    }
+
+    Page* m_inspectedPage;
+};
+
 PassOwnPtr<InspectorProfilerAgent> InspectorProfilerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, Page* inspectedPage, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
 {
-    return adoptPtr(new InspectorProfilerAgent(instrumentingAgents, consoleAgent, inspectedPage, inspectorState, injectedScriptManager));
+    return adoptPtr(new PageProfilerAgent(instrumentingAgents, consoleAgent, inspectedPage, inspectorState, injectedScriptManager));
+}
+
+
+#if ENABLE(WORKERS)
+class WorkerProfilerAgent : public InspectorProfilerAgent {
+public:
+    WorkerProfilerAgent(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, WorkerContext* workerContext, InspectorState* state, InjectedScriptManager* injectedScriptManager)
+        : InspectorProfilerAgent(instrumentingAgents, consoleAgent, state, injectedScriptManager), m_workerContext(workerContext) { }
+    virtual ~WorkerProfilerAgent() { }
+
+private:
+    virtual void startProfiling(const String& title)
+    {
+        ScriptProfiler::startForWorkerContext(m_workerContext, title);
+    }
+
+    virtual PassRefPtr<ScriptProfile> stopProfiling(const String& title)
+    {
+        return ScriptProfiler::stopForWorkerContext(m_workerContext, title);
+    }
+
+    WorkerContext* m_workerContext;
+};
+
+PassOwnPtr<InspectorProfilerAgent> InspectorProfilerAgent::create(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, WorkerContext* workerContext, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
+{
+    return adoptPtr(new WorkerProfilerAgent(instrumentingAgents, consoleAgent, workerContext, inspectorState, injectedScriptManager));
 }
+#endif
 
-InspectorProfilerAgent::InspectorProfilerAgent(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, Page* inspectedPage, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
+InspectorProfilerAgent::InspectorProfilerAgent(InstrumentingAgents* instrumentingAgents, InspectorConsoleAgent* consoleAgent, InspectorState* inspectorState, InjectedScriptManager* injectedScriptManager)
     : InspectorBaseAgent<InspectorProfilerAgent>("Profiler", instrumentingAgents, inspectorState)
     , m_consoleAgent(consoleAgent)
-    , m_inspectedPage(inspectedPage)
     , m_injectedScriptManager(injectedScriptManager)
     , m_frontend(0)
     , m_enabled(false)
@@ -318,12 +362,7 @@ void InspectorProfilerAgent::start(ErrorString*)
     }
     m_recordingUserInitiatedProfile = true;
     String title = getCurrentUserInitiatedProfileName(true);
-#if USE(JSC)
-    JSC::ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame(), debuggerWorld())->globalExec();
-#else
-    ScriptState* scriptState = 0;
-#endif
-    ScriptProfiler::start(scriptState, title);
+    startProfiling(title);
     addStartProfilingMessageToConsole(title, 0, String());
     toggleRecordButton(true);
     m_state->setBoolean(ProfilerAgentState::userInitiatedProfiling, true);
@@ -335,14 +374,7 @@ void InspectorProfilerAgent::stop(ErrorString*)
         return;
     m_recordingUserInitiatedProfile = false;
     String title = getCurrentUserInitiatedProfileName();
-#if USE(JSC)
-    JSC::ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame(), debuggerWorld())->globalExec();
-#else
-    // Use null script state to avoid filtering by context security token.
-    // All functions from all iframes should be visible from Inspector UI.
-    ScriptState* scriptState = 0;
-#endif
-    RefPtr<ScriptProfile> profile = ScriptProfiler::stop(scriptState, title);
+    RefPtr<ScriptProfile> profile = stopProfiling(title);
     if (profile)
         addProfile(profile, 0, String());
     toggleRecordButton(false);
diff --git a/Source/WebCore/inspector/InspectorProfilerAgent.h b/Source/WebCore/inspector/InspectorProfilerAgent.h
index a5576d899..e0b05a826 100644
--- a/Source/WebCore/inspector/InspectorProfilerAgent.h
+++ b/Source/WebCore/inspector/InspectorProfilerAgent.h
@@ -52,6 +52,7 @@ class InstrumentingAgents;
 class Page;
 class ScriptHeapSnapshot;
 class ScriptProfile;
+class WorkerContext;
 
 typedef String ErrorString;
 
@@ -59,6 +60,9 @@ class InspectorProfilerAgent : public InspectorBaseAgent<InspectorProfilerAgent>
     WTF_MAKE_NONCOPYABLE(InspectorProfilerAgent); WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassOwnPtr<InspectorProfilerAgent> create(InstrumentingAgents*, InspectorConsoleAgent*, Page*, InspectorState*, InjectedScriptManager*);
+#if ENABLE(WORKERS)
+    static PassOwnPtr<InspectorProfilerAgent> create(InstrumentingAgents*, InspectorConsoleAgent*, WorkerContext*, InspectorState*, InjectedScriptManager*);
+#endif
     virtual ~InspectorProfilerAgent();
 
     void addProfile(PassRefPtr<ScriptProfile> prpProfile, unsigned lineNumber, const String& sourceURL);
@@ -94,6 +98,11 @@ public:
 
     virtual void getObjectByHeapObjectId(ErrorString*, int id, const String* objectGroup, RefPtr<InspectorObject>& result);
 
+protected:
+    InspectorProfilerAgent(InstrumentingAgents*, InspectorConsoleAgent*, InspectorState*, InjectedScriptManager*);
+    virtual void startProfiling(const String& title) = 0;
+    virtual PassRefPtr<ScriptProfile> stopProfiling(const String& title) = 0;
+
 private:
     typedef HashMap<unsigned int, RefPtr<ScriptProfile> > ProfilesMap;
     typedef HashMap<unsigned int, RefPtr<ScriptHeapSnapshot> > HeapSnapshotsMap;
@@ -101,12 +110,10 @@ private:
     void resetFrontendProfiles();
     void restoreEnablement();
 
-    InspectorProfilerAgent(InstrumentingAgents*, InspectorConsoleAgent*, Page*, InspectorState*, InjectedScriptManager*);
     PassRefPtr<InspectorObject> createProfileHeader(const ScriptProfile& profile);
     PassRefPtr<InspectorObject> createSnapshotHeader(const ScriptHeapSnapshot& snapshot);
 
     InspectorConsoleAgent* m_consoleAgent;
-    Page* m_inspectedPage;
     InjectedScriptManager* m_injectedScriptManager;
     InspectorFrontend::Profiler* m_frontend;
     bool m_enabled;
diff --git a/Source/WebCore/inspector/InspectorStyleSheet.cpp b/Source/WebCore/inspector/InspectorStyleSheet.cpp
index b72461e17..bf13ac917 100644
--- a/Source/WebCore/inspector/InspectorStyleSheet.cpp
+++ b/Source/WebCore/inspector/InspectorStyleSheet.cpp
@@ -30,12 +30,14 @@
 #include "CSSImportRule.h"
 #include "CSSMediaRule.h"
 #include "CSSParser.h"
+#include "CSSPropertyNames.h"
 #include "CSSPropertySourceData.h"
 #include "CSSRule.h"
 #include "CSSRuleList.h"
 #include "CSSStyleRule.h"
 #include "CSSStyleSelector.h"
 #include "CSSStyleSheet.h"
+#include "ContentSecurityPolicy.h"
 #include "Document.h"
 #include "Element.h"
 #include "HTMLHeadElement.h"
@@ -46,6 +48,7 @@
 #include "InspectorValues.h"
 #include "Node.h"
 #include "SVGNames.h"
+#include "StyleRule.h"
 #include "StyleSheetList.h"
 #include "WebKitCSSKeyframesRule.h"
 
@@ -329,6 +332,10 @@ bool InspectorStyle::setPropertyText(unsigned index, const String& propertyText,
 
     InspectorStyleTextEditor editor(&allProperties, &m_disabledProperties, text, newLineAndWhitespaceDelimiters());
     if (overwrite) {
+        if (index >= allProperties.size()) {
+            ec = INDEX_SIZE_ERR;
+            return false;
+        }
         *oldText = allProperties.at(index).rawText;
         editor.replaceProperty(index, propertyText);
     } else
@@ -478,7 +485,10 @@ void InspectorStyle::populateObjectWithStyleProperties(InspectorObject* result)
                 // Parsed property overrides any property with the same name. Non-parsed property overrides
                 // previous non-parsed property with the same name (if any).
                 bool shouldInactivate = false;
-                HashMap<String, RefPtr<InspectorObject> >::iterator activeIt = propertyNameToPreviousActiveProperty.find(name);
+                CSSPropertyID propertyId = static_cast<CSSPropertyID>(cssPropertyID(name));
+                // Canonicalize property names to treat non-prefixed and vendor-prefixed property names the same (opacity vs. -webkit-opacity).
+                String canonicalPropertyName = propertyId ? String(getPropertyName(propertyId)) : name;
+                HashMap<String, RefPtr<InspectorObject> >::iterator activeIt = propertyNameToPreviousActiveProperty.find(canonicalPropertyName);
                 if (activeIt != propertyNameToPreviousActiveProperty.end()) {
                     if (propertyEntry.parsedOk)
                         shouldInactivate = true;
@@ -489,12 +499,12 @@ void InspectorStyle::populateObjectWithStyleProperties(InspectorObject* result)
                             shouldInactivate = true;
                     }
                 } else
-                    propertyNameToPreviousActiveProperty.set(name, property);
+                    propertyNameToPreviousActiveProperty.set(canonicalPropertyName, property);
 
                 if (shouldInactivate) {
                     activeIt->second->setString("status", "inactive");
                     activeIt->second->remove("shorthandName");
-                    propertyNameToPreviousActiveProperty.set(name, property);
+                    propertyNameToPreviousActiveProperty.set(canonicalPropertyName, property);
                 }
             } else {
                 bool implicit = m_style->isPropertyImplicit(name);
@@ -862,7 +872,7 @@ PassRefPtr<InspectorObject> InspectorStyleSheet::buildObjectForRule(CSSStyleRule
     // "sourceURL" is present only for regular rules, otherwise "origin" should be used in the frontend.
     if (m_origin == "regular")
         result->setString("sourceURL", finalURL());
-    result->setNumber("sourceLine", rule->sourceLine());
+    result->setNumber("sourceLine", rule->styleRule()->sourceLine());
     result->setString("origin", m_origin);
 
     result->setObject("style", buildObjectForStyle(rule->style()));
@@ -1148,7 +1158,7 @@ void InspectorStyleSheet::revalidateStyle(CSSStyleDeclaration* pageStyle)
     for (unsigned i = 0, size = m_flatRules.size(); i < size; ++i) {
         CSSStyleRule* parsedRule = m_flatRules.at(i);
         if (parsedRule->style() == pageStyle) {
-            if (parsedRule->declaration()->asText() != pageStyle->cssText()) {
+            if (parsedRule->styleRule()->properties()->asText() != pageStyle->cssText()) {
                 // Clear the disabled properties for the invalid style here.
                 m_inspectorStyles.remove(pageStyle);
                 setStyleText(pageStyle, pageStyle->cssText());
@@ -1318,7 +1328,12 @@ bool InspectorStyleSheetForInlineStyle::setStyleText(CSSStyleDeclaration* style,
 {
     ASSERT_UNUSED(style, style == inlineStyle());
     ExceptionCode ec = 0;
-    m_element->setAttribute("style", text, ec);
+
+    {
+        InspectorCSSAgent::InlineStyleOverrideScope overrideScope(m_element->ownerDocument());
+        m_element->setAttribute("style", text, ec);
+    }
+
     m_styleText = text;
     m_isStyleTextValid = true;
     m_ruleSourceData.clear();
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.cpp b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
index ed7d143d5..7d4703731 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.cpp
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -60,6 +60,8 @@ static const char EventDispatch[] = "EventDispatch";
 static const char Layout[] = "Layout";
 static const char RecalculateStyles[] = "RecalculateStyles";
 static const char Paint[] = "Paint";
+static const char BeginFrame[] = "BeginFrame";
+
 static const char ParseHTML[] = "ParseHTML";
 
 static const char TimerInstall[] = "TimerInstall";
@@ -98,9 +100,9 @@ void InspectorTimelineAgent::pushGCEventRecords()
     GCEvents events = m_gcEvents;
     m_gcEvents.clear();
     for (GCEvents::iterator i = events.begin(); i != events.end(); ++i) {
-        RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(i->startTime, m_maxCallStackDepth);
+        RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(timestampFromMicroseconds(i->startTime), m_maxCallStackDepth);
         record->setObject("data", TimelineRecordFactory::createGCEventData(i->collectedBytes));
-        record->setNumber("endTime", i->endTime);
+        record->setNumber("endTime", timestampFromMicroseconds(i->endTime));
         addRecordToTimeline(record.release(), TimelineRecordType::GCEvent);
     }
 }
@@ -146,7 +148,7 @@ void InspectorTimelineAgent::start(ErrorString*, const int* maxCallStackDepth)
     else
         m_maxCallStackDepth = 5;
     m_state->setLong(TimelineAgentState::timelineMaxCallStackDepth, m_maxCallStackDepth);
-
+    m_timestampOffset = currentTime() - monotonicallyIncreasingTime();
     m_instrumentingAgents->setInspectorTimelineAgent(this);
     ScriptGCEvent::addEventListener(this);
     m_state->setBoolean(TimelineAgentState::timelineAgentEnabled, true);
@@ -170,6 +172,11 @@ void InspectorTimelineAgent::setIncludeMemoryDetails(ErrorString*, bool value)
     m_state->setBoolean(TimelineAgentState::includeMemoryDetails, value);
 }
 
+void InspectorTimelineAgent::didBeginFrame()
+{
+    appendRecord(InspectorObject::create(), TimelineRecordType::BeginFrame, true);
+}
+
 void InspectorTimelineAgent::willCallFunction(const String& scriptName, int scriptLine)
 {
     pushCurrentRecord(TimelineRecordFactory::createFunctionCallData(scriptName, scriptLine), TimelineRecordType::FunctionCall, true);
@@ -292,7 +299,7 @@ void InspectorTimelineAgent::didScheduleResourceRequest(const String& url)
 void InspectorTimelineAgent::willSendResourceRequest(unsigned long identifier, const ResourceRequest& request)
 {
     pushGCEventRecords();
-    RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS(), m_maxCallStackDepth);
+    RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(timestamp(), m_maxCallStackDepth);
     String requestId = IdentifiersFactory::requestId(identifier);
     record->setObject("data", TimelineRecordFactory::createResourceSendRequestData(requestId, request));
     record->setString("type", TimelineRecordType::ResourceSendRequest);
@@ -391,9 +398,9 @@ void InspectorTimelineAgent::setHeapSizeStatistic(InspectorObject* record)
 
     if (m_state->getBoolean(TimelineAgentState::includeMemoryDetails)) {
         RefPtr<InspectorObject> counters = InspectorObject::create();
-        counters->setNumber("nodes", InspectorCounters::counterValue(InspectorCounters::NodeCounter));
-        counters->setNumber("documents", InspectorCounters::counterValue(InspectorCounters::DocumentCounter));
-        counters->setNumber("jsEventListeners", InspectorCounters::counterValue(InspectorCounters::JSEventListenerCounter));
+        counters->setNumber("nodes", (m_inspectorType == PageInspector) ? InspectorCounters::counterValue(InspectorCounters::NodeCounter) : 0);
+        counters->setNumber("documents", (m_inspectorType == PageInspector) ? InspectorCounters::counterValue(InspectorCounters::DocumentCounter) : 0);
+        counters->setNumber("jsEventListeners", ThreadLocalInspectorCounters::current().counterValue(ThreadLocalInspectorCounters::JSEventListenerCounter));
         record->setObject("counters", counters.release());
     }
 }
@@ -409,23 +416,24 @@ void InspectorTimelineAgent::didCompleteCurrentRecord(const String& type)
         ASSERT(entry.type == type);
         entry.record->setObject("data", entry.data);
         entry.record->setArray("children", entry.children);
-        entry.record->setNumber("endTime", WTF::currentTimeMS());
+        entry.record->setNumber("endTime", timestamp());
         addRecordToTimeline(entry.record, type);
     }
 }
 
-InspectorTimelineAgent::InspectorTimelineAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state)
+InspectorTimelineAgent::InspectorTimelineAgent(InstrumentingAgents* instrumentingAgents, InspectorState* state, InspectorType type)
     : InspectorBaseAgent<InspectorTimelineAgent>("Timeline", instrumentingAgents, state)
     , m_frontend(0)
     , m_id(1)
     , m_maxCallStackDepth(5)
+    , m_inspectorType(type)
 {
 }
 
 void InspectorTimelineAgent::appendRecord(PassRefPtr<InspectorObject> data, const String& type, bool captureCallStack)
 {
     pushGCEventRecords();
-    RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS(), captureCallStack ? m_maxCallStackDepth : 0);
+    RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(timestamp(), captureCallStack ? m_maxCallStackDepth : 0);
     record->setObject("data", data);
     record->setString("type", type);
     addRecordToTimeline(record.release(), type);
@@ -434,7 +442,7 @@ void InspectorTimelineAgent::appendRecord(PassRefPtr<InspectorObject> data, cons
 void InspectorTimelineAgent::pushCurrentRecord(PassRefPtr<InspectorObject> data, const String& type, bool captureCallStack)
 {
     pushGCEventRecords();
-    RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS(), captureCallStack ? m_maxCallStackDepth : 0);
+    RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(timestamp(), captureCallStack ? m_maxCallStackDepth : 0);
     m_recordStack.append(TimelineRecordEntry(record.release(), data, InspectorArray::create(), type));
 }
 
@@ -444,6 +452,16 @@ void InspectorTimelineAgent::clearRecordStack()
     m_id++;
 }
 
+double InspectorTimelineAgent::timestamp()
+{
+    return timestampFromMicroseconds(WTF::monotonicallyIncreasingTime());
+}
+
+double InspectorTimelineAgent::timestampFromMicroseconds(double microseconds)
+{
+    return (microseconds + m_timestampOffset) * 1000.0;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/Source/WebCore/inspector/InspectorTimelineAgent.h b/Source/WebCore/inspector/InspectorTimelineAgent.h
index e8c34869a..ba9855a30 100644
--- a/Source/WebCore/inspector/InspectorTimelineAgent.h
+++ b/Source/WebCore/inspector/InspectorTimelineAgent.h
@@ -56,9 +56,10 @@ typedef String ErrorString;
 class InspectorTimelineAgent : public InspectorBaseAgent<InspectorTimelineAgent>, ScriptGCEventListener, public InspectorBackendDispatcher::TimelineCommandHandler {
     WTF_MAKE_NONCOPYABLE(InspectorTimelineAgent);
 public:
-    static PassOwnPtr<InspectorTimelineAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state)
+    enum InspectorType { PageInspector, WorkerInspector };
+    static PassOwnPtr<InspectorTimelineAgent> create(InstrumentingAgents* instrumentingAgents, InspectorState* state, InspectorType type)
     {
-        return adoptPtr(new InspectorTimelineAgent(instrumentingAgents, state));
+        return adoptPtr(new InspectorTimelineAgent(instrumentingAgents, state, type));
     }
 
     ~InspectorTimelineAgent();
@@ -82,6 +83,8 @@ public:
     void willDispatchEvent(const Event&);
     void didDispatchEvent();
 
+    void didBeginFrame();
+
     void willLayout();
     void didLayout();
 
@@ -140,7 +143,7 @@ private:
         String type;
     };
         
-    InspectorTimelineAgent(InstrumentingAgents*, InspectorState*);
+    InspectorTimelineAgent(InstrumentingAgents*, InspectorState*, InspectorType);
 
     void pushCurrentRecord(PassRefPtr<InspectorObject>, const String& type, bool captureCallStack);
     void setHeapSizeStatistic(InspectorObject* record);
@@ -153,7 +156,11 @@ private:
     void pushGCEventRecords();
     void clearRecordStack();
 
+    double timestamp();
+    double timestampFromMicroseconds(double microseconds);
+
     InspectorFrontend::Timeline* m_frontend;
+    double m_timestampOffset;
 
     Vector<TimelineRecordEntry> m_recordStack;
 
@@ -170,6 +177,7 @@ private:
     typedef Vector<GCEvent> GCEvents;
     GCEvents m_gcEvents;
     int m_maxCallStackDepth;
+    InspectorType m_inspectorType;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/inspector/NetworkResourcesData.cpp b/Source/WebCore/inspector/NetworkResourcesData.cpp
index bc519e670..61fd2c83f 100644
--- a/Source/WebCore/inspector/NetworkResourcesData.cpp
+++ b/Source/WebCore/inspector/NetworkResourcesData.cpp
@@ -29,6 +29,7 @@
 #include "config.h"
 #include "NetworkResourcesData.h"
 
+#include "DOMImplementation.h"
 #include "SharedBuffer.h"
 #include "TextResourceDecoder.h"
 
@@ -122,6 +123,21 @@ void NetworkResourcesData::resourceCreated(const String& requestId, const String
     m_requestIdToResourceDataMap.set(requestId, new ResourceData(requestId, loaderId));
 }
 
+static PassRefPtr<TextResourceDecoder> createOtherResourceTextDecoder(const String& mimeType, const String& textEncodingName)
+{
+    RefPtr<TextResourceDecoder> decoder;
+    if (!textEncodingName.isEmpty())
+        decoder = TextResourceDecoder::create("text/plain", textEncodingName);
+    else if (DOMImplementation::isXMLMIMEType(mimeType.lower())) {
+        decoder = TextResourceDecoder::create("application/xml");
+        decoder->useLenientXMLDecoding();
+    } else if (equalIgnoringCase(mimeType, "text/html"))
+        decoder = TextResourceDecoder::create("text/html", "UTF-8");
+    else if (mimeType == "text/plain")
+        decoder = TextResourceDecoder::create("text/plain", "ISO-8859-1");
+    return decoder;
+}
+
 void NetworkResourcesData::responseReceived(const String& requestId, const String& frameId, const ResourceResponse& response)
 {
     ResourceData* resourceData = m_requestIdToResourceDataMap.get(requestId);
@@ -129,7 +145,7 @@ void NetworkResourcesData::responseReceived(const String& requestId, const Strin
         return;
     resourceData->setFrameId(frameId);
     resourceData->setUrl(response.url());
-    resourceData->setDecoder(InspectorPageAgent::createDecoder(response.mimeType(), response.textEncodingName()));
+    resourceData->setDecoder(createOtherResourceTextDecoder(response.mimeType(), response.textEncodingName()));
 }
 
 void NetworkResourcesData::setResourceType(const String& requestId, InspectorPageAgent::ResourceType type)
diff --git a/Source/WebCore/inspector/PageConsoleAgent.cpp b/Source/WebCore/inspector/PageConsoleAgent.cpp
index fcd1f3d0b..a6e7aa8b6 100644
--- a/Source/WebCore/inspector/PageConsoleAgent.cpp
+++ b/Source/WebCore/inspector/PageConsoleAgent.cpp
@@ -77,7 +77,7 @@ private:
 void PageConsoleAgent::addInspectedNode(ErrorString* errorString, int nodeId)
 {
     Node* node = m_inspectorDOMAgent->nodeForId(nodeId);
-    if (!node) {
+    if (!node || node->isInShadowTree()) {
         *errorString = "nodeId is not valid";
         return;
     }
diff --git a/Source/WebCore/inspector/WorkerInspectorController.cpp b/Source/WebCore/inspector/WorkerInspectorController.cpp
index 79db35f29..8f0ed0b80 100644
--- a/Source/WebCore/inspector/WorkerInspectorController.cpp
+++ b/Source/WebCore/inspector/WorkerInspectorController.cpp
@@ -41,8 +41,10 @@
 #include "InspectorConsoleAgent.h"
 #include "InspectorFrontend.h"
 #include "InspectorFrontendChannel.h"
+#include "InspectorProfilerAgent.h"
 #include "InspectorState.h"
 #include "InspectorStateClient.h"
+#include "InspectorTimelineAgent.h"
 #include "InstrumentingAgents.h"
 #include "WorkerConsoleAgent.h"
 #include "WorkerContext.h"
@@ -93,11 +95,14 @@ WorkerInspectorController::WorkerInspectorController(WorkerContext* workerContex
     , m_injectedScriptManager(InjectedScriptManager::createForWorker())
 {
 
+    m_runtimeAgent = WorkerRuntimeAgent::create(m_instrumentingAgents.get(), m_state.get(), m_injectedScriptManager.get(), workerContext);
+    m_consoleAgent = WorkerConsoleAgent::create(m_instrumentingAgents.get(), m_state.get(), m_injectedScriptManager.get());
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent = WorkerDebuggerAgent::create(m_instrumentingAgents.get(), m_state.get(), workerContext, m_injectedScriptManager.get());
+    m_profilerAgent = InspectorProfilerAgent::create(m_instrumentingAgents.get(), m_consoleAgent.get(), workerContext, m_state.get(), m_injectedScriptManager.get());
 #endif
-    m_runtimeAgent = WorkerRuntimeAgent::create(m_instrumentingAgents.get(), m_state.get(), m_injectedScriptManager.get(), workerContext);
-    m_consoleAgent = WorkerConsoleAgent::create(m_instrumentingAgents.get(), m_state.get(), m_injectedScriptManager.get());
+    m_timelineAgent = InspectorTimelineAgent::create(m_instrumentingAgents.get(), m_state.get(), InspectorTimelineAgent::WorkerInspector);
 
     m_injectedScriptManager->injectedScriptHost()->init(0
         , 0
@@ -125,15 +130,19 @@ void WorkerInspectorController::connectFrontend()
     m_frontend = adoptPtr(new InspectorFrontend(m_frontendChannel.get()));
     m_backendDispatcher = InspectorBackendDispatcher::create(m_frontendChannel.get());
     m_consoleAgent->registerInDispatcher(m_backendDispatcher.get());
+    m_timelineAgent->registerInDispatcher(m_backendDispatcher.get());
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent->registerInDispatcher(m_backendDispatcher.get());
+    m_profilerAgent->registerInDispatcher(m_backendDispatcher.get());
 #endif
     m_runtimeAgent->registerInDispatcher(m_backendDispatcher.get());
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent->setFrontend(m_frontend.get());
+    m_profilerAgent->setFrontend(m_frontend.get());
 #endif
     m_consoleAgent->setFrontend(m_frontend.get());
+    m_timelineAgent->setFrontend(m_frontend.get());
 }
 
 void WorkerInspectorController::disconnectFrontend()
@@ -147,8 +156,10 @@ void WorkerInspectorController::disconnectFrontend()
     m_state->mute();
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent->clearFrontend();
+    m_profilerAgent->clearFrontend();
 #endif
     m_consoleAgent->clearFrontend();
+    m_timelineAgent->clearFrontend();
 
     m_frontend.clear();
     m_frontendChannel.clear();
@@ -162,8 +173,10 @@ void WorkerInspectorController::restoreInspectorStateFromCookie(const String& in
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_debuggerAgent->restore();
+    m_profilerAgent->restore();
 #endif
     m_consoleAgent->restore();
+    m_timelineAgent->restore();
 }
 
 void WorkerInspectorController::dispatchMessageFromFrontend(const String& message)
diff --git a/Source/WebCore/inspector/WorkerInspectorController.h b/Source/WebCore/inspector/WorkerInspectorController.h
index 4a4d4a98e..0e61e9b1c 100644
--- a/Source/WebCore/inspector/WorkerInspectorController.h
+++ b/Source/WebCore/inspector/WorkerInspectorController.h
@@ -51,9 +51,11 @@ class InspectorFrontend;
 class InspectorFrontendChannel;
 class InspectorConsoleAgent;
 class InspectorInstrumentation;
+class InspectorProfilerAgent;
 class InspectorRuntimeAgent;
 class InspectorState;
 class InspectorStateClient;
+class InspectorTimelineAgent;
 class InstrumentingAgents;
 class WorkerContext;
 
@@ -83,9 +85,11 @@ private:
     OwnPtr<InjectedScriptManager> m_injectedScriptManager;
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     OwnPtr<InspectorDebuggerAgent> m_debuggerAgent;
+    OwnPtr<InspectorProfilerAgent> m_profilerAgent;
 #endif
     OwnPtr<InspectorRuntimeAgent> m_runtimeAgent;
     OwnPtr<InspectorConsoleAgent> m_consoleAgent;
+    OwnPtr<InspectorTimelineAgent> m_timelineAgent;
 
     OwnPtr<InspectorFrontendChannel> m_frontendChannel;
     OwnPtr<InspectorFrontend> m_frontend;
diff --git a/Source/WebCore/inspector/compile-front-end.sh b/Source/WebCore/inspector/compile-front-end.sh
index 17ed1039d..7ff0d5571 100755
--- a/Source/WebCore/inspector/compile-front-end.sh
+++ b/Source/WebCore/inspector/compile-front-end.sh
@@ -45,7 +45,7 @@ java -jar ~/closure/compiler.jar --summary_detail_level 3 --compilation_level SI
         --js Source/WebCore/inspector/front-end/UserMetrics.js \
         --js Source/WebCore/inspector/front-end/HandlerRegistry.js \
         --js Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js \
-    --module jsmodule_sdk:30:jsmodule_common \
+    --module jsmodule_sdk:34:jsmodule_common \
         --js Source/WebCore/inspector/front-end/InspectorBackend.js \
         --js Source/WebCore/inspector/front-end/ApplicationCacheModel.js \
         --js Source/WebCore/inspector/front-end/Color.js \
@@ -68,6 +68,10 @@ java -jar ~/closure/compiler.jar --summary_detail_level 3 --compilation_level SI
         --js Source/WebCore/inspector/front-end/Placard.js \
         --js Source/WebCore/inspector/front-end/Script.js \
         --js Source/WebCore/inspector/front-end/ScriptFormatter.js \
+        --js Source/WebCore/inspector/front-end/ScriptMapping.js \
+        --js Source/WebCore/inspector/front-end/TimelineManager.js \
+        --js Source/WebCore/inspector/front-end/TimelineModel.js \
+        --js Source/WebCore/inspector/front-end/TimelinePresentationModel.js \
         --js Source/WebCore/inspector/front-end/RawSourceCode.js \
         --js Source/WebCore/inspector/front-end/RemoteObject.js \
         --js Source/WebCore/inspector/front-end/Resource.js \
@@ -113,7 +117,7 @@ java -jar ~/closure/compiler.jar --summary_detail_level 3 --compilation_level SI
         --js Source/WebCore/inspector/front-end/Toolbar.js \
         --js Source/WebCore/inspector/front-end/UIUtils.js \
         --js Source/WebCore/inspector/front-end/View.js \
-    --module jsmodule_components:16:jsmodule_sdk,jsmodule_ui \
+    --module jsmodule_components:14:jsmodule_sdk,jsmodule_ui \
         --js Source/WebCore/inspector/front-end/ConsoleMessage.js \
         --js Source/WebCore/inspector/front-end/BreakpointsSidebarPane.js \
         --js Source/WebCore/inspector/front-end/DOMBreakpointsSidebarPane.js \
@@ -127,9 +131,7 @@ java -jar ~/closure/compiler.jar --summary_detail_level 3 --compilation_level SI
         --js Source/WebCore/inspector/front-end/ObjectPropertiesSection.js \
         --js Source/WebCore/inspector/front-end/PropertiesSidebarPane.js \
         --js Source/WebCore/inspector/front-end/SourceFrame.js \
-        --js Source/WebCore/inspector/front-end/TimelineAgent.js \
         --js Source/WebCore/inspector/front-end/TimelineGrid.js \
-        --js Source/WebCore/inspector/front-end/TimelineManager.js \
     --module jsmodule_elements:3:jsmodule_components \
         --js Source/WebCore/inspector/front-end/StylesSidebarPane.js \
         --js Source/WebCore/inspector/front-end/MetricsSidebarPane.js \
diff --git a/Source/WebCore/inspector/front-end/AuditRules.js b/Source/WebCore/inspector/front-end/AuditRules.js
index 1a0dd9839..11d20966d 100644
--- a/Source/WebCore/inspector/front-end/AuditRules.js
+++ b/Source/WebCore/inspector/front-end/AuditRules.js
@@ -358,7 +358,7 @@ WebInspector.AuditRules.UnusedCssRule.prototype = {
                     var pctUnused = Math.round(100 * unusedStylesheetSize / stylesheetSize);
                     if (!summary)
                         summary = result.addChild("", true);
-                    var entry = summary.addFormatted("%s: %s (%d%%) is not used by the current page.", url, Number.bytesToString(unusedStylesheetSize), pctUnused);
+                    var entry = summary.addFormatted("%s: %s (%d%) is not used by the current page.", url, Number.bytesToString(unusedStylesheetSize), pctUnused);
 
                     for (var j = 0; j < unusedRules.length; ++j)
                         entry.addSnippet(unusedRules[j]);
@@ -370,7 +370,7 @@ WebInspector.AuditRules.UnusedCssRule.prototype = {
                     return callback(null);
 
                 var totalUnusedPercent = Math.round(100 * totalUnusedStylesheetSize / totalStylesheetSize);
-                summary.value = String.sprintf("%s (%d%%) of CSS is not used by the current page.", Number.bytesToString(totalUnusedStylesheetSize), totalUnusedPercent);
+                summary.value = String.sprintf("%s (%d%) of CSS is not used by the current page.", Number.bytesToString(totalUnusedStylesheetSize), totalUnusedPercent);
 
                 callback(result);
             }
diff --git a/Source/WebCore/inspector/front-end/BreakpointManager.js b/Source/WebCore/inspector/front-end/BreakpointManager.js
index ee1397c75..284a73e15 100644
--- a/Source/WebCore/inspector/front-end/BreakpointManager.js
+++ b/Source/WebCore/inspector/front-end/BreakpointManager.js
@@ -34,8 +34,9 @@
  * @param {function(WebInspector.Breakpoint)} breakpointAddedDelegate
  * @param {function(WebInspector.Breakpoint)} breakpointRemovedDelegate
  * @param {WebInspector.DebuggerModel} debuggerModel
+ * @param {WebInspector.MainScriptMapping} scriptMapping
  */
-WebInspector.BreakpointManager = function(breakpointStorage, breakpointAddedDelegate, breakpointRemovedDelegate, debuggerModel)
+WebInspector.BreakpointManager = function(breakpointStorage, breakpointAddedDelegate, breakpointRemovedDelegate, debuggerModel, scriptMapping)
 {
     this._breakpointStorage = breakpointStorage;
     this._breakpointAddedDelegate = breakpointAddedDelegate;
@@ -46,6 +47,7 @@ WebInspector.BreakpointManager = function(breakpointStorage, breakpointAddedDele
     this._breakpointsByUILocation = {};
 
     this._debuggerModel = debuggerModel;
+    this._scriptMapping = scriptMapping;
 
     /**
      * @type {Object.<DebuggerAgent.BreakpointId, WebInspector.Breakpoint>}
@@ -71,7 +73,7 @@ WebInspector.BreakpointManager.prototype = {
         for (var lineNumber in breakpoints) {
             var breakpoint = breakpoints[lineNumber];
             breakpoint.uiSourceCode = uiSourceCode;
-            this._materializeBreakpoint(breakpoint, uiSourceCode.rawSourceCode.sourceMapping, uiSourceCode);
+            this._materializeBreakpoint(breakpoint, uiSourceCode);
             if (breakpoint._debuggerLocation)
                 this._breakpointDebuggerLocationChanged(breakpoint);
         }
@@ -100,7 +102,7 @@ WebInspector.BreakpointManager.prototype = {
         var breakpoint = new WebInspector.Breakpoint(uiSourceCode.id, lineNumber, condition, enabled, persistent);
         breakpoint.uiSourceCode = uiSourceCode;
         this._addBreakpointToUI(breakpoint);
-        this._materializeBreakpoint(breakpoint, uiSourceCode.rawSourceCode.sourceMapping, uiSourceCode);
+        this._materializeBreakpoint(breakpoint, uiSourceCode);
     },
 
     /**
@@ -131,16 +133,15 @@ WebInspector.BreakpointManager.prototype = {
 
     /**
      * @param {WebInspector.Breakpoint} breakpoint
-     * @param {WebInspector.RawSourceCode.SourceMapping} sourceMapping
      * @param {WebInspector.UISourceCode} uiSourceCode
      */
-    _materializeBreakpoint: function(breakpoint, sourceMapping, uiSourceCode)
+    _materializeBreakpoint: function(breakpoint, uiSourceCode)
     {
         if (!breakpoint.enabled || breakpoint._materialized)
             return;
 
         breakpoint._materialized = true;
-        var rawLocation = sourceMapping.uiLocationToRawLocation(uiSourceCode, breakpoint.lineNumber, 0);
+        var rawLocation = this._scriptMapping.uiLocationToRawLocation(uiSourceCode, breakpoint.lineNumber, 0);
         this._setBreakpointInDebugger(breakpoint, rawLocation);
     },
 
@@ -149,9 +150,9 @@ WebInspector.BreakpointManager.prototype = {
      */
     _breakpointDebuggerLocationChanged: function(breakpoint)
     {
-        if (!breakpoint.uiSourceCode)
+        var uiLocation = this._scriptMapping.rawLocationToUILocation(breakpoint._debuggerLocation);
+        if (!uiLocation)
             return;
-        var uiLocation = breakpoint.uiSourceCode.rawSourceCode.sourceMapping.rawLocationToUILocation(breakpoint._debuggerLocation);
         if (uiLocation.lineNumber === breakpoint.lineNumber)
             return;
 
diff --git a/Source/WebCore/inspector/front-end/CSSStyleModel.js b/Source/WebCore/inspector/front-end/CSSStyleModel.js
index ecdbfd308..72a9cfe93 100644
--- a/Source/WebCore/inspector/front-end/CSSStyleModel.js
+++ b/Source/WebCore/inspector/front-end/CSSStyleModel.js
@@ -478,9 +478,13 @@ WebInspector.CSSStyleDeclaration.prototype = {
         return 0;
     },
 
-    newBlankProperty: function()
+    /**
+     * @param {number=} index
+     */
+    newBlankProperty: function(index)
     {
-        return new WebInspector.CSSProperty(this, this.pastLastSourcePropertyIndex(), "", "", "", "active", true, false, false, "");
+        index = (typeof index === "undefined") ? this.pastLastSourcePropertyIndex() : index;
+        return new WebInspector.CSSProperty(this, index, "", "", "", "active", true, false, false, "");
     },
 
     insertPropertyAt: function(index, name, value, userCallback)
@@ -619,8 +623,15 @@ WebInspector.CSSProperty.prototype = {
         return this.status === "disabled";
     },
 
-    // Replaces "propertyName: propertyValue [!important];" in the stylesheet by an arbitrary propertyText.
-    setText: function(propertyText, majorChange, userCallback)
+    /**
+     * Replaces "propertyName: propertyValue [!important];" in the stylesheet by an arbitrary propertyText.
+     *
+     * @param {string} propertyText
+     * @param {boolean} majorChange
+     * @param {boolean} overwrite
+     * @param {Function=} userCallback
+     */
+    setText: function(propertyText, majorChange, overwrite, userCallback)
     {
         function enabledCallback(style)
         {
@@ -656,13 +667,19 @@ WebInspector.CSSProperty.prototype = {
 
         // An index past all the properties adds a new property to the style.
         WebInspector.cssModel._pendingCommandsMajorState.push(majorChange);
-        CSSAgent.setPropertyText(this.ownerStyle.id, this.index, propertyText, this.index < this.ownerStyle.pastLastSourcePropertyIndex(), callback.bind(this));
+        CSSAgent.setPropertyText(this.ownerStyle.id, this.index, propertyText, overwrite, callback.bind(this));
     },
 
-    setValue: function(newValue, majorChange, userCallback)
+    /**
+     * @param {string} newValue
+     * @param {boolean} majorChange
+     * @param {boolean} overwrite
+     * @param {Function=} userCallback
+     */
+    setValue: function(newValue, majorChange, overwrite, userCallback)
     {
         var text = this.name + ": " + newValue + (this.priority ? " !" + this.priority : "") + ";"
-        this.setText(text, majorChange, userCallback);
+        this.setText(text, majorChange, overwrite, userCallback);
     },
 
     setDisabled: function(disabled, userCallback)
diff --git a/Source/WebCore/inspector/front-end/ConsoleMessage.js b/Source/WebCore/inspector/front-end/ConsoleMessage.js
index f2a74efa8..1925b923a 100644
--- a/Source/WebCore/inspector/front-end/ConsoleMessage.js
+++ b/Source/WebCore/inspector/front-end/ConsoleMessage.js
@@ -286,9 +286,13 @@ WebInspector.ConsoleMessageImpl.prototype = {
         object.pushNodeToFrontend(printNode.bind(this));
     },
 
-    _formatParameterAsArray: function(arr, elem)
+    _formatParameterAsArray: function(array, elem)
     {
-        arr.getOwnProperties(this._printArray.bind(this, elem));
+        const maxFlatArrayLength = 100;
+        if (array.arrayLength() > maxFlatArrayLength)
+            this._formatParameterAsObject(array, elem);
+        else
+            array.getOwnProperties(this._printArray.bind(this, array, elem));
     },
 
     _formatParameterAsString: function(output, elem)
@@ -304,19 +308,16 @@ WebInspector.ConsoleMessageImpl.prototype = {
         elem.appendChild(document.createTextNode("\""));
     },
 
-    _printArray: function(elem, properties)
+    _printArray: function(array, elem, properties)
     {
         if (!properties)
             return;
 
         var elements = [];
-        var length = 0;
         for (var i = 0; i < properties.length; ++i) {
             var property = properties[i];
             var name = property.name;
-            if (name === "length")
-                length = parseInt(property.value.description, 10);
-            if (name == parseInt(name, 10))
+            if (!isNaN(name))
                 elements[name] = this._formatAsArrayEntry(property.value);
         }
 
@@ -331,6 +332,7 @@ WebInspector.ConsoleMessageImpl.prototype = {
             span.textContent = WebInspector.UIString("undefined × %d", index - lastNonEmptyIndex - 1);
         }
 
+        var length = array.arrayLength();
         for (var i = 0; i < length; ++i) {
             var element = elements[i];
             if (!element)
@@ -592,6 +594,14 @@ WebInspector.ConsoleMessageImpl.prototype = {
         return this._messageText;
     },
 
+    get location()
+    {
+        // FIXME(62725): stack trace line/column numbers are one-based.
+        var lineNumber = this.stackTrace ? this.stackTrace[0].lineNumber - 1 : this.line - 1;
+        var columnNumber = this.stackTrace ? this.stackTrace[0].columnNumber - 1 : 0;
+        return new WebInspector.DebuggerModel.Location(lineNumber, columnNumber);
+    },
+
     isEqual: function(msg)
     {
         if (!msg)
diff --git a/Source/WebCore/inspector/front-end/ConsoleView.js b/Source/WebCore/inspector/front-end/ConsoleView.js
index adde06982..c9d5df0c5 100644
--- a/Source/WebCore/inspector/front-end/ConsoleView.js
+++ b/Source/WebCore/inspector/front-end/ConsoleView.js
@@ -111,7 +111,7 @@ WebInspector.ConsoleView = function(hideContextSelector)
 
     this._linkifier = WebInspector.debuggerPresentationModel.createLinkifier();
 
-    this.prompt = new WebInspector.TextPromptWithHistory(this.completions.bind(this), ExpressionStopCharacters + ".");
+    this.prompt = new WebInspector.TextPromptWithHistory(this.completionsForTextPrompt.bind(this), ExpressionStopCharacters + ".");
     this.prompt.setSuggestBoxEnabled("generic-suggest");
     this.prompt.renderAsBlock();
     this.prompt.attach(this.promptElement);
@@ -342,16 +342,16 @@ WebInspector.ConsoleView.prototype = {
         this._linkifier.reset();
     },
 
-    completions: function(wordRange, force, completionsReadyCallback)
+    completionsForTextPrompt: function(textPrompt, wordRange, force, completionsReadyCallback)
     {
         // Pass less stop characters to rangeOfWord so the range will be a more complete expression.
-        var expressionRange = wordRange.startContainer.rangeOfWord(wordRange.startOffset, ExpressionStopCharacters, this.promptElement, "backward");
+        var expressionRange = wordRange.startContainer.rangeOfWord(wordRange.startOffset, ExpressionStopCharacters, textPrompt.proxyElement, "backward");
         var expressionString = expressionRange.toString();
         var prefix = wordRange.toString();
-        this._completions(expressionString, prefix, force, completionsReadyCallback);
+        this.completionsForExpression(expressionString, prefix, force, completionsReadyCallback);
     },
 
-    _completions: function(expressionString, prefix, force, completionsReadyCallback)
+    completionsForExpression: function(expressionString, prefix, force, completionsReadyCallback)
     {
         var lastIndex = expressionString.length - 1;
 
@@ -372,7 +372,7 @@ WebInspector.ConsoleView.prototype = {
             return;
         }
 
-        if (!expressionString && WebInspector.debuggerPresentationModel.paused)
+        if (!expressionString && WebInspector.debuggerPresentationModel.selectedCallFrame)
             WebInspector.debuggerPresentationModel.getSelectedCallFrameVariables(receivedPropertyNames.bind(this));
         else
             this.evalInInspectedWindow(expressionString, "completion", true, true, false, evaluated.bind(this));
@@ -409,7 +409,7 @@ WebInspector.ConsoleView.prototype = {
             }
 
             if (result.type === "object" || result.type === "function")
-                result.callFunctionJSON(getCompletions, receivedPropertyNames.bind(this));
+                result.callFunctionJSON(getCompletions, undefined, receivedPropertyNames.bind(this));
             else if (result.type === "string" || result.type === "number" || result.type === "boolean")
                 this.evalInInspectedWindow("(" + getCompletions + ")(\"" + result.type + "\")", "completion", false, true, true, receivedPropertyNamesFromEval.bind(this));
         }
@@ -592,7 +592,7 @@ WebInspector.ConsoleView.prototype = {
      */
     evalInInspectedWindow: function(expression, objectGroup, includeCommandLineAPI, doNotPauseOnExceptions, returnByValue, callback)
     {
-        if (WebInspector.debuggerPresentationModel.paused) {
+        if (WebInspector.debuggerPresentationModel.selectedCallFrame) {
             WebInspector.debuggerPresentationModel.evaluateInSelectedCallFrame(expression, objectGroup, includeCommandLineAPI, returnByValue, callback);
             return;
         }
diff --git a/Source/WebCore/inspector/front-end/DOMAgent.js b/Source/WebCore/inspector/front-end/DOMAgent.js
index 2ef016943..28a567254 100644
--- a/Source/WebCore/inspector/front-end/DOMAgent.js
+++ b/Source/WebCore/inspector/front-end/DOMAgent.js
@@ -33,11 +33,13 @@
  * @constructor
  * @param {WebInspector.DOMAgent} domAgent
  * @param {?WebInspector.DOMDocument} doc
+ * @param {boolean} isInShadowTree
  * @param {DOMAgent.Node} payload
  */
-WebInspector.DOMNode = function(domAgent, doc, payload) {
+WebInspector.DOMNode = function(domAgent, doc, isInShadowTree, payload) {
     this._domAgent = domAgent;
     this.ownerDocument = doc;
+    this._isInShadowTree = isInShadowTree;
 
     this.id = payload.nodeId;
     domAgent._idToDOMNode[this.id] = this;
@@ -46,6 +48,8 @@ WebInspector.DOMNode = function(domAgent, doc, payload) {
     this._localName = payload.localName;
     this._nodeValue = payload.nodeValue;
 
+    this._shadowRoots = [];
+
     this._attributes = [];
     this._attributesMap = {};
     if (payload.attributes)
@@ -69,6 +73,14 @@ WebInspector.DOMNode = function(domAgent, doc, payload) {
         this._renumber();
     }
 
+    if (payload.shadowRoots && WebInspector.experimentsSettings.showShadowDOM.isEnabled()) {
+        for (var i = 0; i < payload.shadowRoots.length; ++i) {
+            var root = payload.shadowRoots[i];
+            var node = new WebInspector.DOMNode(this._domAgent, this.ownerDocument, true, root);
+            this._shadowRoots.push(node);
+        }
+    }
+
     if (this._nodeType === Node.ELEMENT_NODE) {
         // HTML and BODY from internal iframes should not overwrite top-level ones.
         if (this.ownerDocument && !this.ownerDocument.documentElement && this._nodeName === "HTML")
@@ -117,7 +129,7 @@ WebInspector.DOMNode.prototype = {
      */
     hasChildNodes: function()
     {
-        return this._childNodeCount > 0;
+        return this._childNodeCount > 0 || !!this._shadowRoots.length;
     },
 
     /**
@@ -137,6 +149,14 @@ WebInspector.DOMNode.prototype = {
     },
 
     /**
+     * @return {boolean}
+     */
+    isInShadowTree: function()
+    {
+        return this._isInShadowTree;
+    },
+
+    /**
      * @return {string}
      */
     nodeNameInCorrectCase: function()
@@ -345,7 +365,7 @@ WebInspector.DOMNode.prototype = {
 
         var className = this.getAttribute("class");
         if (className) {
-            var selector = "." + className.replace(/\s+/, ".");
+            var selector = "." + className.trim().replace(/\s+/g, ".");
             return (justSelector ? selector : lowerCaseName + selector);
         }
 
@@ -400,11 +420,11 @@ WebInspector.DOMNode.prototype = {
      */
     _insertChild: function(prev, payload)
     {
-        var node = new WebInspector.DOMNode(this._domAgent, this.ownerDocument, payload);
+        var node = new WebInspector.DOMNode(this._domAgent, this.ownerDocument, this._isInShadowTree, payload);
         if (!prev) {
             if (!this.children) {
                 // First node
-                this.children = [ node ];
+                this.children = this._shadowRoots.concat([ node ]);
             } else
                 this.children.unshift(node);
         } else
@@ -432,10 +452,10 @@ WebInspector.DOMNode.prototype = {
         if (this._contentDocument)
             return;
 
-        this.children = [];
+        this.children = this._shadowRoots.slice();
         for (var i = 0; i < payloads.length; ++i) {
             var payload = payloads[i];
-            var node = new WebInspector.DOMNode(this._domAgent, this.ownerDocument, payload);
+            var node = new WebInspector.DOMNode(this._domAgent, this.ownerDocument, this._isInShadowTree, payload);
             this.children.push(node);
         }
         this._renumber();
@@ -642,7 +662,7 @@ WebInspector.DOMNode.prototype = {
  */
 WebInspector.DOMDocument = function(domAgent, payload)
 {
-    WebInspector.DOMNode.call(this, domAgent, this, payload);
+    WebInspector.DOMNode.call(this, domAgent, this, false, payload);
     this.documentURL = payload.documentURL || "";
     this.xmlVersion = payload.xmlVersion;
     this._listeners = {};
@@ -887,7 +907,7 @@ WebInspector.DOMAgent.prototype = {
      */
     _setDetachedRoot: function(payload)
     {
-        new WebInspector.DOMNode(this, null, payload);
+        new WebInspector.DOMNode(this, null, false, payload);
     },
 
     /**
@@ -944,6 +964,13 @@ WebInspector.DOMAgent.prototype = {
     },
 
     /**
+     * @param {DOMAgent.NodeId} rootId
+     */
+    _shadowRootPopped: function(rootId)
+    {
+    },
+
+    /**
      * @param {DOMAgent.Node} node
      */
     _unbind: function(node)
@@ -1253,6 +1280,24 @@ WebInspector.DOMDispatcher.prototype = {
     childNodeRemoved: function(parentNodeId, nodeId)
     {
         this._domAgent._childNodeRemoved(parentNodeId, nodeId);
+    },
+
+    /**
+     * @param {DOMAgent.NodeId} hostId
+     * @param {DOMAgent.Node} root
+     */
+    shadowRootPushed: function(hostId, root)
+    {
+        this._domAgent._childNodeInserted(hostId, 0, root);
+    },
+
+    /**
+     * @param {DOMAgent.NodeId} hostId
+     * @param {DOMAgent.NodeId} rootId
+     */
+    shadowRootPopped: function(hostId, rootId)
+    {
+        this._domAgent._childNodeRemoved(hostId, rootId);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/DatabaseQueryView.js b/Source/WebCore/inspector/front-end/DatabaseQueryView.js
index be233a173..f928ec0cd 100644
--- a/Source/WebCore/inspector/front-end/DatabaseQueryView.js
+++ b/Source/WebCore/inspector/front-end/DatabaseQueryView.js
@@ -61,7 +61,7 @@ WebInspector.DatabaseQueryView.prototype = {
             this.prompt.moveCaretToEndOfPrompt();
     },
     
-    completions: function(wordRange, force, completionsReadyCallback)
+    completions: function(textPrompt, wordRange, force, completionsReadyCallback)
     {
         var prefix = wordRange.toString().toLowerCase();
         if (!prefix.length && !force)
diff --git a/Source/WebCore/inspector/front-end/DebuggerModel.js b/Source/WebCore/inspector/front-end/DebuggerModel.js
index 9bae2c070..c9a64bd3e 100644
--- a/Source/WebCore/inspector/front-end/DebuggerModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerModel.js
@@ -234,11 +234,11 @@ WebInspector.DebuggerModel.prototype = {
 
     /**
      * @param {DebuggerAgent.ScriptId} scriptId
-     * @return {WebInspector.Script|undefined}
+     * @return {WebInspector.Script}
      */
     scriptForSourceID: function(scriptId)
     {
-        return this._scripts[scriptId];
+        return this._scripts[scriptId] || null;
     },
 
     /**
diff --git a/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js b/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
index 27b045758..47182ee9b 100644
--- a/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
+++ b/Source/WebCore/inspector/front-end/DebuggerPresentationModel.js
@@ -34,15 +34,16 @@
  */
 WebInspector.DebuggerPresentationModel = function()
 {
-    // FIXME: apply formatter from outside as a generic mapping.
-    this._formatter = new WebInspector.ScriptFormatter();
-    this._rawSourceCodes = [];
-    this._rawSourceCodeForScriptId = {};
-    this._rawSourceCodeForURL = {};
-    this._rawSourceCodeForDocumentURL = {};
+    this._scriptMapping = new WebInspector.MainScriptMapping();
+    this._scriptMapping.addEventListener(WebInspector.MainScriptMapping.Events.UISourceCodeListChanged, this._handleUISourceCodeListChanged, this);
+
     this._presentationCallFrames = [];
 
-    this._breakpointManager = new WebInspector.BreakpointManager(WebInspector.settings.breakpoints, this._breakpointAdded.bind(this), this._breakpointRemoved.bind(this), WebInspector.debuggerModel);
+    this._breakpointManager = new WebInspector.BreakpointManager(WebInspector.settings.breakpoints, this._breakpointAdded.bind(this), this._breakpointRemoved.bind(this), WebInspector.debuggerModel, this._scriptMapping);
+
+    this._pendingConsoleMessages = {};
+    this._consoleMessageLiveLocations = [];
+    this._presentationConsoleMessages = [];
 
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.ParsedScriptSource, this._parsedScriptSource, this);
     WebInspector.debuggerModel.addEventListener(WebInspector.DebuggerModel.Events.FailedToParseScriptSource, this._failedToParseScriptSource, this);
@@ -87,7 +88,7 @@ WebInspector.DebuggerPresentationModel.prototype = {
      */
     createPlacard: function(callFrame)
     {
-        return new WebInspector.DebuggerPresentationModel.CallFramePlacard(callFrame);
+        return new WebInspector.DebuggerPresentationModel.CallFramePlacard(callFrame, this);
     },
 
     /**
@@ -96,84 +97,46 @@ WebInspector.DebuggerPresentationModel.prototype = {
      */
     rawLocationToUILocation: function(rawLocation)
     {
-        var rawSourceCode = this._rawSourceCodeForScriptId[rawLocation.scriptId];
-        if (!rawSourceCode.sourceMapping)
-            return null;
-        return rawSourceCode.sourceMapping.rawLocationToUILocation(rawLocation);
+        return this._scriptMapping.rawLocationToUILocation(rawLocation);
     },
 
     /**
-     * @param {WebInspector.Event} event
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     * @param {number} lineNumber
+     * @param {number} columnNumber
+     * @return {DebuggerAgent.Location}
      */
-    _parsedScriptSource: function(event)
+    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber)
     {
-        var script = /** @type {WebInspector.Script} */ event.data;
-        this._addScript(script);
+        return this._scriptMapping.uiLocationToRawLocation(uiSourceCode, lineNumber, columnNumber);
     },
 
     /**
-     * @param {WebInspector.Event} event
+     * @param {DebuggerAgent.Location} rawLocation
+     * @param {function(WebInspector.UILocation)} updateDelegate
+     * @return {WebInspector.LiveLocation}
      */
-    _failedToParseScriptSource: function(event)
+    createLiveLocation: function(rawLocation, updateDelegate)
     {
-        var script = /** @type {WebInspector.Script} */ event.data;
-        this._addScript(script);
+        return this._scriptMapping.createLiveLocation(rawLocation, updateDelegate);
     },
 
     /**
-     * @param {WebInspector.Script} script
-     */
-    _addScript: function(script)
-    {
-        var resource = null;
-        var isInlineScript = false;
-        if (script.isInlineScript()) {
-            resource = WebInspector.networkManager.inflightResourceForURL(script.sourceURL) || WebInspector.resourceForURL(script.sourceURL);
-            if (resource && resource.type === WebInspector.Resource.Type.Document) {
-                isInlineScript = true;
-                var rawSourceCode = this._rawSourceCodeForDocumentURL[script.sourceURL];
-                if (rawSourceCode) {
-                    rawSourceCode.addScript(script);
-                    this._bindScriptToRawSourceCode(script, rawSourceCode);
-                    return;
-                }
-            }
-        }
-
-        var compilerSourceMapping = null;
-        if (WebInspector.settings.sourceMapsEnabled.get() && script.sourceMapURL)
-            compilerSourceMapping = new WebInspector.ClosureCompilerSourceMapping(script.sourceMapURL, script.sourceURL);
-
-        var rawSourceCode = new WebInspector.RawSourceCode(script.scriptId, script, resource, this._formatter, this._formatSource, compilerSourceMapping);
-        this._rawSourceCodes.push(rawSourceCode);
-        this._bindScriptToRawSourceCode(script, rawSourceCode);
-
-        if (isInlineScript)
-            this._rawSourceCodeForDocumentURL[script.sourceURL] = rawSourceCode;
-
-        if (rawSourceCode.sourceMapping)
-            this._updateSourceMapping(rawSourceCode, null);
-        rawSourceCode.addEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, this._sourceMappingUpdated, this);
-    },
-
-    /**
-     * @param {WebInspector.Script} script
-     * @param {WebInspector.RawSourceCode} rawSourceCode
+     * @param {WebInspector.Event} event
      */
-    _bindScriptToRawSourceCode: function(script, rawSourceCode)
+    _parsedScriptSource: function(event)
     {
-        this._rawSourceCodeForScriptId[script.scriptId] = rawSourceCode;
-        this._rawSourceCodeForURL[script.sourceURL] = rawSourceCode;
+        var script = /** @type {WebInspector.Script} */ event.data;
+        this._scriptMapping.addScript(script);
+        this._addPendingConsoleMessagesToScript(script);
     },
 
     /**
      * @param {WebInspector.Event} event
      */
-    _sourceMappingUpdated: function(event)
+    _failedToParseScriptSource: function(event)
     {
-        var rawSourceCode = /** @type {WebInspector.RawSourceCode} */ event.target;
-        var oldSourceMapping = /** @type {WebInspector.RawSourceCode.SourceMapping} */ event.data["oldSourceMapping"];
-        this._updateSourceMapping(rawSourceCode, oldSourceMapping);
+        this._parsedScriptSource(event);
     },
 
     /**
@@ -181,54 +144,45 @@ WebInspector.DebuggerPresentationModel.prototype = {
      */
     uiSourceCodes: function()
     {
-        var result = [];
-        for (var i = 0; i < this._rawSourceCodes.length; ++i) {
-            if (!this._rawSourceCodes[i].sourceMapping)
-                continue;
-            var uiSourceCodeList = this._rawSourceCodes[i].sourceMapping.uiSourceCodeList();
-            for (var j = 0; j < uiSourceCodeList.length; ++j)
-                result.push(uiSourceCodeList[j]);
-        }
-        return result;
+        return this._scriptMapping.uiSourceCodeList();
     },
 
     /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
-     * @param {WebInspector.RawSourceCode.SourceMapping} oldSourceMapping
+     * @param {WebInspector.Event} event
      */
-    _updateSourceMapping: function(rawSourceCode, oldSourceMapping)
+    _handleUISourceCodeListChanged: function(event)
     {
-        if (oldSourceMapping) {
-            var oldUISourceCodeList = oldSourceMapping.uiSourceCodeList();
-            for (var i = 0; i < oldUISourceCodeList.length; ++i) {
-                var breakpoints = this._breakpointManager.breakpointsForUISourceCode(oldUISourceCodeList[i]);
-                for (var lineNumber in breakpoints) {
-                    var breakpoint = breakpoints[lineNumber];
-                    this._breakpointRemoved(breakpoint);
-                    delete breakpoint.uiSourceCode;
-                }
+        var removedItems = /** @type {Array.<WebInspector.UISourceCode>} */ event.data["removedItems"];
+        var addedItems = /** @type {Array.<WebInspector.UISourceCode>} */ event.data["addedItems"];
+
+        for (var i = 0; i < removedItems.length; ++i) {
+            var breakpoints = this._breakpointManager.breakpointsForUISourceCode(removedItems[i]);
+            for (var lineNumber in breakpoints) {
+                var breakpoint = breakpoints[lineNumber];
+                this._breakpointRemoved(breakpoint);
+                delete breakpoint.uiSourceCode;
             }
         }
 
-        this._restoreBreakpoints(rawSourceCode);
-        this._restoreConsoleMessages(rawSourceCode);
+        this._restoreBreakpoints(addedItems);
 
-        if (!oldSourceMapping) {
-            var uiSourceCodeList = rawSourceCode.sourceMapping.uiSourceCodeList();
-            for (var i = 0; i < uiSourceCodeList.length; ++i)
-                this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.UISourceCodeAdded, uiSourceCodeList[i]);
+        if (!removedItems.length) {
+            for (var i = 0; i < addedItems.length; ++i)
+                this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.UISourceCodeAdded, addedItems[i]);
+        } else if (!addedItems.length) {
+            for (var i = 0; i < addedItems.length; ++i)
+                this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.UISourceCodeRemoved, removedItems[i]);
         } else {
-            var eventData = { uiSourceCodeList: rawSourceCode.sourceMapping.uiSourceCodeList(), oldUISourceCodeList: oldSourceMapping.uiSourceCodeList() };
+            var eventData = { uiSourceCodeList: addedItems, oldUISourceCodeList: removedItems };
             this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.UISourceCodeReplaced, eventData);
         }
     },
 
     /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
+     * @param {Array.<WebInspector.UISourceCode>} uiSourceCodeList
      */
-    _restoreBreakpoints: function(rawSourceCode)
+    _restoreBreakpoints: function(uiSourceCodeList)
     {
-        var uiSourceCodeList = rawSourceCode.sourceMapping.uiSourceCodeList();
         for (var i = 0; i < uiSourceCodeList.length; ++i) {
             var uiSourceCode = uiSourceCodeList[i];
             this._breakpointManager.uiSourceCodeAdded(uiSourceCode);
@@ -236,17 +190,6 @@ WebInspector.DebuggerPresentationModel.prototype = {
             for (var lineNumber in breakpoints)
                 this._breakpointAdded(breakpoints[lineNumber]);
         }
-
-    },
-
-    /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
-     */
-    _restoreConsoleMessages: function(rawSourceCode)
-    {
-        var messages = rawSourceCode.messages;
-        for (var i = 0; i < messages.length; ++i)
-            messages[i]._presentationMessage = this._createPresentationMessage(messages[i], rawSourceCode.sourceMapping);
     },
 
     /**
@@ -255,11 +198,7 @@ WebInspector.DebuggerPresentationModel.prototype = {
      */
     canEditScriptSource: function(uiSourceCode)
     {
-        if (!WebInspector.debuggerModel.canSetScriptSource() || this._formatSource)
-            return false;
-        var rawSourceCode = uiSourceCode.rawSourceCode;
-        var script = this._scriptForRawSourceCode(rawSourceCode);
-        return script && !script.lineOffset && !script.columnOffset;
+        return WebInspector.debuggerModel.canSetScriptSource() && uiSourceCode.isEditable;
     },
 
     /**
@@ -269,8 +208,8 @@ WebInspector.DebuggerPresentationModel.prototype = {
      */
     setScriptSource: function(uiSourceCode, newSource, callback)
     {
-        var rawSourceCode = uiSourceCode.rawSourceCode;
-        var script = this._scriptForRawSourceCode(rawSourceCode);
+        var rawLocation = this.uiLocationToRawLocation(uiSourceCode, 0, 0);
+        var script = WebInspector.debuggerModel.scriptForSourceID(rawLocation.scriptId);
 
         /**
          * @this {WebInspector.DebuggerPresentationModel}
@@ -282,7 +221,7 @@ WebInspector.DebuggerPresentationModel.prototype = {
             if (error)
                 return;
 
-            var resource = WebInspector.resourceForURL(rawSourceCode.url);
+            var resource = WebInspector.resourceForURL(script.sourceURL);
             if (resource)
                 resource.addRevision(newSource);
 
@@ -334,13 +273,8 @@ WebInspector.DebuggerPresentationModel.prototype = {
      */
     setFormatSource: function(formatSource)
     {
-        if (this._formatSource === formatSource)
-            return;
-
-        this._formatSource = formatSource;
         this._breakpointManager.reset();
-        for (var i = 0; i < this._rawSourceCodes.length; ++i)
-            this._rawSourceCodes[i].setFormatted(this._formatSource);
+        this._scriptMapping.setFormatSource(formatSource);
     },
 
     /**
@@ -352,36 +286,73 @@ WebInspector.DebuggerPresentationModel.prototype = {
         if (!message.url || !message.isErrorOrWarning())
             return;
 
-        var rawSourceCode = this._rawSourceCodeForScriptWithURL(message.url);
-        if (!rawSourceCode)
-            return;
+        var script = this._scriptForURLAndLocation(message.url, message.location);
+        if (script)
+            this._addConsoleMessageToScript(message, script);
+        else
+            this._addPendingConsoleMessage(message);
+    },
 
-        rawSourceCode.messages.push(message);
-        if (rawSourceCode.sourceMapping) {
-            message._presentationMessage = this._createPresentationMessage(message, rawSourceCode.sourceMapping);
-            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.ConsoleMessageAdded, message._presentationMessage);
+    /**
+     * @param {WebInspector.ConsoleMessage} message
+     * @param {WebInspector.Script} script
+     */
+    _addConsoleMessageToScript: function(message, script)
+    {
+        function updateLocation(uiLocation)
+        {
+            var presentationMessage = new WebInspector.PresentationConsoleMessage(uiLocation.uiSourceCode, uiLocation.lineNumber, message);
+            this._presentationConsoleMessages.push(presentationMessage);
+            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.ConsoleMessageAdded, presentationMessage);
         }
+        var rawLocation = new WebInspector.DebuggerModel.Location(message.location.lineNumber, message.location.columnNumber);
+        rawLocation.scriptId = script.scriptId;
+        var liveLocation = this.createLiveLocation(rawLocation, updateLocation.bind(this));
+        liveLocation.init();
+        this._consoleMessageLiveLocations.push(liveLocation);
     },
 
     /**
      * @param {WebInspector.ConsoleMessage} message
-     * @param {WebInspector.RawSourceCode.SourceMapping} sourceMapping
-     * @return {WebInspector.PresentationConsoleMessage}
      */
-    _createPresentationMessage: function(message, sourceMapping)
+    _addPendingConsoleMessage: function(message)
     {
-        // FIXME(62725): stack trace line/column numbers are one-based.
-        var lineNumber = message.stackTrace ? message.stackTrace[0].lineNumber - 1 : message.line - 1;
-        var columnNumber = message.stackTrace ? message.stackTrace[0].columnNumber - 1 : 0;
-        var uiLocation = sourceMapping.rawLocationToUILocation(/** @type {DebuggerAgent.Location} */ { lineNumber: lineNumber, columnNumber: columnNumber });
-        var presentationMessage = new WebInspector.PresentationConsoleMessage(uiLocation.uiSourceCode, uiLocation.lineNumber, message);
-        return presentationMessage;
+        if (!this._pendingConsoleMessages[message.url])
+            this._pendingConsoleMessages[message.url] = [];
+        this._pendingConsoleMessages[message.url].push(message);
+    },
+
+    /**
+     * @param {WebInspector.Script} script
+     */
+    _addPendingConsoleMessagesToScript: function(script)
+    {
+        var messages = this._pendingConsoleMessages[script.sourceURL];
+        if (!messages)
+            return;
+
+        var pendingMessages = [];
+        for (var i = 0; i < messages.length; i++) {
+            var message = messages[i];
+            if (script === this._scriptForURLAndLocation(message.url, message.location))
+                this._addConsoleMessageToScript(messages, script);
+            else
+                pendingMessages.push(message);
+        }
+
+        if (pendingMessages.length)
+            this._pendingConsoleMessages[script.sourceURL] = pendingMessages;
+        else
+            delete this._pendingConsoleMessages[script.sourceURL];
     },
 
     _consoleCleared: function()
     {
-        for (var i = 0; i < this._rawSourceCodes.length; ++i)
-            this._rawSourceCodes[i].messages = [];
+        this._pendingConsoleMessages = {};
+        for (var i = 0; i < this._consoleMessageLiveLocations.length; ++i)
+            this._consoleMessageLiveLocations[i].dispose();
+        this._consoleMessageLiveLocations = [];
+        this._presentationConsoleMessages = [];
         this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.ConsoleMessagesCleared);
     },
 
@@ -391,8 +362,7 @@ WebInspector.DebuggerPresentationModel.prototype = {
      */
     continueToLine: function(uiSourceCode, lineNumber)
     {
-        // FIXME: use RawSourceCode.uiLocationToRawLocation.
-        var rawLocation = uiSourceCode.rawSourceCode.sourceMapping.uiLocationToRawLocation(uiSourceCode, lineNumber, 0);
+        var rawLocation = this.uiLocationToRawLocation(uiSourceCode, lineNumber, 0);
         WebInspector.debuggerModel.continueToLocation(rawLocation);
     },
 
@@ -411,14 +381,16 @@ WebInspector.DebuggerPresentationModel.prototype = {
 
     /**
      * @param {WebInspector.UISourceCode} uiSourceCode
-     * @return {Array.<WebInspector.ConsoleMessage>}
+     * @return {Array.<WebInspector.PresentationConsoleMessage>}
      */
     messagesForUISourceCode: function(uiSourceCode)
     {
-        var rawSourceCode = uiSourceCode.rawSourceCode;
         var messages = [];
-        for (var i = 0; i < rawSourceCode.messages.length; ++i)
-            messages.push(rawSourceCode.messages[i]._presentationMessage);
+        for (var i = 0; i < this._presentationConsoleMessages.length; ++i) {
+            var message = this._presentationConsoleMessages[i];
+            if (message.uiSourceCode === uiSourceCode)
+                messages.push(message);
+        }
         return messages;
     },
 
@@ -509,15 +481,12 @@ WebInspector.DebuggerPresentationModel.prototype = {
         this._presentationCallFrames = [];
         for (var i = 0; i < callFrames.length; ++i) {
             var callFrame = callFrames[i];
-            var script = WebInspector.debuggerModel.scriptForSourceID(callFrame.location.scriptId);
-            if (!script)
-                continue;
-            var rawSourceCode = this._rawSourceCodeForScript(script);
-            this._presentationCallFrames.push(new WebInspector.PresentationCallFrame(callFrame, i, this, rawSourceCode));
+            if (WebInspector.debuggerModel.scriptForSourceID(callFrame.location.scriptId))
+                this._presentationCallFrames.push(new WebInspector.PresentationCallFrame(callFrame, i, this));
         }
         var details = WebInspector.debuggerModel.debuggerPausedDetails;
-        this.selectedCallFrame = this._presentationCallFrames[0];
         this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.DebuggerPaused, { callFrames: this._presentationCallFrames, details: details });
+        this.selectedCallFrame = this._presentationCallFrames[0];
     },
 
     _debuggerResumed: function()
@@ -534,16 +503,23 @@ WebInspector.DebuggerPresentationModel.prototype = {
 
     set selectedCallFrame(callFrame)
     {
-        if (this._selectedCallFrame)
-            this._selectedCallFrame.rawSourceCode.removeEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, this._dispatchExecutionLineChanged, this);
+        if (this._executionLineLiveLocation)
+            this._executionLineLiveLocation.dispose();
+        delete this._executionLineLiveLocation;
+
         this._selectedCallFrame = callFrame;
         if (!this._selectedCallFrame)
             return;
 
-        this._selectedCallFrame.rawSourceCode.forceUpdateSourceMapping();
+        this._scriptMapping.forceUpdateSourceMapping(callFrame._callFrame.location);
         this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.CallFrameSelected, callFrame);
 
-        this._selectedCallFrame.rawSourceCode.addEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, this._dispatchExecutionLineChanged, this);
+        function updateExecutionLine(uiLocation)
+        {
+            this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.ExecutionLineChanged, uiLocation);
+        }
+        this._executionLineLiveLocation = this.createLiveLocation(callFrame._callFrame.location, updateExecutionLine.bind(this));
+        this._executionLineLiveLocation.init();
     },
 
     get selectedCallFrame()
@@ -604,77 +580,33 @@ WebInspector.DebuggerPresentationModel.prototype = {
     },
 
     /**
-     * @param {WebInspector.Event} event
-     */
-    _dispatchExecutionLineChanged: function(event)
-    {
-        this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.ExecutionLineChanged, this.executionLineLocation);
-    },
-
-    /**
-     * @type {WebInspector.UILocation}
-     */
-    get executionLineLocation()
-    {
-        if (!this._selectedCallFrame.rawSourceCode.sourceMapping)
-            return;
-
-        var rawLocation = this._selectedCallFrame._callFrame.location;
-        var uiLocation = this._selectedCallFrame.rawSourceCode.sourceMapping.rawLocationToUILocation(rawLocation);
-        return uiLocation;
-    },
-
-    /**
-     * @param {string} sourceURL
-     */
-    _rawSourceCodeForScriptWithURL: function(sourceURL)
-    {
-        return this._rawSourceCodeForURL[sourceURL];
-    },
-
-    /**
-     * @param {WebInspector.Script} script
-     */
-    _rawSourceCodeForScript: function(script)
-    {
-        return this._rawSourceCodeForScriptId[script.scriptId];
-    },
-
-    /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
+     * @param {string} url
+     * @param {DebuggerAgent.Location} rawLocation
+     * @return {WebInspector.Script}
      */
-    _scriptForRawSourceCode: function(rawSourceCode)
+    _scriptForURLAndLocation: function(url, rawLocation)
     {
-        /**
-         * @this {WebInspector.DebuggerPresentationModel}
-         * @param {WebInspector.Script} script
-         * @return {boolean}
-         */
-        function filter(script)
-        {
-            return script.scriptId === rawSourceCode.id;
+        var scripts = WebInspector.debuggerModel.scriptsForURL(url);
+        for (var i = 0; i < scripts.length; ++i) {
+            var script = scripts[i];
+            if (script.lineOffset > rawLocation.lineNumber || (script.lineOffset === rawLocation.lineNumber && script.columnOffset > rawLocation.columnNumber))
+                continue;
+            if (script.endLine < rawLocation.lineNumber || (script.endLine === rawLocation.lineNumber && script.endColumn <= rawLocation.columnNumber))
+                continue;
+            return script;
         }
-        return WebInspector.debuggerModel.queryScripts(filter.bind(this))[0];
+        return null;
     },
 
     _debuggerReset: function()
     {
-        for (var i = 0; i < this._rawSourceCodes.length; ++i) {
-            var rawSourceCode = this._rawSourceCodes[i];
-            if (rawSourceCode.sourceMapping) {
-                var uiSourceCodeList = rawSourceCode.sourceMapping.uiSourceCodeList();
-                for (var j = 0; j < uiSourceCodeList.length; ++j)
-                    this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.UISourceCodeRemoved, uiSourceCodeList[j]);
-            }
-            rawSourceCode.removeAllListeners();
-        }
-        this._rawSourceCodes = [];
-        this._rawSourceCodeForScriptId = {};
-        this._rawSourceCodeForURL = {};
-        this._rawSourceCodeForDocumentURL = {};
+        this._scriptMapping.reset();
         this._presentationCallFrames = [];
         this._selectedCallFrame = null;
         this._breakpointManager.debuggerReset();
+        this._pendingConsoleMessages = {};
+        this._consoleMessageLiveLocations = [];
+        this._presentationConsoleMessages = [];
         this.dispatchEventToListeners(WebInspector.DebuggerPresentationModel.Events.DebuggerReset);
     }
 }
@@ -699,14 +631,12 @@ WebInspector.PresentationConsoleMessage = function(uiSourceCode, lineNumber, ori
  * @param {DebuggerAgent.CallFrame} callFrame
  * @param {number} index
  * @param {WebInspector.DebuggerPresentationModel} model
- * @param {WebInspector.RawSourceCode} rawSourceCode
  */
-WebInspector.PresentationCallFrame = function(callFrame, index, model, rawSourceCode)
+WebInspector.PresentationCallFrame = function(callFrame, index, model)
 {
     this._callFrame = callFrame;
     this._index = index;
     this._model = model;
-    this._rawSourceCode = rawSourceCode;
 }
 
 WebInspector.PresentationCallFrame.prototype = {
@@ -743,14 +673,6 @@ WebInspector.PresentationCallFrame.prototype = {
     },
 
     /**
-     * @return {WebInspector.RawSourceCode}
-     */
-    get rawSourceCode()
-    {
-        return this._rawSourceCode;
-    },
-
-    /**
      * @param {string} code
      * @param {string} objectGroup
      * @param {boolean} includeCommandLineAPI
@@ -782,15 +704,13 @@ WebInspector.PresentationCallFrame.prototype = {
      */
     uiLocation: function(callback)
     {
-        function sourceMappingReady()
+        function locationUpdated(uiLocation)
         {
-            this._rawSourceCode.removeEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, sourceMappingReady, this);
-            callback(this._rawSourceCode.sourceMapping.rawLocationToUILocation(this._callFrame.location));
+            callback(uiLocation);
+            liveLocation.dispose();
         }
-        if (this._rawSourceCode.sourceMapping)
-            sourceMappingReady.call(this);
-        else
-            this._rawSourceCode.addEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, sourceMappingReady, this);
+        var liveLocation = this._model.createLiveLocation(this._callFrame.location, locationUpdated.bind(this));
+        liveLocation.init();
     }
 }
 
@@ -798,27 +718,23 @@ WebInspector.PresentationCallFrame.prototype = {
  * @constructor
  * @extends {WebInspector.Placard}
  * @param {WebInspector.PresentationCallFrame} callFrame
+ * @param {WebInspector.DebuggerPresentationModel} model
  */
-WebInspector.DebuggerPresentationModel.CallFramePlacard = function(callFrame)
+WebInspector.DebuggerPresentationModel.CallFramePlacard = function(callFrame, model)
 {
     WebInspector.Placard.call(this, callFrame._callFrame.functionName || WebInspector.UIString("(anonymous function)"), "");
-    this._callFrame = callFrame;
-    var rawSourceCode = callFrame._rawSourceCode;
-    if (rawSourceCode.sourceMapping)
-        this._update();
-    rawSourceCode.addEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, this._update, this);
+    this._liveLocation = model.createLiveLocation(callFrame._callFrame.location, this._update.bind(this));
+    this._liveLocation.init();
 }
 
 WebInspector.DebuggerPresentationModel.CallFramePlacard.prototype = {
     discard: function()
     {
-        this._callFrame._rawSourceCode.removeEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, this._update, this);
+        this._liveLocation.dispose();
     },
 
-    _update: function()
+    _update: function(uiLocation)
     {
-        var rawSourceCode = this._callFrame._rawSourceCode;
-        var uiLocation = rawSourceCode.sourceMapping.rawLocationToUILocation(this._callFrame._callFrame.location);
         this.subtitle = WebInspector.displayNameForURL(uiLocation.uiSourceCode.url) + ":" + (uiLocation.lineNumber + 1);
     }
 }
@@ -842,10 +758,8 @@ WebInspector.DebuggerPresentationModelResourceBinding.prototype = {
      */
     canSetContent: function(resource)
     {
-        var rawSourceCode = this._presentationModel._rawSourceCodeForScriptWithURL(resource.url)
-        if (!rawSourceCode)
-            return false;
-        return this._presentationModel.canEditScriptSource(rawSourceCode.sourceMapping.uiSourceCodeList()[0]);
+        var uiSourceCode = this._uiSourceCodeForResource(resource);
+        return uiSourceCode && this._presentationModel.canEditScriptSource(uiSourceCode);
     },
 
     /**
@@ -859,13 +773,28 @@ WebInspector.DebuggerPresentationModelResourceBinding.prototype = {
         if (!majorChange)
             return;
 
-        var rawSourceCode = this._presentationModel._rawSourceCodeForScriptWithURL(resource.url);
-        if (!rawSourceCode) {
+        var uiSourceCode = this._uiSourceCodeForResource(resource);
+        if (!uiSourceCode) {
             userCallback("Resource is not editable");
             return;
         }
 
-        resource.requestContent(this._setContentWithInitialContent.bind(this, rawSourceCode.sourceMapping.uiSourceCodeList()[0], content, userCallback));
+        resource.requestContent(this._setContentWithInitialContent.bind(this, uiSourceCode, content, userCallback));
+    },
+
+    /**
+     * @param {WebInspector.Resource} resource
+     * @return {WebInspector.UISourceCode}
+     */
+    _uiSourceCodeForResource: function(resource)
+    {
+        var script = WebInspector.debuggerModel.scriptsForURL(resource.url)[0];
+        if (!script)
+            return null;
+        var rawLocation = new WebInspector.DebuggerModel.Location(0, 0);
+        rawLocation.scriptId = script.scriptId;
+        var uiLocation = this._presentationModel.rawLocationToUILocation(rawLocation);
+        return uiLocation ? uiLocation.uiSourceCode : null;
     },
 
     /**
@@ -892,6 +821,8 @@ WebInspector.DebuggerPresentationModelResourceBinding.prototype = {
     }
 }
 
+WebInspector.DebuggerPresentationModelResourceBinding.prototype.__proto__ = WebInspector.ResourceDomainModelBinding.prototype;
+
 /**
  * @interface
  */
@@ -901,10 +832,10 @@ WebInspector.DebuggerPresentationModel.LinkifierFormatter = function()
 
 WebInspector.DebuggerPresentationModel.LinkifierFormatter.prototype = {
     /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
      * @param {Element} anchor
+     * @param {WebInspector.UILocation} uiLocation
      */
-    formatRawSourceCodeAnchor: function(rawSourceCode, anchor) { },
+    formatLiveAnchor: function(anchor, uiLocation) { },
 }
 
 /**
@@ -919,13 +850,11 @@ WebInspector.DebuggerPresentationModel.DefaultLinkifierFormatter = function(maxL
 
 WebInspector.DebuggerPresentationModel.DefaultLinkifierFormatter.prototype = {
     /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
      * @param {Element} anchor
+     * @param {WebInspector.UILocation} uiLocation
      */
-    formatRawSourceCodeAnchor: function(rawSourceCode, anchor)
+    formatLiveAnchor: function(anchor, uiLocation)
     {
-        var uiLocation = rawSourceCode.sourceMapping.rawLocationToUILocation(anchor.rawLocation);
-
         anchor.textContent = WebInspector.formatLinkText(uiLocation.uiSourceCode.url, uiLocation.lineNumber);
 
         var text = WebInspector.formatLinkText(uiLocation.uiSourceCode.url, uiLocation.lineNumber);
@@ -946,7 +875,7 @@ WebInspector.DebuggerPresentationModel.Linkifier = function(model, formatter)
 {
     this._model = model;
     this._formatter = formatter || new WebInspector.DebuggerPresentationModel.DefaultLinkifierFormatter();
-    this._anchorsForRawSourceCode = {};
+    this._liveLocations = [];
 }
 
 WebInspector.DebuggerPresentationModel.Linkifier.prototype = {
@@ -958,82 +887,48 @@ WebInspector.DebuggerPresentationModel.Linkifier.prototype = {
      */
     linkifyLocation: function(sourceURL, lineNumber, columnNumber, classes)
     {
-        var rawSourceCode = this._model._rawSourceCodeForScriptWithURL(sourceURL);
-        if (!rawSourceCode)
+        var rawLocation = new WebInspector.DebuggerModel.Location(lineNumber, columnNumber || 0);
+        var script = this._model._scriptForURLAndLocation(sourceURL, rawLocation);
+        if (!script)
             return WebInspector.linkifyResourceAsNode(sourceURL, lineNumber, classes);
-
-        return this.linkifyRawSourceCode(rawSourceCode, lineNumber, columnNumber, classes);
+        rawLocation.scriptId = script.scriptId;
+        return this.linkifyRawLocation(rawLocation, classes);
     },
 
     /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
-     * @param {number=} lineNumber
-     * @param {number=} columnNumber
+     * @param {WebInspector.DebuggerModel.Location} rawLocation
      * @param {string=} classes
      */
-    linkifyRawSourceCode: function(rawSourceCode, lineNumber, columnNumber, classes)
+    linkifyRawLocation: function(rawLocation, classes)
     {
-        var anchor = WebInspector.linkifyURLAsNode(rawSourceCode.url, "", classes, false);
-        anchor.rawLocation = { lineNumber: lineNumber, columnNumber: columnNumber };
-
-        var anchors = this._anchorsForRawSourceCode[rawSourceCode.id];
-        if (!anchors) {
-            anchors = [];
-            this._anchorsForRawSourceCode[rawSourceCode.id] = anchors;
-            rawSourceCode.addEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, this._updateSourceAnchors, this);
-        }
-
-        if (rawSourceCode.sourceMapping)
-            this._updateAnchor(rawSourceCode, anchor);
-        anchors.push(anchor);
+        var anchor = WebInspector.linkifyURLAsNode("", "", classes, false);
+        var liveLocation = this._model.createLiveLocation(rawLocation, this._updateAnchor.bind(this, anchor));
+        liveLocation.init();
+        this._liveLocations.push(liveLocation);
         return anchor;
     },
 
-    linkifyFunctionLocation: function(functionLocation, classes)
-    {
-        var rawSourceCode = this._model._rawSourceCodeForScriptId[functionLocation.scriptId];
-        if (!rawSourceCode)
-            return undefined;
-        return this.linkifyRawSourceCode(rawSourceCode, functionLocation.lineNumber, functionLocation.columnNumber, classes);
-    },
-
     reset: function()
     {
-        for (var id in this._anchorsForRawSourceCode) {
-            if (this._model._rawSourceCodeForScriptId[id]) // In case of navigation the list of rawSourceCodes is empty.
-                this._model._rawSourceCodeForScriptId[id].removeEventListener(WebInspector.RawSourceCode.Events.SourceMappingUpdated, this._updateSourceAnchors, this);
-        }
-        this._anchorsForRawSourceCode = {};
+        for (var i = 0; i < this._liveLocations.length; ++i)
+            this._liveLocations[i].dispose();
+        this._liveLocations = [];
     },
 
     /**
-     * @param {WebInspector.Event} event
-     */
-    _updateSourceAnchors: function(event)
-    {
-        var rawSourceCode = /** @type {WebInspector.RawSourceCode} */ event.target;
-        var anchors = this._anchorsForRawSourceCode[rawSourceCode.id];
-        for (var i = 0; i < anchors.length; ++i)
-            this._updateAnchor(rawSourceCode, anchors[i]);
-    },
-
-    /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
      * @param {Element} anchor
+     * @param {WebInspector.UILocation} uiLocation
      */
-    _updateAnchor: function(rawSourceCode, anchor)
+    _updateAnchor: function(anchor, uiLocation)
     {
-        var uiLocation = rawSourceCode.sourceMapping.rawLocationToUILocation(anchor.rawLocation);
         anchor.preferredPanel = "scripts";
+        anchor.href = uiLocation.uiSourceCode.url;
         anchor.uiSourceCode = uiLocation.uiSourceCode;
         anchor.lineNumber = uiLocation.lineNumber;
-
-        this._formatter.formatRawSourceCodeAnchor(rawSourceCode, anchor);
+        this._formatter.formatLiveAnchor(anchor, uiLocation);
     }
 }
 
-WebInspector.DebuggerPresentationModelResourceBinding.prototype.__proto__ = WebInspector.ResourceDomainModelBinding.prototype;
-
 /**
  * @type {?WebInspector.DebuggerPresentationModel}
  */
diff --git a/Source/WebCore/inspector/front-end/DetailedHeapshotView.js b/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
index d35b20350..37d985fd9 100644
--- a/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
+++ b/Source/WebCore/inspector/front-end/DetailedHeapshotView.js
@@ -623,6 +623,8 @@ WebInspector.DetailedHeapshotView.prototype = {
     {
         this._currentSearchResultIndex = -1;
         this._popoverHelper.hidePopover();
+        if (this.helpPopover && this.helpPopover.visible)
+            this.helpPopover.hide();
     },
 
     onResize: function()
diff --git a/Source/WebCore/inspector/front-end/Drawer.js b/Source/WebCore/inspector/front-end/Drawer.js
index 9bf372a3e..fec9c9eb3 100644
--- a/Source/WebCore/inspector/front-end/Drawer.js
+++ b/Source/WebCore/inspector/front-end/Drawer.js
@@ -123,7 +123,7 @@ WebInspector.Drawer.prototype = {
         
         function animationFinished()
         {
-            WebInspector.inspectorView.currentPanel().statusBarResized();
+            WebInspector.inspectorView.currentPanel().doResize();
             if (this._view && this._view.afterShow)
                 this._view.afterShow();
             delete this._currentAnimation;
diff --git a/Source/WebCore/inspector/front-end/ElementsPanel.js b/Source/WebCore/inspector/front-end/ElementsPanel.js
index 535e70579..7dbc2c8ff 100644
--- a/Source/WebCore/inspector/front-end/ElementsPanel.js
+++ b/Source/WebCore/inspector/front-end/ElementsPanel.js
@@ -381,7 +381,7 @@ WebInspector.ElementsPanel.prototype = {
                 return;
             }
 
-            object.callFunctionJSON(dimensions, callback);
+            object.callFunctionJSON(dimensions, undefined, callback);
             object.release();
 
             function dimensions()
diff --git a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
index 1367fdef6..07817e8cc 100644
--- a/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/Source/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -1505,6 +1505,8 @@ WebInspector.ElementsTreeElement.prototype = {
         var classes = [ "webkit-html-tag" ];
         if (isClosingTag && isDistinctTreeElement)
             classes.push("close");
+        if (node.isInShadowTree())
+            classes.push("shadow");
         var tagElement = parentElement.createChild("span", classes.join(" "));
         tagElement.appendChild(document.createTextNode("<"));
         var tagNameElement = tagElement.createChild("span", isClosingTag ? "" : "webkit-html-tag-name");
@@ -1527,10 +1529,6 @@ WebInspector.ElementsTreeElement.prototype = {
         var info = {titleDOM: document.createDocumentFragment(), hasChildren: this.hasChildren};
 
         switch (node.nodeType()) {
-            case Node.DOCUMENT_FRAGMENT_NODE:
-                info.titleDOM.appendChild(document.createTextNode("Document Fragment"));
-                break;
-
             case Node.ATTRIBUTE_NODE:
                 var value = node.value || "\u200B"; // Zero width space to force showing an empty value.
                 this._buildAttributeDOM(info.titleDOM, node.name, value);
@@ -1616,10 +1614,15 @@ WebInspector.ElementsTreeElement.prototype = {
                 var cdataElement = info.titleDOM.createChild("span", "webkit-html-text-node");
                 cdataElement.appendChild(document.createTextNode("<![CDATA[" + node.nodeValue() + "]]>"));
                 break;
+            case Node.DOCUMENT_FRAGMENT_NODE:
+                var fragmentElement = info.titleDOM.createChild("span", "webkit-html-fragment");
+                fragmentElement.textContent = node.nodeNameInCorrectCase().collapseWhitespace();
+                if (node.isInShadowTree())
+                    fragmentElement.addStyleClass("shadow");
+                break;
             default:
-                var defaultElement = info.titleDOM.appendChild(document.createTextNode(node.nodeNameInCorrectCase().collapseWhitespace()));
+                info.titleDOM.appendChild(document.createTextNode(node.nodeNameInCorrectCase().collapseWhitespace()));
         }
-
         return info;
     },
 
diff --git a/Source/WebCore/inspector/front-end/ExtensionAPI.js b/Source/WebCore/inspector/front-end/ExtensionAPI.js
index 220d78bde..ce3f976cd 100644
--- a/Source/WebCore/inspector/front-end/ExtensionAPI.js
+++ b/Source/WebCore/inspector/front-end/ExtensionAPI.js
@@ -125,7 +125,7 @@ EventSinkImpl.prototype = {
         if (this._listeners.length === 0)
             extensionServer.sendRequest({ command: commands.Subscribe, type: this._type });
         this._listeners.push(callback);
-        extensionServer.registerHandler("notify-" + this._type, bind(this._dispatch, this));
+        extensionServer.registerHandler("notify-" + this._type, this._dispatch.bind(this));
     },
 
     removeListener: function(callback)
@@ -279,7 +279,7 @@ function Panels()
         return panels[name];
     }
     for (var panel in panels)
-        this.__defineGetter__(panel, bind(panelGetter, null, panel));
+        this.__defineGetter__(panel, panelGetter.bind(null, panel));
 }
 
 Panels.prototype = {
@@ -293,7 +293,7 @@ Panels.prototype = {
             icon: icon,
             page: page
         };
-        extensionServer.sendRequest(request, callback && bind(callback, this, new ExtensionPanel(id)));
+        extensionServer.sendRequest(request, callback && callback.bind(this, new ExtensionPanel(id)));
     },
 
     setOpenResourceHandler: function(callback)
@@ -495,9 +495,9 @@ function AuditResultImpl(id)
 {
     this._id = id;
 
-    this.createURL = bind(this._nodeFactory, null, "url");
-    this.createSnippet = bind(this._nodeFactory, null, "snippet");
-    this.createText = bind(this._nodeFactory, null, "text");
+    this.createURL = this._nodeFactory.bind(null, "url");
+    this.createSnippet = this._nodeFactory.bind(null, "snippet");
+    this.createText = this._nodeFactory.bind(null, "text");
 }
 
 AuditResultImpl.prototype = {
@@ -677,11 +677,11 @@ function ExtensionServerClient()
     this._lastRequestId = 0;
     this._lastObjectId = 0;
 
-    this.registerHandler("callback", bind(this._onCallback, this));
+    this.registerHandler("callback", this._onCallback.bind(this));
 
     var channel = new MessageChannel();
     this._port = channel.port1;
-    this._port.addEventListener("message", bind(this._onMessage, this), false);
+    this._port.addEventListener("message", this._onMessage.bind(this), false);
     this._port.start();
 
     top.postMessage("registerExtension", [ channel.port2 ], "*");
@@ -740,15 +740,6 @@ ExtensionServerClient.prototype = {
     }
 }
 
-/**
- * @param {...*} vararg
- */
-function bind(func, thisObject, vararg)
-{
-    var args = Array.prototype.slice.call(arguments, 2);
-    return function() { return func.apply(thisObject, args.concat(Array.prototype.slice.call(arguments, 0))); };
-}
-
 function populateInterfaceClass(interface, implementation)
 {
     for (var member in implementation) {
@@ -761,9 +752,9 @@ function populateInterfaceClass(interface, implementation)
         if (!descriptor)
             continue;
         if (typeof descriptor.value === "function")
-            interface[member] = bind(descriptor.value, implementation);
+            interface[member] = descriptor.value.bind(implementation);
         else if (typeof descriptor.get === "function")
-            interface.__defineGetter__(member, bind(descriptor.get, implementation));
+            interface.__defineGetter__(member, descriptor.get.bind(implementation));
         else
             Object.defineProperty(interface, member, descriptor);
     }
diff --git a/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js b/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js
index 2b2823a0d..fe98f3c29 100644
--- a/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js
+++ b/Source/WebCore/inspector/front-end/HeapSnapshotProxy.js
@@ -263,20 +263,22 @@ WebInspector.HeapSnapshotLoaderProxy.prototype = {
         delete this._onLoadCallbacks;
         this._loading = false;
         this._loaded = true;
-        function callLoadCallbacks(snapshotProxy)
-        {
-            for (var i = 0; i < loadCallbacks.length; ++i)
-                loadCallbacks[i](snapshotProxy);
-        }
+        var self = this;
         function updateStaticData(snapshotProxy)
         {
             this.dispose();
-            snapshotProxy.updateStaticData(callLoadCallbacks);
+            snapshotProxy.updateStaticData(this._callLoadCallbacks.bind(this, loadCallbacks));
         }
         this.callFactoryMethod(updateStaticData.bind(this), "finishLoading", "WebInspector.HeapSnapshotProxy");
         return true;
     },
 
+    _callLoadCallbacks: function(loadCallbacks, snapshotProxy)
+    {
+        for (var i = 0; i < loadCallbacks.length; ++i)
+            loadCallbacks[i](snapshotProxy);
+    },
+
     get loaded()
     {
         return this._loaded;
diff --git a/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png b/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png
index a46d72888..c483e06e5 100644
--- a/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png
+++ b/Source/WebCore/inspector/front-end/Images/statusbarButtonGlyphs.png
diff --git a/Source/WebCore/inspector/front-end/IndexedDBModel.js b/Source/WebCore/inspector/front-end/IndexedDBModel.js
index a73fc7ed3..2f075c569 100644
--- a/Source/WebCore/inspector/front-end/IndexedDBModel.js
+++ b/Source/WebCore/inspector/front-end/IndexedDBModel.js
@@ -73,7 +73,7 @@ WebInspector.IndexedDBModel.idbKeyFromKey = function(key)
         break;
     case WebInspector.IndexedDBModel.KeyTypes.ArrayType:
         idbKey = [];
-        for (var i = 0; i < key.length; ++i)
+        for (var i = 0; i < key.array.length; ++i)
             idbKey.push(WebInspector.IndexedDBModel.idbKeyFromKey(key.array[i]));
         break;
     }
diff --git a/Source/WebCore/inspector/front-end/IndexedDBViews.js b/Source/WebCore/inspector/front-end/IndexedDBViews.js
index a14b791b9..6d12c2737 100644
--- a/Source/WebCore/inspector/front-end/IndexedDBViews.js
+++ b/Source/WebCore/inspector/front-end/IndexedDBViews.js
@@ -37,14 +37,14 @@ WebInspector.IDBDatabaseView = function(database)
 {
     WebInspector.View.call(this);
     this.registerRequiredCSS("indexedDBViews.css");
-    
+
     this.element.addStyleClass("fill");
     this.element.addStyleClass("indexed-db-database-view");
-    
+
     this._headersListElement = this.element.createChild("ol", "outline-disclosure");
     this._headersTreeOutline = new TreeOutline(this._headersListElement);
     this._headersTreeOutline.expandTreeElementsWhenArrowing = true;
-    
+
     this._securityOriginTreeElement = new TreeElement("", null, false);
     this._securityOriginTreeElement.selectable = false;
     this._headersTreeOutline.appendChild(this._securityOriginTreeElement);
@@ -105,8 +105,8 @@ WebInspector.IDBDataView = function(model, databaseId, objectStore, index)
 {
     WebInspector.View.call(this);
     this.registerRequiredCSS("indexedDBViews.css");
-    
-    this._model = model; 
+
+    this._model = model;
     this._databaseId = databaseId;
     this._isIndex = !!index;
 
@@ -114,10 +114,13 @@ WebInspector.IDBDataView = function(model, databaseId, objectStore, index)
 
     var editorToolbar = this._createEditorToolbar();
     this.element.appendChild(editorToolbar);
-    
+
     this._dataGridContainer = this.element.createChild("div", "fill");
     this._dataGridContainer.addStyleClass("data-grid-container");
 
+    this._refreshButton = new WebInspector.StatusBarButton(WebInspector.UIString("Refresh"), "refresh-storage-status-bar-item");
+    this._refreshButton.addEventListener("click", this._refreshButtonClicked, this);
+
     this._pageSize = 50;
     this._skipCount = 0;
 
@@ -134,18 +137,18 @@ WebInspector.IDBDataView.prototype = {
         columns["number"] = {};
         columns["number"].title = WebInspector.UIString("#");
         columns["number"].width = "50px";
-        
+
         var keyPath = this._isIndex ? this._index.keyPath : this._objectStore.keyPath;
         columns["key"] = {};
-        var keyColumnTitle = WebInspector.UIString("Key") + (keyPath ? " (" + keyPath + ")" : "");
+        var keyColumnTitle = WebInspector.UIString("Key") + this._keyPathHeader(keyPath);
         columns["key"].title = keyColumnTitle;
-        
+
         if (this._isIndex) {
             columns["primaryKey"] = {};
-            var primaryKeyColumnTitle = WebInspector.UIString("Primary key") + (this._objectStore.keyPath ? " (" + this._objectStore.keyPath + ")" : "");
+            var primaryKeyColumnTitle = WebInspector.UIString("Primary key") + this._keyPathHeader(this._objectStore.keyPath);
             columns["primaryKey"].title = primaryKeyColumnTitle;
         }
-        
+
         columns["value"] = {};
         columns["value"].title = WebInspector.UIString("Value");
 
@@ -154,6 +157,16 @@ WebInspector.IDBDataView.prototype = {
     },
 
     /**
+     * @return {string}
+     */
+    _keyPathHeader: function(keyPath)
+    {
+        if (!keyPath)
+            return "";
+        return " (" + WebInspector.UIString("keyPath") + ": \"" + keyPath + "\")";
+    },
+
+    /**
      * @return {Element}
      */
     _createEditorToolbar: function()
@@ -169,7 +182,7 @@ WebInspector.IDBDataView.prototype = {
         this._pageBackButton.appendChild(document.createElement("img"));
         this._pageBackButton.addEventListener("click", this._pageBackButtonClicked.bind(this), false);
         editorToolbar.appendChild(this._pageBackButton);
-        
+
         this._pageForwardButton = editorToolbar.createChild("button", "forward-button");
         this._pageForwardButton.addStyleClass("status-bar-item");
         this._pageForwardButton.title = WebInspector.UIString("Show next page.");
@@ -177,7 +190,7 @@ WebInspector.IDBDataView.prototype = {
         this._pageForwardButton.appendChild(document.createElement("img"));
         this._pageForwardButton.addEventListener("click", this._pageForwardButtonClicked.bind(this), false);
         editorToolbar.appendChild(this._pageForwardButton);
-        
+
         this._keyInputElement = editorToolbar.createChild("input", "key-input");
         this._keyInputElement.placeholder = WebInspector.UIString("Start from key");
         this._keyInputElement.addEventListener("paste", this._keyInputChanged.bind(this));
@@ -193,18 +206,18 @@ WebInspector.IDBDataView.prototype = {
         this._skipCount = Math.max(0, this._skipCount - this._pageSize);
         this._updateData(false);
     },
-    
+
     _pageForwardButtonClicked: function()
     {
         this._skipCount = this._skipCount + this._pageSize;
         this._updateData(false);
     },
-    
+
     _keyInputChanged: function()
     {
-        window.setTimeout(this._updateData.bind(this, false), 0);        
+        window.setTimeout(this._updateData.bind(this, false), 0);
     },
-    
+
     /**
      * @param {WebInspector.IndexedDBModel.ObjectStore} objectStore
      * @param {WebInspector.IndexedDBModel.Index} index
@@ -220,9 +233,9 @@ WebInspector.IDBDataView.prototype = {
         this._dataGrid.show(this._dataGridContainer);
 
         this._skipCount = 0;
-        this._updateData(true); 
+        this._updateData(true);
     },
-    
+
     /**
      * @param {string} keyString
      */
@@ -236,7 +249,7 @@ WebInspector.IDBDataView.prototype = {
         }
         return result;
     },
-    
+
     /**
      * @return {string}
      */
@@ -255,7 +268,7 @@ WebInspector.IDBDataView.prototype = {
         var key = this._parseKey(this._keyInputElement.value);
         var pageSize = this._pageSize;
         var skipCount = this._skipCount;
-        
+
         if (!force && this._lastKey === key && this._lastPageSize === pageSize && this._lastSkipCount === skipCount)
             return;
 
@@ -277,8 +290,8 @@ WebInspector.IDBDataView.prototype = {
             for (var i = 0; i < entries.length; ++i) {
                 var data = {};
                 data["number"] = i + skipCount;
-                data["key"] = this._stringifyKey(entries[i].key);
-                data["primaryKey"] = this._stringifyKey(entries[i].primaryKey);
+                data["key"] = entries[i].key;
+                data["primaryKey"] = entries[i].primaryKey;
                 data["value"] = entries[i].value;
 
                 var primaryKey = JSON.stringify(this._isIndex ? entries[i].primaryKey : entries[i].key);
@@ -286,17 +299,27 @@ WebInspector.IDBDataView.prototype = {
                 var node = new WebInspector.IDBDataGridNode(valueTitle, data);
                 this._dataGrid.appendChild(node);
             }
-            
+
             this._pageBackButton.disabled = skipCount === 0;
             this._pageForwardButton.disabled = !hasMore;
         }
-        
+
         var idbKeyRange = key ? window.webkitIDBKeyRange.lowerBound(key) : null;
         if (this._isIndex)
             this._model.loadIndexData(this._databaseId, this._objectStore.name, this._index.name, idbKeyRange, skipCount, pageSize, callback.bind(this));
         else
             this._model.loadObjectStoreData(this._databaseId, this._objectStore.name, idbKeyRange, skipCount, pageSize, callback.bind(this));
     },
+
+    _refreshButtonClicked: function(event)
+    {
+        this._updateData(true);
+    },
+
+    get statusBarItems()
+    {
+        return [this._refreshButton.element];
+    }
 }
 
 WebInspector.IDBDataView.prototype.__proto__ = WebInspector.View.prototype;
@@ -310,7 +333,7 @@ WebInspector.IDBDataView.prototype.__proto__ = WebInspector.View.prototype;
 WebInspector.IDBDataGridNode = function(valueTitle, data)
 {
     WebInspector.DataGridNode.call(this, data, false);
-    
+
     this._valueTitle = valueTitle;
     this.selectable = false;
 }
@@ -321,13 +344,46 @@ WebInspector.IDBDataGridNode.prototype = {
      */
     createCell: function(columnIdentifier)
     {
-        if (columnIdentifier !== "value")
-            return WebInspector.DataGridNode.prototype.createCell.call(this, columnIdentifier);
+        var cell = WebInspector.DataGridNode.prototype.createCell.call(this, columnIdentifier);
+        var value = this.data[columnIdentifier];
         
-        var section = new WebInspector.ObjectPropertiesSection(this.data["value"], this._valueTitle)
-        section.editable = false;
-        section.skipProto = true;
-        return section.element;
+        switch (columnIdentifier) {
+        case "value":
+            cell.removeChildren();
+            this._formatValue(cell, value);
+            break;
+        case "key":
+        case "primaryKey":
+            cell.removeChildren();
+            this._formatValue(cell, new WebInspector.LocalJSONObject(value));
+            break;
+        default:
+        }
+
+        return cell;
+    },
+
+    _formatValue: function(cell, value)
+    {
+        var type = value.subtype || value.type;
+        var contents = cell.createChild("div", "source-code console-formatted-" + type);
+
+        switch (type) {
+        case "object":
+        case "array":
+            var section = new WebInspector.ObjectPropertiesSection(value, value.description)
+            section.editable = false;
+            section.skipProto = true;
+            contents.appendChild(section.element);
+            break;
+        case "string":
+            contents.addStyleClass("primitive-value");
+            contents.appendChild(document.createTextNode("\"" + value.description + "\""));
+            break;
+        default:
+            contents.addStyleClass("primitive-value");
+            contents.appendChild(document.createTextNode(value.description));
+        }
     }
 };
 
diff --git a/Source/WebCore/inspector/front-end/InspectorFrontendAPI.js b/Source/WebCore/inspector/front-end/InspectorFrontendAPI.js
index 828c54032..3b02f6c2b 100644
--- a/Source/WebCore/inspector/front-end/InspectorFrontendAPI.js
+++ b/Source/WebCore/inspector/front-end/InspectorFrontendAPI.js
@@ -95,6 +95,11 @@ InspectorFrontendAPI = {
         WebInspector.inspectorView.setCurrentPanel(WebInspector.panels.resources);
     },
 
+    setDockingUnavailable: function(unavailable)
+    {
+        WebInspector.setDockingUnavailable(unavailable);
+    },
+
     dispatch: function(signature)
     {
         if (WebInspector.panels) {
diff --git a/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js b/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
index 6e9b12ea1..ac314a4eb 100644
--- a/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
+++ b/Source/WebCore/inspector/front-end/InspectorFrontendHostStub.js
@@ -36,6 +36,7 @@ if (!window.InspectorFrontendHost) {
 WebInspector.InspectorFrontendHostStub = function()
 {
     this._attachedWindowHeight = 0;
+    this.isStub = true;
 }
 
 WebInspector.InspectorFrontendHostStub.prototype = {
@@ -136,11 +137,6 @@ WebInspector.InspectorFrontendHostStub.prototype = {
         fr.readAsDataURL(blob);
     },
 
-    canAttachWindow: function()
-    {
-        return false;
-    },
-
     sendMessageToBackend: function(message)
     {
     },
@@ -160,6 +156,10 @@ WebInspector.InspectorFrontendHostStub.prototype = {
     loadResourceSynchronously: function(url)
     {
         return "";
+    },
+
+    setZoomFactor: function(zoom)
+    {
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js b/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
index c8b9528ce..0b6fc18c2 100644
--- a/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
+++ b/Source/WebCore/inspector/front-end/JavaScriptSourceFrame.js
@@ -169,7 +169,7 @@ WebInspector.JavaScriptSourceFrame.prototype = {
         if (typeof this._executionLineNumber === "number") {
             var newExecutionLineNumber = this._lineNumberAfterEditing(this._executionLineNumber, oldRange, newRange);
             this.clearExecutionLine();
-            this.setExecutionLine(newExecutionLineNumber, true);
+            this.setExecutionLine(newExecutionLineNumber);
         }
 
         // Adjust breakpoints.
@@ -460,16 +460,13 @@ WebInspector.JavaScriptSourceFrame.prototype = {
     },
 
     /**
-     * @param {boolean=} skipRevealLine
+     * @param {number} lineNumber
      */
-    setExecutionLine: function(lineNumber, skipRevealLine)
+    setExecutionLine: function(lineNumber)
     {
         this._executionLineNumber = lineNumber;
-        if (this.loaded) {
+        if (this.loaded)
             this.textViewer.addDecoration(lineNumber, "webkit-execution-line");
-            if (!skipRevealLine)
-                this.textViewer.revealLine(lineNumber);
-        }
     },
 
     clearExecutionLine: function()
diff --git a/Source/WebCore/inspector/front-end/MemoryStatistics.js b/Source/WebCore/inspector/front-end/MemoryStatistics.js
index d9d2fbcff..c3fdfb506 100644
--- a/Source/WebCore/inspector/front-end/MemoryStatistics.js
+++ b/Source/WebCore/inspector/front-end/MemoryStatistics.js
@@ -46,27 +46,177 @@ WebInspector.MemoryStatistics = function(timelinePanel, sidebarWidth)
     this._memorySplitView.addEventListener(WebInspector.SplitView.EventTypes.Resized, this._sidebarResized.bind(this));
 
     this._canvasContainer = this._memorySplitView.mainElement;
-    this._canvas = this._canvasContainer.createChild("canvas", "fill");
+    this._canvasContainer.id = "memory-graphs-canvas-container";
+    this._currentValuesBar = this._canvasContainer.createChild("div");
+    this._currentValuesBar.id = "counter-values-bar";
+    this._canvas = this._canvasContainer.createChild("canvas");
     this._canvas.id = "memory-counters-graph";
     this._lastMarkerXPosition = 0;
 
-    this._canvasContainer.addEventListener("mouseover", this._onMouseOver.bind(this), true);
-    this._canvasContainer.addEventListener("mousemove", this._onMouseMove.bind(this), true);
-    this._canvasContainer.addEventListener("mouseout", this._onMouseOut.bind(this), true);
+    this._canvas.addEventListener("mouseover", this._onMouseOver.bind(this), true);
+    this._canvas.addEventListener("mousemove", this._onMouseMove.bind(this), true);
+    this._canvas.addEventListener("mouseout", this._onMouseOut.bind(this), true);
+    this._canvas.addEventListener("click", this._onClick.bind(this), true);
+    // We create extra timeline grid here to reuse its event dividers.
+    this._timelineGrid = new WebInspector.TimelineGrid();
+    this._canvasContainer.appendChild(this._timelineGrid.dividersElement);
 
     // Populate sidebar
-    this._counterSidebarElements = [];
-    this._documents = this._createCounterSidebarElement(WebInspector.UIString("Document count"), true);
-    this._domNodes = this._createCounterSidebarElement(WebInspector.UIString("DOM node count"), true);
-    this._listeners = this._createCounterSidebarElement(WebInspector.UIString("Event listener count"), false);
-
-    this._savedImageData = [];
-    this._graphColors = ["rgba(100,0,0,0.8)", "rgba(0,100,0,0.8)", "rgba(0,0,100,0.8)"];
+    this._memorySplitView.sidebarElement.createChild("div", "sidebar-tree sidebar-tree-section").textContent = WebInspector.UIString("COUNTERS");
+    function getDocumentCount(entry)
+    {
+        return entry.documentCount;
+    }
+    function getNodeCount(entry)
+    {
+        return entry.nodeCount;
+    }
+    function getListenerCount(entry)
+    {
+        return entry.listenerCount;
+    }
+    this._counterUI = [
+        new WebInspector.CounterUI(this, "Document Count", "Documents: %d", [100,0,0], getDocumentCount),
+        new WebInspector.CounterUI(this, "DOM Node Count", "Nodes: %d", [0,100,0], getNodeCount),
+        new WebInspector.CounterUI(this, "Event Listener Count", "Listeners: %d", [0,0,100], getListenerCount)
+    ];
 
     TimelineAgent.setIncludeMemoryDetails(true);
 }
 
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.SwatchCheckbox = function(title, color)
+{
+    this.element = document.createElement("div");
+    this._swatch = this.element.createChild("div", "swatch");
+    this.element.createChild("span", "title").textContent = title;
+    this._color = color;
+    this.checked = true;
+
+    this.element.addEventListener("click", this._toggleCheckbox.bind(this), true);
+}
+
+WebInspector.SwatchCheckbox.Events = {
+    Changed: "Changed"
+}
+
+WebInspector.SwatchCheckbox.prototype = {
+    get checked()
+    {
+        return this._checked;
+    },
+
+    set checked(v)
+    {
+        this._checked = v;
+        if (this._checked)
+            this._swatch.style.backgroundColor = this._color;
+        else
+            this._swatch.style.backgroundColor = "";
+    },
+
+    _toggleCheckbox: function(event)
+    {
+        this.checked = !this.checked;
+        this.dispatchEventToListeners(WebInspector.SwatchCheckbox.Events.Changed);
+    }
+}
+
+WebInspector.SwatchCheckbox.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ */
+WebInspector.CounterUI = function(memoryCountersPane, title, currentValueLabel, rgb, valueGetter)
+{
+    this._memoryCountersPane = memoryCountersPane;
+    this.valueGetter = valueGetter;
+    var container = memoryCountersPane._memorySplitView.sidebarElement.createChild("div", "memory-counter-sidebar-info");
+    var swatchColor = "rgb(" + rgb.join(",") + ")";
+    this._swatch = new WebInspector.SwatchCheckbox(WebInspector.UIString(title), swatchColor);
+    this._swatch.addEventListener(WebInspector.SwatchCheckbox.Events.Changed, this._toggleCounterGraph.bind(this));
+    container.appendChild(this._swatch.element);
+    this._range = this._swatch.element.createChild("span");
+
+    this._value = memoryCountersPane._currentValuesBar.createChild("span", "memory-counter-value");
+    this._value.style.color = swatchColor;
+    this._currentValueLabel = currentValueLabel;
+
+    this.graphColor = "rgba(" + rgb.join(",") + ",0.8)";
+    this.graphYValues = [];
+}
+
+WebInspector.CounterUI.prototype = {
+    _toggleCounterGraph: function(event)
+    {
+        if (this._swatch.checked)
+            this._value.removeStyleClass("hidden");
+        else
+            this._value.addStyleClass("hidden");
+        this._memoryCountersPane.refresh();
+    },
+
+    setRange: function(minValue, maxValue)
+    {
+        this._range.textContent = WebInspector.UIString("[ %d - %d ]", minValue, maxValue);
+    },
+
+    updateCurrentValue: function(countersEntry)
+    {
+        this._value.textContent =  WebInspector.UIString(this._currentValueLabel, this.valueGetter(countersEntry));
+    },
+
+    clearCurrentValueAndMarker: function(ctx)
+    {
+        this._value.textContent = "";
+        this.restoreImageUnderMarker(ctx);
+    },
+
+    get visible()
+    {
+        return this._swatch.checked;
+    },
+
+    saveImageUnderMarker: function(ctx, x, y, radius)
+    {
+        const w = radius + 1;
+        var imageData = ctx.getImageData(x - w, y - w, 2 * w, 2 * w);
+        this._imageUnderMarker = {
+            x: x - w,
+            y: y - w,
+            imageData: imageData };
+    },
+
+    restoreImageUnderMarker: function(ctx)
+    {
+        if (!this.visible)
+            return;
+        if (this._imageUnderMarker)
+            ctx.putImageData(this._imageUnderMarker.imageData, this._imageUnderMarker.x, this._imageUnderMarker.y);
+        this.discardImageUnderMarker();
+    },
+
+    discardImageUnderMarker: function()
+    {
+        delete this._imageUnderMarker;
+    }
+}
+
+
 WebInspector.MemoryStatistics.prototype = {
+    reset: function()
+    {
+        this._counters = [];
+    },
+
+    setMainTimelineGrid: function(timelineGrid)
+    {
+        this._mainTimelineGrid = timelineGrid;
+    },
+
     setTopPosition: function(top)
     {
         this._memorySplitView.element.style.top = top + "px";
@@ -93,46 +243,12 @@ WebInspector.MemoryStatistics.prototype = {
 
     _updateSize: function()
     {
-        var height = this._canvasContainer.offsetHeight;
-        this._canvas.width = this._canvasContainer.offsetWidth;
-        this._canvas.height = height;
-        this._updateSidebarSize(height);
-    },
-
-    _updateSidebarSize: function(height)
-    {
-        var length = this._counterSidebarElements.length;
-        var graphHeight =  Math.round(height / length);
-        var top = 0;
-        for (var i = 0; i < length; i++) {
-            var element = this._counterSidebarElements[i];
-            element.style.top = top + "px";
-            element.style.height = graphHeight + "px";
-            top += graphHeight;
-        }
-    },
-
-    _createCounterSidebarElement: function(title, showBottomBorder)
-    {
-        var container = this._memorySplitView.sidebarElement.createChild("div", "memory-counter-sidebar-info");
-        container.createChild("div", "title").textContent = title;
-
-        var currentValue = container.createChild("div", "counter-value");
-        currentValue.createChild("span").textContent = WebInspector.UIString("Current: ");
-        container._value = currentValue.createChild("span");
-
-        var minValue = container.createChild("div", "counter-value");
-        minValue.createChild("span").textContent = WebInspector.UIString("Min: ");
-        container._minValue = minValue.createChild("span");
+        var width = this._mainTimelineGrid.dividersElement.offsetWidth + 1;
+        this._canvasContainer.style.width = width + "px";
 
-        var maxValue = container.createChild("div", "counter-value");
-        maxValue.createChild("span").textContent = WebInspector.UIString("Max: ");
-        container._maxValue = maxValue.createChild("span");
-
-        if (showBottomBorder)
-            container.addStyleClass("bottom-border-visible");
-        this._counterSidebarElements.push(container);
-        return container;
+        var height = this._canvasContainer.offsetHeight - this._currentValuesBar.offsetHeight;
+        this._canvas.width = width;
+        this._canvas.height = height;
     },
 
     addTimlineEvent: function(event)
@@ -151,30 +267,10 @@ WebInspector.MemoryStatistics.prototype = {
         this._calculateVisibleIndexes();
         this._calculateXValues();
         this._clear();
-        var graphHeight = Math.round(this._canvas.height / 3);
-
-        function getDocumentCount(entry)
-        {
-            return entry.documentCount;
-        }
-        this._setVerticalClip(0 * graphHeight + 2, graphHeight - 4);
-        this._drawPolyline(getDocumentCount, this._graphColors[0], this._documents);
-        this._drawBottomBound("rgba(20,20,20,0.8)");
 
-        function getNodeCount(entry)
-        {
-            return entry.nodeCount;
-        }
-        this._setVerticalClip(1 * graphHeight + 2, graphHeight - 4);
-        this._drawPolyline(getNodeCount, this._graphColors[1], this._domNodes);
-        this._drawBottomBound("rgba(20,20,20,0.8)");
-
-        function getListenerCount(entry)
-        {
-            return entry.listenerCount;
-        }
-        this._setVerticalClip(2 * graphHeight + 2, graphHeight - 4);
-        this._drawPolyline(getListenerCount, this._graphColors[2], this._listeners);
+        this._setVerticalClip(10, this._canvas.height - 20);
+        for (var i = 0; i < this._counterUI.length; i++)
+            this._drawGraph(this._counterUI[i]);
     },
 
     _calculateVisibleIndexes: function()
@@ -205,14 +301,21 @@ WebInspector.MemoryStatistics.prototype = {
         this._maxTime = end;
     },
 
+    _onClick: function(event)
+    {
+        var x = event.x - event.target.offsetParent.offsetLeft
+        var i = this._recordIndexAt(x);
+        var counter = this._counters[i];
+        this._timelinePanel.revealRecordAt(counter.time / 1000);
+    },
+
     _onMouseOut: function(event)
     {
-        this._clearMarkers();
         delete this._markerXPosition;
 
-        this._documents._value.textContent = "";
-        this._domNodes._value.textContent = "";
-        this._listeners._value.textContent = "";
+        var ctx = this._canvas.getContext("2d");
+        for (var i = 0; i < this._counterUI.length; i++)
+            this._counterUI[i].clearCurrentValueAndMarker(ctx);
     },
 
     _onMouseOver: function(event)
@@ -235,9 +338,8 @@ WebInspector.MemoryStatistics.prototype = {
             return;
         var i = this._recordIndexAt(this._markerXPosition);
 
-        this._documents._value.textContent = this._counters[i].documentCount;
-        this._domNodes._value.textContent = this._counters[i].nodeCount;
-        this._listeners._value.textContent = this._counters[i].listenerCount;
+        for (var j = 0; j < this._counterUI.length; j++)
+            this._counterUI[j].updateCurrentValue(this._counters[i]);
 
         this._highlightCurrentPositionOnGraphs(this._markerXPosition, i);
     },
@@ -257,43 +359,38 @@ WebInspector.MemoryStatistics.prototype = {
     _highlightCurrentPositionOnGraphs: function(x, index)
     {
         var ctx = this._canvas.getContext("2d");
-        this._clearMarkers();
-        var yValues = this._counters[index].yValues;
-        for (var i = 0; i < yValues.length; i++) {
-            var y = yValues[i];
+        for (var i = 0; i < this._counterUI.length; i++) {
+            var counterUI = this._counterUI[i];
+            if (!counterUI.visible)
+                continue;
+            counterUI.restoreImageUnderMarker(ctx);
+        }
+
+        const radius = 2;
+        for (var i = 0; i < this._counterUI.length; i++) {
+            var counterUI = this._counterUI[i];
+            if (!counterUI.visible)
+                continue;
+            var y = counterUI.graphYValues[index];
+            counterUI.saveImageUnderMarker(ctx, x, y, radius);
+        }
+
+        for (var i = 0; i < this._counterUI.length; i++) {
+            var counterUI = this._counterUI[i];
+            if (!counterUI.visible)
+                continue;
+            var y = counterUI.graphYValues[index];
             ctx.beginPath();
-            const radius = 2;
-            this._saveImageUnderMarker(ctx, x, y, radius);
             ctx.arc(x, y, radius, 0, Math.PI*2, true);
             ctx.lineWidth = 1;
-            ctx.fillStyle = this._graphColors[i];
-            ctx.strokeStyle = this._graphColors[i];
+            ctx.fillStyle = counterUI.graphColor;
+            ctx.strokeStyle = counterUI.graphColor;
             ctx.fill();
             ctx.stroke();
             ctx.closePath();
         }
     },
 
-    _clearMarkers: function()
-    {
-        var ctx = this._canvas.getContext("2d");
-        for (var i = 0; i < this._savedImageData.length; i++) {
-            var entry = this._savedImageData[i];
-            ctx.putImageData(entry.imageData, entry.x, entry.y);
-        }
-        this._savedImageData = [];
-    },
-
-    _saveImageUnderMarker: function(ctx, x, y, radius)
-    {
-        const w = radius + 1;
-        var imageData = ctx.getImageData(x - w, y - w, 2 * w, 2 * w);
-        this._savedImageData.push({
-            x: x - w,
-            y: y - w,
-            imageData: imageData });
-    },
-
     visible: function()
     {
         return this._memorySplitView.isShowing();
@@ -304,12 +401,14 @@ WebInspector.MemoryStatistics.prototype = {
         var anchor = /** @type {Element|null} */ this._containerAnchor.nextSibling;
         this._memorySplitView.show(this._timelinePanel.element, anchor);
         this._updateSize();
+        this._refreshDividers();
         setTimeout(this._draw.bind(this), 0);
     },
 
     refresh: function()
     {
         this._updateSize();
+        this._refreshDividers();
         this._draw();
         this._refreshCurrentValues();
     },
@@ -319,6 +418,11 @@ WebInspector.MemoryStatistics.prototype = {
         this._memorySplitView.detach();
     },
 
+    _refreshDividers: function()
+    {
+        this._timelineGrid.updateDividers(true, this._timelinePanel.calculator, this._timelinePanel.timelinePaddingLeft);
+    },
+
     _setVerticalClip: function(originY, height)
     {
         this._originY = originY;
@@ -339,22 +443,14 @@ WebInspector.MemoryStatistics.prototype = {
         this._counters[this._maximumIndex].x = width;
     },
 
-    _drawPolyline: function(valueGetter, color, section)
+    _drawGraph: function(counterUI)
     {
         var canvas = this._canvas;
         var ctx = canvas.getContext("2d");
         var width = canvas.width;
         var height = this._clippedHeight;
         var originY = this._originY;
-
-        // Draw originalValue level
-        ctx.beginPath();
-        ctx.moveTo(0, originY + height / 2 + 0.5);
-        ctx.lineTo(width, originY + height / 2 + 0.5);
-        ctx.lineWidth = 0.1;
-        ctx.strokeStyle = "rgb(100, 100, 100)";
-        ctx.stroke();
-        ctx.closePath();
+        var valueGetter = counterUI.valueGetter;
 
         if (!this._counters.length)
             return;
@@ -369,44 +465,31 @@ WebInspector.MemoryStatistics.prototype = {
                 maxValue = value;
         }
 
-        section._minValue.textContent = minValue;
-        section._maxValue.textContent = maxValue;
+        counterUI.setRange(minValue, maxValue);
+
+        if (!counterUI.visible)
+            return;
 
-        var originalValue = valueGetter(this._counters[this._minimumIndex]);
+        var yValues = counterUI.graphYValues;
+        yValues.length = this._counters.length;
 
-        var maxYRange = Math.max(maxValue - originalValue, originalValue - minValue);
-        var yFactor = maxYRange ? height / (2 * maxYRange) : 0.5;
+        var maxYRange = maxValue - minValue;
+        var yFactor = maxYRange ? height / (maxYRange) : 1;
 
         ctx.beginPath();
-        var currentY = originY + height / 2;
+        var currentY = originY + (height - (valueGetter(this._counters[this._minimumIndex])- minValue) * yFactor);
         ctx.moveTo(0, currentY);
         for (var i = this._minimumIndex; i <= this._maximumIndex; i++) {
              var x = this._counters[i].x;
              ctx.lineTo(x, currentY);
-             currentY = originY + (height / 2 - (valueGetter(this._counters[i])- originalValue) * yFactor);
+             currentY = originY + (height - (valueGetter(this._counters[i])- minValue) * yFactor);
              ctx.lineTo(x, currentY);
 
-             this._counters[i].yValues.push(currentY);
+             yValues[i] = currentY;
         }
         ctx.lineTo(width, currentY);
         ctx.lineWidth = 1;
-        ctx.strokeStyle = color;
-        ctx.stroke();
-        ctx.closePath();
-    },
-
-    _drawBottomBound: function(color)
-    {
-        var canvas = this._canvas;
-        var width = canvas.width;
-        var y = this._originY + this._clippedHeight + 1.5;
-
-        var ctx = canvas.getContext("2d");
-        ctx.beginPath();
-        ctx.moveTo(0, y);
-        ctx.lineTo(width, y);
-        ctx.lineWidth = 0.5;
-        ctx.strokeStyle = color;
+        ctx.strokeStyle = counterUI.graphColor;
         ctx.stroke();
         ctx.closePath();
     },
@@ -414,9 +497,8 @@ WebInspector.MemoryStatistics.prototype = {
     _clear: function() {
         var ctx = this._canvas.getContext("2d");
         ctx.clearRect(0, 0, ctx.canvas.width, ctx.canvas.height);
-        for (var i = this._minimumIndex; i <= this._maximumIndex; i++)
-             this._counters[i].yValues = [];
-        this._savedImageData = [];
+        for (var i = 0; i < this._counterUI.length; i++)
+            this._counterUI[i].discardImageUnderMarker();
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/MetricsSidebarPane.js b/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
index 6467004c5..585b57e68 100644
--- a/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/MetricsSidebarPane.js
@@ -443,7 +443,7 @@ WebInspector.MetricsSidebarPane.prototype = {
                 continue;
 
             this.previousPropertyDataCandidate = property;
-            property.setValue(userInput, commitEditor, callback);
+            property.setValue(userInput, commitEditor, true, callback);
             return;
         }
 
diff --git a/Source/WebCore/inspector/front-end/NetworkPanel.js b/Source/WebCore/inspector/front-end/NetworkPanel.js
index 9b65a8717..88c270d4b 100644
--- a/Source/WebCore/inspector/front-end/NetworkPanel.js
+++ b/Source/WebCore/inspector/front-end/NetworkPanel.js
@@ -1451,7 +1451,7 @@ WebInspector.NetworkBaseCalculator.prototype = {
 
     computeBarGraphLabels: function(item)
     {
-        const label = this.formatValue(this._value(item));
+        const label = this.formatTime(this._value(item));
         return {left: label, right: label, tooltip: label};
     },
 
@@ -1483,7 +1483,7 @@ WebInspector.NetworkBaseCalculator.prototype = {
         return 0;
     },
 
-    formatValue: function(value)
+    formatTime: function(value)
     {
         return value.toString();
     }
@@ -1553,11 +1553,11 @@ WebInspector.NetworkTimeCalculator.prototype = {
     {
         var rightLabel = "";
         if (resource.responseReceivedTime !== -1 && resource.endTime !== -1)
-            rightLabel = this.formatValue(resource.endTime - resource.responseReceivedTime);
+            rightLabel = this.formatTime(resource.endTime - resource.responseReceivedTime);
 
         var hasLatency = resource.latency > 0;
         if (hasLatency)
-            var leftLabel = this.formatValue(resource.latency);
+            var leftLabel = this.formatTime(resource.latency);
         else
             var leftLabel = rightLabel;
 
@@ -1565,7 +1565,7 @@ WebInspector.NetworkTimeCalculator.prototype = {
             return {left: leftLabel, right: rightLabel};
 
         if (hasLatency && rightLabel) {
-            var total = this.formatValue(resource.duration);
+            var total = this.formatTime(resource.duration);
             var tooltip = WebInspector.UIString("%s latency, %s download (%s total)", leftLabel, rightLabel, total);
         } else if (hasLatency)
             var tooltip = WebInspector.UIString("%s latency", leftLabel);
@@ -1601,7 +1601,7 @@ WebInspector.NetworkTimeCalculator.prototype = {
         return didChange;
     },
 
-    formatValue: function(value)
+    formatTime: function(value)
     {
         return Number.secondsToString(value);
     },
@@ -1629,7 +1629,7 @@ WebInspector.NetworkTransferTimeCalculator = function()
 }
 
 WebInspector.NetworkTransferTimeCalculator.prototype = {
-    formatValue: function(value)
+    formatTime: function(value)
     {
         return Number.secondsToString(value);
     },
@@ -1657,7 +1657,7 @@ WebInspector.NetworkTransferDurationCalculator = function()
 }
 
 WebInspector.NetworkTransferDurationCalculator.prototype = {
-    formatValue: function(value)
+    formatTime: function(value)
     {
         return Number.secondsToString(value);
     },
diff --git a/Source/WebCore/inspector/front-end/ObjectPopoverHelper.js b/Source/WebCore/inspector/front-end/ObjectPopoverHelper.js
index 3a560dbf0..f4a099d86 100644
--- a/Source/WebCore/inspector/front-end/ObjectPopoverHelper.js
+++ b/Source/WebCore/inspector/front-end/ObjectPopoverHelper.js
@@ -73,7 +73,7 @@ WebInspector.ObjectPopoverHelper.prototype = {
                         functionName.textContent = response.name || response.inferredName || response.displayName || WebInspector.UIString("(anonymous function)");
 
                         this._linkifier = WebInspector.debuggerPresentationModel.createLinkifier();
-                        var link = this._linkifier.linkifyFunctionLocation(response.location, "function-location-link");
+                        var link = this._linkifier.linkifyRawLocation(response.location, "function-location-link");
                         if (link)
                             title.appendChild(link);
 
diff --git a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
index 20acf9133..8369a83d0 100644
--- a/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/Source/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -48,6 +48,8 @@ WebInspector.ObjectPropertiesSection = function(object, title, subtitle, emptyPl
     WebInspector.PropertiesSection.call(this, title, subtitle);
 }
 
+WebInspector.ObjectPropertiesSection._arrayLoadThreshold = 100;
+
 WebInspector.ObjectPropertiesSection.prototype = {
     onpopulate: function()
     {
@@ -56,17 +58,23 @@ WebInspector.ObjectPropertiesSection.prototype = {
 
     update: function()
     {
-        var self = this;
+        if (this.object.arrayLength() > WebInspector.ObjectPropertiesSection._arrayLoadThreshold) {
+            this.propertiesTreeOutline.removeChildren();
+            WebInspector.ArrayGroupingTreeElement._populateArray(this.propertiesTreeOutline, this.object, 0, this.object.arrayLength() - 1);
+            return;
+        }
+
         function callback(properties)
         {
             if (!properties)
                 return;
-            self.updateProperties(properties);
+            this.updateProperties(properties);
         }
+
         if (this.ignoreHasOwnProperty)
-            this.object.getAllProperties(callback);
+            this.object.getAllProperties(callback.bind(this));
         else
-            this.object.getOwnProperties(callback);
+            this.object.getOwnProperties(callback.bind(this));
     },
 
     updateProperties: function(properties, rootTreeElementConstructor, rootPropertyComparer)
@@ -88,11 +96,14 @@ WebInspector.ObjectPropertiesSection.prototype = {
         for (var i = 0; i < properties.length; ++i) {
             if (this.skipProto && properties[i].name === "__proto__")
                 continue;
-
             properties[i].parentObject = this.object;
-            this.propertiesTreeOutline.appendChild(new rootTreeElementConstructor(properties[i]));
         }
 
+        this.propertiesForTest = properties;
+
+        for (var i = 0; i < properties.length; ++i)
+            this.propertiesTreeOutline.appendChild(new rootTreeElementConstructor(properties[i]));
+
         if (!this.propertiesTreeOutline.children.length) {
             var title = document.createElement("div");
             title.className = "info";
@@ -100,7 +111,6 @@ WebInspector.ObjectPropertiesSection.prototype = {
             var infoElement = new TreeElement(title, null, false);
             this.propertiesTreeOutline.appendChild(infoElement);
         }
-        this.propertiesForTest = properties;
     }
 }
 
@@ -154,6 +164,7 @@ WebInspector.ObjectPropertiesSection.CompareProperties = function(propertyA, pro
 /**
  * @constructor
  * @extends {TreeElement}
+ * @param {WebInspector.RemoteObjectProperty} property
  */
 WebInspector.ObjectPropertyTreeElement = function(property)
 {
@@ -171,23 +182,34 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
         if (this.children.length && !this.shouldRefreshChildren)
             return;
 
-        var callback = function(properties) {
+        if (this.property.value.arrayLength() > WebInspector.ObjectPropertiesSection._arrayLoadThreshold) {
+            this.removeChildren();
+            WebInspector.ArrayGroupingTreeElement._populateArray(this, this.property.value, 0, this.property.value.arrayLength() - 1);
+            return;
+        }
+
+        function callback(properties)
+        {
             this.removeChildren();
             if (!properties)
                 return;
 
             properties.sort(WebInspector.ObjectPropertiesSection.CompareProperties);
             for (var i = 0; i < properties.length; ++i) {
+                if (this.treeOutline.section.skipProto && properties[i].name === "__proto__")
+                    continue;
+                properties[i].parentObject = this.property.value;
                 this.appendChild(new this.treeOutline.section.treeElementConstructor(properties[i]));
             }
-        };
+        }
+
         this.property.value.getOwnProperties(callback.bind(this));
     },
 
     ondblclick: function(event)
     {
         if (this.property.writable)
-            this.startEditing();
+            this.startEditing(event);
     },
 
     onattach: function()
@@ -290,28 +312,56 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
             this.parent.shouldRefreshChildren = true;
     },
 
-    startEditing: function()
+    renderPromptAsBlock: function()
+    {
+        return false;
+    },
+
+    /**
+     * @param {Event=} event
+     */
+    elementAndValueToEdit: function(event)
+    {
+        return [this.valueElement, (typeof this.valueElement._originalTextContent === "string") ? this.valueElement._originalTextContent : undefined];
+    },
+
+    startEditing: function(event)
     {
-        if (WebInspector.isBeingEdited(this.valueElement) || !this.treeOutline.section.editable)
+        var elementAndValueToEdit = this.elementAndValueToEdit(event);
+        var elementToEdit = elementAndValueToEdit[0];
+        var valueToEdit = elementAndValueToEdit[1];
+
+        if (WebInspector.isBeingEdited(elementToEdit) || !this.treeOutline.section.editable || this._readOnly)
             return;
 
-        var context = { expanded: this.expanded };
+        // Edit original source.
+        if (typeof valueToEdit !== "undefined")
+            elementToEdit.textContent = valueToEdit;
+
+        var context = { expanded: this.expanded, elementToEdit: elementToEdit, previousContent: elementToEdit.textContent };
 
         // Lie about our children to prevent expanding on double click and to collapse subproperties.
         this.hasChildren = false;
 
         this.listItemElement.addStyleClass("editing-sub-part");
 
-        // Edit original source.
-        if (typeof this.valueElement._originalTextContent === "string")
-            this.valueElement.textContent = this.valueElement._originalTextContent;
+        this._prompt = new WebInspector.ObjectPropertyPrompt(this.editingCommitted.bind(this, null, elementToEdit.textContent, context.previousContent, context), this.editingCancelled.bind(this, null, context), this.renderPromptAsBlock());
 
-        var config = new WebInspector.EditingConfig(this.editingCommitted.bind(this), this.editingCancelled.bind(this), context);
-        WebInspector.startEditing(this.valueElement, config);
+        function blurListener()
+        {
+            this.editingCommitted(null, elementToEdit.textContent, context.previousContent, context);
+        }
+
+        var proxyElement = this._prompt.attachAndStartEditing(elementToEdit, blurListener.bind(this));
+        window.getSelection().setBaseAndExtent(elementToEdit, 0, elementToEdit, 1);
+        proxyElement.addEventListener("keydown", this._promptKeyDown.bind(this, context), false);
     },
 
     editingEnded: function(context)
     {
+        this._prompt.detach();
+        delete this._prompt;
+
         this.listItemElement.scrollLeft = 0;
         this.listItemElement.removeStyleClass("editing-sub-part");
         if (context.expanded)
@@ -320,8 +370,8 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
 
     editingCancelled: function(element, context)
     {
-        this.update();
         this.editingEnded(context);
+        this.update();
     },
 
     editingCommitted: function(element, userInput, previousContent, context)
@@ -329,9 +379,21 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
         if (userInput === previousContent)
             return this.editingCancelled(element, context); // nothing changed, so cancel
 
+        this.editingEnded(context);
         this.applyExpression(userInput, true);
+    },
 
-        this.editingEnded(context);
+    _promptKeyDown: function(context, event)
+    {
+        if (isEnterKey(event)) {
+            event.stopPropagation();
+            event.preventDefault();
+            return this.editingCommitted(null, context.elementToEdit.textContent, context.previousContent, context);
+        }
+        if (event.keyIdentifier === "U+001B") { // Esc
+            event.stopPropagation();
+            return this.editingCancelled(null, context);
+        }
     },
 
     applyExpression: function(expression, updateInterface)
@@ -359,3 +421,231 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
 }
 
 WebInspector.ObjectPropertyTreeElement.prototype.__proto__ = TreeElement.prototype;
+
+/**
+ * @constructor
+ * @extends {TreeElement}
+ * @param {WebInspector.RemoteObject} object
+ * @param {number} fromIndex
+ * @param {number} toIndex
+ * @param {number} propertyCount
+ */
+WebInspector.ArrayGroupingTreeElement = function(object, fromIndex, toIndex, propertyCount)
+{
+    TreeElement.call(this, String.sprintf("[%d \u2026 %d]", fromIndex, toIndex), undefined, true);
+    this._fromIndex = fromIndex;
+    this._toIndex = toIndex;
+    this._object = object;
+    this._readOnly = true;
+    this._propertyCount = propertyCount;
+    this._populated = false;
+}
+
+WebInspector.ArrayGroupingTreeElement._bucketThreshold = 20;
+
+/**
+ * @param {TreeElement|TreeOutline} treeElement
+ * @param {WebInspector.RemoteObject} object
+ * @param {number} fromIndex
+ * @param {number} toIndex
+ */
+WebInspector.ArrayGroupingTreeElement._populateArray = function(treeElement, object, fromIndex, toIndex)
+{
+    WebInspector.ArrayGroupingTreeElement._populateRanges(treeElement, object, fromIndex, toIndex, true);
+}
+
+/**
+ * @param {TreeElement|TreeOutline} treeElement
+ * @param {WebInspector.RemoteObject} object
+ * @param {number} fromIndex
+ * @param {number} toIndex
+ * @param {boolean} topLevel
+ */
+WebInspector.ArrayGroupingTreeElement._populateRanges = function(treeElement, object, fromIndex, toIndex, topLevel)
+{
+    object.callFunctionJSON(packRanges, [{value: fromIndex}, {value: toIndex}, {value: WebInspector.ArrayGroupingTreeElement._bucketThreshold}], callback.bind(this));
+
+    function packRanges(fromIndex, toIndex, bucketThreshold)
+    {
+        var count = 0;
+        for (var i = fromIndex; i <= toIndex; ++i) {
+            var value = this[i];
+            if (typeof value !== "undefined")
+                ++count;
+        }
+
+        var bucketSize;
+        if (count < bucketThreshold)
+            bucketSize = count;
+        else {
+            bucketSize = Math.ceil(count / bucketThreshold);
+            if (bucketSize < bucketThreshold)
+                bucketSize = Math.floor(Math.sqrt(count));
+        }
+
+        var ranges = [];
+        count = 0;
+        var groupStart = -1;
+        var groupEnd = 0;
+        for (var i = fromIndex; i <= toIndex; ++i) {
+            var value = this[i];
+            if (typeof value === "undefined")
+                continue;
+
+            if (groupStart === -1)
+                groupStart = i;
+
+            groupEnd = i;
+            if (++count === bucketSize) {
+                ranges.push([groupStart, groupEnd, count]);
+                count = 0;
+                groupStart = -1;
+            }
+        }
+
+        if (count > 0)
+            ranges.push([groupStart, groupEnd, count]);
+        return ranges;
+    }
+
+    function callback(ranges)
+    {
+        if (ranges.length == 1)
+            WebInspector.ArrayGroupingTreeElement._populateAsFragment(treeElement, object, ranges[0][0], ranges[0][1]);
+        else {
+            for (var i = 0; i < ranges.length; ++i) {
+                var fromIndex = ranges[i][0];
+                var toIndex = ranges[i][1];
+                var count = ranges[i][2];
+                if (fromIndex == toIndex)
+                    WebInspector.ArrayGroupingTreeElement._populateAsFragment(treeElement, object, fromIndex, toIndex);
+                else
+                    treeElement.appendChild(new WebInspector.ArrayGroupingTreeElement(object, fromIndex, toIndex, count));
+            }
+        }
+        if (topLevel)
+            WebInspector.ArrayGroupingTreeElement._populateNonIndexProperties(treeElement, object);
+    }
+}
+
+/**
+ * @param {TreeElement|TreeOutline} treeElement
+ * @param {WebInspector.RemoteObject} object
+ * @param {number} fromIndex
+ * @param {number} toIndex
+ */
+WebInspector.ArrayGroupingTreeElement._populateAsFragment = function(treeElement, object, fromIndex, toIndex)
+{
+    object.callFunction(buildArrayFragment, [{value: fromIndex}, {value: toIndex}], processArrayFragment.bind(this));
+
+    function buildArrayFragment(fromIndex, toIndex)
+    {
+        var result = Object.create(null);
+        for (var i = fromIndex; i <= toIndex; ++i) {
+            var value = this[i];
+            if (typeof value !== "undefined")
+                result[i] = value;
+        }
+        return result;
+    }
+
+    function processArrayFragment(arrayFragment)
+    {
+        arrayFragment.getAllProperties(processProperties.bind(this));
+    }
+
+    function processProperties(properties)
+    {
+        if (!properties)
+            return;
+
+        properties.sort(WebInspector.ObjectPropertiesSection.CompareProperties);
+        for (var i = 0; i < properties.length; ++i) {
+            properties[i].parentObject = this._object;
+            var childTreeElement = new treeElement.treeOutline.section.treeElementConstructor(properties[i]);
+            childTreeElement._readOnly = true;
+            treeElement.appendChild(childTreeElement);
+        }
+    }
+}
+
+/**
+ * @param {TreeElement|TreeOutline} treeElement
+ * @param {WebInspector.RemoteObject} object
+ */
+WebInspector.ArrayGroupingTreeElement._populateNonIndexProperties = function(treeElement, object)
+{
+    object.callFunction(buildObjectFragment, undefined, processObjectFragment.bind(this));
+
+    function buildObjectFragment()
+    {
+        var result = Object.create(this.__proto__);
+        var names = Object.getOwnPropertyNames(this);
+        for (var i = 0; i < names.length; ++i) {
+            var name = names[i];
+            if (!isNaN(name))
+                continue;
+            var descriptor = Object.getOwnPropertyDescriptor(this, name);
+            Object.defineProperty(result, name, descriptor);
+        }
+        return result;
+    }
+
+    function processObjectFragment(arrayFragment)
+    {
+        arrayFragment.getOwnProperties(processProperties.bind(this));
+    }
+
+    function processProperties(properties)
+    {
+        if (!properties)
+            return;
+
+        properties.sort(WebInspector.ObjectPropertiesSection.CompareProperties);
+        for (var i = 0; i < properties.length; ++i) {
+            properties[i].parentObject = this._object;
+            var childTreeElement = new treeElement.treeOutline.section.treeElementConstructor(properties[i]);
+            childTreeElement._readOnly = true;
+            treeElement.appendChild(childTreeElement);
+        }
+    }
+}
+
+WebInspector.ArrayGroupingTreeElement.prototype = {
+    onpopulate: function()
+    {
+        if (this._populated)
+            return;
+        
+        this._populated = true;
+
+        if (this._propertyCount >= WebInspector.ArrayGroupingTreeElement._bucketThreshold) {
+            WebInspector.ArrayGroupingTreeElement._populateRanges(this, this._object, this._fromIndex, this._toIndex, false);
+            return;
+        }
+        WebInspector.ArrayGroupingTreeElement._populateAsFragment(this, this._object, this._fromIndex, this._toIndex);
+    },
+
+    onattach: function()
+    {
+        this.listItemElement.addStyleClass("name");
+    }
+}
+
+WebInspector.ArrayGroupingTreeElement.prototype.__proto__ = TreeElement.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.TextPrompt}
+ * @param {boolean=} renderAsBlock
+ */
+WebInspector.ObjectPropertyPrompt = function(commitHandler, cancelHandler, renderAsBlock)
+{
+    const ExpressionStopCharacters = " =:[({;,!+-*/&|^<>."; // Same as in ConsoleView.js + "."
+    WebInspector.TextPrompt.call(this, WebInspector.consoleView.completionsForTextPrompt.bind(WebInspector.consoleView), ExpressionStopCharacters);
+    this.setSuggestBoxEnabled("generic-suggest");
+    if (renderAsBlock)
+        this.renderAsBlock();
+}
+
+WebInspector.ObjectPropertyPrompt.prototype.__proto__ = WebInspector.TextPrompt.prototype;
diff --git a/Source/WebCore/inspector/front-end/Panel.js b/Source/WebCore/inspector/front-end/Panel.js
index 7d10e5902..c9a1c7d7c 100644
--- a/Source/WebCore/inspector/front-end/Panel.js
+++ b/Source/WebCore/inspector/front-end/Panel.js
@@ -212,6 +212,11 @@ WebInspector.Panel.prototype = {
     registerShortcut: function(key, handler)
     {
         this._shortcuts[key] = handler;
+    },
+
+    unregisterShortcut: function(key)
+    {
+        delete this._shortcuts[key];
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/ProfileDataGridTree.js b/Source/WebCore/inspector/front-end/ProfileDataGridTree.js
index c30884644..7490b4bd8 100644
--- a/Source/WebCore/inspector/front-end/ProfileDataGridTree.js
+++ b/Source/WebCore/inspector/front-end/ProfileDataGridTree.js
@@ -59,17 +59,17 @@ WebInspector.ProfileDataGridNode.prototype = {
         data["calls"] = this.numberOfCalls;
 
         if (this.profileView.showSelfTimeAsPercent.get())
-            data["self"] = WebInspector.UIString("%.2f%%", this.selfPercent);
+            data["self"] = WebInspector.UIString("%.2f%", this.selfPercent);
         else
             data["self"] = formatMilliseconds(this.selfTime);
 
         if (this.profileView.showTotalTimeAsPercent.get())
-            data["total"] = WebInspector.UIString("%.2f%%", this.totalPercent);
+            data["total"] = WebInspector.UIString("%.2f%", this.totalPercent);
         else
             data["total"] = formatMilliseconds(this.totalTime);
 
         if (this.profileView.showAverageTimeAsPercent.get())
-            data["average"] = WebInspector.UIString("%.2f%%", this.averagePercent);
+            data["average"] = WebInspector.UIString("%.2f%", this.averagePercent);
         else
             data["average"] = formatMilliseconds(this.averageTime);
 
diff --git a/Source/WebCore/inspector/front-end/ProfilesPanel.js b/Source/WebCore/inspector/front-end/ProfilesPanel.js
index 3725e5df0..6d139b70a 100644
--- a/Source/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/Source/WebCore/inspector/front-end/ProfilesPanel.js
@@ -142,7 +142,8 @@ WebInspector.ProfilesPanel = function()
     this._launcherView.setUpEventListeners();
 
     this._registerProfileType(new WebInspector.CPUProfileType());
-    this._registerProfileType(new WebInspector.CSSSelectorProfileType());
+    if (!WebInspector.WorkerManager.isWorkerFrontend())
+        this._registerProfileType(new WebInspector.CSSSelectorProfileType());
     if (Capabilities.heapProfilerPresent)
         this._registerProfileType(new WebInspector.DetailedHeapshotProfileType());
 
@@ -858,7 +859,7 @@ WebInspector.ProfilesPanel.prototype = {
     _reportHeapSnapshotProgress: function(done, total)
     {
         if (this.hasTemporaryProfile(WebInspector.DetailedHeapshotProfileType.TypeId)) {
-            this._temporaryRecordingProfile.sidebarElement.subtitle = WebInspector.UIString("%.2f%%", (done / total) * 100);
+            this._temporaryRecordingProfile.sidebarElement.subtitle = WebInspector.UIString("%.2f%", (done / total) * 100);
             this._temporaryRecordingProfile.sidebarElement.wait = true;
             if (done >= total)
                 this._removeTemporaryProfile();
diff --git a/Source/WebCore/inspector/front-end/PropertiesSection.js b/Source/WebCore/inspector/front-end/PropertiesSection.js
index 935e2baa2..0611b143a 100644
--- a/Source/WebCore/inspector/front-end/PropertiesSection.js
+++ b/Source/WebCore/inspector/front-end/PropertiesSection.js
@@ -39,8 +39,8 @@ WebInspector.PropertiesSection = function(title, subtitle)
     this.headerElement.addStyleClass("monospace");
     this.propertiesElement = document.createElement("ol");
     this.propertiesElement.className = "properties properties-tree monospace";
-    this.propertiesElement.tabIndex = 0;
-    this.propertiesTreeOutline = new TreeOutline(this.propertiesElement);
+    this.propertiesTreeOutline = new TreeOutline(this.propertiesElement, true);
+    this.propertiesTreeOutline.setFocusable(false);
     this.propertiesTreeOutline.section = this;
 
     this.element.appendChild(this.propertiesElement);
diff --git a/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js b/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js
index 6a7ea64f2..b2fbc527c 100644
--- a/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/PropertiesSidebarPane.js
@@ -65,7 +65,7 @@ WebInspector.PropertiesSidebarPane.prototype = {
                 }
                 return result;
             }
-            object.callFunction(protoList, nodePrototypesReady.bind(this));
+            object.callFunction(protoList, undefined, nodePrototypesReady.bind(this));
             object.release();
         }
 
diff --git a/Source/WebCore/inspector/front-end/RawSourceCode.js b/Source/WebCore/inspector/front-end/RawSourceCode.js
index c7fd9aec3..3ed4c3088 100644
--- a/Source/WebCore/inspector/front-end/RawSourceCode.js
+++ b/Source/WebCore/inspector/front-end/RawSourceCode.js
@@ -51,7 +51,6 @@ WebInspector.RawSourceCode = function(id, script, resource, formatter, formatted
     this._formatted = formatted;
     this._compilerSourceMapping = compilerSourceMapping;
     this._resource = resource;
-    this.messages = [];
 
     this._useTemporaryContent = !this._compilerSourceMapping && this._resource && !this._resource.finished;
     this._hasNewScripts = true;
@@ -62,7 +61,7 @@ WebInspector.RawSourceCode = function(id, script, resource, formatter, formatted
 }
 
 WebInspector.RawSourceCode.Events = {
-    SourceMappingUpdated: "source-mapping-updated"
+    UISourceCodeListChanged: "us-source-code-list-changed"
 }
 
 WebInspector.RawSourceCode.prototype = {
@@ -76,11 +75,37 @@ WebInspector.RawSourceCode.prototype = {
     },
 
     /**
-     * @return {WebInspector.RawSourceCode.SourceMapping}
+     * @param {DebuggerAgent.Location} rawLocation
+     * @return {WebInspector.UILocation}
      */
-    get sourceMapping()
+    rawLocationToUILocation: function(rawLocation)
     {
-        return this._sourceMapping;
+        if (this._sourceMapping)
+            return this._sourceMapping.rawLocationToUILocation(rawLocation);
+        return null;
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     * @param {number} lineNumber
+     * @param {number} columnNumber
+     * @return {DebuggerAgent.Location}
+     */
+    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber)
+    {
+        if (this._sourceMapping)
+            return this._sourceMapping.uiLocationToRawLocation(uiSourceCode, lineNumber, columnNumber);
+        return null;
+    },
+
+    /**
+     * @return {Array.<WebInspector.UISourceCode>}
+     */
+    uiSourceCodeList: function()
+    {
+        if (this._sourceMapping)
+            return this._sourceMapping.uiSourceCodeList();
+        return [];
     },
 
     /**
@@ -231,8 +256,10 @@ WebInspector.RawSourceCode.prototype = {
      */
     _createUISourceCode: function(id, url, contentProvider)
     {
-        var uiSourceCode = new WebInspector.UISourceCode(id, url, this, contentProvider);
+        var uiSourceCode = new WebInspector.UISourceCode(id, url, contentProvider);
         uiSourceCode.isContentScript = this.isContentScript;
+        uiSourceCode.isEditable = this._scripts.length === 1 && !this._scripts[0].lineOffset && !this._scripts[0].columnOffset
+                                  && !this._formatted && !this._compilerSourceMapping;
         return uiSourceCode;
     },
 
@@ -241,11 +268,11 @@ WebInspector.RawSourceCode.prototype = {
      */
     _saveSourceMapping: function(sourceMapping)
     {
-        var oldSourceMapping;
+        var oldUISourceCodeList = [];
         if (this._sourceMapping)
-            oldSourceMapping = this._sourceMapping;
+            oldUISourceCodeList = this._sourceMapping.uiSourceCodeList();
         this._sourceMapping = sourceMapping;
-        this.dispatchEventToListeners(WebInspector.RawSourceCode.Events.SourceMappingUpdated, { oldSourceMapping: oldSourceMapping });
+        this.dispatchEventToListeners(WebInspector.RawSourceCode.Events.UISourceCodeListChanged, { oldUISourceCodeList: oldUISourceCodeList });
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/RemoteObject.js b/Source/WebCore/inspector/front-end/RemoteObject.js
index 55191dd44..a8262dc14 100644
--- a/Source/WebCore/inspector/front-end/RemoteObject.js
+++ b/Source/WebCore/inspector/front-end/RemoteObject.js
@@ -272,35 +272,51 @@ WebInspector.RemoteObject.prototype = {
 
     /**
      * @param {string} functionDeclaration
+     * @param {Array.<RuntimeAgent.CallArgument>} args
      * @param {function(?WebInspector.RemoteObject)} callback
      */
-    callFunction: function(functionDeclaration, callback)
+    callFunction: function(functionDeclaration, args, callback)
     {
         function mycallback(error, result, wasThrown)
         {
             callback((error || wasThrown) ? null : WebInspector.RemoteObject.fromPayload(result));
         }
 
-        RuntimeAgent.callFunctionOn(this._objectId, functionDeclaration.toString(), undefined, undefined, mycallback);
+        RuntimeAgent.callFunctionOn(this._objectId, functionDeclaration.toString(), args, undefined, mycallback);
     },
 
     /**
      * @param {string} functionDeclaration
+     * @param {Array.<RuntimeAgent.CallArgument>} args
      * @param {function(*)} callback
      */
-    callFunctionJSON: function(functionDeclaration, callback)
+    callFunctionJSON: function(functionDeclaration, args, callback)
     {
         function mycallback(error, result, wasThrown)
         {
             callback((error || wasThrown) ? null : result.value);
         }
 
-        RuntimeAgent.callFunctionOn(this._objectId, functionDeclaration.toString(), undefined, true, mycallback);
+        RuntimeAgent.callFunctionOn(this._objectId, functionDeclaration.toString(), args, true, mycallback);
     },
 
     release: function()
     {
         RuntimeAgent.releaseObject(this._objectId);
+    },
+
+    /**
+     * @return {number}
+     */
+    arrayLength: function()
+    {
+        if (this.subtype !== "array")
+            return 0;
+
+        var matches = this._description.match(/\[([0-9]+)\]/);
+        if (!matches)
+            return 0;
+        return parseInt(matches[1], 10);
     }
 }
 
@@ -364,6 +380,9 @@ WebInspector.LocalJSONObject.prototype = {
                 }
                 this._cachedDescription = this._concatenate("[", "]", formatArrayItem);
                 break;
+            case "date":
+                this._cachedDescription = "" + this._value;
+                break;
             case "null":
                 this._cachedDescription = "null";
                 break;
@@ -424,6 +443,9 @@ WebInspector.LocalJSONObject.prototype = {
         if (this._value instanceof Array)
             return "array";
 
+        if (this._value instanceof Date)
+            return "date";
+
         return undefined;
     },
 
@@ -474,5 +496,13 @@ WebInspector.LocalJSONObject.prototype = {
     isError: function()
     {
         return false;
+    },
+
+    /**
+     * @return {number}
+     */
+    arrayLength: function()
+    {
+        return this._value instanceof Array ? this._value.length : 0;
     }
 }
diff --git a/Source/WebCore/inspector/front-end/ResourceUtils.js b/Source/WebCore/inspector/front-end/ResourceUtils.js
index 501df10ea..90ffff01d 100644
--- a/Source/WebCore/inspector/front-end/ResourceUtils.js
+++ b/Source/WebCore/inspector/front-end/ResourceUtils.js
@@ -274,6 +274,11 @@ WebInspector.completeURL = function(baseURL, href)
         var path = href;
         if (path.charAt(0) !== "/") {
             var basePath = parsedURL.path;
+
+            // Trim off the query part of the basePath.
+            var questionMarkIndex = basePath.indexOf("?");
+            if (questionMarkIndex > 0)
+                basePath = basePath.substring(0, questionMarkIndex);
             // A href of "?foo=bar" implies "basePath?foo=bar".
             // With "basePath?a=b" and "?foo=bar" we should get "basePath?foo=bar".
             var prefix;
diff --git a/Source/WebCore/inspector/front-end/ResourcesPanel.js b/Source/WebCore/inspector/front-end/ResourcesPanel.js
index 219b01b75..d5649ffe1 100644
--- a/Source/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/Source/WebCore/inspector/front-end/ResourcesPanel.js
@@ -1513,6 +1513,19 @@ WebInspector.IndexedDBTreeElement.prototype = {
             this._createIndexedDBModel();
     },
 
+    onattach: function()
+    {
+        WebInspector.StorageCategoryTreeElement.prototype.onattach.call(this);
+        this.listItemElement.addEventListener("contextmenu", this._handleContextMenuEvent.bind(this), true);
+    },
+
+    _handleContextMenuEvent: function(event)
+    {
+        var contextMenu = new WebInspector.ContextMenu();
+        contextMenu.appendItem(WebInspector.UIString("Refresh IndexedDB"), this.refreshIndexedDB.bind(this));
+        contextMenu.show(event);
+    },
+
     _createIndexedDBModel: function()
     {
         this._indexedDBModel = new WebInspector.IndexedDBModel();
@@ -1617,6 +1630,24 @@ WebInspector.IDBDatabaseTreeElement.prototype = {
         return "indexedDB://" + this._databaseId.securityOrigin + "/" + this._databaseId.name;
     },
 
+    onattach: function()
+    {
+        WebInspector.BaseStorageTreeElement.prototype.onattach.call(this);
+        this.listItemElement.addEventListener("contextmenu", this._handleContextMenuEvent.bind(this), true);
+    },
+
+    _handleContextMenuEvent: function(event)
+    {
+        var contextMenu = new WebInspector.ContextMenu();
+        contextMenu.appendItem(WebInspector.UIString("Refresh IndexedDB"), this._refreshIndexedDB.bind(this));
+        contextMenu.show(event);
+    },
+
+    _refreshIndexedDB: function(event)
+    {
+        this._model.refreshDatabaseNames();
+    },
+
     /**
      * @param {WebInspector.IndexedDBModel.Database} database
      */
@@ -1640,7 +1671,7 @@ WebInspector.IDBDatabaseTreeElement.prototype = {
                 delete this._idbObjectStoreTreeElements[objectStoreName];
             }
         }
-        
+
         if (this.children.length) {
             this.hasChildren = true;
             this.expand();
@@ -1648,6 +1679,13 @@ WebInspector.IDBDatabaseTreeElement.prototype = {
 
         if (this._view)
             this._view.update(database);
+        
+        this._updateTooltip();
+    },
+
+    _updateTooltip: function()
+    {
+        this.tooltip = WebInspector.UIString("Version") + ": " + this._database.version;
     },
 
     onselect: function()
@@ -1656,7 +1694,7 @@ WebInspector.IDBDatabaseTreeElement.prototype = {
         if (!this._view)
             this._view = new WebInspector.IDBDatabaseView(this._database);
 
-        this._storagePanel.showIndexedDB(this._view);        
+        this._storagePanel.showIndexedDB(this._view);
     }
 }
 
@@ -1708,7 +1746,7 @@ WebInspector.IDBObjectStoreTreeElement.prototype = {
                 delete this._idbIndexTreeElements[indexName];
             }
         }
-        
+
         if (this.children.length) {
             this.hasChildren = true;
             this.expand();
@@ -1716,6 +1754,13 @@ WebInspector.IDBObjectStoreTreeElement.prototype = {
 
         if (this._view)
             this._view.update(this._objectStore);
+        
+        this._updateTooltip();
+    },
+
+    _updateTooltip: function()
+    {
+        this.tooltip = this._objectStore.keyPath ? (WebInspector.UIString("Key path") + ": " + this._objectStore.keyPath) : "";
     },
 
     onselect: function()
@@ -1724,7 +1769,7 @@ WebInspector.IDBObjectStoreTreeElement.prototype = {
         if (!this._view)
             this._view = new WebInspector.IDBDataView(this._model, this._databaseId, this._objectStore, null);
 
-        this._storagePanel.showIndexedDB(this._view);        
+        this._storagePanel.showIndexedDB(this._view);
     }
 }
 
@@ -1760,9 +1805,22 @@ WebInspector.IDBIndexTreeElement.prototype = {
     update: function(index)
     {
         this._index = index;
-        
+
         if (this._view)
             this._view.update(this._index);
+        
+        this._updateTooltip();
+    },
+
+    _updateTooltip: function()
+    {
+        var tooltipLines = [];
+        tooltipLines.push(WebInspector.UIString("Key path") + ": " + this._index.keyPath);
+        if (this._index.unique)
+            tooltipLines.push(WebInspector.UIString("unique"));
+        if (this._index.multiEntry)
+            tooltipLines.push(WebInspector.UIString("multiEntry"));
+        this.tooltip = tooltipLines.join("\n");
     },
 
     onselect: function()
@@ -1771,7 +1829,7 @@ WebInspector.IDBIndexTreeElement.prototype = {
         if (!this._view)
             this._view = new WebInspector.IDBDataView(this._model, this._databaseId, this._objectStore, this._index);
 
-        this._storagePanel.showIndexedDB(this._view);        
+        this._storagePanel.showIndexedDB(this._view);
     }
 }
 
diff --git a/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js b/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js
index a359f34ea..c3e80e0a8 100644
--- a/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/ScopeChainSidebarPane.js
@@ -167,10 +167,12 @@ WebInspector.ScopeVariableTreeElement.prototype = {
         var result;
 
         do {
-            if (result)
-                result = current.property.name + "." + result;
-            else
-                result = current.property.name;
+            if (current.property) {
+                if (result)
+                    result = current.property.name + "." + result;
+                else
+                    result = current.property.name;
+            }
             current = current.parent;
         } while (current && !current.root);
 
diff --git a/Source/WebCore/inspector/front-end/ScriptMapping.js b/Source/WebCore/inspector/front-end/ScriptMapping.js
new file mode 100644
index 000000000..771535bf7
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/ScriptMapping.js
@@ -0,0 +1,300 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.ScriptMapping = function()
+{
+}
+
+WebInspector.ScriptMapping.Events = {
+    UISourceCodeListChanged: "us-source-code-list-changed"
+}
+
+WebInspector.ScriptMapping.prototype = {
+    /**
+     * @param {DebuggerAgent.Location} rawLocation
+     * @return {WebInspector.UILocation}
+     */
+    rawLocationToUILocation: function(rawLocation) {},
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     * @param {number} lineNumber
+     * @param {number} columnNumber
+     * @return {DebuggerAgent.Location}
+     */
+    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber) {},
+
+    /**
+     * @return {Array.<WebInspector.UISourceCode>}
+     */
+    uiSourceCodeList: function() {}
+}
+
+WebInspector.ScriptMapping.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.MainScriptMapping = function()
+{
+    this._rawSourceCodes = [];
+    this._rawSourceCodeForScriptId = {};
+    this._rawSourceCodeForURL = {};
+    this._rawSourceCodeForDocumentURL = {};
+    this._rawSourceCodeForUISourceCode = new Map();
+    this._formatter = new WebInspector.ScriptFormatter();
+    this._formatSource = false;
+    this._liveLocationsForScriptId = {};
+}
+
+WebInspector.MainScriptMapping.Events = {
+    UISourceCodeListChanged: "us-source-code-list-changed"
+}
+
+WebInspector.MainScriptMapping.prototype = {
+    /**
+     * @param {DebuggerAgent.Location} rawLocation
+     * @return {WebInspector.UILocation}
+     */
+    rawLocationToUILocation: function(rawLocation)
+    {
+        var rawSourceCode = this._rawSourceCodeForScriptId[rawLocation.scriptId];
+        return rawSourceCode.rawLocationToUILocation(rawLocation);
+    },
+
+    /**
+     * @param {WebInspector.UISourceCode} uiSourceCode
+     * @param {number} lineNumber
+     * @param {number} columnNumber
+     * @return {DebuggerAgent.Location}
+     */
+    uiLocationToRawLocation: function(uiSourceCode, lineNumber, columnNumber)
+    {
+        var rawSourceCode = this._rawSourceCodeForUISourceCode.get(uiSourceCode);
+        return rawSourceCode.uiLocationToRawLocation(uiSourceCode, lineNumber, columnNumber);
+    },
+
+    /**
+     * @param {DebuggerAgent.Location} rawLocation
+     * @param {function(WebInspector.UILocation)} updateDelegate
+     * @return {WebInspector.LiveLocation}
+     */
+    createLiveLocation: function(rawLocation, updateDelegate)
+    {
+        return new WebInspector.LiveLocation(this, rawLocation, updateDelegate);
+    },
+
+    _registerLiveLocation: function(scriptId, liveLocation)
+    {
+        this._liveLocationsForScriptId[scriptId].push(liveLocation)
+        liveLocation._update();
+    },
+
+    _unregisterLiveLocation: function(scriptId, liveLocation)
+    {
+        this._liveLocationsForScriptId[scriptId].remove(liveLocation);
+    },
+
+    _updateLiveLocations: function(scriptIds)
+    {
+        for (var i = 0; i < scriptIds.length; ++i) {
+            var liveLocations = this._liveLocationsForScriptId[scriptIds[i]];
+            for (var j = 0; j < liveLocations.length; ++j)
+                liveLocations[j]._update();
+        }
+    },
+
+    /**
+     * @return {Array.<WebInspector.UISourceCode>}
+     */
+    uiSourceCodeList: function()
+    {
+        var result = [];
+        for (var i = 0; i < this._rawSourceCodes.length; ++i) {
+            var uiSourceCodeList = this._rawSourceCodes[i].uiSourceCodeList();
+            for (var j = 0; j < uiSourceCodeList.length; ++j)
+                result.push(uiSourceCodeList[j]);
+        }
+        return result;
+    },
+
+    /**
+     * @param {WebInspector.Script} script
+     */
+    addScript: function(script)
+    {
+        this._liveLocationsForScriptId[script.scriptId] = [];
+
+        var resource = null;
+        var isInlineScript = false;
+        if (script.isInlineScript()) {
+            resource = WebInspector.networkManager.inflightResourceForURL(script.sourceURL) || WebInspector.resourceForURL(script.sourceURL);
+            if (resource && resource.type === WebInspector.Resource.Type.Document) {
+                isInlineScript = true;
+                var rawSourceCode = this._rawSourceCodeForDocumentURL[script.sourceURL];
+                if (rawSourceCode) {
+                    rawSourceCode.addScript(script);
+                    this._bindScriptToRawSourceCode(script, rawSourceCode);
+                    return;
+                }
+            }
+        }
+
+        var compilerSourceMapping = null;
+        if (WebInspector.settings.sourceMapsEnabled.get() && script.sourceMapURL)
+            compilerSourceMapping = new WebInspector.ClosureCompilerSourceMapping(script.sourceMapURL, script.sourceURL);
+
+        var rawSourceCode = new WebInspector.RawSourceCode(script.scriptId, script, resource, this._formatter, this._formatSource, compilerSourceMapping);
+        this._rawSourceCodes.push(rawSourceCode);
+        this._bindScriptToRawSourceCode(script, rawSourceCode);
+
+        if (isInlineScript)
+            this._rawSourceCodeForDocumentURL[script.sourceURL] = rawSourceCode;
+
+        if (rawSourceCode.uiSourceCodeList().length)
+            this._uiSourceCodeListChanged(rawSourceCode, [], rawSourceCode.uiSourceCodeList());
+        rawSourceCode.addEventListener(WebInspector.RawSourceCode.Events.UISourceCodeListChanged, this._handleUISourceCodeListChanged, this);
+    },
+
+    /**
+     * @param {WebInspector.Event} event
+     */
+    _handleUISourceCodeListChanged: function(event)
+    {
+        var rawSourceCode = /** @type {WebInspector.RawSourceCode} */ event.target;
+        var oldUISourceCodeList = /** @type {Array.<WebInspector.UISourceCode>} */ event.data["oldUISourceCodeList"];
+        this._uiSourceCodeListChanged(rawSourceCode, oldUISourceCodeList, rawSourceCode.uiSourceCodeList());
+    },
+
+    /**
+     * @param {WebInspector.RawSourceCode} rawSourceCode
+     * @param {Array.<WebInspector.UISourceCode>} removedItems
+     * @param {Array.<WebInspector.UISourceCode>} addedItems
+     */
+    _uiSourceCodeListChanged: function(rawSourceCode, removedItems, addedItems)
+    {
+        for (var i = 0; i < removedItems.length; ++i)
+            this._rawSourceCodeForUISourceCode.remove(removedItems[i]);
+        for (var i = 0; i < addedItems.length; ++i)
+            this._rawSourceCodeForUISourceCode.put(addedItems[i], rawSourceCode);
+        this.dispatchEventToListeners(WebInspector.ScriptMapping.Events.UISourceCodeListChanged, { removedItems: removedItems, addedItems: addedItems });
+
+        var scriptIds = [];
+        for (var i = 0; i < rawSourceCode._scripts.length; ++i)
+            scriptIds.push(rawSourceCode._scripts[i].scriptId);
+        this._updateLiveLocations(scriptIds);
+    },
+
+    /**
+     * @param {WebInspector.Script} script
+     * @param {WebInspector.RawSourceCode} rawSourceCode
+     */
+    _bindScriptToRawSourceCode: function(script, rawSourceCode)
+    {
+        this._rawSourceCodeForScriptId[script.scriptId] = rawSourceCode;
+        this._rawSourceCodeForURL[script.sourceURL] = rawSourceCode;
+    },
+
+    /**
+     * @param {boolean} formatSource
+     */
+    setFormatSource: function(formatSource)
+    {
+        if (this._formatSource === formatSource)
+            return;
+
+        this._formatSource = formatSource;
+        for (var i = 0; i < this._rawSourceCodes.length; ++i)
+            this._rawSourceCodes[i].setFormatted(this._formatSource);
+    },
+
+    /**
+     * @param {DebuggerAgent.Location} rawLocation
+     */
+    forceUpdateSourceMapping: function(rawLocation)
+    {
+        var rawSourceCode = this._rawSourceCodeForScriptId[rawLocation.scriptId];
+        rawSourceCode.forceUpdateSourceMapping();
+    },
+
+    reset: function()
+    {
+        for (var i = 0; i < this._rawSourceCodes.length; ++i) {
+            var rawSourceCode = this._rawSourceCodes[i];
+            this._uiSourceCodeListChanged(rawSourceCode, rawSourceCode.uiSourceCodeList(), []);
+            rawSourceCode.removeAllListeners();
+        }
+        this._rawSourceCodes = [];
+        this._rawSourceCodeForScriptId = {};
+        this._rawSourceCodeForURL = {};
+        this._rawSourceCodeForDocumentURL = {};
+        this._rawSourceCodeForUISourceCode.clear();
+        this._liveLocationsForScriptId = {};
+    }
+}
+
+WebInspector.MainScriptMapping.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ * @param {WebInspector.MainScriptMapping} scriptMapping
+ * @param {DebuggerAgent.Location} rawLocation
+ * @param {function(WebInspector.UILocation)} updateDelegate
+ */
+WebInspector.LiveLocation = function(scriptMapping, rawLocation, updateDelegate)
+{
+    this._scriptMapping = scriptMapping;
+    this._rawLocation = rawLocation;
+    this._updateDelegate = updateDelegate;
+}
+
+WebInspector.LiveLocation.prototype = {
+    init: function()
+    {
+        this._scriptMapping._registerLiveLocation(this._rawLocation.scriptId, this);
+    },
+
+    dispose: function()
+    {
+        this._scriptMapping._unregisterLiveLocation(this._rawLocation.scriptId, this);
+    },
+
+    _update: function()
+    {
+        var uiLocation = this._scriptMapping.rawLocationToUILocation(this._rawLocation);
+        if (uiLocation)
+            this._updateDelegate(uiLocation);
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/ScriptsPanel.js b/Source/WebCore/inspector/front-end/ScriptsPanel.js
index cd93e9ead..881ca3df3 100644
--- a/Source/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/Source/WebCore/inspector/front-end/ScriptsPanel.js
@@ -35,6 +35,7 @@ WebInspector.ScriptsPanel = function(presentationModel)
     this.registerRequiredCSS("scriptsPanel.css");
 
     WebInspector.settings.pauseOnExceptionStateString = WebInspector.settings.createSetting("pauseOnExceptionStateString", WebInspector.ScriptsPanel.PauseOnExceptionsState.DontPauseOnExceptions);
+    WebInspector.settings.navigatorWasOnceHidden = WebInspector.settings.createSetting("navigatorWasOnceHidden", false);
 
     this._presentationModel = presentationModel;
 
@@ -66,6 +67,7 @@ WebInspector.ScriptsPanel = function(presentationModel)
         const minimalViewsContainerWidthPercent = 50;
         this.editorView = new WebInspector.SplitView(WebInspector.SplitView.SidebarPosition.Left, "scriptsPanelNavigatorSidebarWidth", initialNavigatorWidth);
         this.editorView.element.id = "scripts-editor-view";
+        this.editorView.element.tabIndex = 0;
 
         this.editorView.minimalSidebarWidth = Preferences.minScriptsSidebarWidth;
         this.editorView.minimalMainWidthPercent = minimalViewsContainerWidthPercent;
@@ -292,11 +294,9 @@ WebInspector.ScriptsPanel.prototype = {
 
     _consoleMessagesCleared: function()
     {
-        var uiSourceCodes = this._sourceFramesByUISourceCode;
-        for (var i = 0; i < uiSourceCodes.length; ++i) {
-            var sourceFrame = this._sourceFramesByUISourceCode.get(uiSourceCodes[i])
-            sourceFrame.clearMessages();
-        }
+        var sourceFrames = this._sourceFramesByUISourceCode.values();
+        for (var i = 0; i < sourceFrames.length; ++i)
+            sourceFrames[i].clearMessages();
     },
 
     _consoleMessageAdded: function(event)
@@ -347,9 +347,7 @@ WebInspector.ScriptsPanel.prototype = {
         this._updateDebuggerButtons();
 
         WebInspector.inspectorView.setCurrentPanel(this);
-
         this.sidebarPanes.callstack.update(callFrames);
-        this._updateCallFrame(this._presentationModel.selectedCallFrame);
 
         if (details.reason === WebInspector.DebuggerModel.BreakReason.DOM) {
             this.sidebarPanes.domBreakpoints.highlightBreakpoint(details.auxData);
@@ -606,21 +604,20 @@ WebInspector.ScriptsPanel.prototype = {
     {
         var uiLocation = event.data;
 
-        this._updateExecutionLine(uiLocation);
-    },
-
-    _updateExecutionLine: function(uiLocation)
-    {
         this._clearCurrentExecutionLine();
         if (!uiLocation)
             return;
+        var sourceFrame = this._getOrCreateSourceFrame(uiLocation.uiSourceCode);
+        sourceFrame.setExecutionLine(uiLocation.lineNumber);
+        this._executionSourceFrame = sourceFrame;
+    },
 
+    _revealExecutionLine: function(uiLocation)
+    {
         // Anonymous scripts are not added to files select by default.
         this._addUISourceCode(uiLocation.uiSourceCode);
-
         var sourceFrame = this._showFile(uiLocation.uiSourceCode);
-        sourceFrame.setExecutionLine(uiLocation.lineNumber);
-        this._executionSourceFrame = sourceFrame;
+        sourceFrame.revealLine(uiLocation.lineNumber);
     },
 
     _callFrameSelected: function(event)
@@ -630,19 +627,15 @@ WebInspector.ScriptsPanel.prototype = {
         if (!callFrame)
             return;
 
-        this._updateCallFrame(callFrame);
-    },
-
-    _updateCallFrame: function(callFrame)
-    {
         this.sidebarPanes.scopechain.update(callFrame);
         this.sidebarPanes.watchExpressions.refreshExpressions();
         this.sidebarPanes.callstack.selectedCallFrame = callFrame;
-        this._updateExecutionLine(this._presentationModel.executionLineLocation);
+        callFrame.uiLocation(this._revealExecutionLine.bind(this));
     },
 
     _editorClosed: function(event)
     {
+        this._hideNavigatorOverlay();
         var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
 
         if (this._currentUISourceCode === uiSourceCode)
@@ -657,14 +650,14 @@ WebInspector.ScriptsPanel.prototype = {
 
     _editorSelected: function(event)
     {
+        this._hideNavigatorOverlay();
         var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
         this._showFile(uiSourceCode);
     },
 
     _fileSelected: function(event)
     {
-        if (this._navigatorOverlayShown)
-            this._hideNavigatorOverlay();
+        this._hideNavigatorOverlay();
         var uiSourceCode = /** @type {WebInspector.UISourceCode} */ event.data;
         this._showFile(uiSourceCode);
     },
@@ -956,9 +949,14 @@ WebInspector.ScriptsPanel.prototype = {
         return button;
     },
 
+    _escDownWhileNavigatorOverlayOpen: function(event)
+    {
+        this._hideNavigatorOverlay();
+    },
+
     _maybeShowNavigatorOverlay: function()
     {
-        if (this._navigator && WebInspector.settings.navigatorHidden.get() && !this._navigatorWasOnceHidden)
+        if (this._navigator && WebInspector.settings.navigatorHidden.get() && !WebInspector.settings.navigatorWasOnceHidden.get())
             this._showNavigatorOverlay();
     },
 
@@ -1011,15 +1009,15 @@ WebInspector.ScriptsPanel.prototype = {
             return;
 
         this._navigatorOverlayShown = true;
-        var sidebarOverlay = new WebInspector.SidebarOverlay(this._navigatorView, "scriptsPanelNavigatorOverlayWidth", Preferences.minScriptsSidebarWidth);
-        sidebarOverlay.addEventListener(WebInspector.SidebarOverlay.EventTypes.WasShown, this._navigatorOverlayWasShown, this);
-        sidebarOverlay.addEventListener(WebInspector.SidebarOverlay.EventTypes.WillHide, this._navigatorOverlayWillHide, this);
+        this._sidebarOverlay = new WebInspector.SidebarOverlay(this._navigatorView, "scriptsPanelNavigatorOverlayWidth", Preferences.minScriptsSidebarWidth);
+        this._sidebarOverlay.addEventListener(WebInspector.SidebarOverlay.EventTypes.WasShown, this._navigatorOverlayWasShown, this);
+        this._sidebarOverlay.addEventListener(WebInspector.SidebarOverlay.EventTypes.WillHide, this._navigatorOverlayWillHide, this);
 
         var navigatorOverlayResizeWidgetElement = document.createElement("div");
         navigatorOverlayResizeWidgetElement.addStyleClass("scripts-navigator-resizer-widget");
-        sidebarOverlay.resizerWidgetElement = navigatorOverlayResizeWidgetElement;
+        this._sidebarOverlay.resizerWidgetElement = navigatorOverlayResizeWidgetElement;
 
-        sidebarOverlay.start(this.editorView.element);
+        this._sidebarOverlay.show(this.editorView.element);
     },
 
     _hideNavigatorOverlay: function()
@@ -1027,7 +1025,7 @@ WebInspector.ScriptsPanel.prototype = {
         if (!this._navigatorOverlayShown)
             return;
 
-        WebInspector.Dialog.hide();
+        this._sidebarOverlay.hide();
     },
 
     _navigatorOverlayWasShown: function(event)
@@ -1036,15 +1034,17 @@ WebInspector.ScriptsPanel.prototype = {
         this._navigatorShowHideButton.addStyleClass("toggled-on");
         this._navigatorShowHideButton.title = WebInspector.UIString("Hide scripts navigator");
         this._navigator.focus();
+        this.registerShortcut(WebInspector.KeyboardShortcut.Keys.Esc.code, this._escDownWhileNavigatorOverlayOpen.bind(this));
     },
 
     _navigatorOverlayWillHide: function(event)
     {
         delete this._navigatorOverlayShown;
-        this._navigatorWasOnceHidden = true;
+        WebInspector.settings.navigatorWasOnceHidden.set(true);
         this.editorView.element.appendChild(this._navigatorShowHideButton);
         this._navigatorShowHideButton.removeStyleClass("toggled-on");
         this._navigatorShowHideButton.title = WebInspector.UIString("Show scripts navigator");
+        this.unregisterShortcut(WebInspector.KeyboardShortcut.Keys.Esc.code);
     },
 
     _createButtonAndRegisterShortcuts: function(buttonId, buttonTitle, handler, shortcuts, shortcutDescription)
diff --git a/Source/WebCore/inspector/front-end/ScriptsSearchScope.js b/Source/WebCore/inspector/front-end/ScriptsSearchScope.js
index 094a8899a..92182416e 100644
--- a/Source/WebCore/inspector/front-end/ScriptsSearchScope.js
+++ b/Source/WebCore/inspector/front-end/ScriptsSearchScope.js
@@ -144,11 +144,9 @@ WebInspector.ScriptsSearchResultsPane.prototype = {
      */
     createAnchor: function(file, lineNumber, columnNumber)
     {
-        
-        var uiSourceCode = file;
-        var rawSourceCode = uiSourceCode.rawSourceCode;
-        var rawLocation = rawSourceCode.sourceMapping.uiLocationToRawLocation(uiSourceCode, lineNumber, columnNumber);
-        var anchor = this._linkifier.linkifyRawSourceCode(uiSourceCode.rawSourceCode, rawLocation.lineNumber, rawLocation.columnNumber);
+        var uiSourceCode = /** @type {WebInspector.UISourceCode} */ file;
+        var rawLocation = WebInspector.debuggerPresentationModel.uiLocationToRawLocation(uiSourceCode, lineNumber, columnNumber);
+        var anchor = this._linkifier.linkifyRawLocation(rawLocation);
         anchor.removeChildren();
         return anchor;
     },
@@ -176,10 +174,10 @@ WebInspector.ScriptsSearchResultsPane.LinkifierFormatter = function()
 
 WebInspector.ScriptsSearchResultsPane.LinkifierFormatter.prototype = {
     /**
-     * @param {WebInspector.RawSourceCode} rawSourceCode
      * @param {Element} anchor
+     * @param {WebInspector.UILocation} uiLocation
      */
-    formatRawSourceCodeAnchor: function(rawSourceCode, anchor)
+    formatLiveAnchor: function(anchor, uiLocation)
     {
         // Empty because we don't want to ever update anchor contents after creation.
     }
diff --git a/Source/WebCore/inspector/front-end/Settings.js b/Source/WebCore/inspector/front-end/Settings.js
index fba3c0f25..867383945 100644
--- a/Source/WebCore/inspector/front-end/Settings.js
+++ b/Source/WebCore/inspector/front-end/Settings.js
@@ -90,11 +90,12 @@ WebInspector.Settings = function()
     this.dockToRight = this.createSetting("dockToRight", false);
     this.emulateTouchEvents = this.createSetting("emulateTouchEvents", false);
     this.showPaintRects = this.createSetting("showPaintRects", false);
+    this.zoomLevel = this.createSetting("zoomLevel", 0);
 
     // If there are too many breakpoints in a storage, it is likely due to a recent bug that caused
     // periodical breakpoints duplication leading to inspector slowness.
-    if (window.localStorage.breakpoints && window.localStorage.breakpoints.length > 500000)
-        delete window.localStorage.breakpoints;
+    if (this.breakpoints.get().length > 500000)
+        this.breakpoints.set([]);
 }
 
 WebInspector.Settings.prototype = {
@@ -174,11 +175,11 @@ WebInspector.ExperimentsSettings = function()
     
     // Add currently running experiments here.
     this.sourceFrameAlwaysEditable = this._createExperiment("sourceFrameAlwaysEditable", "Make resources always editable");
-    this.showMemoryCounters = this._createExperiment("showMemoryCounters", "Show memory counters in Timeline panel");
-    this.timelineStartAtZero = this._createExperiment("timelineStartAtZero", "Enable start at zero mode in Timeline panel");
+    this.timelineVerticalOverview = this._createExperiment("timelineStartAtZero", "Enable vertical overview mode in the Timeline panel");
     // FIXME: Enable http/tests/inspector/indexeddb/resources-panel.html when removed from experiments.
     this.showIndexedDB = this._createExperiment("showIndexedDB", "Show IndexedDB in Resources panel");
     this.debugCSS = this._createExperiment("debugCSS", "Load CSS via link tags for debugging");
+    this.showShadowDOM = this._createExperiment("showShadowDOM", "Show shadow DOM");
 
     this._cleanUpSetting();
 }
diff --git a/Source/WebCore/inspector/front-end/SidebarOverlay.js b/Source/WebCore/inspector/front-end/SidebarOverlay.js
index 17c93e5c8..246788ed2 100644
--- a/Source/WebCore/inspector/front-end/SidebarOverlay.js
+++ b/Source/WebCore/inspector/front-end/SidebarOverlay.js
@@ -30,15 +30,18 @@
 
 /**
  * @constructor
- * @extends {WebInspector.DialogDelegate}
+ * @extends {WebInspector.Object}
  * @param {WebInspector.View} view
  * @param {string} widthSettingName
  * @param {number} minimalWidth
  */
 WebInspector.SidebarOverlay = function(view, widthSettingName, minimalWidth)
 {
-    WebInspector.DialogDelegate.call(this);
+    WebInspector.Object.call(this);
     
+    this.element = document.createElement("div");
+    this.element.className = "sidebar-overlay";
+
     this._view = view;
     this._widthSettingName = widthSettingName;
     this._minimalWidth = minimalWidth;
@@ -59,34 +62,36 @@ WebInspector.SidebarOverlay.EventTypes = {
 
 WebInspector.SidebarOverlay.prototype = {
     /**
-     * @param {Element} element
+     * @param {Element} relativeToElement
      */
-    show: function(element)
+    show: function(relativeToElement)
     {
-        this._element = element;
-        element.addStyleClass("sidebar-overlay-dialog");
-        this._view.markAsRoot();
-        this._view.show(element);
-        this._element.appendChild(this._resizerElement);
+        relativeToElement.appendChild(this.element);
+        relativeToElement.addStyleClass("sidebar-overlay-shown");
+        this._view.show(this.element);
+        this.element.appendChild(this._resizerElement);
         if (this._resizerWidgetElement)
-            this._element.appendChild(this._resizerWidgetElement);
-
+            this.element.appendChild(this._resizerWidgetElement);
+        this.position(relativeToElement);
+        this._boundContainingElementFocused = this._containingElementFocused.bind(this);
+        relativeToElement.addEventListener("DOMFocusIn", this._boundContainingElementFocused, false);
+        
         this.dispatchEventToListeners(WebInspector.SidebarOverlay.EventTypes.WasShown, null);
     },
 
+    _containingElementFocused: function(event)
+    {
+        if (!event.target.isSelfOrDescendant(this.element))
+            this.hide();
+    },
+
     /**
-     * @param {Element} element
      * @param {Element} relativeToElement
      */
-    position: function(element, relativeToElement)
+    position: function(relativeToElement)
     {
         this._totalWidth = relativeToElement.offsetWidth;
-        
-        var offset = relativeToElement.offsetRelativeToWindow(window);
-        element.style.left = offset.x + "px";
-        element.style.top = offset.y + "px";
         this._setWidth(this._preferredWidth());
-        element.style.height = relativeToElement.offsetHeight + "px";
     },
 
     focus: function()
@@ -94,17 +99,21 @@ WebInspector.SidebarOverlay.prototype = {
         WebInspector.setCurrentFocusElement(this._view.element);
     },
 
-    willHide: function() {
-        this._view.detach();
-        this.dispatchEventToListeners(WebInspector.SidebarOverlay.EventTypes.WillHide, null);
-    },
-    
-    /**
-     * @param {Element} relativeToElement
-     */
-    start: function(relativeToElement)
+    hide: function()
     {
-        WebInspector.Dialog.show(relativeToElement, this);
+        var element = this.element.parentElement;
+        if (!element)
+            return;
+
+        this.dispatchEventToListeners(WebInspector.SidebarOverlay.EventTypes.WillHide, null);
+        
+        this._view.detach();
+        element.removeChild(this.element);
+        element.removeStyleClass("sidebar-overlay-shown");
+        this.element.removeChild(this._resizerElement);
+        if (this._resizerWidgetElement)
+            this.element.removeChild(this._resizerWidgetElement);
+        element.removeEventListener("DOMFocusIn", this._boundContainingElementFocused, false);
     },
     
     /**
@@ -117,7 +126,7 @@ WebInspector.SidebarOverlay.prototype = {
         if (this._width === width)
             return;
 
-        this._element.style.width = width + "px";
+        this.element.style.width = width + "px";
         this._resizerElement.style.left = (width - 3) + "px";
         this._width = width;
         this._view.doResize();
@@ -191,4 +200,4 @@ WebInspector.SidebarOverlay.prototype = {
     }
 }
 
-WebInspector.SidebarOverlay.prototype.__proto__ = WebInspector.DialogDelegate.prototype;
+WebInspector.SidebarOverlay.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/SourceFrame.js b/Source/WebCore/inspector/front-end/SourceFrame.js
index f66f67b63..9e225aefe 100644
--- a/Source/WebCore/inspector/front-end/SourceFrame.js
+++ b/Source/WebCore/inspector/front-end/SourceFrame.js
@@ -97,6 +97,8 @@ WebInspector.SourceFrame.prototype = {
             this._textViewer.freeCachedElements();
 
         this._clearLineHighlight();
+        this._clearLineToReveal();
+        
         if (!this._textViewer.readOnly)
             this._wasHiddenWhileEditing = true;
         this.setReadOnly(true);
@@ -185,6 +187,7 @@ WebInspector.SourceFrame.prototype = {
 
     highlightLine: function(line)
     {
+        this._clearLineToReveal();
         if (this.loaded)
             this._textViewer.highlightLine(line);
         else
@@ -199,6 +202,20 @@ WebInspector.SourceFrame.prototype = {
             delete this._lineToHighlight;
     },
 
+    revealLine: function(line)
+    {
+        this._clearLineHighlight();
+        if (this.loaded)
+            this._textViewer.revealLine(line);
+        else
+            this._lineToReveal = line;
+    },
+
+    _clearLineToReveal: function()
+    {
+        delete this._lineToReveal;
+    },
+
     _saveViewerState: function()
     {
         this._viewerState = {
@@ -250,6 +267,11 @@ WebInspector.SourceFrame.prototype = {
             delete this._lineToHighlight;
         }
 
+        if (typeof this._lineToReveal === "number") {
+            this.revealLine(this._lineToReveal);
+            delete this._lineToReveal;
+        }
+
         if (this._delayedFindSearchMatches) {
             this._delayedFindSearchMatches();
             delete this._delayedFindSearchMatches;
diff --git a/Source/WebCore/inspector/front-end/Spectrum.js b/Source/WebCore/inspector/front-end/Spectrum.js
index 3f9a58e44..550c8f009 100644
--- a/Source/WebCore/inspector/front-end/Spectrum.js
+++ b/Source/WebCore/inspector/front-end/Spectrum.js
@@ -38,6 +38,8 @@ WebInspector.Spectrum = function()
 
     this._containerElement = document.createElement('div');
     this._containerElement.className = "spectrum-container";
+    this._containerElement.tabIndex = 0;
+    this._containerElement.addEventListener("keydown", this._onKeyDown.bind(this), false);
 
     var topElement = this._containerElement.createChild("div", "spectrum-top");
     topElement.createChild("div", "spectrum-fill");
@@ -405,11 +407,16 @@ WebInspector.Spectrum.prototype = {
 
     reposition: function(element)
     {
+        if (!this._previousFocusElement)
+            this._previousFocusElement = WebInspector.currentFocusElement();
         this._popover.show(this._containerElement, element);
+        WebInspector.markBeingEdited(this._containerElement, true);    
+        WebInspector.setCurrentFocusElement(this._containerElement);
     },
 
     hide: function()
     {
+        WebInspector.markBeingEdited(this._containerElement, false);
         this._popover.hide();
 
         document.removeEventListener("mousedown", this._hideProxy, false);
@@ -417,8 +424,20 @@ WebInspector.Spectrum.prototype = {
 
         this.dispatchEventToListeners(WebInspector.Spectrum.Events.Hidden);
 
+        WebInspector.setCurrentFocusElement(this._previousFocusElement);
+        delete this._previousFocusElement;
+
         delete this.anchorElement;
+    },
+
+    _onKeyDown: function(event)
+    {
+        if (event.keyIdentifier === "Enter" || event.keyIdentifier === "U+001B") { // Escape key
+            this.hide();
+            event.stopPropagation();
+            event.preventDefault();
+        }
     }
-};
+}
 
 WebInspector.Spectrum.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/StylesSidebarPane.js b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
index dd273ae99..f76e1d63f 100644
--- a/Source/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -189,7 +189,17 @@ WebInspector.StylesSidebarPane.alteredHexNumber = function(hexString, event)
     for (var i = 0, lengthDelta = hexString.length - resultString.length; i < lengthDelta; ++i)
         resultString = "0" + resultString;
     return resultString;
-},
+}
+
+WebInspector.StylesSidebarPane.canonicalPropertyName = function(name)
+{
+    if (!name || name.length < 9 || name.charAt(0) !== "-")
+        return name;
+    var match = name.match(/(?:-webkit-|-khtml-|-apple-)(.+)/);
+    if (!match)
+        return name;
+    return match[1];
+}
 
 WebInspector.StylesSidebarPane.prototype = {
     _contextMenuEventFired: function(event)
@@ -563,26 +573,26 @@ WebInspector.StylesSidebarPane.prototype = {
                 var property = allProperties[j];
                 if (!property.isLive || !property.parsedOk)
                     continue;
-                var name = property.name;
+                var canonicalName = WebInspector.StylesSidebarPane.canonicalPropertyName(property.name);
 
                 if (!priorityUsed && property.priority.length)
                     priorityUsed = true;
 
                 // If the property name is already used by another rule then this rule's
                 // property is overloaded, so don't add it to the rule's usedProperties.
-                if (!(name in usedProperties))
-                    styleRule.usedProperties[name] = true;
+                if (!(canonicalName in usedProperties))
+                    styleRule.usedProperties[canonicalName] = true;
             }
 
             // Add all the properties found in this style to the used properties list.
             // Do this here so only future rules are affect by properties used in this rule.
-            for (var name in styleRules[i].usedProperties)
-                usedProperties[name] = true;
+            for (var canonicalName in styleRules[i].usedProperties)
+                usedProperties[canonicalName] = true;
         }
 
         if (priorityUsed) {
             // Walk the properties again and account for !important.
-            var foundPriorityProperties = [];
+            var foundPriorityProperties = {};
 
             // Walk in direct order to detect the active/most specific rule providing a priority
             // (in this case all subsequent !important values get canceled.)
@@ -596,15 +606,15 @@ WebInspector.StylesSidebarPane.prototype = {
                     var property = allProperties[j];
                     if (!property.isLive)
                         continue;
-                    var name = property.name;
+                    var canonicalName = WebInspector.StylesSidebarPane.canonicalPropertyName(property.name);
                     if (property.priority.length) {
-                        if (!(name in foundPriorityProperties))
-                            styleRules[i].usedProperties[name] = true;
+                        if (!(canonicalName in foundPriorityProperties))
+                            styleRules[i].usedProperties[canonicalName] = true;
                         else
-                            delete styleRules[i].usedProperties[name];
-                        foundPriorityProperties[name] = true;
-                    } else if (name in foundPriorityProperties)
-                        delete styleRules[i].usedProperties[name];
+                            delete styleRules[i].usedProperties[canonicalName];
+                        foundPriorityProperties[canonicalName] = true;
+                    } else if (canonicalName in foundPriorityProperties)
+                        delete styleRules[i].usedProperties[canonicalName];
                 }
             }
         }
@@ -967,6 +977,8 @@ WebInspector.StylePropertiesSection = function(parentPane, styleRule, editable,
     var openBrace = document.createElement("span");
     openBrace.textContent = " {";
     selectorContainer.appendChild(openBrace);
+    selectorContainer.addEventListener("mousedown", this._handleEmptySpaceMouseDown.bind(this), false);
+    selectorContainer.addEventListener("click", this._handleSelectorContainerClick.bind(this), false);
 
     var closeBrace = document.createElement("div");
     closeBrace.textContent = "}";
@@ -996,6 +1008,7 @@ WebInspector.StylePropertiesSection = function(parentPane, styleRule, editable,
     this._selectorRefElement.appendChild(this._createRuleOriginNode());
     selectorContainer.insertBefore(this._selectorRefElement, selectorContainer.firstChild);
     this.titleElement.appendChild(selectorContainer);
+    this._selectorContainer = selectorContainer;
 
     if (isInherited)
         this.element.addStyleClass("show-inherited"); // This one is related to inherited rules, not compted style.
@@ -1030,7 +1043,8 @@ WebInspector.StylePropertiesSection.prototype = {
             return false;
         }
 
-        var used = (propertyName in this._usedProperties);
+        var canonicalName = WebInspector.StylesSidebarPane.canonicalPropertyName(propertyName);
+        var used = (canonicalName in this._usedProperties);
         if (used || !shorthand)
             return !used;
 
@@ -1039,7 +1053,7 @@ WebInspector.StylePropertiesSection.prototype = {
         var longhandProperties = this.styleRule.style.getLonghandProperties(propertyName);
         for (var j = 0; j < longhandProperties.length; ++j) {
             var individualProperty = longhandProperties[j];
-            if (individualProperty.name in this._usedProperties)
+            if (WebInspector.StylesSidebarPane.canonicalPropertyName(individualProperty.name) in this._usedProperties)
                 return false;
         }
 
@@ -1162,15 +1176,31 @@ WebInspector.StylePropertiesSection.prototype = {
         return null;
     },
 
+    _checkWillCancelEditing: function()
+    {
+        var willCauseCancelEditing = this._willCauseCancelEditing;
+        delete this._willCauseCancelEditing;
+        return willCauseCancelEditing;
+    },
+
+    _handleSelectorContainerClick: function(event)
+    {
+        if (this._checkWillCancelEditing())
+            return;
+        if (event.target === this._selectorContainer)
+            this.addNewBlankProperty(0).startEditing();
+    },
+
     /**
-     * @param {number=} optionalIndex
+     * @param {number=} index
      */
-    addNewBlankProperty: function(optionalIndex)
+    addNewBlankProperty: function(index)
     {
         var style = this.styleRule.style;
-        var property = style.newBlankProperty();
+        var property = style.newBlankProperty(index);
         var item = new WebInspector.StylePropertyTreeElement(this, this._parentPane, this.styleRule, style, property, false, false, false);
-        this.propertiesTreeOutline.appendChild(item);
+        index = property.index;
+        this.propertiesTreeOutline.insertChild(item, index);
         item.listItemElement.textContent = "";
         item._newProperty = true;
         item.updateTitle();
@@ -1210,9 +1240,7 @@ WebInspector.StylePropertiesSection.prototype = {
 
     _handleEmptySpaceClick: function(event)
     {
-        var willCauseCancelEditing = this._willCauseCancelEditing;
-        delete this._willCauseCancelEditing;
-        if (willCauseCancelEditing)
+        if (this._checkWillCancelEditing())
             return;
 
         if (event.target.hasStyleClass("header") || this.element.hasStyleClass("read-only") || event.target.enclosingNodeOrSelfWithClass("media")) {
@@ -1609,14 +1637,16 @@ WebInspector.StylePropertyTreeElement.prototype = {
         this.updateTitle();
         this.listItemElement.addEventListener("mousedown", this._mouseDown.bind(this));
         this.listItemElement.addEventListener("mouseup", this._resetMouseDownElement.bind(this));
-        this.listItemElement.addEventListener("click", this._startEditing.bind(this));
+        this.listItemElement.addEventListener("click", this._mouseClick.bind(this));
     },
 
     _mouseDown: function(event)
     {
-        this._parentPane._mouseDownTreeElement = this;
-        this._parentPane._mouseDownTreeElementIsName = this._isNameElement(event.target);
-        this._parentPane._mouseDownTreeElementIsValue = this._isValueElement(event.target);
+        if (this._parentPane) {
+            this._parentPane._mouseDownTreeElement = this;
+            this._parentPane._mouseDownTreeElementIsName = this._isNameElement(event.target);
+            this._parentPane._mouseDownTreeElementIsValue = this._isValueElement(event.target);
+        }
     },
 
     _resetMouseDownElement: function()
@@ -1992,11 +2022,19 @@ WebInspector.StylePropertyTreeElement.prototype = {
         this.listItemElement.insertBefore(this.nameElement, this.listItemElement.firstChild);
     },
 
-    _startEditing: function(event)
+    _mouseClick: function(event)
     {
-        this.startEditing(event.target);
         event.stopPropagation();
         event.preventDefault();
+
+        if (event.target === this.listItemElement) {
+            if (this.section._checkWillCancelEditing())
+                return;
+            this.section.addNewBlankProperty(this.property.index + 1).startEditing();
+            return;
+        }
+
+        this.startEditing(event.target);
     },
 
     _isNameElement: function(element)
@@ -2233,6 +2271,16 @@ WebInspector.StylePropertyTreeElement.prototype = {
         }
     },
 
+    _findSibling: function(moveDirection)
+    {
+        var target = this;
+        do {
+            target = (moveDirection === "forward" ? target.nextSibling : target.previousSibling);
+        } while(target && target.inherited);
+
+        return target;
+    },
+
     editingCommitted: function(element, userInput, previousContent, context, moveDirection)
     {
         this._removePrompt();
@@ -2245,10 +2293,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
         var moveToOther = (isEditingName ^ (moveDirection === "forward"));
         var abandonNewProperty = this._newProperty && !userInput && (moveToOther || isEditingName);
         if (moveDirection === "forward" && !isEditingName || moveDirection === "backward" && isEditingName) {
-            do {
-                moveTo = (moveDirection === "forward" ? moveTo.nextSibling : moveTo.previousSibling);
-            } while(moveTo && moveTo.inherited);
-
+            moveTo = moveTo._findSibling(moveDirection);
             if (moveTo)
                 moveToPropertyName = moveTo.name;
             else if (moveDirection === "forward" && (!this._newProperty || userInput))
@@ -2258,6 +2303,7 @@ WebInspector.StylePropertyTreeElement.prototype = {
         }
 
         // Make the Changes and trigger the moveToNextCallback after updating.
+        var moveToIndex = moveTo && this.treeOutline ? this.treeOutline.children.indexOf(moveTo) : -1;
         var blankInput = /^\s*$/.test(userInput);
         var isDataPasted = "originalName" in context;
         var isDirtyViaPaste = isDataPasted && (this.nameElement.textContent !== context.originalName || this.valueElement.textContent !== context.originalValue);
@@ -2280,8 +2326,6 @@ WebInspector.StylePropertyTreeElement.prototype = {
             moveToNextCallback.call(this, this._newProperty, false, this.treeOutline.section);
         }
 
-        var moveToIndex = moveTo && this.treeOutline ? this.treeOutline.children.indexOf(moveTo) : -1;
-
         // The Callback to start editing the next/previous property/selector.
         function moveToNextCallback(alreadyNew, valueChanged, section)
         {
@@ -2305,7 +2349,10 @@ WebInspector.StylePropertyTreeElement.prototype = {
                 else {
                     var treeElement = moveToIndex >= 0 ? propertyElements[moveToIndex] : null;
                     if (treeElement) {
-                        treeElement.startEditing(!isEditingName ? treeElement.nameElement : treeElement.valueElement);
+                        var elementToEdit = !isEditingName ? treeElement.nameElement : treeElement.valueElement;
+                        if (alreadyNew && blankInput)
+                            elementToEdit = moveDirection === "forward" ? treeElement.nameElement : treeElement.valueElement;
+                        treeElement.startEditing(elementToEdit);
                         return;
                     } else if (!alreadyNew)
                         moveToSelector = true;
@@ -2322,7 +2369,8 @@ WebInspector.StylePropertyTreeElement.prototype = {
             }
 
             if (abandonNewProperty) {
-                var sectionToEdit = moveDirection === "backward" ? section : section.nextEditableSibling();
+                moveTo = this._findSibling(moveDirection);
+                var sectionToEdit = (moveTo || moveDirection === "backward") ? section : section.nextEditableSibling();
                 if (sectionToEdit) {
                     if (sectionToEdit.rule)
                         sectionToEdit.startEditingSelector();
@@ -2401,6 +2449,8 @@ WebInspector.StylePropertyTreeElement.prototype = {
                 return;
             }
 
+            if (this._newProperty)
+                this._newPropertyInStyle = true;
             this.style = newStyle;
             this.property = newStyle.propertyAt(this.property.index);
             this._styleRule.style = this.style;
@@ -2420,7 +2470,8 @@ WebInspector.StylePropertyTreeElement.prototype = {
         // FIXME: this does not handle trailing comments.
         if (styleText.length && !/;\s*$/.test(styleText))
             styleText += ";";
-        this.property.setText(styleText, majorChange, callback.bind(this, userOperationFinishedCallback.bind(null, this._parentPane, updateInterface), this.originalPropertyText));
+        var overwriteProperty = !!(!this._newProperty || this._newPropertyInStyle);
+        this.property.setText(styleText, majorChange, overwriteProperty, callback.bind(this, userOperationFinishedCallback.bind(null, this._parentPane, updateInterface), this.originalPropertyText));
     },
 
     ondblclick: function()
@@ -2555,7 +2606,7 @@ WebInspector.StylesSidebarPane.CSSPropertyPrompt.prototype = {
         return false;
     },
 
-    _buildPropertyCompletions: function(wordRange, force, completionsReadyCallback)
+    _buildPropertyCompletions: function(textPrompt, wordRange, force, completionsReadyCallback)
     {
         var prefix = wordRange.toString().toLowerCase();
         if (!prefix && !force)
diff --git a/Source/WebCore/inspector/front-end/TabbedPane.js b/Source/WebCore/inspector/front-end/TabbedPane.js
index 4b24e880d..a2a390d3b 100644
--- a/Source/WebCore/inspector/front-end/TabbedPane.js
+++ b/Source/WebCore/inspector/front-end/TabbedPane.js
@@ -114,11 +114,9 @@ WebInspector.TabbedPane.prototype = {
     closeTab: function(id, userGesture)
     {
         this._innerCloseTab(id, userGesture);
-
+        this._updateTabElements();
         if (this._tabsHistory.length)
             this.selectTab(this._tabsHistory[0].id, userGesture);
-        else
-            this._updateTabElements();
     },
 
     /**
@@ -596,9 +594,7 @@ WebInspector.TabbedPaneTab.prototype = {
             tabElement.addStyleClass("measuring");
         else {
             this._tabElement = tabElement;
-            tabElement.addEventListener("click", this._tabSelected.bind(this), false);
-            if (this._closeable)
-                closeButtonSpan.addEventListener("click", this._tabClosed.bind(this), false);
+            tabElement.addEventListener("click", this._tabClicked.bind(this), false);
         }
         
         return tabElement;
@@ -612,13 +608,14 @@ WebInspector.TabbedPaneTab.prototype = {
         this._measureElement.removeChild(measuringTabElement);
     },
 
-    _tabSelected: function()
-    {
-        this._tabbedPane.selectTab(this.id, true);        
-    },
-
-    _tabClosed: function()
+    /**
+     * @param {Event} event
+     */
+    _tabClicked: function(event)
     {
-        this._tabbedPane.closeTab(this.id, true);        
+        if (this._closeable && (event.button === 1 || event.target.hasStyleClass("tabbed-pane-header-tab-close-button")))
+            this._tabbedPane.closeTab(this.id, true);
+        else
+            this._tabbedPane.selectTab(this.id, true);
     }
-}
\ No newline at end of file
+}
diff --git a/Source/WebCore/inspector/front-end/TextPrompt.js b/Source/WebCore/inspector/front-end/TextPrompt.js
index 3c43f690d..13efa331c 100644
--- a/Source/WebCore/inspector/front-end/TextPrompt.js
+++ b/Source/WebCore/inspector/front-end/TextPrompt.js
@@ -30,7 +30,7 @@
 /**
  * @constructor
  * @extends WebInspector.Object
- * @param {function(Range, boolean, function(Array.<string>=))} completions
+ * @param {function(WebInspector.TextPrompt, Range, boolean, function(Array.<string>=))} completions
  * @param {string} stopCharacters
  */
 WebInspector.TextPrompt = function(completions, stopCharacters)
@@ -383,7 +383,7 @@ WebInspector.TextPrompt.prototype = {
         }
 
         var wordPrefixRange = selectionRange.startContainer.rangeOfWord(selectionRange.startOffset, this._completionStopCharacters, this._element, "backward");
-        this._loadCompletions(wordPrefixRange, force, this._completionsReady.bind(this, selection, auto, wordPrefixRange, !!reverse));
+        this._loadCompletions(this, wordPrefixRange, force, this._completionsReady.bind(this, selection, auto, wordPrefixRange, !!reverse));
     },
 
     _boxForAnchorAtStart: function(selection, textRange)
@@ -748,7 +748,7 @@ WebInspector.TextPrompt.prototype.__proto__ = WebInspector.Object.prototype;
 /**
  * @constructor
  * @extends {WebInspector.TextPrompt}
- * @param {function(Range, boolean, function(Array.<string>=))} completions
+ * @param {function(WebInspector.TextPrompt, Range, boolean, function(Array.<string>=))} completions
  * @param {string} stopCharacters
  */
 WebInspector.TextPromptWithHistory = function(completions, stopCharacters)
diff --git a/Source/WebCore/inspector/front-end/TimelineAgent.js b/Source/WebCore/inspector/front-end/TimelineAgent.js
deleted file mode 100644
index 46ad7eae0..000000000
--- a/Source/WebCore/inspector/front-end/TimelineAgent.js
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * Copyright (C) 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * @constructor
- */
-WebInspector.TimelineAgent = function() {
-    // Not implemented.
-}
-
-// Must be kept in sync with InspectorTimelineAgent.h
-WebInspector.TimelineAgent.RecordType = {
-    EventDispatch: "EventDispatch",
-    Layout: "Layout",
-    RecalculateStyles: "RecalculateStyles",
-    Paint: "Paint",
-    ParseHTML: "ParseHTML",
-
-
-    TimerInstall: "TimerInstall",
-    TimerRemove: "TimerRemove",
-    TimerFire: "TimerFire",
-
-    XHRReadyStateChange: "XHRReadyStateChange",
-    XHRLoad: "XHRLoad",
-    EvaluateScript: "EvaluateScript",
-
-    TimeStamp: "TimeStamp",
-
-    MarkLoad: "MarkLoad",
-    MarkDOMContent: "MarkDOMContent",
-
-    ScheduleResourceRequest: "ScheduleResourceRequest",
-    ResourceSendRequest: "ResourceSendRequest",
-    ResourceReceiveResponse: "ResourceReceiveResponse",
-    ResourceReceivedData: "ResourceReceivedData",
-    ResourceFinish: "ResourceFinish",
-
-    FunctionCall: "FunctionCall",
-    GCEvent: "GCEvent",
-
-    RequestAnimationFrame: "RequestAnimationFrame",
-    CancelAnimationFrame: "CancelAnimationFrame",
-    FireAnimationFrame: "FireAnimationFrame"
-}
diff --git a/Source/WebCore/inspector/front-end/TimelineGrid.js b/Source/WebCore/inspector/front-end/TimelineGrid.js
index 5b7f323d6..eff40fee9 100644
--- a/Source/WebCore/inspector/front-end/TimelineGrid.js
+++ b/Source/WebCore/inspector/front-end/TimelineGrid.js
@@ -58,6 +58,11 @@ WebInspector.TimelineGrid.prototype = {
         return this._itemsGraphsElement;
     },
 
+    get dividersElement()
+    {
+        return this._dividersElement;
+    },
+
     /**
      * @param {number=} paddingLeft
      */
@@ -76,8 +81,8 @@ WebInspector.TimelineGrid.prototype = {
         var divider = this._dividersElement.firstChild;
         var dividerLabelBar = this._dividersLabelBarElement.firstChild;
 
-        var dividersLabelBarElementClientWidth = this._dividersLabelBarElement.clientWidth;
-        var clientWidth = dividersLabelBarElementClientWidth - paddingLeft;
+        var dividersElementClientWidth = this._dividersElement.clientWidth;
+        var clientWidth = dividersElementClientWidth - paddingLeft;
         for (var i = paddingLeft ? 0 : 1; i <= dividerCount; ++i) {
             if (!divider) {
                 divider = document.createElement("div");
@@ -91,7 +96,6 @@ WebInspector.TimelineGrid.prototype = {
                 dividerLabelBar._labelElement = label;
                 dividerLabelBar.appendChild(label);
                 this._dividersLabelBarElement.appendChild(dividerLabelBar);
-                dividersLabelBarElementClientWidth = this._dividersLabelBarElement.clientWidth;
             }
 
             if (i === (paddingLeft ? 0 : 1)) {
@@ -111,11 +115,11 @@ WebInspector.TimelineGrid.prototype = {
             }
 
             var left = paddingLeft + clientWidth * (i / dividerCount);
-            var percentLeft = 100 * left / dividersLabelBarElementClientWidth;
+            var percentLeft = 100 * left / dividersElementClientWidth;
             this._setDividerAndBarLeft(divider, dividerLabelBar, percentLeft);
 
             if (!isNaN(slice))
-                dividerLabelBar._labelElement.textContent = calculator.formatValue(slice * i);
+                dividerLabelBar._labelElement.textContent = calculator.formatTime(slice * i);
             else
                 dividerLabelBar._labelElement.textContent = "";
 
diff --git a/Source/WebCore/inspector/front-end/TimelineModel.js b/Source/WebCore/inspector/front-end/TimelineModel.js
new file mode 100644
index 000000000..815fe7a83
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/TimelineModel.js
@@ -0,0 +1,181 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.TimelineModel = function()
+{
+    this._records = [];
+    this._collectionEnabled = false;
+
+    WebInspector.timelineManager.addEventListener(WebInspector.TimelineManager.EventTypes.TimelineEventRecorded, this._onRecordAdded, this);
+}
+
+WebInspector.TimelineModel.RecordType = {
+    Root: "Root",
+    EventDispatch: "EventDispatch",
+
+    BeginFrame: "BeginFrame",
+    Layout: "Layout",
+    RecalculateStyles: "RecalculateStyles",
+    Paint: "Paint",
+
+    ParseHTML: "ParseHTML",
+
+    TimerInstall: "TimerInstall",
+    TimerRemove: "TimerRemove",
+    TimerFire: "TimerFire",
+
+    XHRReadyStateChange: "XHRReadyStateChange",
+    XHRLoad: "XHRLoad",
+    EvaluateScript: "EvaluateScript",
+
+    TimeStamp: "TimeStamp",
+
+    MarkLoad: "MarkLoad",
+    MarkDOMContent: "MarkDOMContent",
+
+    ScheduleResourceRequest: "ScheduleResourceRequest",
+    ResourceSendRequest: "ResourceSendRequest",
+    ResourceReceiveResponse: "ResourceReceiveResponse",
+    ResourceReceivedData: "ResourceReceivedData",
+    ResourceFinish: "ResourceFinish",
+
+    FunctionCall: "FunctionCall",
+    GCEvent: "GCEvent",
+
+    RequestAnimationFrame: "RequestAnimationFrame",
+    CancelAnimationFrame: "CancelAnimationFrame",
+    FireAnimationFrame: "FireAnimationFrame"
+}
+
+WebInspector.TimelineModel.Events = {
+    RecordAdded: "RecordAdded",
+    RecordsCleared: "RecordsCleared"
+}
+
+WebInspector.TimelineModel.prototype = {
+    startRecord: function()
+    {
+        if (this._collectionEnabled)
+            return;
+        this.reset();
+        WebInspector.timelineManager.start(30);
+        this._collectionEnabled = true;
+    },
+
+    stopRecord: function()
+    {
+        if (!this._collectionEnabled)
+            return;
+        WebInspector.timelineManager.stop();
+        this._collectionEnabled = false;
+    },
+
+    get records()
+    {
+        return this._records;
+    },
+
+    _onRecordAdded: function(event)
+    {
+        if (this._collectionEnabled)
+            this._addRecord(event.data);
+    },
+
+    _addRecord: function(record)
+    {
+        this._records.push(record);
+        this.dispatchEventToListeners(WebInspector.TimelineModel.Events.RecordAdded, record);
+    },
+
+    _loadNextChunk: function(data, index)
+    {
+        for (var i = 0; i < 20 && index < data.length; ++i, ++index)
+            this._addRecord(data[index]);
+
+        if (index !== data.length)
+            setTimeout(this._loadNextChunk.bind(this, data, index), 0);
+    },
+
+    loadFromFile: function(file)
+    {
+        function onLoad(e)
+        {
+            var data = JSON.parse(e.target.result);
+            this.reset();
+            this._loadNextChunk(data, 1);
+        }
+
+        function onError(e)
+        {
+            switch(e.target.error.code) {
+            case e.target.error.NOT_FOUND_ERR:
+                WebInspector.log(WebInspector.UIString('Timeline.loadFromFile: File "%s" not found.', file.name));
+            break;
+            case e.target.error.NOT_READABLE_ERR:
+                WebInspector.log(WebInspector.UIString('Timeline.loadFromFile: File "%s" is not readable', file.name));
+            break;
+            case e.target.error.ABORT_ERR:
+                break;
+            default:
+                WebInspector.log(WebInspector.UIString('Timeline.loadFromFile: An error occurred while reading the file "%s"', file.name));
+            }
+        }
+
+        var reader = new FileReader();
+        reader.onload = onLoad.bind(this);
+        reader.onerror = onError;
+        reader.readAsText(file);
+    },
+
+    saveToFile: function()
+    {
+        var records = ['[' + JSON.stringify(new String(window.navigator.appVersion))];
+        for (var i = 0; i < this._records.length; ++i)
+            records.push(JSON.stringify(this._records[i]));
+
+        records[records.length - 1] = records[records.length - 1] + "]";
+
+        var now = new Date();
+        var suggestedFileName = "TimelineRawData-" + now.toISO8601Compact() + ".json";
+        InspectorFrontendHost.saveAs(suggestedFileName, records.join(",\n"));
+    },
+
+    reset: function()
+    {
+        this._records = [];
+        this.dispatchEventToListeners(WebInspector.TimelineModel.Events.RecordsCleared);
+    }
+}
+
+WebInspector.TimelineModel.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/TimelineOverviewPane.js b/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
index 858742c6c..839ef15af 100644
--- a/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
+++ b/Source/WebCore/inspector/front-end/TimelineOverviewPane.js
@@ -31,22 +31,29 @@
 /**
  * @constructor
  * @extends {WebInspector.Object}
+ * @implements {WebInspector.TimelinePresentationModel.Filter}
  */
 WebInspector.TimelineOverviewPane = function(presentationModel)
 {
     this.element = document.createElement("div");
-    this.element.className = "fill";
+    this.element.id = "timeline-overview-panel";
 
-    this._startAtZero = false;
+    this._windowStartTime = 0;
+    this._windowEndTime = null;
 
     this._presentationModel = presentationModel;
 
-    this.element = document.createElement("div");
-    this.element.id = "timeline-overview-panel";
-
     this._topPaneSidebarElement = document.createElement("div");
     this._topPaneSidebarElement.id = "timeline-overview-sidebar";
 
+    if (WebInspector.experimentsSettings.timelineVerticalOverview.isEnabled()) {
+        this._overviewModeSelector = new WebInspector.TimelineOverviewModeSelector(this._onOverviewModeChanged.bind(this));
+        this._overviewModeSelector.addButton(WebInspector.UIString("Show each event category as a horizontal strip in overview"),
+                                             "timeline-mode-horizontal-bars", WebInspector.TimelineOverviewPane.Mode.EventsHorizontal);
+        this._overviewModeSelector.addButton(WebInspector.UIString("Show each event as a vertical bar in overview"),
+                                             "timeline-mode-vertical-bars", WebInspector.TimelineOverviewPane.Mode.EventsVertical);
+    }
+
     var overviewTreeElement = document.createElement("ol");
     overviewTreeElement.className = "sidebar-tree";
     this._topPaneSidebarElement.appendChild(overviewTreeElement);
@@ -54,6 +61,9 @@ WebInspector.TimelineOverviewPane = function(presentationModel)
 
     var topPaneSidebarTree = new TreeOutline(overviewTreeElement);
     this._timelinesOverviewItem = new WebInspector.SidebarTreeElement("resources-time-graph-sidebar-item", WebInspector.UIString("Timelines"));
+    if (this._overviewModeSelector)
+        this._timelinesOverviewItem.statusElement = this._overviewModeSelector.element;
+
     topPaneSidebarTree.appendChild(this._timelinesOverviewItem);
     this._timelinesOverviewItem.revealAndSelect(false);
     this._timelinesOverviewItem.onselect = this._showTimelines.bind(this);
@@ -62,18 +72,25 @@ WebInspector.TimelineOverviewPane = function(presentationModel)
     topPaneSidebarTree.appendChild(this._memoryOverviewItem);
     this._memoryOverviewItem.onselect = this._showMemoryGraph.bind(this);
 
+    this._currentMode = WebInspector.TimelineOverviewPane.Mode.EventsHorizontal;
+
+    this._overviewContainer = this.element.createChild("div", "fill");
+    this._overviewContainer.id = "timeline-overview-container";
+
     this._overviewGrid = new WebInspector.TimelineGrid();
     this._overviewGrid.element.id = "timeline-overview-grid";
     this._overviewGrid.itemsGraphsElement.id = "timeline-overview-timelines";
 
+    this._overviewContainer.appendChild(this._overviewGrid.element);
+
     this._heapGraph = new WebInspector.HeapGraph();
     this._heapGraph.element.id = "timeline-overview-memory";
     this._overviewGrid.element.insertBefore(this._heapGraph.element, this._overviewGrid.itemsGraphsElement);
 
-    this._overviewWindow = new WebInspector.TimelineOverviewWindow(this._overviewGrid.element);
+    this._overviewWindow = new WebInspector.TimelineOverviewWindow(this._overviewContainer);
     this._overviewWindow.addEventListener(WebInspector.TimelineOverviewWindow.Events.WindowChanged, this._onWindowChanged, this);
 
-    this.element.appendChild(this._overviewGrid.element);
+    this._overviewContainer.appendChild(this._overviewGrid.element);
 
     var separatorElement = document.createElement("div");
     separatorElement.id = "timeline-overview-separator";
@@ -86,11 +103,10 @@ WebInspector.TimelineOverviewPane = function(presentationModel)
         var categoryGraph = new WebInspector.TimelineCategoryGraph(categories[category], i++ % 2);
         this._categoryGraphs[category] = categoryGraph;
         this._overviewGrid.itemsGraphsElement.appendChild(categoryGraph.graphElement);
+        categories[category].addEventListener(WebInspector.TimelineCategory.Events.VisibilityChanged, this._onCategoryVisibilityChanged, this);
     }
-    this._presentationModel.addEventListener(WebInspector.TimelinePresentationModel.Events.CategoryVisibilityChanged, this._onCategoryVisibilityChanged, this);
 
     this._overviewGrid.setScrollAndDividerTop(0, 0);
-
     this._overviewCalculator = new WebInspector.TimelineOverviewCalculator();
 }
 
@@ -101,58 +117,62 @@ WebInspector.TimelineOverviewPane.WindowScrollSpeedFactor = .3;
 WebInspector.TimelineOverviewPane.ResizerOffset = 3.5; // half pixel because offset values are not rounded but ceiled
 
 WebInspector.TimelineOverviewPane.Mode = {
-    Events: "Events",
+    EventsVertical: "EventsVertical",
+    EventsHorizontal: "EventsHorizontal",
     Memory: "Memory"
 };
 
 WebInspector.TimelineOverviewPane.Events = {
-    ModeChanged: "ModeChanged"
+    ModeChanged: "ModeChanged",
+    WindowChanged: "WindowChanged"
 };
 
 WebInspector.TimelineOverviewPane.prototype = {
     _showTimelines: function()
     {
+        var newMode = this._overviewModeSelector ? this._overviewModeSelector.value : WebInspector.TimelineOverviewPane.Mode.EventsHorizontal;
+        if (this._currentMode === newMode)
+            return;
+        this._currentMode = newMode;
         this._timelinesOverviewItem.revealAndSelect(false);
         this._heapGraph.hide();
+        this._setVerticalOverview(this._currentMode === WebInspector.TimelineOverviewPane.Mode.EventsVertical);
         this._overviewGrid.itemsGraphsElement.removeStyleClass("hidden");
-        this.dispatchEventToListeners(WebInspector.TimelineOverviewPane.Events.ModeChanged, WebInspector.TimelineOverviewPane.Mode.Events);
+        this.dispatchEventToListeners(WebInspector.TimelineOverviewPane.Events.ModeChanged, this._currentMode);
     },
 
     _showMemoryGraph: function()
     {
+        this._currentMode = WebInspector.TimelineOverviewPane.Mode.Memory;
+        this._setVerticalOverview(false);
         this._memoryOverviewItem.revealAndSelect(false);
         this._heapGraph.show();
-        this._heapGraph.update(this._records);
+        this._heapGraph.update(this._presentationModel.rootRecord().children);
         this._overviewGrid.itemsGraphsElement.addStyleClass("hidden");
-        this.dispatchEventToListeners(WebInspector.TimelineOverviewPane.Events.ModeChanged, WebInspector.TimelineOverviewPane.Mode.Memory);
+        this.dispatchEventToListeners(WebInspector.TimelineOverviewPane.Events.ModeChanged, this._currentMode);
     },
 
-    /**
-     * @param {boolean} enabled
-     */
-    setStartAtZero: function(enabled)
+    _setVerticalOverview: function(enabled)
     {
-        if (this._startAtZero === enabled)
+        if (!enabled === !this._verticalOverview)
             return;
-        this._startAtZero = enabled;
         if (enabled) {
-            if (this._heapGraph.visible)
-                this._showTimelines();
-            this.element.addStyleClass("timeline-start-at-zero");
-            this._startAtZeroOverview = new WebInspector.TimelineStartAtZeroOverview(this._presentationModel);
-            this._startAtZeroOverview.show(this.element);
-            this._startAtZeroOverview.update(this._records);
+            this._verticalOverview = new WebInspector.TimelineVerticalOverview();
+            this._verticalOverview.show(this._overviewContainer);
+            this._verticalOverview.update(this._presentationModel.rootRecord().children);
         } else {
-            this.element.removeStyleClass("timeline-start-at-zero");
-            this._startAtZeroOverview.detach();
-            this._startAtZeroOverview = null;
-            this._showTimelines();
+            this._verticalOverview.detach();
+            this._overviewGrid.itemsGraphsElement.removeStyleClass("hidden");
+            this._verticalOverview = null;
         }
     },
 
-    _onWindowChanged: function()
+    _onOverviewModeChanged: function()
     {
-        this._presentationModel.setWindowPosition(this._overviewWindow.windowLeft, this._overviewWindow.windowRight);
+        // If we got this while in memory mode, we postpone actual switch until we get to the events mode.
+        if (this._currentMode === WebInspector.TimelineOverviewPane.Mode.Memory)
+            return;
+        this._showTimelines();
     },
 
     _onCategoryVisibilityChanged: function(event)
@@ -161,28 +181,8 @@ WebInspector.TimelineOverviewPane.prototype = {
         this._categoryGraphs[category.name].dimmed = category.hidden;
     },
 
-    _forAllRecords: function(recordsArray, callback)
-    {
-        if (!recordsArray)
-            return;
-        var stack = [{array: recordsArray, index: 0}];
-        while (stack.length) {
-            var entry = stack[stack.length - 1];
-            var records = entry.array;
-            if (entry.index < records.length) {
-                 var record = records[entry.index];
-                 callback(record);
-                 if (record.children)
-                     stack.push({array: record.children, index: 0});
-                 ++entry.index;
-            } else
-                stack.pop();
-        }
-    },
-
-    update: function(records, showShortEvents)
+    update: function(showShortEvents)
     {
-        this._records = records;
         this._showShortEvents = showShortEvents;
         // Clear summary bars.
         var timelines = {};
@@ -193,7 +193,15 @@ WebInspector.TimelineOverviewPane.prototype = {
 
         // Create sparse arrays with 101 cells each to fill with chunks for a given category.
         this._overviewCalculator.reset();
-        this._forAllRecords(records, this._overviewCalculator.updateBoundaries.bind(this._overviewCalculator));
+
+        function updateBoundaries(record)
+        {
+            this._overviewCalculator.updateBoundaries(record);
+            return false;
+        }
+
+        var records = this._presentationModel.rootRecord().children;
+        WebInspector.TimelinePanel.forAllRecords(records, updateBoundaries.bind(this));
 
         function markPercentagesForRecord(record)
         {
@@ -206,7 +214,7 @@ WebInspector.TimelineOverviewPane.prototype = {
             for (var j = Math.round(percentages.start); j <= end; ++j)
                 timelines[categoryName][j] = true;
         }
-        this._forAllRecords(records, markPercentagesForRecord.bind(this));
+        WebInspector.TimelinePanel.forAllRecords(records, markPercentagesForRecord.bind(this));
 
         // Convert sparse arrays to continuous segments, render graphs for each.
         for (var category in this._presentationModel.categories) {
@@ -233,8 +241,8 @@ WebInspector.TimelineOverviewPane.prototype = {
         this._heapGraph.setSize(this._overviewGrid.element.offsetWidth, 60);
         if (this._heapGraph.visible)
             this._heapGraph.update(records);
-        if (this._startAtZeroOverview)
-            this._startAtZeroOverview.update(records);
+        if (this._verticalOverview)
+            this._verticalOverview.update(records);
         this._overviewGrid.updateDividers(true, this._overviewCalculator);
     },
 
@@ -244,6 +252,8 @@ WebInspector.TimelineOverviewPane.prototype = {
         var dividers = [];
         for (var i = 0; i < records.length; ++i) {
             var record = records[i];
+            if (record.type === WebInspector.TimelineModel.RecordType.BeginFrame)
+                continue;
             var positions = this._overviewCalculator.computeBarGraphPercentages(record);
             var dividerPosition = Math.round(positions.start * 10);
             if (dividers[dividerPosition])
@@ -257,22 +267,67 @@ WebInspector.TimelineOverviewPane.prototype = {
 
     sidebarResized: function(width)
     {
-        this._overviewGrid.element.style.left = width + "px";
+        this._overviewContainer.style.left = width + "px";
         this._topPaneSidebarElement.style.width = width + "px";
     },
 
     reset: function()
     {
+        this._windowStartTime = 0;
+        this._windowEndTime = null;
         this._overviewWindow.reset();
         this._overviewCalculator.reset();
         this._overviewGrid.updateDividers(true, this._overviewCalculator);
-        if (this._startAtZeroOverview)
-            this._startAtZeroOverview.reset();
+        if (this._verticalOverview)
+            this._verticalOverview.reset();
     },
 
     scrollWindow: function(event)
     {
         this._overviewWindow.scrollWindow(event);
+    },
+
+    /**
+     * @param {WebInspector.TimelinePresentationModel.Record} record
+     */
+    accept: function(record)
+    {
+        return record.endTime >= this._windowStartTime && (typeof this._windowEndTime !== "number" || record.startTime <= this._windowEndTime);
+    },
+
+    windowStartTime: function()
+    {
+        return this._windowStartTime || this._presentationModel.minimumRecordTime();
+    },
+
+    windowEndTime: function()
+    {
+        return this._windowEndTime || this._presentationModel.maximumRecordTime();
+    },
+
+    windowLeft: function()
+    {
+        return this._overviewWindow.windowLeft;
+    },
+
+    windowRight: function()
+    {
+        return this._overviewWindow.windowRight;
+    },
+
+    _onWindowChanged: function()
+    {
+        if (this._verticalOverview) {
+            var times = this._verticalOverview.getWindowTimes(this.windowLeft(), this.windowRight());
+            this._windowStartTime = times.startTime;
+            this._windowEndTime = times.endTime;
+        } else {
+            var absoluteMin = this._presentationModel.minimumRecordTime();
+            var absoluteMax = this._presentationModel.maximumRecordTime();
+            this._windowStartTime = absoluteMin + (absoluteMax - absoluteMin) * this.windowLeft();
+            this._windowEndTime = absoluteMin + (absoluteMax - absoluteMin) * this.windowRight();
+        }
+        this.dispatchEventToListeners(WebInspector.TimelineOverviewPane.Events.WindowChanged);
     }
 }
 
@@ -359,7 +414,7 @@ WebInspector.TimelineOverviewWindow.prototype = {
                 break;
             } else if (node === this._parentElement) {
                 var position = event.pageX - this._parentElement.offsetLeft;
-                this._overviewWindowSelector = new WebInspector.TimelinePanel.WindowSelector(this._parentElement, position);
+                this._overviewWindowSelector = new WebInspector.TimelineOverviewPane.WindowSelector(this._parentElement, position);
                 WebInspector.elementDragStart(null, this._windowSelectorDragging.bind(this), this._endWindowSelectorDragging.bind(this), event, "ew-resize");
                 break;
             } else if (node === this._leftResizeElement || node === this._rightResizeElement) {
@@ -496,15 +551,16 @@ WebInspector.TimelineOverviewCalculator.prototype = {
 
     updateBoundaries: function(record)
     {
+        var result = false;
         if (typeof this.minimumBoundary === "undefined" || record.startTime < this.minimumBoundary) {
             this.minimumBoundary = record.startTime;
-            return true;
+            result = true;
         }
         if (typeof this.maximumBoundary === "undefined" || record.endTime > this.maximumBoundary) {
             this.maximumBoundary = record.endTime;
-            return true;
+            result = true;
         }
-        return false;
+        return result;
     },
 
     get boundarySpan()
@@ -512,7 +568,7 @@ WebInspector.TimelineOverviewCalculator.prototype = {
         return this.maximumBoundary - this.minimumBoundary;
     },
 
-    formatValue: function(value)
+    formatTime: function(value)
     {
         return Number.secondsToString(value);
     }
@@ -565,7 +621,7 @@ WebInspector.TimelineCategoryGraph.prototype = {
 /**
  * @constructor
  */
-WebInspector.TimelinePanel.WindowSelector = function(parent, position)
+WebInspector.TimelineOverviewPane.WindowSelector = function(parent, position)
 {
     this._startPosition = position;
     this._width = parent.offsetWidth;
@@ -576,7 +632,7 @@ WebInspector.TimelinePanel.WindowSelector = function(parent, position)
     parent.appendChild(this._windowSelector);
 }
 
-WebInspector.TimelinePanel.WindowSelector.prototype = {
+WebInspector.TimelineOverviewPane.WindowSelector.prototype = {
     _createSelectorElement: function(parent, left, width, height)
     {
         var selectorElement = document.createElement("div");
@@ -662,7 +718,7 @@ WebInspector.HeapGraph.prototype = {
         var minUsedHeapSize = 100000000000;
         var minTime;
         var maxTime;
-        this._forAllRecords(records, function(r) {
+        WebInspector.TimelinePanel.forAllRecords(records, function(r) {
             maxUsedHeapSize = Math.max(maxUsedHeapSize, r.usedHeapSize || maxUsedHeapSize);
             minUsedHeapSize = Math.min(minUsedHeapSize, r.usedHeapSize || minUsedHeapSize);
 
@@ -679,7 +735,7 @@ WebInspector.HeapGraph.prototype = {
         var yFactor = height / (maxUsedHeapSize - minUsedHeapSize);
 
         var histogram = new Array(width);
-        this._forAllRecords(records, function(r) {
+        WebInspector.TimelinePanel.forAllRecords(records, function(r) {
             if (!r.usedHeapSize)
                 return;
              var x = Math.round((r.endTime - minTime) * xFactor);
@@ -728,58 +784,134 @@ WebInspector.HeapGraph.prototype = {
         ctx.fillStyle = "rgba(255,255,255,0.8)";
         ctx.fillRect(0, 0, this._canvas.width, this._canvas.height);
     },
-
-    _forAllRecords: WebInspector.TimelineOverviewPane.prototype._forAllRecords
 }
 
 /**
  * @constructor
- * @param {WebInspector.TimelinePresentationModel} model
  * @extends {WebInspector.View}
  */
-WebInspector.TimelineStartAtZeroOverview = function(model) {
+WebInspector.TimelineVerticalOverview = function() {
     WebInspector.View.call(this);
-    this._presentationModel = model;
-    this.element.className = "timeline-overview-start-at-zero fill";
-    this._overviewElement = this.element.createChild("div", "timeline-overview-start-at-zero-bars fill");
-    this._overviewWindow = new WebInspector.TimelineOverviewWindow(this.element);
-    this._overviewWindow.addEventListener(WebInspector.TimelineOverviewWindow.Events.WindowChanged, this._onWindowChanged, this);
-    this._recordsPerBar = 1;
-    this._calculator = new WebInspector.TimelineStartAtZeroCalculator();
+    this.element = document.createElement("div");
+    this.element.className = "timeline-vertical-overview-bars fill";
+    this.reset();
 }
 
-WebInspector.TimelineStartAtZeroOverview.prototype = {
+WebInspector.TimelineVerticalOverview.prototype = {
     reset: function()
     {
         this._recordsPerBar = 1;
-        this._overviewWindow.reset();
+        this._frameMode = false;
+        this._barTimes = [];
     },
 
     update: function(records)
     {
-        this._calculator.reset();
         records = this._filterRecords(records);
-        records.forEach(this._calculator.updateBoundaries, this._calculator);
-        this._calculator.calculateWindow();
-
-        var scale = (this._overviewElement.clientHeight - 4) / this._calculator.boundarySpan;
-        this._recordsPerBar = Math.max(1, records.length * 4 / this.element.clientWidth);
-        var numberOfBars = Math.ceil(records.length / this._recordsPerBar);
-
-        this._overviewElement.removeChildren();
-        var padding = this._overviewElement.createChild("div", "padding");
-
-        for (var i = 0; i < numberOfBars; ++i) {
-            var index = Math.floor(i * this._recordsPerBar);
-            var longestRecord = records[index];
-            var stopIndex = Math.min(Math.floor((i + 1) * this._recordsPerBar), records.length);
-            for (++index; index < stopIndex; ++index) {
-                var record = records[index];
+
+        var frameCount = 0;
+        var boundarySpan = 0;
+        var lastFrameTime = records.length && records[0].startTime;
+        for (var i = 0; i < records.length; ++i) {
+            var record = records[i];
+            var duration = record.endTime - record.startTime;
+            if (boundarySpan < duration)
+                boundarySpan = duration;
+            if (record.type === WebInspector.TimelineModel.RecordType.BeginFrame || (frameCount && (i + 1 === records.length))) {
+                // if we have frames, take frame duration into account
+                if (record.startTime - lastFrameTime > boundarySpan)
+                    boundarySpan = record.startTime - lastFrameTime;
+                lastFrameTime = record.startTime;
+                ++frameCount;
+            }
+        }
+        // If we have frames, aggregate by frames; otherwise, just show top-level records.
+        var recordCount = frameCount || records.length;
+
+        const paddingTop = 4;
+        const minBarWidth = 4;
+        var scale = (this.element.clientHeight - paddingTop) / boundarySpan;
+        this._recordsPerBar = Math.max(1, recordCount * minBarWidth / this.element.clientWidth);
+        var numberOfBars = Math.ceil(recordCount / this._recordsPerBar);
+
+        this._barTimes = [];
+        this.element.removeChildren();
+        var padding = this.element.createChild("div", "padding");
+
+        var statistics = frameCount ? this._aggregateFrames(records, numberOfBars) : this._aggregateRecords(records, numberOfBars);
+        for (var i = 0; i < statistics.length; ++i)
+            this.element.insertBefore(this._buildBar(statistics[i], scale), padding);
+    },
+
+    _aggregateFrames: function(records, numberOfBars)
+    {
+        var statistics = [];
+        for (var barNumber = 0, currentRecord = 0, currentFrame = 0;
+             barNumber < numberOfBars && currentRecord < records.length; ++barNumber) {
+            var lastFrame = Math.floor((barNumber + 1) * this._recordsPerBar);
+            var barStartTime = records[currentRecord].startTime;
+            var longestFrameStatistics;
+            var longestFrameTime = 0;
+
+            for (; currentFrame < lastFrame && currentRecord < records.length; ++currentFrame) {
+                if (records[currentRecord].type === WebInspector.TimelineModel.RecordType.BeginFrame)
+                    currentRecord++;
+                var frameStatistics = {};
+                var frameInfo = this._aggregateFrameStatistics(records, currentRecord, frameStatistics);
+                currentRecord += frameInfo.recordCount;
+                if (frameInfo.totalTime > longestFrameTime) {
+                    longestFrameStatistics = frameStatistics;
+                    longestFrameTime = frameInfo.totalTime;
+                }
+            }
+            var barEndTime = records[currentRecord - 1].endTime;
+            if (longestFrameStatistics) {
+                statistics.push(longestFrameStatistics);
+                this._barTimes.push({ startTime: barStartTime, endTime: barEndTime });
+            }
+        }
+        return statistics;
+    },
+
+    _aggregateFrameStatistics: function(records, startIndex, statistics)
+    {
+        var totalTime = 0;
+        for (var index = startIndex; index < records.length; ++index) {
+            var record = records[index];
+            if (record.type === WebInspector.TimelineModel.RecordType.BeginFrame)
+                break;
+            var categories = Object.keys(record.aggregatedStats);
+            for (var i = 0; i < categories.length; ++i) {
+                var category = categories[i];
+                var value = statistics[category] || 0;
+                value += record.aggregatedStats[category];
+                totalTime += record.aggregatedStats[category];
+                statistics[category] = value;
+            }
+        }
+        return {
+            totalTime: totalTime,
+            recordCount: index - startIndex
+        }
+    },
+
+    _aggregateRecords: function(records, numberOfBars)
+    {
+        var statistics = [];
+        for (var barNumber = 0, currentRecord = 0; barNumber < numberOfBars && currentRecord < records.length; ++barNumber) {
+            var barStartTime = records[currentRecord].startTime;
+            var longestRecord = records[currentRecord];
+            var lastIndex = Math.min(Math.floor((barNumber + 1) * this._recordsPerBar), records.length);
+            for (++currentRecord; currentRecord < lastIndex; ++currentRecord) {
+                var record = records[currentRecord];
                 if (longestRecord.endTime - longestRecord.startTime < record.endTime - record.startTime)
                     longestRecord = record;
             }
-            this._overviewElement.insertBefore(this._buildBar(longestRecord, scale), padding);
+            var barEndTime = records[currentRecord - 1].endTime;
+            statistics.push(longestRecord.aggregatedStats);
+            this._barTimes.push({ startTime: barStartTime, endTime: barEndTime });
         }
+        return statistics;
     },
 
     _filterRecords: function(records)
@@ -791,40 +923,101 @@ WebInspector.TimelineStartAtZeroOverview.prototype = {
         return records.filter(filter);
     },
 
-    _buildBar: function(record, scale)
+    _buildBar: function(statistics, scale)
     {
         var outer = document.createElement("div");
         outer.className = "timeline-bar-vertical";
-        var stats = record.aggregatedStats;
-        var categories = Object.keys(stats);
+        var categories = Object.keys(statistics);
         for (var i = 0; i < categories.length; ++i) {
             var category = categories[i];
-            var duration = stats[category];
+            var duration = statistics[category];
             if (!duration)
                 continue;
             var bar = outer.createChild("div", "timeline-" + category);
-            bar.style.height = (stats[category] * scale) + "px";
+            bar.style.height = (statistics[category] * scale) + "px";
         }
         return outer;
     },
 
-    _onWindowChanged: function()
+    getWindowTimes: function(windowLeft, windowRight)
     {
-        var leftOffset = this._overviewWindow.windowLeft * this.element.clientWidth;
-        var rightOffset = this._overviewWindow.windowRight * this.element.clientWidth;
-        var bars = this._overviewElement.children;
+        var windowSpan = this.element.clientWidth
+        var leftOffset = windowLeft * windowSpan;
+        var rightOffset = windowRight * windowSpan;
+        var bars = this.element.children;
         var offset0 = bars[0] ? bars[0].offsetLeft : 4;
         var barWidth = 9;
         if (bars.length > 2) {
             var offset1 = bars[bars.length - 2].offsetLeft;
             barWidth = (offset1 - offset0) / (bars.length - 2);
         }
+        var firstBar = Math.floor(Math.max(leftOffset - offset0, 0) / barWidth);
+        var lastBar = Math.min(Math.ceil((rightOffset - offset0 - 2) / barWidth), this._barTimes.length - 1);
+        const snapToRightTolerancePixels = 3;
+        return {
+            startTime: this._barTimes[firstBar].startTime,
+            endTime: rightOffset + snapToRightTolerancePixels > windowSpan ? null : this._barTimes[lastBar].endTime
+        }
+    }
+}
 
-        var leftIndex = Math.floor((leftOffset - offset0) / barWidth * this._recordsPerBar);
-        var rightIndex = rightOffset + barWidth >= this.element.clientWidth ? null : Math.ceil((rightOffset - offset0 - 2) / barWidth * this._recordsPerBar);
+WebInspector.TimelineVerticalOverview.prototype.__proto__ = WebInspector.View.prototype;
 
-        this._presentationModel.setWindowIndices(leftIndex, rightIndex);
-    }
+/**
+ * @constructor
+ */
+WebInspector.TimelineOverviewModeSelector = function(selectCallback)
+{
+    this.element = document.createElement("div");
+    this.element.className = "timeline-overview-mode-selector";
+    this._selectCallback = selectCallback;
+
+    this._buttons = [];
+    this.element.addEventListener("click", this._onClick.bind(this), false);
 }
 
-WebInspector.TimelineStartAtZeroOverview.prototype.__proto__ = WebInspector.View.prototype;
+WebInspector.TimelineOverviewModeSelector.prototype = {
+    addButton: function(tooltip, className, value)
+    {
+        var button = this._createButton(tooltip, className, value);
+        this.element.appendChild(button);
+        this._buttons.push(button);
+        if (this._buttons.length === 1)
+            this._select(button, true);
+    },
+
+    get value()
+    {
+        return this._value;
+    },
+
+    _createButton: function(tooltip, className, value)
+    {
+        var button = document.createElement("button");
+        button.createChild("div", "glyph");
+        button.createChild("div", "glyph shadow");
+        button.className = className;
+        button.title = tooltip;
+        button.value = value;
+        return button;
+    },
+
+    _select: function(button, selected)
+    {
+        if (selected) {
+            button.addStyleClass("toggled");
+            this._value = button.value;
+        } else
+            button.removeStyleClass("toggled");
+    },
+
+    _onClick: function(event)
+    {
+        var button = event.target.enclosingNodeOrSelfWithNodeName("button");
+        if (!button)
+            return;
+        for (var i = 0; i < this._buttons.length; ++i)
+            this._select(this._buttons[i], this._buttons[i] === button);
+        this._selectCallback(button.value);
+    }
+}
diff --git a/Source/WebCore/inspector/front-end/TimelinePanel.js b/Source/WebCore/inspector/front-end/TimelinePanel.js
index bf580cd21..e9f8d927e 100644
--- a/Source/WebCore/inspector/front-end/TimelinePanel.js
+++ b/Source/WebCore/inspector/front-end/TimelinePanel.js
@@ -38,13 +38,9 @@ WebInspector.TimelinePanel = function()
     this.registerRequiredCSS("timelinePanel.css");
 
     this._presentationModel = new WebInspector.TimelinePresentationModel();
-    this._presentationModel.addCategory(new WebInspector.TimelineCategory("loading", WebInspector.UIString("Loading"), "rgb(47,102,236)"));
-    this._presentationModel.addCategory(new WebInspector.TimelineCategory("scripting", WebInspector.UIString("Scripting"), "rgb(157,231,119)"));
-    this._presentationModel.addCategory(new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), "rgb(164,60,255)"));
-    this._presentationModel.addEventListener(WebInspector.TimelinePresentationModel.Events.WindowChanged, this._scheduleRefresh.bind(this, false));
-    this._presentationModel.addEventListener(WebInspector.TimelinePresentationModel.Events.CategoryVisibilityChanged, this._scheduleRefresh.bind(this, true));
 
     this._overviewPane = new WebInspector.TimelineOverviewPane(this._presentationModel);
+    this._overviewPane.addEventListener(WebInspector.TimelineOverviewPane.Events.WindowChanged, this._scheduleRefresh.bind(this, false));
 
     this.element.appendChild(this._overviewPane.element);
     this.element.addEventListener("contextmenu", this._contextMenu.bind(this), true);
@@ -59,14 +55,13 @@ WebInspector.TimelinePanel = function()
     this._containerElement.id = "timeline-container";
     this._containerElement.addEventListener("scroll", this._onScroll.bind(this), false);
 
-    if (WebInspector.experimentsSettings.showMemoryCounters.isEnabled()) {
-        this._timelineMemorySplitter = this.element.createChild("div");
-        this._timelineMemorySplitter.id = "timeline-memory-splitter";
-        this._timelineMemorySplitter.addEventListener("mousedown", this._startSplitterDragging.bind(this), false);
-        this._timelineMemorySplitter.addStyleClass("hidden");
-        this._memoryStatistics = new WebInspector.MemoryStatistics(this, this.splitView.preferredSidebarWidth());
-        this._overviewPane.addEventListener(WebInspector.TimelineOverviewPane.Events.ModeChanged, this._timelinesOverviewModeChanged, this);
-    }
+    this._timelineMemorySplitter = this.element.createChild("div");
+    this._timelineMemorySplitter.id = "timeline-memory-splitter";
+    this._timelineMemorySplitter.addEventListener("mousedown", this._startSplitterDragging.bind(this), false);
+    this._timelineMemorySplitter.addStyleClass("hidden");
+    this._memoryStatistics = new WebInspector.MemoryStatistics(this, this.splitView.preferredSidebarWidth());
+    this._overviewPane.addEventListener(WebInspector.TimelineOverviewPane.Events.ModeChanged, this._timelinesOverviewModeChanged, this);
+    WebInspector.settings.memoryCounterGraphsHeight = WebInspector.settings.createSetting("memoryCounterGraphsHeight", 150);
 
     var itemsTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("RECORDS"), {}, true);
     this.sidebarTree.appendChild(itemsTreeElement);
@@ -82,6 +77,7 @@ WebInspector.TimelinePanel = function()
     this._itemsGraphsElement.id = "timeline-graphs";
     this._itemsGraphsElement.addEventListener("mousewheel", this._overviewPane.scrollWindow.bind(this._overviewPane), true);
     this._containerContentElement.appendChild(this._timelineGrid.element);
+    this._memoryStatistics.setMainTimelineGrid(this._timelineGrid);
 
     this._topGapElement = document.createElement("div");
     this._topGapElement.className = "timeline-gap";
@@ -98,18 +94,13 @@ WebInspector.TimelinePanel = function()
     this._expandElements.id = "orphan-expand-elements";
     this._itemsGraphsElement.appendChild(this._expandElements);
 
-    this._rootRecord = this._createRootRecord();
-    this._sendRequestRecords = {};
-    this._scheduledResourceRequests = {};
-    this._timerRecords = {};
-    this._requestAnimationFrameRecords = {};
-
-    this._calculator = new WebInspector.TimelineCalculator();
-    var shortRecordThresholdTitle = Number.secondsToString(WebInspector.TimelinePanel.shortRecordThreshold);
+    this._calculator = new WebInspector.TimelineCalculator(this._presentationModel);
+    var shortRecordThresholdTitle = Number.secondsToString(WebInspector.TimelinePresentationModel.shortRecordThreshold);
     this._showShortRecordsTitleText = WebInspector.UIString("Show the records that are shorter than %s", shortRecordThresholdTitle);
     this._hideShortRecordsTitleText = WebInspector.UIString("Hide the records that are shorter than %s", shortRecordThresholdTitle);
     this._createStatusbarButtons();
 
+    this._verticalOverview = false;
     this._boundariesAreValid = true;
     this._scrollTop = 0;
 
@@ -129,12 +120,16 @@ WebInspector.TimelinePanel = function()
     this._model.addEventListener(WebInspector.TimelineModel.Events.RecordsCleared, this._onRecordsCleared, this);
 
     this._registerShortcuts();
-    this._linkifier = WebInspector.debuggerPresentationModel.createLinkifier();
+
+    this._allRecordsCount = 0;
+
+    this._presentationModel.addFilter(this._overviewPane);
+    this._presentationModel.addFilter(new WebInspector.TimelineCategoryFilter()); 
+    this._presentationModel.addFilter(new WebInspector.TimelineIsLongFilter(this)); 
 }
 
 // Define row height, should be in sync with styles for timeline graphs.
 WebInspector.TimelinePanel.rowHeight = 18;
-WebInspector.TimelinePanel.shortRecordThreshold = 0.015;
 
 WebInspector.TimelinePanel.prototype = {
     /**
@@ -154,6 +149,7 @@ WebInspector.TimelinePanel.prototype = {
         var top = event.pageY + this._dragOffset
         this._setSplitterPosition(top);
         event.preventDefault();
+        this._refresh();
     },
 
     /**
@@ -163,8 +159,8 @@ WebInspector.TimelinePanel.prototype = {
     {
         delete this._dragOffset;
         WebInspector.elementDragEnd(event);
-        if (this._memoryStatistics)
-            this._memoryStatistics.show();
+        this._memoryStatistics.show();
+        WebInspector.settings.memoryCounterGraphsHeight.set(this.splitView.element.offsetHeight);
     },
 
     _setSplitterPosition: function(top)
@@ -178,19 +174,6 @@ WebInspector.TimelinePanel.prototype = {
         this._memoryStatistics.setTopPosition(top);
     },
 
-    _linkifyLocation: function(url, lineNumber, columnNumber)
-    {
-        // FIXME(62725): stack trace line/column numbers are one-based.
-        lineNumber = lineNumber ? lineNumber - 1 : lineNumber;
-        columnNumber = columnNumber ? columnNumber - 1 : 0;
-        return this._linkifier.linkifyLocation(url, lineNumber, columnNumber, "timeline-details");
-    },
-
-    _linkifyCallFrame: function(callFrame)
-    {
-        return this._linkifyLocation(callFrame.url, callFrame.lineNumber, callFrame.columnNumber);
-    },
-
     get calculator()
     {
         return this._calculator;
@@ -203,12 +186,8 @@ WebInspector.TimelinePanel.prototype = {
 
     get statusBarItems()
     {
-        var statusBarItems = [ this.toggleFilterButton.element, this.toggleTimelineButton.element, this.clearButton.element, this.garbageCollectButton.element, this._glueParentButton.element ];
-
-        if (WebInspector.experimentsSettings.timelineStartAtZero.isEnabled())
-            statusBarItems.push(this.toggleStartAtZeroButton.element);
+        var statusBarItems = [ this.toggleFilterButton.element, this.toggleTimelineButton.element, this.clearButton.element, this.garbageCollectButton.element, this._glueParentButton.element, this.statusBarFilters ];
 
-        statusBarItems.push(this.statusBarFilters);
         return statusBarItems;
     },
 
@@ -217,42 +196,6 @@ WebInspector.TimelinePanel.prototype = {
         return this.element;
     },
 
-    get _recordStyles()
-    {
-        if (!this._recordStylesArray) {
-            var recordTypes = WebInspector.TimelineAgent.RecordType;
-            var categories = this._presentationModel.categories;
-
-            var recordStyles = {};
-            recordStyles[recordTypes.EventDispatch] = { title: WebInspector.UIString("Event"), category: categories["scripting"] };
-            recordStyles[recordTypes.Layout] = { title: WebInspector.UIString("Layout"), category: categories["rendering"] };
-            recordStyles[recordTypes.RecalculateStyles] = { title: WebInspector.UIString("Recalculate Style"), category: categories["rendering"] };
-            recordStyles[recordTypes.Paint] = { title: WebInspector.UIString("Paint"), category: categories["rendering"] };
-            recordStyles[recordTypes.ParseHTML] = { title: WebInspector.UIString("Parse"), category: categories["loading"] };
-            recordStyles[recordTypes.TimerInstall] = { title: WebInspector.UIString("Install Timer"), category: categories["scripting"] };
-            recordStyles[recordTypes.TimerRemove] = { title: WebInspector.UIString("Remove Timer"), category: categories["scripting"] };
-            recordStyles[recordTypes.TimerFire] = { title: WebInspector.UIString("Timer Fired"), category: categories["scripting"] };
-            recordStyles[recordTypes.XHRReadyStateChange] = { title: WebInspector.UIString("XHR Ready State Change"), category: categories["scripting"] };
-            recordStyles[recordTypes.XHRLoad] = { title: WebInspector.UIString("XHR Load"), category: categories["scripting"] };
-            recordStyles[recordTypes.EvaluateScript] = { title: WebInspector.UIString("Evaluate Script"), category: categories["scripting"] };
-            recordStyles[recordTypes.TimeStamp] = { title: WebInspector.UIString("Stamp"), category: categories["scripting"] };
-            recordStyles[recordTypes.ResourceSendRequest] = { title: WebInspector.UIString("Send Request"), category: categories["loading"] };
-            recordStyles[recordTypes.ResourceReceiveResponse] = { title: WebInspector.UIString("Receive Response"), category: categories["loading"] };
-            recordStyles[recordTypes.ResourceFinish] = { title: WebInspector.UIString("Finish Loading"), category: categories["loading"] };
-            recordStyles[recordTypes.FunctionCall] = { title: WebInspector.UIString("Function Call"), category: categories["scripting"] };
-            recordStyles[recordTypes.ResourceReceivedData] = { title: WebInspector.UIString("Receive Data"), category: categories["loading"] };
-            recordStyles[recordTypes.GCEvent] = { title: WebInspector.UIString("GC Event"), category: categories["scripting"] };
-            recordStyles[recordTypes.MarkDOMContent] = { title: WebInspector.UIString("DOMContent event"), category: categories["scripting"] };
-            recordStyles[recordTypes.MarkLoad] = { title: WebInspector.UIString("Load event"), category: categories["scripting"] };
-            recordStyles[recordTypes.ScheduleResourceRequest] = { title: WebInspector.UIString("Schedule Request"), category: categories["loading"] };
-            recordStyles[recordTypes.RequestAnimationFrame] = { title: WebInspector.UIString("Request Animation Frame"), category: categories["scripting"] };
-            recordStyles[recordTypes.CancelAnimationFrame] = { title: WebInspector.UIString("Cancel Animation Frame"), category: categories["scripting"] };
-            recordStyles[recordTypes.FireAnimationFrame] = { title: WebInspector.UIString("Animation Frame Fired"), category: categories["scripting"] };
-            this._recordStylesArray = recordStyles;
-        }
-        return this._recordStylesArray;
-    },
-
     _createStatusbarButtons: function()
     {
         this.toggleTimelineButton = new WebInspector.StatusBarButton(WebInspector.UIString("Record"), "record-profile-status-bar-item");
@@ -267,14 +210,12 @@ WebInspector.TimelinePanel.prototype = {
         this.garbageCollectButton = new WebInspector.StatusBarButton(WebInspector.UIString("Collect Garbage"), "garbage-collect-status-bar-item");
         this.garbageCollectButton.addEventListener("click", this._garbageCollectButtonClicked, this);
 
-        this.toggleStartAtZeroButton = new WebInspector.StatusBarButton(WebInspector.UIString("Display all top level events starting at zero"), "timeline-start-at-zero-status-bar-item");
-        this.toggleStartAtZeroButton.addEventListener("click", this._toggleStartAtZeroButtonClicked, this);
-
         this.recordsCounter = document.createElement("span");
         this.recordsCounter.className = "timeline-records-counter";
 
         this._glueParentButton = new WebInspector.StatusBarButton(WebInspector.UIString("Glue asynchronous events to causes"), "glue-async-status-bar-item");
         this._glueParentButton.toggled = true;
+        this._presentationModel.setGlueRecords(true);
         this._glueParentButton.addEventListener("click", this._glueParentButtonClicked, this);
 
         this.statusBarFilters = document.createElement("div");
@@ -312,7 +253,8 @@ WebInspector.TimelinePanel.prototype = {
 
     _onCategoryCheckboxClicked: function(category, event)
     {
-        this._presentationModel.setCategoryVisibility(category, event.target.checked);
+        category.hidden = !event.target.checked;
+        this._scheduleRefresh(true);
     },
 
     _registerShortcuts: function()
@@ -358,7 +300,7 @@ WebInspector.TimelinePanel.prototype = {
 
     _saveToFile: function()
     {
-        this._model._saveToFile();
+        this._model.saveToFile();
     },
 
     _loadFromFile: function()
@@ -367,13 +309,18 @@ WebInspector.TimelinePanel.prototype = {
             this.toggleTimelineButton.toggled = false;
             this._model.stopRecord();
         }
-        this._model._loadFromFile(this._fileSelectorElement.files[0]);
+        this._model.loadFromFile(this._fileSelectorElement.files[0]);
         this._createFileSelector();
     },
 
-    _updateRecordsCounter: function()
+    _rootRecord: function()
     {
-        this.recordsCounter.textContent = WebInspector.UIString("%d of %d captured records are visible", this._rootRecord._visibleRecordsCount, this._rootRecord._allRecordsCount);
+        return this._presentationModel.rootRecord();
+    },
+
+    _updateRecordsCounter: function(recordsInWindowCount)
+    {
+        this.recordsCounter.textContent = WebInspector.UIString("%d of %d captured records are visible", recordsInWindowCount, this._allRecordsCount);
     },
 
     _updateEventDividers: function()
@@ -381,8 +328,13 @@ WebInspector.TimelinePanel.prototype = {
         this._timelineGrid.removeEventDividers();
         var clientWidth = this._graphRowsElement.offsetWidth - this._expandOffset;
         var dividers = [];
+        // Only show frames if we're zoomed close enough -- otherwise they'd be to dense to be useful and will overpopulate DOM.
+        var showFrames = this.calculator.boundarySpan < 1.0 && this._verticalOverview;
+
         for (var i = 0; i < this._timeStampRecords.length; ++i) {
             var record = this._timeStampRecords[i];
+            if (record.type === WebInspector.TimelineModel.RecordType.BeginFrame && !showFrames)
+                continue;
             var positions = this._calculator.computeBarGraphWindowPosition(record, clientWidth);
             var dividerPosition = Math.round(positions.left);
             if (dividerPosition < 0 || dividerPosition >= clientWidth || dividers[dividerPosition])
@@ -399,7 +351,7 @@ WebInspector.TimelinePanel.prototype = {
     {
         var eventDivider = document.createElement("div");
         eventDivider.className = "resources-event-divider";
-        var recordTypes = WebInspector.TimelineAgent.RecordType;
+        var recordTypes = WebInspector.TimelineModel.RecordType;
 
         var eventDividerPadding = document.createElement("div");
         eventDividerPadding.className = "resources-event-divider-padding";
@@ -412,16 +364,27 @@ WebInspector.TimelinePanel.prototype = {
         else if (record.type === recordTypes.TimeStamp) {
             eventDivider.className += " resources-orange-divider";
             eventDividerPadding.title = record.data["message"];
-        }
+        } else if (record.type === recordTypes.BeginFrame)
+            eventDivider.className += " timeline-frame-divider";
+
         eventDividerPadding.appendChild(eventDivider);
         return eventDividerPadding;
     },
 
     _timelinesOverviewModeChanged: function(event)
     {
-        if (!this._memoryStatistics)
-            return;
         var shouldShowMemory = event.data === WebInspector.TimelineOverviewPane.Mode.Memory;
+        var verticalOverview = event.data === WebInspector.TimelineOverviewPane.Mode.EventsVertical;
+        if (verticalOverview !== this._verticalOverview) {
+            this._verticalOverview = verticalOverview;
+            this._glueParentButton.disabled = verticalOverview;
+            if (verticalOverview)
+                this.element.addStyleClass("timeline-vertical-overview");
+            else
+                this.element.removeStyleClass("timeline-vertical-overview");
+            this._presentationModel.setGlueRecords(this._glueParentButton.toggled && !verticalOverview);
+            this._repopulateRecords();
+        }
         if (shouldShowMemory === this._memoryStatistics.visible())
             return;
         if (!shouldShowMemory) {
@@ -429,13 +392,13 @@ WebInspector.TimelinePanel.prototype = {
             this._memoryStatistics.hide();
             this.splitView.element.style.height = "auto";
             this.splitView.element.style.bottom = "0";
-            this.onResize();
         } else {
             this._timelineMemorySplitter.removeStyleClass("hidden");
             this._memoryStatistics.show();
             this.splitView.element.style.bottom = "auto";
-            this._setSplitterPosition(600);
+            this._setSplitterPosition(WebInspector.settings.memoryCounterGraphsHeight.get());
         }
+        this._refresh();
     },
 
     _toggleTimelineButtonClicked: function()
@@ -465,134 +428,42 @@ WebInspector.TimelinePanel.prototype = {
     _glueParentButtonClicked: function()
     {
         this._glueParentButton.toggled = !this._glueParentButton.toggled;
+        this._presentationModel.setGlueRecords(this._glueParentButton.toggled);
         this._repopulateRecords();
     },
 
-    _toggleStartAtZeroButtonClicked: function()
-    {
-        var toggled = !this.toggleStartAtZeroButton.toggled
-        this._glueParentButton.disabled = toggled;
-        this.toggleStartAtZeroButton.toggled = toggled;
-        this._calculator = toggled ? new WebInspector.TimelineStartAtZeroCalculator() : new WebInspector.TimelineCalculator();
-        this._repopulateRecords();
-        this._overviewPane.setStartAtZero(toggled);
-    },
-
     _repopulateRecords: function()
     {
         this._resetPanel();
         var records = this._model.records;
         for (var i = 0; i < records.length; ++i)
-            this._innerAddRecordToTimeline(records[i], this._rootRecord);
+            this._innerAddRecordToTimeline(records[i], this._rootRecord());
         this._scheduleRefresh(false);
     },
 
-    get _startAtZero()
-    {
-        return this.toggleStartAtZeroButton.toggled;
-    },
-
     _onTimelineEventRecorded: function(event)
     {
-        this._innerAddRecordToTimeline(event.data, this._rootRecord);
+        this._innerAddRecordToTimeline(event.data, this._rootRecord());
         this._scheduleRefresh(false);
 
-        if (this._memoryStatistics && event.data["counters"])
+        if (event.data["counters"])
             this._memoryStatistics.addTimlineEvent(event);
     },
 
-    _findParentRecord: function(record)
-    {
-        if (!this._glueParentButton.toggled)
-            return null;
-
-        var recordTypes = WebInspector.TimelineAgent.RecordType;
-        var parentRecord;
-        if (record.type === recordTypes.ResourceReceiveResponse ||
-            record.type === recordTypes.ResourceFinish ||
-            record.type === recordTypes.ResourceReceivedData)
-            parentRecord = this._sendRequestRecords[record.data["requestId"]];
-        else if (record.type === recordTypes.TimerFire)
-            parentRecord = this._timerRecords[record.data["timerId"]];
-        else if (record.type === recordTypes.ResourceSendRequest)
-            parentRecord = this._scheduledResourceRequests[record.data["url"]];
-        else if (record.type === recordTypes.FireAnimationFrame)
-            parentRecord = this._requestAnimationFrameRecords[record.data["id"]];
-        return parentRecord;
-    },
-
     _innerAddRecordToTimeline: function(record, parentRecord)
     {
-        var connectedToOldRecord = false;
-        var recordTypes = WebInspector.TimelineAgent.RecordType;
-
-        if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad)
-            parentRecord = null; // No bar entry for load events.
-        else if (!this._startAtZero &&
-                    (parentRecord === this._rootRecord ||
-                    record.type === recordTypes.ResourceReceiveResponse ||
-                    record.type === recordTypes.ResourceFinish ||
-                    record.type === recordTypes.ResourceReceivedData)) {
-            var newParentRecord = this._findParentRecord(record);
-            if (newParentRecord) {
-                parentRecord = newParentRecord;
-                connectedToOldRecord = true;
-            }
-        }
-
-        var children = record.children;
-        var scriptDetails;
-        if (record.data && record.data["scriptName"]) {
-            scriptDetails = {
-                scriptName: record.data["scriptName"],
-                scriptLine: record.data["scriptLine"]
-            }
-        };
-
-        if ((record.type === recordTypes.TimerFire || record.type === recordTypes.FireAnimationFrame) && children && children.length) {
-            var childRecord = children[0];
-            if (childRecord.type === recordTypes.FunctionCall) {
-                scriptDetails = {
-                    scriptName: childRecord.data["scriptName"],
-                    scriptLine: childRecord.data["scriptLine"]
-                };
-                children = childRecord.children.concat(children.slice(1));
+        var formattedRecord = this._presentationModel.addRecord(record, parentRecord);
+        ++this._allRecordsCount;
+        var recordTypes = WebInspector.TimelineModel.RecordType;
+        var timeStampRecords = this._timeStampRecords;
+        function addTimestampRecords(record)
+        {
+            if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad ||
+                record.type === recordTypes.TimeStamp || record.type === recordTypes.BeginFrame) {
+                timeStampRecords.push(record);
             }
         }
-
-        var formattedRecord = new WebInspector.TimelinePanel.FormattedRecord(record, parentRecord, this, scriptDetails);
-
-        if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad) {
-            this._timeStampRecords.push(formattedRecord);
-            return;
-        }
-
-        ++this._rootRecord._allRecordsCount;
-        formattedRecord.collapsed = (parentRecord === this._rootRecord);
-
-        var childrenCount = children ? children.length : 0;
-        for (var i = 0; i < childrenCount; ++i)
-            this._innerAddRecordToTimeline(children[i], formattedRecord);
-
-        formattedRecord._calculateAggregatedStats(this._presentationModel.categories);
-
-        if (connectedToOldRecord) {
-            record = formattedRecord;
-            do {
-                var parent = record.parent;
-                if (parent._lastChildEndTime < record._lastChildEndTime)
-                    parent._lastChildEndTime = record._lastChildEndTime;
-                for (var category in formattedRecord._aggregatedStats)
-                    parent._aggregatedStats[category] += formattedRecord._aggregatedStats[category];
-                record = parent;
-            } while (record.parent);
-        } else {
-            if (parentRecord !== this._rootRecord)
-                parentRecord._selfTime -= formattedRecord.endTime - formattedRecord.startTime;
-        }
-        // Keep bar entry for mark timeline since nesting might be interesting to the user.
-        if (record.type === recordTypes.TimeStamp)
-            this._timeStampRecords.push(formattedRecord);
+        WebInspector.TimelinePanel.forAllRecords([ formattedRecord ], addTimestampRecords);
     },
 
     sidebarResized: function(event)
@@ -603,9 +474,7 @@ WebInspector.TimelinePanel.prototype = {
         this._overviewPane.sidebarResized(width);
         // Min width = <number of buttons on the left> * 31
         this.statusBarFilters.style.left = Math.max((this.statusBarItems.length + 2) * 31, width) + "px";
-
-        if (this._memoryStatistics)
-            this._memoryStatistics.setSidebarWidth(width);
+        this._memoryStatistics.setSidebarWidth(width);
     },
 
     onResize: function()
@@ -614,19 +483,9 @@ WebInspector.TimelinePanel.prototype = {
         this._scheduleRefresh(false);
     },
 
-    _createRootRecord: function()
-    {
-        var rootRecord = {};
-        rootRecord.children = [];
-        rootRecord._visibleRecordsCount = 0;
-        rootRecord._allRecordsCount = 0;
-        rootRecord._aggregatedStats = {};
-        return rootRecord;
-    },
-
     _clearPanel: function()
     {
-        this._model._reset();
+        this._model.reset();
     },
 
     _onRecordsCleared: function()
@@ -639,16 +498,12 @@ WebInspector.TimelinePanel.prototype = {
     {
         this._presentationModel.reset();
         this._timeStampRecords = [];
-        this._sendRequestRecords = {};
-        this._scheduledResourceRequests = {};
-        this._timerRecords = {};
-        this._requestAnimationFrameRecords = {};
-        this._rootRecord = this._createRootRecord();
         this._boundariesAreValid = false;
         this._overviewPane.reset();
         this._adjustScrollPosition(0);
         this._closeRecordDetails();
-        this._linkifier.reset();
+        this._allRecordsCount = 0;
+        this._memoryStatistics.reset();
     },
 
     elementsToRestoreScrollPositionsFor: function()
@@ -702,73 +557,53 @@ WebInspector.TimelinePanel.prototype = {
             delete this._refreshTimeout;
         }
 
-        this._overviewPane.update(this._rootRecord.children, this._showShortEvents);
+        this._overviewPane.update(this._showShortEvents);
 
         if (!this._boundariesAreValid)
-            this._updateBoundaries();
-        this._refreshRecords(!this._boundariesAreValid);
-        this._updateRecordsCounter();
+            this._calculator.setWindow(this._overviewPane.windowStartTime(), this._overviewPane.windowEndTime());
+
+        var recordsInWindowCount = this._refreshRecords(!this._boundariesAreValid);
+        this._updateRecordsCounter(recordsInWindowCount);
         if(!this._boundariesAreValid)
             this._updateEventDividers();
-        if (this._memoryStatistics && this._memoryStatistics.visible())
+        if (this._memoryStatistics.visible())
             this._memoryStatistics.refresh();
         this._boundariesAreValid = true;
     },
 
-    _updateBoundaries: function()
+    revealRecordAt: function(time)
     {
-        this._calculator.reset();
-        this._calculator.windowLeft = this._presentationModel.windowLeft;
-        this._calculator.windowRight = this._presentationModel.windowRight;
-
-        for (var i = 0; i < this._rootRecord.children.length; ++i)
-            this._calculator.updateBoundaries(this._rootRecord.children[i]);
-
-        this._calculator.calculateWindow();
-    },
-
-    _filterRecords: function()
-    {
-        var recordsInWindow = [];
-        var filter = this._startAtZero ? new WebInspector.TimelineStartAtZeroRecordFilter(this._presentationModel, this._rootRecord, this._showShortEvents)
-            : new WebInspector.TimelineRecordFilter(this._calculator, this._showShortEvents);
-        this._rootRecord._visibleRecordsCount = 0;
-
-        var stack = [{children: this._rootRecord.children, index: 0, parentIsCollapsed: false}];
-        while (stack.length) {
-            var entry = stack[stack.length - 1];
-            var records = entry.children;
-            if (records && entry.index < records.length) {
-                 var record = records[entry.index];
-                 ++entry.index;
-
-                 if (filter.accept(record)) {
-                     ++this._rootRecord._visibleRecordsCount;
-                     ++record.parent._invisibleChildrenCount;
-                     if (!entry.parentIsCollapsed)
-                         recordsInWindow.push(record);
-                 }
-
-                 record._invisibleChildrenCount = 0;
-
-                 stack.push({children: record.children,
-                             index: 0,
-                             parentIsCollapsed: (entry.parentIsCollapsed || record.collapsed),
-                             parentRecord: record,
-                             windowLengthBeforeChildrenTraversal: recordsInWindow.length});
-            } else {
-                stack.pop();
-                if (entry.parentRecord)
-                    entry.parentRecord._visibleChildrenCount = recordsInWindow.length - entry.windowLengthBeforeChildrenTraversal;
+        if (this._verticalOverview)
+            return;
+        var recordsInWindow = this._presentationModel.filteredRecords();
+        var recordToReveal;
+        for (var i = 0; i < recordsInWindow.length; ++i) {
+            var record = recordsInWindow[i];
+            if (record.containsTime(time)) {
+                recordToReveal = record;
+                break;
             }
+            // If there is no record containing the time than use the latest one before that time.
+            if (!recordToReveal || record.endTime < time && recordToReveal.endTime < record.endTime)
+                recordToReveal = record;
         }
 
-        return recordsInWindow;
+        // The record ends before the window left bound so scroll to the top.
+        if (!recordToReveal) {
+            this._containerElement.scrollTop = 0;
+            return;
+        }
+
+        // Expand all ancestors.
+        for (var parent = recordToReveal.parent; parent !== this._rootRecord(); parent = parent.parent)
+            parent.collapsed = false;
+        var index = recordsInWindow.indexOf(recordToReveal);
+        this._containerElement.scrollTop = index * WebInspector.TimelinePanel.rowHeight;
     },
 
     _refreshRecords: function(updateBoundaries)
     {
-        var recordsInWindow = this._filterRecords();
+        var recordsInWindow = this._presentationModel.filteredRecords();
 
         // Calculate the visible area.
         this._scrollTop = this._containerElement.scrollTop;
@@ -802,7 +637,7 @@ WebInspector.TimelinePanel.prototype = {
             var isEven = !(i % 2);
 
             if (i < startIndex) {
-                var lastChildIndex = i + record._visibleChildrenCount;
+                var lastChildIndex = i + record.visibleChildrenCount;
                 if (lastChildIndex >= startIndex && lastChildIndex < endIndex) {
                     var expandElement = new WebInspector.TimelineExpandableElement(this._expandElements);
                     expandElement._update(record, i, this._calculator.computeBarGraphWindowPosition(record, width - this._expandOffset));
@@ -841,10 +676,16 @@ WebInspector.TimelinePanel.prototype = {
         this._itemsGraphsElement.appendChild(this._expandElements);
         this.splitView.sidebarResizerElement.style.height = this.sidebarElement.clientHeight + "px";
         // Reserve some room for expand / collapse controls to the left for records that start at 0ms.
-        var timelinePaddingLeft = this._calculator.windowLeft === 0 ? this._expandOffset : 0;
         if (updateBoundaries)
-            this._timelineGrid.updateDividers(true, this._calculator, timelinePaddingLeft);
+            this._timelineGrid.updateDividers(true, this._calculator, this.timelinePaddingLeft);
         this._adjustScrollPosition((recordsInWindow.length + 1) * rowHeight);
+
+        return recordsInWindow.length;
+    },
+
+    get timelinePaddingLeft()
+    {
+        return !this._overviewPane.windowLeft() ? this._expandOffset : 0;
     },
 
     _adjustScrollPosition: function(totalHeight)
@@ -893,7 +734,7 @@ WebInspector.TimelinePanel.prototype = {
     _showPopover: function(anchor, popover)
     {
         var record = anchor.row._record;
-        popover.show(record._generatePopupContent(this._calculator, this._presentationModel.categories), anchor);
+        popover.show(record.generatePopupContent(this._calculator), anchor);
     },
 
     _closeRecordDetails: function()
@@ -906,31 +747,21 @@ WebInspector.TimelinePanel.prototype.__proto__ = WebInspector.Panel.prototype;
 
 /**
  * @constructor
+ * @param {WebInspector.TimelinePresentationModel} presentationModel
  */
-WebInspector.TimelineCategory = function(name, title, color)
-{
-    this.name = name;
-    this.title = title;
-    this.color = color;
-}
-
-/**
- * @constructor
- */
-WebInspector.TimelineCalculator = function()
+WebInspector.TimelineCalculator = function(presentationModel)
 {
-    this.reset();
-    this.windowLeft = 0.0;
-    this.windowRight = 1.0;
+    this._presentationModel = presentationModel;
 }
 
 WebInspector.TimelineCalculator.prototype = {
     computeBarGraphPercentages: function(record)
     {
         var start = (record.startTime - this.minimumBoundary) / this.boundarySpan * 100;
-        var end = (record.startTime + record._selfTime - this.minimumBoundary) / this.boundarySpan * 100;
-        var endWithChildren = (record._lastChildEndTime - this.minimumBoundary) / this.boundarySpan * 100;
-        return {start: start, end: end, endWithChildren: endWithChildren};
+        var end = (record.startTime + record.selfTime - this.minimumBoundary) / this.boundarySpan * 100;
+        var endWithChildren = (record.lastChildEndTime - this.minimumBoundary) / this.boundarySpan * 100;
+        var cpuWidth = record.cpuTime / this.boundarySpan * 100;
+        return {start: start, end: end, endWithChildren: endWithChildren, cpuWidth: cpuWidth};
     },
 
     computeBarGraphWindowPosition: function(record, clientWidth)
@@ -943,113 +774,27 @@ WebInspector.TimelineCalculator.prototype = {
         var left = percentages.start / 100 * workingArea;
         var width = (percentages.end - percentages.start) / 100 * workingArea + minWidth;
         var widthWithChildren =  (percentages.endWithChildren - percentages.start) / 100 * workingArea;
+        var cpuWidth = percentages.cpuWidth / 100 * workingArea + minWidth;
         if (percentages.endWithChildren > percentages.end)
             widthWithChildren += borderWidth + minWidth;
-        return {left: left, width: width, widthWithChildren: widthWithChildren};
+        return {left: left, width: width, widthWithChildren: widthWithChildren, cpuWidth: cpuWidth};
     },
 
-    calculateWindow: function()
+    setWindow: function(minimumBoundary, maximumBoundary)
     {
-        this.minimumBoundary = this._absoluteMinimumBoundary + this.windowLeft * (this._absoluteMaximumBoundary - this._absoluteMinimumBoundary);
-        this.maximumBoundary = this._absoluteMinimumBoundary + this.windowRight * (this._absoluteMaximumBoundary - this._absoluteMinimumBoundary);
+        this.minimumBoundary = minimumBoundary;
+        this.maximumBoundary = maximumBoundary;
         this.boundarySpan = this.maximumBoundary - this.minimumBoundary;
     },
 
-    reset: function()
-    {
-        this._absoluteMinimumBoundary = -1;
-        this._absoluteMaximumBoundary = -1;
-    },
-
-    updateBoundaries: function(record)
-    {
-        var lowerBound = record.startTime;
-        if (this._absoluteMinimumBoundary === -1 || lowerBound < this._absoluteMinimumBoundary)
-            this._absoluteMinimumBoundary = lowerBound;
-
-        const minimumTimeFrame = 0.1;
-        const minimumDeltaForZeroSizeEvents = 0.01;
-        var upperBound = Math.max(record._lastChildEndTime + minimumDeltaForZeroSizeEvents, lowerBound + minimumTimeFrame);
-        if (this._absoluteMaximumBoundary === -1 || upperBound > this._absoluteMaximumBoundary)
-            this._absoluteMaximumBoundary = upperBound;
-    },
-
-    formatValue: function(value)
+    formatTime: function(value)
     {
-        return Number.secondsToString(value + this.minimumBoundary - this._absoluteMinimumBoundary);
+        return Number.secondsToString(value + this.minimumBoundary - this._presentationModel.minimumRecordTime());
     }
 }
 
 /**
  * @constructor
- * @extends WebInspector.TimelineCalculator
- */
-WebInspector.TimelineStartAtZeroCalculator = function()
-{
-    this.reset();
-    this.windowLeft = 0.0;
-    this.windowRight = 1.0;
-}
-
-WebInspector.TimelineStartAtZeroCalculator.prototype = {
-    computeBarGraphPercentages: function(record)
-    {
-        var scale = 100 / this.maximumBoundary;
-        return {
-            start: record._initiatorOffset * scale,
-            end: (record._initiatorOffset + record.endTime - record.startTime) * scale,
-            endWithChildren: (record._initiatorOffset + record._lastChildEndTime - record.startTime) * scale
-        };
-    },
-
-    computeBarGraphWindowPosition: function(record, clientWidth)
-    {
-        const minWidth = 5;
-        const borderWidth = 4;
-        var workingArea = clientWidth - minWidth - borderWidth;
-        var percentages = this.computeBarGraphPercentages(record);
-        var left = percentages.start / 100 * workingArea;
-        var width = (percentages.end - percentages.start) / 100 * workingArea + minWidth;
-        var widthWithChildren =  (percentages.endWithChildren - percentages.start) / 100 * workingArea;
-        if (percentages.endWithChildren > percentages.end)
-            widthWithChildren += borderWidth + minWidth;
-
-        return {left: left, width: width, widthWithChildren: widthWithChildren};
-    },
-
-    calculateWindow: function()
-    {
-        this.minimumBoundary = this._absoluteMinimumBoundary;
-        this.maximumBoundary = this._absoluteMaximumBoundary * 1.05;
-        this.boundarySpan = this.maximumBoundary >= 0 ? this.maximumBoundary : 0;
-    },
-
-    reset: function()
-    {
-        this._absoluteMinimumBoundary = -1;
-        this._absoluteMaximumBoundary = -1;
-    },
-
-    updateBoundaries: function(record)
-    {
-        var lowerBound = record.startTime;
-        if (this._absoluteMinimumBoundary === -1 || lowerBound < this._absoluteMinimumBoundary)
-            this._absoluteMinimumBoundary = lowerBound;
-
-        const minimumTimeFrame = 0.001;
-        var upperBound = Math.max(record.endTime - record.startTime, minimumTimeFrame);
-        if (this._absoluteMaximumBoundary === -1 || upperBound > this._absoluteMaximumBoundary)
-            this._absoluteMaximumBoundary = upperBound;
-    },
-
-    formatValue: function(value)
-    {
-        return Number.secondsToString(value, true);
-    }
-};
-
-/**
- * @constructor
  */
 WebInspector.TimelineRecordListRow = function()
 {
@@ -1122,6 +867,11 @@ WebInspector.TimelineRecordGraphRow = function(graphContainer, scheduleRefresh)
     this._barWithChildrenElement.row = this;
     this._barAreaElement.appendChild(this._barWithChildrenElement);
 
+    this._barCpuElement = document.createElement("div");
+    this._barCpuElement.className = "timeline-graph-bar cpu"
+    this._barCpuElement.row = this;
+    this._barAreaElement.appendChild(this._barCpuElement);
+
     this._barElement = document.createElement("div");
     this._barElement.className = "timeline-graph-bar";
     this._barElement.row = this;
@@ -1143,6 +893,8 @@ WebInspector.TimelineRecordGraphRow.prototype = {
         this._barWithChildrenElement.style.width = barPosition.widthWithChildren + "px";
         this._barElement.style.left = barPosition.left + expandOffset + "px";
         this._barElement.style.width =  barPosition.width + "px";
+        this._barCpuElement.style.left = barPosition.left + expandOffset + "px";
+        this._barCpuElement.style.width = barPosition.cpuWidth + "px";
         this._expandElement._update(record, index, barPosition);
     },
 
@@ -1159,330 +911,23 @@ WebInspector.TimelineRecordGraphRow.prototype = {
     }
 }
 
-/**
- * @constructor
- */
-WebInspector.TimelinePanel.FormattedRecord = function(record, parentRecord, panel, scriptDetails)
-{
-    this._panel = panel;
-    var recordTypes = WebInspector.TimelineAgent.RecordType;
-    var style = panel._recordStyles[record.type];
-    this.parent = parentRecord;
-    if (parentRecord)
-        parentRecord.children.push(this);
-    this.category = style.category;
-    this.title = style.title;
-    this.startTime = record.startTime / 1000;
-    this.data = record.data;
-    this.type = record.type;
-    this.endTime = (typeof record.endTime !== "undefined") ? record.endTime / 1000 : this.startTime;
-    this._selfTime = this.endTime - this.startTime;
-    this._lastChildEndTime = this.endTime;
-    this._initiatorOffset = (parentRecord && parentRecord !== panel._rootRecord) ?
-        parentRecord._initiatorOffset + this.startTime - parentRecord.startTime : 0;
-
-    if (record.stackTrace && record.stackTrace.length)
-        this.stackTrace = record.stackTrace;
-    this.totalHeapSize = record.totalHeapSize;
-    this.usedHeapSize = record.usedHeapSize;
-    if (record.data && record.data["url"])
-        this.url = record.data["url"];
-    if (scriptDetails) {
-        this.scriptName = scriptDetails.scriptName;
-        this.scriptLine = scriptDetails.scriptLine;
-    }
-    // Make resource receive record last since request was sent; make finish record last since response received.
-    if (record.type === recordTypes.ResourceSendRequest) {
-        panel._sendRequestRecords[record.data["requestId"]] = this;
-    } else if (record.type === recordTypes.ScheduleResourceRequest) {
-        panel._scheduledResourceRequests[record.data["url"]] = this;
-    } else if (record.type === recordTypes.ResourceReceiveResponse) {
-        var sendRequestRecord = panel._sendRequestRecords[record.data["requestId"]];
-        if (sendRequestRecord) { // False if we started instrumentation in the middle of request.
-            this.url = sendRequestRecord.url;
-            // Now that we have resource in the collection, recalculate details in order to display short url.
-            sendRequestRecord._refreshDetails();
-            if (sendRequestRecord.parent !== panel._rootRecord && sendRequestRecord.parent.type === recordTypes.ScheduleResourceRequest)
-                sendRequestRecord.parent._refreshDetails();
-        }
-    } else if (record.type === recordTypes.ResourceReceivedData || record.type === recordTypes.ResourceFinish) {
-        var sendRequestRecord = panel._sendRequestRecords[record.data["requestId"]];
-        if (sendRequestRecord) // False for main resource.
-            this.url = sendRequestRecord.url;
-    } else if (record.type === recordTypes.TimerInstall) {
-        this.timeout = record.data["timeout"];
-        this.singleShot = record.data["singleShot"];
-        panel._timerRecords[record.data["timerId"]] = this;
-    } else if (record.type === recordTypes.TimerFire) {
-        var timerInstalledRecord = panel._timerRecords[record.data["timerId"]];
-        if (timerInstalledRecord) {
-            this.callSiteStackTrace = timerInstalledRecord.stackTrace;
-            this.timeout = timerInstalledRecord.timeout;
-            this.singleShot = timerInstalledRecord.singleShot;
-        }
-    } else if (record.type === recordTypes.RequestAnimationFrame) {
-        panel._requestAnimationFrameRecords[record.data["id"]] = this;
-    } else if (record.type === recordTypes.FireAnimationFrame) {
-        var requestAnimationRecord = panel._requestAnimationFrameRecords[record.data["id"]];
-        if (requestAnimationRecord)
-            this.callSiteStackTrace = requestAnimationRecord.stackTrace;
-    }
-    this._refreshDetails();
-}
-
-WebInspector.TimelinePanel.FormattedRecord.prototype = {
-    isLong: function()
-    {
-        return (this._lastChildEndTime - this.startTime) > WebInspector.TimelinePanel.shortRecordThreshold;
-    },
-
-    get children()
-    {
-        if (!this._children)
-            this._children = [];
-        return this._children;
-    },
-
-    _generateAggregatedInfo: function()
-    {
-        var cell = document.createElement("span");
-        cell.className = "timeline-aggregated-info";
-        for (var index in this._aggregatedStats) {
-            var label = document.createElement("div");
-            label.className = "timeline-aggregated-category timeline-" + index;
-            cell.appendChild(label);
-            var text = document.createElement("span");
-            text.textContent = Number.secondsToString(this._aggregatedStats[index], true);
-            cell.appendChild(text);
-        }
-        return cell;
-    },
-
-    _generatePopupContent: function(calculator, categories)
-    {
-        var contentHelper = new WebInspector.TimelinePanel.PopupContentHelper(this.title, this._panel);
-
-        if (this._children && this._children.length) {
-            contentHelper._appendTextRow(WebInspector.UIString("Self Time"), Number.secondsToString(this._selfTime, true));
-            contentHelper._appendElementRow(WebInspector.UIString("Aggregated Time"), this._generateAggregatedInfo());
-        }
-        var text = WebInspector.UIString("%s (at %s)", Number.secondsToString(this._lastChildEndTime - this.startTime, true),
-            calculator.formatValue(this.startTime - calculator.minimumBoundary));
-        contentHelper._appendTextRow(WebInspector.UIString("Duration"), text);
-
-        const recordTypes = WebInspector.TimelineAgent.RecordType;
-
-        switch (this.type) {
-            case recordTypes.GCEvent:
-                contentHelper._appendTextRow(WebInspector.UIString("Collected"), Number.bytesToString(this.data["usedHeapSizeDelta"]));
-                break;
-            case recordTypes.TimerInstall:
-            case recordTypes.TimerFire:
-            case recordTypes.TimerRemove:
-                contentHelper._appendTextRow(WebInspector.UIString("Timer ID"), this.data["timerId"]);
-                if (typeof this.timeout === "number") {
-                    contentHelper._appendTextRow(WebInspector.UIString("Timeout"), Number.secondsToString(this.timeout / 1000));
-                    contentHelper._appendTextRow(WebInspector.UIString("Repeats"), !this.singleShot);
-                }
-                break;
-            case recordTypes.FireAnimationFrame:
-                contentHelper._appendTextRow(WebInspector.UIString("Callback ID"), this.data["id"]);
-                break;
-            case recordTypes.FunctionCall:
-                contentHelper._appendLinkRow(WebInspector.UIString("Location"), this.scriptName, this.scriptLine);
-                break;
-            case recordTypes.ScheduleResourceRequest:
-            case recordTypes.ResourceSendRequest:
-            case recordTypes.ResourceReceiveResponse:
-            case recordTypes.ResourceReceivedData:
-            case recordTypes.ResourceFinish:
-                contentHelper._appendLinkRow(WebInspector.UIString("Resource"), this.url);
-                if (this.data["requestMethod"])
-                    contentHelper._appendTextRow(WebInspector.UIString("Request Method"), this.data["requestMethod"]);
-                if (typeof this.data["statusCode"] === "number")
-                    contentHelper._appendTextRow(WebInspector.UIString("Status Code"), this.data["statusCode"]);
-                if (this.data["mimeType"])
-                    contentHelper._appendTextRow(WebInspector.UIString("MIME Type"), this.data["mimeType"]);
-                break;
-            case recordTypes.EvaluateScript:
-                if (this.data && this.url)
-                    contentHelper._appendLinkRow(WebInspector.UIString("Script"), this.url, this.data["lineNumber"]);
-                break;
-            case recordTypes.Paint:
-                contentHelper._appendTextRow(WebInspector.UIString("Location"), WebInspector.UIString("(%d, %d)", this.data["x"], this.data["y"]));
-                contentHelper._appendTextRow(WebInspector.UIString("Dimensions"), WebInspector.UIString("%d × %d", this.data["width"], this.data["height"]));
-            case recordTypes.RecalculateStyles: // We don't want to see default details.
-                break;
-            default:
-                if (this.details)
-                    contentHelper._appendTextRow(WebInspector.UIString("Details"), this.details);
-                break;
-        }
-
-        if (this.scriptName && this.type !== recordTypes.FunctionCall)
-            contentHelper._appendLinkRow(WebInspector.UIString("Function Call"), this.scriptName, this.scriptLine);
-
-        if (this.usedHeapSize)
-            contentHelper._appendTextRow(WebInspector.UIString("Used Heap Size"), WebInspector.UIString("%s of %s", Number.bytesToString(this.usedHeapSize), Number.bytesToString(this.totalHeapSize)));
-
-        if (this.callSiteStackTrace && this.callSiteStackTrace.length)
-            contentHelper._appendStackTrace(WebInspector.UIString("Call Site stack"), this.callSiteStackTrace);
-
-        if (this.stackTrace)
-            contentHelper._appendStackTrace(WebInspector.UIString("Call Stack"), this.stackTrace);
-
-        return contentHelper._contentTable;
-    },
-
-    _refreshDetails: function()
-    {
-        this.details = this._getRecordDetails();
-    },
-
-    _getRecordDetails: function()
-    {
-        switch (this.type) {
-            case WebInspector.TimelineAgent.RecordType.GCEvent:
-                return WebInspector.UIString("%s collected", Number.bytesToString(this.data["usedHeapSizeDelta"]));
-            case WebInspector.TimelineAgent.RecordType.TimerFire:
-                return this.scriptName ? this._panel._linkifyLocation(this.scriptName, this.scriptLine, 0) : this.data["timerId"];
-            case WebInspector.TimelineAgent.RecordType.FunctionCall:
-                return this.scriptName ? this._panel._linkifyLocation(this.scriptName, this.scriptLine, 0) : null;
-            case WebInspector.TimelineAgent.RecordType.FireAnimationFrame:
-                return this.scriptName ? this._panel._linkifyLocation(this.scriptName, this.scriptLine, 0) : this.data["id"];
-            case WebInspector.TimelineAgent.RecordType.EventDispatch:
-                return this.data ? this.data["type"] : null;
-            case WebInspector.TimelineAgent.RecordType.Paint:
-                return this.data["width"] + "\u2009\u00d7\u2009" + this.data["height"];
-            case WebInspector.TimelineAgent.RecordType.TimerInstall:
-            case WebInspector.TimelineAgent.RecordType.TimerRemove:
-                return this.stackTrace ? this._panel._linkifyCallFrame(this.stackTrace[0]) : this.data["timerId"];
-            case WebInspector.TimelineAgent.RecordType.RequestAnimationFrame:
-            case WebInspector.TimelineAgent.RecordType.CancelAnimationFrame:
-                return this.stackTrace ? this._panel._linkifyCallFrame(this.stackTrace[0]) : this.data["id"];
-            case WebInspector.TimelineAgent.RecordType.ParseHTML:
-            case WebInspector.TimelineAgent.RecordType.RecalculateStyles:
-                return this.stackTrace ? this._panel._linkifyCallFrame(this.stackTrace[0]) : null;
-            case WebInspector.TimelineAgent.RecordType.EvaluateScript:
-                return this.url ? this._panel._linkifyLocation(this.url, this.data["lineNumber"], 0) : null;
-            case WebInspector.TimelineAgent.RecordType.XHRReadyStateChange:
-            case WebInspector.TimelineAgent.RecordType.XHRLoad:
-            case WebInspector.TimelineAgent.RecordType.ScheduleResourceRequest:
-            case WebInspector.TimelineAgent.RecordType.ResourceSendRequest:
-            case WebInspector.TimelineAgent.RecordType.ResourceReceivedData:
-            case WebInspector.TimelineAgent.RecordType.ResourceReceiveResponse:
-            case WebInspector.TimelineAgent.RecordType.ResourceFinish:
-                return WebInspector.displayNameForURL(this.url);
-            case WebInspector.TimelineAgent.RecordType.TimeStamp:
-                return this.data["message"];
-            default:
-                return null;
-        }
-    },
-
-    _calculateAggregatedStats: function(categories)
-    {
-        this._aggregatedStats = {};
-        for (var category in categories)
-            this._aggregatedStats[category] = 0;
-
-        if (this._children) {
-            for (var index = this._children.length; index; --index) {
-                var child = this._children[index - 1];
-                for (var category in categories)
-                    this._aggregatedStats[category] += child._aggregatedStats[category];
-            }
-        }
-        this._aggregatedStats[this.category.name] += this._selfTime;
-    },
-
-    get aggregatedStats()
-    {
-        return this._aggregatedStats;
-    }
-}
-
-/**
- * @constructor
- */
-WebInspector.TimelinePanel.PopupContentHelper = function(title, panel)
+WebInspector.TimelinePanel.forAllRecords = function(recordsArray, callback)
 {
-    this._panel = panel;
-    this._contentTable = document.createElement("table");;
-    var titleCell = this._createCell(WebInspector.UIString("%s - Details", title), "timeline-details-title");
-    titleCell.colSpan = 2;
-    var titleRow = document.createElement("tr");
-    titleRow.appendChild(titleCell);
-    this._contentTable.appendChild(titleRow);
-}
-
-WebInspector.TimelinePanel.PopupContentHelper.prototype = {
-    /**
-     * @param {string=} styleName
-     */
-    _createCell: function(content, styleName)
-    {
-        var text = document.createElement("label");
-        text.appendChild(document.createTextNode(content));
-        var cell = document.createElement("td");
-        cell.className = "timeline-details";
-        if (styleName)
-            cell.className += " " + styleName;
-        cell.textContent = content;
-        return cell;
-    },
-
-    _appendTextRow: function(title, content)
-    {
-        var row = document.createElement("tr");
-        row.appendChild(this._createCell(title, "timeline-details-row-title"));
-        row.appendChild(this._createCell(content, "timeline-details-row-data"));
-        this._contentTable.appendChild(row);
-    },
-
-    /**
-     * @param {string=} titleStyle
-     */
-    _appendElementRow: function(title, content, titleStyle)
-    {
-        var row = document.createElement("tr");
-        var titleCell = this._createCell(title, "timeline-details-row-title");
-        if (titleStyle)
-            titleCell.addStyleClass(titleStyle);
-        row.appendChild(titleCell);
-        var cell = document.createElement("td");
-        cell.className = "timeline-details";
-        cell.appendChild(content);
-        row.appendChild(cell);
-        this._contentTable.appendChild(row);
-    },
-
-    /**
-     * @param {number=} scriptLine
-     */
-    _appendLinkRow: function(title, scriptName, scriptLine)
-    {
-        var link = this._panel._linkifyLocation(scriptName, scriptLine, 0, "timeline-details");
-        this._appendElementRow(title, link);
-    },
-
-    _appendStackTrace: function(title, stackTrace)
-    {
-        this._appendTextRow("", "");
-        var framesTable = document.createElement("table");
-        for (var i = 0; i < stackTrace.length; ++i) {
-            var stackFrame = stackTrace[i];
-            var row = document.createElement("tr");
-            row.className = "timeline-details";
-            row.appendChild(this._createCell(stackFrame.functionName ? stackFrame.functionName : WebInspector.UIString("(anonymous function)"), "timeline-function-name"));
-            row.appendChild(this._createCell(" @ "));
-            var linkCell = document.createElement("td");
-            var urlElement = this._panel._linkifyCallFrame(stackFrame);
-            linkCell.appendChild(urlElement);
-            row.appendChild(linkCell);
-            framesTable.appendChild(row);
-        }
-        this._appendElementRow(title, framesTable, "timeline-stacktrace-title");
+    if (!recordsArray)
+        return;
+    var stack = [{array: recordsArray, index: 0}];
+    while (stack.length) {
+        var entry = stack[stack.length - 1];
+        var records = entry.array;
+        if (entry.index < records.length) {
+             var record = records[entry.index];
+             if (callback(record))
+                 return;
+             if (record.children)
+                 stack.push({array: record.children, index: 0});
+             ++entry.index;
+        } else
+            stack.pop();
     }
 }
 
@@ -1505,12 +950,12 @@ WebInspector.TimelineExpandableElement.prototype = {
     _update: function(record, index, barPosition)
     {
         const rowHeight = WebInspector.TimelinePanel.rowHeight;
-        if (record._visibleChildrenCount || record._invisibleChildrenCount) {
+        if (record.visibleChildrenCount || record.invisibleChildrenCount) {
             this._element.style.top = index * rowHeight + "px";
             this._element.style.left = barPosition.left + "px";
             this._element.style.width = Math.max(12, barPosition.width + 25) + "px";
             if (!record.collapsed) {
-                this._element.style.height = (record._visibleChildrenCount + 1) * rowHeight + "px";
+                this._element.style.height = (record.visibleChildrenCount + 1) * rowHeight + "px";
                 this._element.addStyleClass("timeline-expandable-expanded");
                 this._element.removeStyleClass("timeline-expandable-collapsed");
             } else {
@@ -1531,245 +976,38 @@ WebInspector.TimelineExpandableElement.prototype = {
 
 /**
  * @constructor
- * @extends {WebInspector.Object}
- */
-WebInspector.TimelineModel = function()
-{
-    this._records = [];
-    this._collectionEnabled = false;
-
-    WebInspector.timelineManager.addEventListener(WebInspector.TimelineManager.EventTypes.TimelineEventRecorded, this._onRecordAdded, this);
-}
-
-WebInspector.TimelineModel.Events = {
-    RecordAdded: "RecordAdded",
-    RecordsCleared: "RecordsCleared"
-}
-
-WebInspector.TimelineModel.prototype = {
-    startRecord: function()
-    {
-        if (this._collectionEnabled)
-            return;
-        this._reset();
-        WebInspector.timelineManager.start(30);
-        this._collectionEnabled = true;
-    },
-
-    stopRecord: function()
-    {
-        if (!this._collectionEnabled)
-            return;
-        WebInspector.timelineManager.stop();
-        this._collectionEnabled = false;
-    },
-
-    get records()
-    {
-        return this._records;
-    },
-
-    _onRecordAdded: function(event)
-    {
-        if (this._collectionEnabled)
-            this._addRecord(event.data);
-    },
-
-    _addRecord: function(record)
-    {
-        this._records.push(record);
-        this.dispatchEventToListeners(WebInspector.TimelineModel.Events.RecordAdded, record);
-    },
-
-    _loadNextChunk: function(data, index)
-    {
-        for (var i = 0; i < 20 && index < data.length; ++i, ++index)
-            this._addRecord(data[index]);
-
-        if (index !== data.length)
-            setTimeout(this._loadNextChunk.bind(this, data, index), 0);
-    },
-
-    _loadFromFile: function(file)
-    {
-        function onLoad(e)
-        {
-            var data = JSON.parse(e.target.result);
-            this._reset();
-            this._loadNextChunk(data, 1);
-        }
-
-        function onError(e)
-        {
-            switch(e.target.error.code) {
-            case e.target.error.NOT_FOUND_ERR:
-                WebInspector.log(WebInspector.UIString('Timeline.loadFromFile: File "%s" not found.', file.name));
-            break;
-            case e.target.error.NOT_READABLE_ERR:
-                WebInspector.log(WebInspector.UIString('Timeline.loadFromFile: File "%s" is not readable', file.name));
-            break;
-            case e.target.error.ABORT_ERR:
-                break;
-            default:
-                WebInspector.log(WebInspector.UIString('Timeline.loadFromFile: An error occurred while reading the file "%s"', file.name));
-            }
-        }
-
-        var reader = new FileReader();
-        reader.onload = onLoad.bind(this);
-        reader.onerror = onError;
-        reader.readAsText(file);
-    },
-
-    _saveToFile: function()
-    {
-        var records = ['[' + JSON.stringify(new String(window.navigator.appVersion))];
-        for (var i = 0; i < this._records.length; ++i)
-            records.push(JSON.stringify(this._records[i]));
-
-        records[records.length - 1] = records[records.length - 1] + "]";
-
-        var now = new Date();
-        var suggestedFileName = "TimelineRawData-" + now.toISO8601Compact() + ".json";
-        InspectorFrontendHost.saveAs(suggestedFileName, records.join(",\n"));
-    },
-
-    _reset: function()
-    {
-        this.stopRecord();
-        this._records = [];
-        this.dispatchEventToListeners(WebInspector.TimelineModel.Events.RecordsCleared);
-    }
-}
-
-WebInspector.TimelineModel.prototype.__proto__ = WebInspector.Object.prototype;
-
-/**
- * @constructor
- * @extends {WebInspector.Object}
- */
-WebInspector.TimelinePresentationModel = function()
-{
-    this._categories = {};
-    this.reset();
-}
-
-WebInspector.TimelinePresentationModel.Events = {
-    WindowChanged: "WindowChanged",
-    CategoryVisibilityChanged: "CategoryVisibilityChanged"
-}
-
-WebInspector.TimelinePresentationModel.prototype = {
-    reset: function()
-    {
-        this.windowLeft = 0.0;
-        this.windowRight = 1.0;
-        this.windowIndexLeft = 0;
-        this.windowIndexRight = null;
-    },
-
-    get categories()
-    {
-        return this._categories;
-    },
-
-    /**
-     * @param {WebInspector.TimelineCategory} category
-     */
-    addCategory: function(category)
-    {
-        this._categories[category.name] = category;
-    },
-
-    /**
-     * @param {number} left
-     * @param {number} right
-     */
-    setWindowPosition: function(left, right)
-    {
-        this.windowLeft = left;
-        this.windowRight = right;
-        this.dispatchEventToListeners(WebInspector.TimelinePresentationModel.Events.WindowChanged);
-    },
-
-    /**
-     * @param {number} left
-     * @param {?number} right
-     */
-    setWindowIndices: function(left, right)
-    {
-        this.windowIndexLeft = left;
-        this.windowIndexRight = right;
-        this.dispatchEventToListeners(WebInspector.TimelinePresentationModel.Events.WindowChanged);
-    },
-
-    /**
-     * @param {WebInspector.TimelineCategory} category
-     * @param {boolean} visible
-     */
-    setCategoryVisibility: function(category, visible)
-    {
-        category.hidden = !visible;
-        this.dispatchEventToListeners(WebInspector.TimelinePresentationModel.Events.CategoryVisibilityChanged, category);
-    }
-}
-
-/**
- * @constructor
- * @param {WebInspector.TimelineCalculator} calculator
- * @param {boolean} showShortEvents
+ * @implements {WebInspector.TimelinePresentationModel.Filter}
  */
-WebInspector.TimelineRecordFilter = function(calculator, showShortEvents)
+WebInspector.TimelineCategoryFilter = function()
 {
-    this._calculator = calculator;
-    this._showShortEvents = showShortEvents;
 }
 
-WebInspector.TimelineRecordFilter.prototype = {
+WebInspector.TimelineCategoryFilter.prototype = {
     /**
-     * @param {WebInspector.TimelinePanel.FormattedRecord} record
+     * @param {WebInspector.TimelinePresentationModel.Record} record
      */
     accept: function(record)
     {
-        if (record.category.hidden)
-            return false;
-        if (!this._showShortEvents && !record.isLong())
-            return false;
-        var percentages = this._calculator.computeBarGraphPercentages(record);
-        return percentages.start <= 100 && percentages.endWithChildren >= 0;
+        return !record.category.hidden && record.type !== WebInspector.TimelineModel.RecordType.BeginFrame;
     }
 }
 
 /**
+ * @param {WebInspector.TimelinePanel} panel
  * @constructor
- * @param {WebInspector.TimelinePresentationModel} model
- * @param {Object} rootRecord
- * @param {boolean} showShortEvents
+ * @implements {WebInspector.TimelinePresentationModel.Filter}
  */
-WebInspector.TimelineStartAtZeroRecordFilter = function(model, rootRecord, showShortEvents)
+WebInspector.TimelineIsLongFilter = function(panel)
 {
-    this._windowIndexLeft = model.windowIndexLeft;
-    this._windowIndexRight = model.windowIndexRight;
-    this._rootRecord = rootRecord;
-    this._topLevelRecordIndex = 0;
-    this._showShortEvents = showShortEvents;
+    this._panel = panel;
 }
 
-WebInspector.TimelineStartAtZeroRecordFilter.prototype = {
+WebInspector.TimelineIsLongFilter.prototype = {
     /**
-     * @param {WebInspector.TimelinePanel.FormattedRecord} record
+     * @param {WebInspector.TimelinePresentationModel.Record} record
      */
     accept: function(record)
     {
-        if (record.category.hidden)
-            return false;
-        if (record.parent === this._rootRecord)
-            ++this._topLevelRecordIndex;
-        if (!this._showShortEvents && !record.isLong())
-            return false;
-        return this._topLevelRecordIndex > this._windowIndexLeft &&
-            (typeof this._windowIndexRight !== "number" || this._topLevelRecordIndex <= this._windowIndexRight);
+        return this._panel._showShortEvents || record.isLong();
     }
 }
-
-WebInspector.TimelinePresentationModel.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/TimelinePresentationModel.js b/Source/WebCore/inspector/front-end/TimelinePresentationModel.js
new file mode 100644
index 000000000..5ef33cf26
--- /dev/null
+++ b/Source/WebCore/inspector/front-end/TimelinePresentationModel.js
@@ -0,0 +1,727 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.TimelinePresentationModel = function()
+{
+    this._categories = {};
+    this._addCategory(new WebInspector.TimelineCategory("loading", WebInspector.UIString("Loading"), "rgb(47,102,236)"));
+    this._addCategory(new WebInspector.TimelineCategory("scripting", WebInspector.UIString("Scripting"), "rgb(157,231,119)"));
+    this._addCategory(new WebInspector.TimelineCategory("rendering", WebInspector.UIString("Rendering"), "rgb(164,60,255)"));
+    this._linkifier = WebInspector.debuggerPresentationModel.createLinkifier();
+    this._glueRecords = false;
+    this._filters = [];
+    this.reset();
+}
+
+WebInspector.TimelinePresentationModel.shortRecordThreshold = 0.015;
+
+WebInspector.TimelinePresentationModel.prototype = {
+    /**
+     * @param {WebInspector.TimelinePresentationModel.Filter} filter
+     */
+    addFilter: function(filter)
+    {
+        this._filters.push(filter);
+    },
+
+    rootRecord: function()
+    {
+        return this._rootRecord;
+    },
+
+    reset: function()
+    {
+        this._linkifier.reset();
+        this._rootRecord = new WebInspector.TimelinePresentationModel.Record(this, { type: WebInspector.TimelineModel.RecordType.Root }, null, null);
+        this._sendRequestRecords = {};
+        this._scheduledResourceRequests = {};
+        this._timerRecords = {};
+        this._requestAnimationFrameRecords = {};
+        this._minimumRecordTime = -1;
+        this._maximumRecordTime = -1;
+    },
+
+    minimumRecordTime: function()
+    {
+        return this._minimumRecordTime;
+    },
+
+    maximumRecordTime: function()
+    {
+        return this._maximumRecordTime;
+    },
+
+    addRecord: function(record, parentRecord)
+    {
+        var connectedToOldRecord = false;
+        var recordTypes = WebInspector.TimelineModel.RecordType;
+
+        if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad)
+            parentRecord = null; // No bar entry for load events.
+        else {
+            var newParentRecord = this._findParentRecord(record);
+            if (newParentRecord) {
+                parentRecord = newParentRecord;
+                connectedToOldRecord = true;
+            }
+        }
+
+        var children = record.children;
+        var scriptDetails;
+        if (record.data && record.data["scriptName"]) {
+            scriptDetails = {
+                scriptName: record.data["scriptName"],
+                scriptLine: record.data["scriptLine"]
+            }
+        };
+
+        if ((record.type === recordTypes.TimerFire || record.type === recordTypes.FireAnimationFrame) && children && children.length) {
+            var childRecord = children[0];
+            if (childRecord.type === recordTypes.FunctionCall) {
+                scriptDetails = {
+                    scriptName: childRecord.data["scriptName"],
+                    scriptLine: childRecord.data["scriptLine"]
+                };
+                children = childRecord.children.concat(children.slice(1));
+            }
+        }
+
+        var formattedRecord = new WebInspector.TimelinePresentationModel.Record(this, record, parentRecord, scriptDetails);
+        this._updateBoundaries(formattedRecord);    
+
+        if (record.type === recordTypes.MarkDOMContent || record.type === recordTypes.MarkLoad)
+            return formattedRecord;
+
+        formattedRecord.collapsed = (parentRecord === this._rootRecord);
+
+        var childrenCount = children ? children.length : 0;
+        for (var i = 0; i < childrenCount; ++i)
+            this.addRecord(children[i], formattedRecord);
+
+        formattedRecord.calculateAggregatedStats(this._categories);
+
+        if (connectedToOldRecord) {
+            record = formattedRecord;
+            do {
+                var parent = record.parent;
+                if (parent.lastChildEndTime < record.lastChildEndTime)
+                    parent.lastChildEndTime = record.lastChildEndTime;
+                for (var category in formattedRecord.aggregatedStats)
+                    parent.aggregatedStats[category] += formattedRecord.aggregatedStats[category];
+                record = parent;
+            } while (record.parent);
+        } else {
+            if (parentRecord !== this._rootRecord)
+                parentRecord.selfTime -= formattedRecord.endTime - formattedRecord.startTime;
+        }
+        return formattedRecord;
+    },
+
+    _updateBoundaries: function(formattedRecord)
+    {
+        if (this._minimumRecordTime === -1 || formattedRecord.startTime < this._minimumRecordTime)
+            this._minimumRecordTime = formattedRecord.startTime;
+        if (this._maximumRecordTime === -1 || formattedRecord.endTime > this._maximumRecordTime)
+            this._maximumRecordTime = formattedRecord.endTime;
+    },
+
+    _findParentRecord: function(record)
+    {
+        if (!this._glueRecords)
+            return null;
+        var recordTypes = WebInspector.TimelineModel.RecordType;
+        var parentRecord;
+        if (record.type === recordTypes.ResourceReceiveResponse ||
+            record.type === recordTypes.ResourceFinish ||
+            record.type === recordTypes.ResourceReceivedData)
+            parentRecord = this._sendRequestRecords[record.data["requestId"]];
+        else if (record.type === recordTypes.TimerFire)
+            parentRecord = this._timerRecords[record.data["timerId"]];
+        else if (record.type === recordTypes.ResourceSendRequest)
+            parentRecord = this._scheduledResourceRequests[record.data["url"]];
+        else if (record.type === recordTypes.FireAnimationFrame)
+            parentRecord = this._requestAnimationFrameRecords[record.data["id"]];
+        return parentRecord;
+    },
+
+    setGlueRecords: function(glue)
+    {
+        this._glueRecords = glue;
+    },
+
+    get categories()
+    {
+        return this._categories;
+    },
+
+    /**
+     * @param {WebInspector.TimelineCategory} category
+     */
+    _addCategory: function(category)
+    {
+        this._categories[category.name] = category;
+    },
+
+    get _recordStyles()
+    {
+        if (!this._recordStylesArray) {
+            var recordTypes = WebInspector.TimelineModel.RecordType;
+            var categories = this._categories;
+
+            var recordStyles = {};
+            recordStyles[recordTypes.Root] = { title: "#root", category: categories["loading"] };
+            recordStyles[recordTypes.EventDispatch] = { title: WebInspector.UIString("Event"), category: categories["scripting"] };
+            recordStyles[recordTypes.Layout] = { title: WebInspector.UIString("Layout"), category: categories["rendering"] };
+            recordStyles[recordTypes.RecalculateStyles] = { title: WebInspector.UIString("Recalculate Style"), category: categories["rendering"] };
+            recordStyles[recordTypes.Paint] = { title: WebInspector.UIString("Paint"), category: categories["rendering"] };
+            recordStyles[recordTypes.BeginFrame] = { title: WebInspector.UIString("Frame Start"), category: categories["rendering"] };
+            recordStyles[recordTypes.ParseHTML] = { title: WebInspector.UIString("Parse"), category: categories["loading"] };
+            recordStyles[recordTypes.TimerInstall] = { title: WebInspector.UIString("Install Timer"), category: categories["scripting"] };
+            recordStyles[recordTypes.TimerRemove] = { title: WebInspector.UIString("Remove Timer"), category: categories["scripting"] };
+            recordStyles[recordTypes.TimerFire] = { title: WebInspector.UIString("Timer Fired"), category: categories["scripting"] };
+            recordStyles[recordTypes.XHRReadyStateChange] = { title: WebInspector.UIString("XHR Ready State Change"), category: categories["scripting"] };
+            recordStyles[recordTypes.XHRLoad] = { title: WebInspector.UIString("XHR Load"), category: categories["scripting"] };
+            recordStyles[recordTypes.EvaluateScript] = { title: WebInspector.UIString("Evaluate Script"), category: categories["scripting"] };
+            recordStyles[recordTypes.TimeStamp] = { title: WebInspector.UIString("Stamp"), category: categories["scripting"] };
+            recordStyles[recordTypes.ResourceSendRequest] = { title: WebInspector.UIString("Send Request"), category: categories["loading"] };
+            recordStyles[recordTypes.ResourceReceiveResponse] = { title: WebInspector.UIString("Receive Response"), category: categories["loading"] };
+            recordStyles[recordTypes.ResourceFinish] = { title: WebInspector.UIString("Finish Loading"), category: categories["loading"] };
+            recordStyles[recordTypes.FunctionCall] = { title: WebInspector.UIString("Function Call"), category: categories["scripting"] };
+            recordStyles[recordTypes.ResourceReceivedData] = { title: WebInspector.UIString("Receive Data"), category: categories["loading"] };
+            recordStyles[recordTypes.GCEvent] = { title: WebInspector.UIString("GC Event"), category: categories["scripting"] };
+            recordStyles[recordTypes.MarkDOMContent] = { title: WebInspector.UIString("DOMContent event"), category: categories["scripting"] };
+            recordStyles[recordTypes.MarkLoad] = { title: WebInspector.UIString("Load event"), category: categories["scripting"] };
+            recordStyles[recordTypes.ScheduleResourceRequest] = { title: WebInspector.UIString("Schedule Request"), category: categories["loading"] };
+            recordStyles[recordTypes.RequestAnimationFrame] = { title: WebInspector.UIString("Request Animation Frame"), category: categories["scripting"] };
+            recordStyles[recordTypes.CancelAnimationFrame] = { title: WebInspector.UIString("Cancel Animation Frame"), category: categories["scripting"] };
+            recordStyles[recordTypes.FireAnimationFrame] = { title: WebInspector.UIString("Animation Frame Fired"), category: categories["scripting"] };
+            this._recordStylesArray = recordStyles;
+        }
+        return this._recordStylesArray;
+    },
+
+    filteredRecords: function()
+    {
+        function filter(record)
+        {
+            for (var i = 0; i < this._filters.length; ++i) {
+                if (!this._filters[i].accept(record))
+                    return false;
+            }
+            return true;
+        }
+        return this._filterRecords(filter.bind(this));
+    },
+
+    _filterRecords: function(filter)
+    {
+        var recordsInWindow = [];
+
+        var stack = [{children: this._rootRecord.children, index: 0, parentIsCollapsed: false}];
+        while (stack.length) {
+            var entry = stack[stack.length - 1];
+            var records = entry.children;
+            if (records && entry.index < records.length) {
+                 var record = records[entry.index];
+                 ++entry.index;
+
+                 if (filter(record)) {
+                     ++record.parent._invisibleChildrenCount;
+                     if (!entry.parentIsCollapsed)
+                         recordsInWindow.push(record);
+                 }
+
+                 record._invisibleChildrenCount = 0;
+
+                 stack.push({children: record.children,
+                             index: 0,
+                             parentIsCollapsed: (entry.parentIsCollapsed || record.collapsed),
+                             parentRecord: record,
+                             windowLengthBeforeChildrenTraversal: recordsInWindow.length});
+            } else {
+                stack.pop();
+                if (entry.parentRecord)
+                    entry.parentRecord._visibleChildrenCount = recordsInWindow.length - entry.windowLengthBeforeChildrenTraversal;
+            }
+        }
+
+        return recordsInWindow;
+    }
+}
+
+WebInspector.TimelinePresentationModel.prototype.__proto__ = WebInspector.Object.prototype;
+
+/**
+ * @constructor
+ */
+WebInspector.TimelinePresentationModel.Record = function(presentationModel, record, parentRecord, scriptDetails)
+{
+    this._presentationModel = presentationModel;
+    this._linkifier = this._presentationModel._linkifier;
+    this._aggregatedStats = [];
+    var recordTypes = WebInspector.TimelineModel.RecordType;
+    var style = presentationModel._recordStyles[record.type];
+    this.parent = parentRecord;
+    if (parentRecord)
+        parentRecord.children.push(this);
+    this.category = style.category;
+    this.title = style.title;
+    this.startTime = record.startTime / 1000;
+    this.data = record.data;
+    this.type = record.type;
+    this.endTime = (typeof record.endTime !== "undefined") ? record.endTime / 1000 : this.startTime;
+    this._selfTime = this.endTime - this.startTime;
+    this._lastChildEndTime = this.endTime;
+    this._initiatorOffset = (parentRecord && parentRecord !== presentationModel._rootRecord) ?
+        parentRecord._initiatorOffset + this.startTime - parentRecord.startTime : 0;
+
+    if (record.stackTrace && record.stackTrace.length)
+        this.stackTrace = record.stackTrace;
+    this.totalHeapSize = record.totalHeapSize;
+    this.usedHeapSize = record.usedHeapSize;
+    if (record.data && record.data["url"])
+        this.url = record.data["url"];
+    if (scriptDetails) {
+        this.scriptName = scriptDetails.scriptName;
+        this.scriptLine = scriptDetails.scriptLine;
+    }
+    // Make resource receive record last since request was sent; make finish record last since response received.
+    if (record.type === recordTypes.ResourceSendRequest) {
+        presentationModel._sendRequestRecords[record.data["requestId"]] = this;
+    } else if (record.type === recordTypes.ScheduleResourceRequest) {
+        presentationModel._scheduledResourceRequests[record.data["url"]] = this;
+    } else if (record.type === recordTypes.ResourceReceiveResponse) {
+        var sendRequestRecord = presentationModel._sendRequestRecords[record.data["requestId"]];
+        if (sendRequestRecord) { // False if we started instrumentation in the middle of request.
+            this.url = sendRequestRecord.url;
+            // Now that we have resource in the collection, recalculate details in order to display short url.
+            sendRequestRecord._refreshDetails();
+            if (sendRequestRecord.parent !== presentationModel._rootRecord && sendRequestRecord.parent.type === recordTypes.ScheduleResourceRequest)
+                sendRequestRecord.parent._refreshDetails();
+        }
+    } else if (record.type === recordTypes.ResourceReceivedData || record.type === recordTypes.ResourceFinish) {
+        var sendRequestRecord = presentationModel._sendRequestRecords[record.data["requestId"]];
+        if (sendRequestRecord) // False for main resource.
+            this.url = sendRequestRecord.url;
+    } else if (record.type === recordTypes.TimerInstall) {
+        this.timeout = record.data["timeout"];
+        this.singleShot = record.data["singleShot"];
+        presentationModel._timerRecords[record.data["timerId"]] = this;
+    } else if (record.type === recordTypes.TimerFire) {
+        var timerInstalledRecord = presentationModel._timerRecords[record.data["timerId"]];
+        if (timerInstalledRecord) {
+            this.callSiteStackTrace = timerInstalledRecord.stackTrace;
+            this.timeout = timerInstalledRecord.timeout;
+            this.singleShot = timerInstalledRecord.singleShot;
+        }
+    } else if (record.type === recordTypes.RequestAnimationFrame) {
+        presentationModel._requestAnimationFrameRecords[record.data["id"]] = this;
+    } else if (record.type === recordTypes.FireAnimationFrame) {
+        var requestAnimationRecord = presentationModel._requestAnimationFrameRecords[record.data["id"]];
+        if (requestAnimationRecord)
+            this.callSiteStackTrace = requestAnimationRecord.stackTrace;
+    }
+    this._refreshDetails();
+}
+
+WebInspector.TimelinePresentationModel.Record.prototype = {
+    get lastChildEndTime()
+    {
+        return this._lastChildEndTime;
+    },
+
+    set lastChildEndTime(time)
+    {
+        this._lastChildEndTime = time;
+    },
+
+    get selfTime()
+    {
+        return this._selfTime;
+    },
+
+    set selfTime(time)
+    {
+        this._selfTime = time;
+    },
+
+    get cpuTime()
+    {
+        return this._cpuTime;
+    },
+
+    isLong: function()
+    {
+        return (this._lastChildEndTime - this.startTime) > WebInspector.TimelinePresentationModel.shortRecordThreshold;
+    },
+
+    get children()
+    {
+        if (!this._children)
+            this._children = [];
+        return this._children;
+    },
+
+    get visibleChildrenCount()
+    {
+        return this._visibleChildrenCount || 0;
+    },
+
+    get invisibleChildrenCount()
+    {
+        return this._invisibleChildrenCount || 0;
+    },
+
+    containsTime: function(time)
+    {
+        return this.startTime <= time && time <= this.endTime;
+    },
+
+    _generateAggregatedInfo: function()
+    {
+        var cell = document.createElement("span");
+        cell.className = "timeline-aggregated-info";
+        for (var index in this._aggregatedStats) {
+            var label = document.createElement("div");
+            label.className = "timeline-aggregated-category timeline-" + index;
+            cell.appendChild(label);
+            var text = document.createElement("span");
+            text.textContent = Number.secondsToString(this._aggregatedStats[index], true);
+            cell.appendChild(text);
+        }
+        return cell;
+    },
+
+    generatePopupContent: function(calculator)
+    {
+        var contentHelper = new WebInspector.TimelinePresentationModel.PopupContentHelper(this.title);
+
+        if (this._children && this._children.length) {
+            contentHelper._appendTextRow(WebInspector.UIString("Self Time"), Number.secondsToString(this._selfTime, true));
+            contentHelper._appendElementRow(WebInspector.UIString("Aggregated Time"), this._generateAggregatedInfo());
+        }
+        var text = WebInspector.UIString("%s (at %s)", Number.secondsToString(this._lastChildEndTime - this.startTime, true),
+            Number.secondsToString(this.startTime - this._presentationModel.minimumRecordTime()));
+        contentHelper._appendTextRow(WebInspector.UIString("Duration"), text);
+
+        const recordTypes = WebInspector.TimelineModel.RecordType;
+
+        switch (this.type) {
+            case recordTypes.GCEvent:
+                contentHelper._appendTextRow(WebInspector.UIString("Collected"), Number.bytesToString(this.data["usedHeapSizeDelta"]));
+                break;
+            case recordTypes.TimerInstall:
+            case recordTypes.TimerFire:
+            case recordTypes.TimerRemove:
+                contentHelper._appendTextRow(WebInspector.UIString("Timer ID"), this.data["timerId"]);
+                if (typeof this.timeout === "number") {
+                    contentHelper._appendTextRow(WebInspector.UIString("Timeout"), Number.secondsToString(this.timeout / 1000));
+                    contentHelper._appendTextRow(WebInspector.UIString("Repeats"), !this.singleShot);
+                }
+                break;
+            case recordTypes.FireAnimationFrame:
+                contentHelper._appendTextRow(WebInspector.UIString("Callback ID"), this.data["id"]);
+                break;
+            case recordTypes.FunctionCall:
+                contentHelper._appendElementRow(WebInspector.UIString("Location"), this._linkifyScriptLocation());
+                break;
+            case recordTypes.ScheduleResourceRequest:
+            case recordTypes.ResourceSendRequest:
+            case recordTypes.ResourceReceiveResponse:
+            case recordTypes.ResourceReceivedData:
+            case recordTypes.ResourceFinish:
+                contentHelper._appendElementRow(WebInspector.UIString("Resource"), this._linkifyLocation(this.url));
+                if (this.data["requestMethod"])
+                    contentHelper._appendTextRow(WebInspector.UIString("Request Method"), this.data["requestMethod"]);
+                if (typeof this.data["statusCode"] === "number")
+                    contentHelper._appendTextRow(WebInspector.UIString("Status Code"), this.data["statusCode"]);
+                if (this.data["mimeType"])
+                    contentHelper._appendTextRow(WebInspector.UIString("MIME Type"), this.data["mimeType"]);
+                break;
+            case recordTypes.EvaluateScript:
+                if (this.data && this.url)
+                    contentHelper._appendElementRow(WebInspector.UIString("Script"), this._linkifyLocation(this.url, this.data["lineNumber"]));
+                break;
+            case recordTypes.Paint:
+                contentHelper._appendTextRow(WebInspector.UIString("Location"), WebInspector.UIString("(%d, %d)", this.data["x"], this.data["y"]));
+                contentHelper._appendTextRow(WebInspector.UIString("Dimensions"), WebInspector.UIString("%d × %d", this.data["width"], this.data["height"]));
+            case recordTypes.RecalculateStyles: // We don't want to see default details.
+                break;
+            default:
+                if (this.details)
+                    contentHelper._appendTextRow(WebInspector.UIString("Details"), this.details);
+                break;
+        }
+
+        if (this.scriptName && this.type !== recordTypes.FunctionCall)
+            contentHelper._appendElementRow(WebInspector.UIString("Function Call"), this._linkifyScriptLocation());
+
+        if (this.usedHeapSize)
+            contentHelper._appendTextRow(WebInspector.UIString("Used Heap Size"), WebInspector.UIString("%s of %s", Number.bytesToString(this.usedHeapSize), Number.bytesToString(this.totalHeapSize)));
+
+        if (this.callSiteStackTrace && this.callSiteStackTrace.length)
+            contentHelper._appendStackTrace(WebInspector.UIString("Call Site stack"), this.callSiteStackTrace, this._linkifyCallFrame.bind(this));
+
+        if (this.stackTrace)
+            contentHelper._appendStackTrace(WebInspector.UIString("Call Stack"), this.stackTrace, this._linkifyCallFrame.bind(this));
+
+        return contentHelper._contentTable;
+    },
+
+    _refreshDetails: function()
+    {
+        this.details = this._getRecordDetails();
+    },
+
+    _getRecordDetails: function()
+    {
+        switch (this.type) {
+            case WebInspector.TimelineModel.RecordType.GCEvent:
+                return WebInspector.UIString("%s collected", Number.bytesToString(this.data["usedHeapSizeDelta"]));
+            case WebInspector.TimelineModel.RecordType.TimerFire:
+                return this._linkifyScriptLocation(this.data["timerId"]);
+            case WebInspector.TimelineModel.RecordType.FunctionCall:
+                return this._linkifyScriptLocation();
+            case WebInspector.TimelineModel.RecordType.FireAnimationFrame:
+                return this._linkifyScriptLocation(this.data["id"]);
+            case WebInspector.TimelineModel.RecordType.EventDispatch:
+                return this.data ? this.data["type"] : null;
+            case WebInspector.TimelineModel.RecordType.Paint:
+                return this.data["width"] + "\u2009\u00d7\u2009" + this.data["height"];
+            case WebInspector.TimelineModel.RecordType.TimerInstall:
+            case WebInspector.TimelineModel.RecordType.TimerRemove:
+                return this._linkifyTopCallFrame(this.data["timerId"]);
+            case WebInspector.TimelineModel.RecordType.RequestAnimationFrame:
+            case WebInspector.TimelineModel.RecordType.CancelAnimationFrame:
+                return this._linkifyTopCallFrame(this.data["id"]);
+            case WebInspector.TimelineModel.RecordType.ParseHTML:
+            case WebInspector.TimelineModel.RecordType.RecalculateStyles:
+                return this._linkifyTopCallFrame();
+            case WebInspector.TimelineModel.RecordType.EvaluateScript:
+                return this.url ? this._linkifyLocation(this.url, this.data["lineNumber"], 0) : null;
+            case WebInspector.TimelineModel.RecordType.XHRReadyStateChange:
+            case WebInspector.TimelineModel.RecordType.XHRLoad:
+            case WebInspector.TimelineModel.RecordType.ScheduleResourceRequest:
+            case WebInspector.TimelineModel.RecordType.ResourceSendRequest:
+            case WebInspector.TimelineModel.RecordType.ResourceReceivedData:
+            case WebInspector.TimelineModel.RecordType.ResourceReceiveResponse:
+            case WebInspector.TimelineModel.RecordType.ResourceFinish:
+                return WebInspector.displayNameForURL(this.url);
+            case WebInspector.TimelineModel.RecordType.TimeStamp:
+                return this.data["message"];
+            default:
+                return null;
+        }
+    },
+
+    /**
+     * @param {string} url
+     * @param {number=} lineNumber
+     * @param {number=} columnNumber
+     */
+    _linkifyLocation: function(url, lineNumber, columnNumber)
+    {
+        // FIXME(62725): stack trace line/column numbers are one-based.
+        lineNumber = lineNumber ? lineNumber - 1 : lineNumber;
+        columnNumber = columnNumber ? columnNumber - 1 : 0;
+        return this._linkifier.linkifyLocation(url, lineNumber, columnNumber, "timeline-details");
+    },
+
+    _linkifyCallFrame: function(callFrame)
+    {
+        return this._linkifyLocation(callFrame.url, callFrame.lineNumber, callFrame.columnNumber);
+    },
+
+    /**
+     * @param {string=} defaultValue
+     */
+    _linkifyTopCallFrame: function(defaultValue)
+    {
+        return this.stackTrace ? this._linkifyCallFrame(this.stackTrace[0]) : defaultValue;
+    },
+
+    /**
+     * @param {string=} defaultValue
+     */
+    _linkifyScriptLocation: function(defaultValue)
+    {
+        return this.scriptName ? this._linkifyLocation(this.scriptName, this.scriptLine, 0) : defaultValue;
+    },
+
+    calculateAggregatedStats: function(categories)
+    {
+        this._aggregatedStats = {};
+        for (var category in categories)
+            this._aggregatedStats[category] = 0;
+        this._cpuTime = this._selfTime;
+
+        if (this._children) {
+            for (var index = this._children.length; index; --index) {
+                var child = this._children[index - 1];
+                for (var category in categories)
+                    this._aggregatedStats[category] += child._aggregatedStats[category];
+            }
+            for (var category in this._aggregatedStats)
+                this._cpuTime += this._aggregatedStats[category];
+        }
+        this._aggregatedStats[this.category.name] += this._selfTime;
+    },
+
+    get aggregatedStats()
+    {
+        return this._aggregatedStats;
+    }
+}
+
+/**
+ * @constructor
+ */
+WebInspector.TimelinePresentationModel.PopupContentHelper = function(title)
+{
+    this._contentTable = document.createElement("table");
+    var titleCell = this._createCell(WebInspector.UIString("%s - Details", title), "timeline-details-title");
+    titleCell.colSpan = 2;
+    var titleRow = document.createElement("tr");
+    titleRow.appendChild(titleCell);
+    this._contentTable.appendChild(titleRow);
+}
+
+WebInspector.TimelinePresentationModel.PopupContentHelper.prototype = {
+    /**
+     * @param {string=} styleName
+     */
+    _createCell: function(content, styleName)
+    {
+        var text = document.createElement("label");
+        text.appendChild(document.createTextNode(content));
+        var cell = document.createElement("td");
+        cell.className = "timeline-details";
+        if (styleName)
+            cell.className += " " + styleName;
+        cell.textContent = content;
+        return cell;
+    },
+
+    _appendTextRow: function(title, content)
+    {
+        var row = document.createElement("tr");
+        row.appendChild(this._createCell(title, "timeline-details-row-title"));
+        row.appendChild(this._createCell(content, "timeline-details-row-data"));
+        this._contentTable.appendChild(row);
+    },
+
+    /**
+     * @param {string=} titleStyle
+     */
+    _appendElementRow: function(title, content, titleStyle)
+    {
+        var row = document.createElement("tr");
+        var titleCell = this._createCell(title, "timeline-details-row-title");
+        if (titleStyle)
+            titleCell.addStyleClass(titleStyle);
+        row.appendChild(titleCell);
+        var cell = document.createElement("td");
+        cell.className = "timeline-details";
+        cell.appendChild(content);
+        row.appendChild(cell);
+        this._contentTable.appendChild(row);
+    },
+
+    _appendStackTrace: function(title, stackTrace, callFrameLinkifier)
+    {
+        this._appendTextRow("", "");
+        var framesTable = document.createElement("table");
+        for (var i = 0; i < stackTrace.length; ++i) {
+            var stackFrame = stackTrace[i];
+            var row = document.createElement("tr");
+            row.className = "timeline-details";
+            row.appendChild(this._createCell(stackFrame.functionName ? stackFrame.functionName : WebInspector.UIString("(anonymous function)"), "timeline-function-name"));
+            row.appendChild(this._createCell(" @ "));
+            var linkCell = document.createElement("td");
+            var urlElement = callFrameLinkifier(stackFrame);
+            linkCell.appendChild(urlElement);
+            row.appendChild(linkCell);
+            framesTable.appendChild(row);
+        }
+        this._appendElementRow(title, framesTable, "timeline-stacktrace-title");
+    }
+}
+
+/**
+ * @interface
+ */
+WebInspector.TimelinePresentationModel.Filter = function()
+{
+}
+
+WebInspector.TimelinePresentationModel.Filter.prototype = {
+    /**
+     * @param {WebInspector.TimelinePresentationModel.Record} record
+     */
+    accept: function(record) { return false; }
+}
+
+/**
+ * @constructor
+ * @extends {WebInspector.Object}
+ */
+WebInspector.TimelineCategory = function(name, title, color)
+{
+    this.name = name;
+    this.title = title;
+    this.color = color;
+    this.hidden = false;
+}
+
+WebInspector.TimelineCategory.Events = {
+    VisibilityChanged: "VisibilityChanged"
+};
+
+WebInspector.TimelineCategory.prototype = {
+    /**
+     * @type {boolean}
+     */
+    get hidden()
+    {
+        return this._hidden;
+    },
+
+    set hidden(hidden)
+    {
+        this._hidden = hidden;
+        this.dispatchEventToListeners(WebInspector.TimelineCategory.Events.VisibilityChanged, this);
+    }
+}
+
+WebInspector.TimelineCategory.prototype.__proto__ = WebInspector.Object.prototype;
diff --git a/Source/WebCore/inspector/front-end/UISourceCode.js b/Source/WebCore/inspector/front-end/UISourceCode.js
index 87d03047b..75abbd637 100644
--- a/Source/WebCore/inspector/front-end/UISourceCode.js
+++ b/Source/WebCore/inspector/front-end/UISourceCode.js
@@ -33,16 +33,15 @@
  * @extends {WebInspector.Object}
  * @param {string} id
  * @param {string} url
- * @param {WebInspector.RawSourceCode} rawSourceCode
  * @param {WebInspector.ContentProvider} contentProvider
  */
-WebInspector.UISourceCode = function(id, url, rawSourceCode, contentProvider)
+WebInspector.UISourceCode = function(id, url, contentProvider)
 {
     this._id = id;
     this._url = url;
-    this._rawSourceCode = rawSourceCode;
     this._contentProvider = contentProvider;
     this.isContentScript = false;
+    this.isEditable = false;
     /**
      * @type Array.<function(string,string)>
      */
@@ -71,14 +70,6 @@ WebInspector.UISourceCode.prototype = {
     },
 
     /**
-     * @return {WebInspector.RawSourceCode}
-     */
-    get rawSourceCode()
-    {
-        return this._rawSourceCode;
-    },
-
-    /**
      * @param {function(string,string)} callback
      */
     requestContent: function(callback)
diff --git a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
index 2887b1d62..80d479ae5 100644
--- a/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
+++ b/Source/WebCore/inspector/front-end/WatchExpressionsSidebarPane.js
@@ -344,30 +344,25 @@ WebInspector.WatchExpressionTreeElement.prototype = {
         this.treeOutline.section.updateExpression(this, null);
     },
 
-    startEditing: function()
+    renderPromptAsBlock: function()
     {
-        if (WebInspector.isBeingEdited(this.nameElement) || !this.treeOutline.section.editable)
-            return;
-
-        this.nameElement.textContent = this.property.name.trim();
-
-        var context = { expanded: this.expanded };
-
-        // collapse temporarily, if required
-        this.hasChildren = false;
-
-        this.listItemElement.addStyleClass("editing-sub-part");
+        return true;
+    },
 
-        WebInspector.startEditing(this.nameElement, new WebInspector.EditingConfig(this.editingCommitted.bind(this), this.editingCancelled.bind(this), context));
+    /**
+     * @param {Event=} event
+     */
+    elementAndValueToEdit: function(event)
+    {
+        return [this.nameElement, this.property.name.trim()];
     },
 
     editingCancelled: function(element, context)
     {
-        if (!this.nameElement.textContent)
+        if (!context.elementToEdit.textContent)
             this.treeOutline.section.updateExpression(this, null);
 
-        this.update();
-        this.editingEnded(context);
+        WebInspector.ObjectPropertyTreeElement.prototype.editingCancelled.call(this, element, context);
     },
 
     applyExpression: function(expression, updateInterface)
diff --git a/Source/WebCore/inspector/front-end/WebKit.qrc b/Source/WebCore/inspector/front-end/WebKit.qrc
index d1031e288..57c58e651 100644
--- a/Source/WebCore/inspector/front-end/WebKit.qrc
+++ b/Source/WebCore/inspector/front-end/WebKit.qrc
@@ -118,6 +118,7 @@
     <file>Script.js</file>
     <file>ScriptFormatter.js</file>
     <file>ScriptFormatterWorker.js</file>
+    <file>ScriptMapping.js</file>
     <file>ScriptsPanel.js</file>
     <file>ScriptsNavigator.js</file>
     <file>ScriptsSearchScope.js</file>
@@ -147,8 +148,9 @@
     <file>TextEditorModel.js</file>
     <file>TextPrompt.js</file>
     <file>TextViewer.js</file>
-    <file>TimelineAgent.js</file>
     <file>TimelineManager.js</file>
+    <file>TimelineModel.js</file>
+    <file>TimelinePresentationModel.js</file>
     <file>TimelineGrid.js</file>
     <file>TimelineOverviewPane.js</file>
     <file>TimelinePanel.js</file>
diff --git a/Source/WebCore/inspector/front-end/dialog.css b/Source/WebCore/inspector/front-end/dialog.css
index 20f3ee1ad..ccfb3a443 100644
--- a/Source/WebCore/inspector/front-end/dialog.css
+++ b/Source/WebCore/inspector/front-end/dialog.css
@@ -53,24 +53,3 @@
     background-color: rgb(215, 215, 215);
     background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(194, 194, 194)), to(rgb(239, 239, 239)));
 }
-
-.sidebar-overlay-dialog {
-    position: absolute;
-    display: -webkit-box;
-    height: 0;
-    width: 0;
-    -webkit-box-orient: vertical;
-    z-index: -1;
-    background-color: white;
-    border-right: 1px solid gray;
-    -webkit-box-shadow: rgb(90,90,90) 20px 0px 50px -25px;
-}
-
-.sidebar-overlay-resizer {
-    position: absolute;
-    top: 0;
-    bottom: 0;
-    width: 5px;
-    z-index: 500;
-    cursor: ew-resize;
-}
diff --git a/Source/WebCore/inspector/front-end/indexedDBViews.css b/Source/WebCore/inspector/front-end/indexedDBViews.css
index b5817d14e..2dc038d3e 100644
--- a/Source/WebCore/inspector/front-end/indexedDBViews.css
+++ b/Source/WebCore/inspector/front-end/indexedDBViews.css
@@ -99,3 +99,26 @@
 .indexed-db-data-view .data-grid .data-container tr:nth-last-child(1) td {
     border: 0;
 }
+
+.indexed-db-data-view .data-grid .data-container td {
+    height: 18px;
+}
+
+.indexed-db-data-view .data-grid .data-container td.value-column,
+.indexed-db-data-view .data-grid .data-container td.key-column,
+.indexed-db-data-view .data-grid .data-container td.primaryKey-column {
+    padding: 0;
+}
+
+.indexed-db-data-view .data-grid .data-container td.value-column div.primitive-value,
+.indexed-db-data-view .data-grid .data-container td.key-column div.primitive-value,
+.indexed-db-data-view .data-grid .data-container td.primaryKey-column div.primitive-value {
+    padding-left: 5px;
+    margin-top: 1px;
+}
+
+.indexed-db-data-view .data-grid .data-container td .section .header .title {
+    white-space: nowrap;
+    text-overflow: ellipsis;
+    overflow: hidden;
+}
diff --git a/Source/WebCore/inspector/front-end/inspector.css b/Source/WebCore/inspector/front-end/inspector.css
index 490c1f52b..628a97c28 100644
--- a/Source/WebCore/inspector/front-end/inspector.css
+++ b/Source/WebCore/inspector/front-end/inspector.css
@@ -522,7 +522,6 @@ select.status-bar-item:active {
     -webkit-mask-image: url(Images/statusbarButtonGlyphs.png);
 }
 
-
 button.dock-status-bar-item.status-bar-item .glyph {
     -webkit-mask-position: 0 -48px;
 }
@@ -541,7 +540,6 @@ button.settings-status-bar-item {
     -webkit-mask-position: -160px -24px;
 }
 
-
 body.port-qt #dock-status-bar-item {
     display: none
 }
@@ -895,14 +893,14 @@ body.platform-linux .monospace, body.platform-linux .source-code {
     display: none;
 }
 
-.console-formatted-object, .console-formatted-node {
+.console-formatted-object, .console-formatted-node, .console-formatted-array {
     position: relative;
     display: inline-block;
     vertical-align: top;
     color: black;
 }
 
-.console-formatted-object .section, .console-formatted-node .section {
+.console-formatted-object .section, .console-formatted-node .section, .console-formatted-array .section {
     position: static;
 }
 
@@ -1075,6 +1073,10 @@ iframe.panel.extension {
     margin-left: -12px;
 }
 
+.webkit-html-tag.shadow, .webkit-html-fragment.shadow {
+    opacity: 0.6;
+}
+
 .outline-disclosure li.parent::before {
     content: url(Images/treeRightTriangleBlack.png);
     float: left;
@@ -1375,7 +1377,7 @@ li.editing .swatch, li.editing .enabled-button,  li.editing-sub-part .delete-but
     padding-top: 2px;
 }
 
-.watch-expressions > li.editing-sub-part .name {
+.watch-expressions > li.editing-sub-part .text-prompt {
     display: block;
     width: 100%;
 }
@@ -1802,6 +1804,8 @@ button.edit-source-status-bar-item.toggled-on .glyph {
     height: 36px;
     padding: 0 5px 0 5px;
     white-space: nowrap;
+    overflow-x: hidden;
+    overflow-y: hidden;
     margin-top: 1px;
     line-height: 34px;
     border-top: 1px solid transparent;
diff --git a/Source/WebCore/inspector/front-end/inspector.html b/Source/WebCore/inspector/front-end/inspector.html
index ee56c86b2..7c20778ae 100644
--- a/Source/WebCore/inspector/front-end/inspector.html
+++ b/Source/WebCore/inspector/front-end/inspector.html
@@ -72,6 +72,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="ResourceUtils.js"></script>
     <script type="text/javascript" src="ResourceCategory.js"></script>
     <script type="text/javascript" src="TimelineManager.js"></script>
+    <script type="text/javascript" src="TimelineModel.js"></script>
     <script type="text/javascript" src="Database.js"></script>
     <script type="text/javascript" src="DOMStorage.js"></script>
     <script type="text/javascript" src="DOMStorageItemsView.js"></script>
@@ -167,6 +168,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="DetailedHeapshotGridNodes.js"></script>
     <script type="text/javascript" src="DetailedHeapshotView.js"></script>
     <script type="text/javascript" src="DebuggerModel.js"></script>
+    <script type="text/javascript" src="ScriptMapping.js"></script>
     <script type="text/javascript" src="DebuggerPresentationModel.js"></script>
     <script type="text/javascript" src="BreakpointManager.js"></script>
     <script type="text/javascript" src="UISourceCode.js"></script>
@@ -175,7 +177,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="CompilerSourceMapping.js"></script>
     <script type="text/javascript" src="ScriptsSearchScope.js"></script>
     <script type="text/javascript" src="DOMAgent.js"></script>
-    <script type="text/javascript" src="TimelineAgent.js"></script>
+    <script type="text/javascript" src="TimelinePresentationModel.js"></script>
     <script type="text/javascript" src="TimelinePanel.js"></script>
     <script type="text/javascript" src="TimelineOverviewPane.js"></script>
     <script type="text/javascript" src="TestController.js"></script>
diff --git a/Source/WebCore/inspector/front-end/inspector.js b/Source/WebCore/inspector/front-end/inspector.js
index 05fa8e2e2..805b7248f 100644
--- a/Source/WebCore/inspector/front-end/inspector.js
+++ b/Source/WebCore/inspector/front-end/inspector.js
@@ -39,6 +39,8 @@ var WebInspector = {
 
         if (WebInspector.WorkerManager.isWorkerFrontend()) {
             this.panels.scripts = new WebInspector.ScriptsPanel(this.debuggerPresentationModel);
+            this.panels.timeline = new WebInspector.TimelinePanel();
+            this.panels.profiles = new WebInspector.ProfilesPanel();
             this.panels.console = new WebInspector.ConsolePanel();
             return;
         }
@@ -71,6 +73,7 @@ var WebInspector = {
         this._dockToggleButton = new WebInspector.StatusBarButton(this._dockButtonTitle(), "dock-status-bar-item");
         this._dockToggleButton.addEventListener("click", this._toggleAttach.bind(this), false);
         this._dockToggleButton.toggled = !this.attached;
+        WebInspector.updateDockToggleButton();
 
         this._settingsButton = new WebInspector.StatusBarButton(WebInspector.UIString("Settings"), "settings-status-bar-item");
         this._settingsButton.addEventListener("click", this._toggleSettings.bind(this), false);
@@ -306,6 +309,30 @@ var WebInspector = {
         Capabilities[name] = result;
         if (callback)
             callback();
+    },
+
+    _zoomIn: function()
+    {
+        ++this._zoomLevel;
+        this._requestZoom();
+    },
+
+    _zoomOut: function()
+    {
+        --this._zoomLevel;
+        this._requestZoom();
+    },
+
+    _resetZoom: function()
+    {
+        this._zoomLevel = 0;
+        this._requestZoom();
+    },
+
+    _requestZoom: function()
+    {
+        WebInspector.settings.zoomLevel.set(this._zoomLevel);
+        InspectorFrontendHost.setZoomFactor(Math.pow(1.2, this._zoomLevel));
     }
 }
 
@@ -403,6 +430,10 @@ WebInspector._doLoadedDoneWithCapabilities = function()
     if (Capabilities.nativeInstrumentationEnabled)
         this.domBreakpointsSidebarPane = new WebInspector.DOMBreakpointsSidebarPane();
 
+    this._zoomLevel = WebInspector.settings.zoomLevel.get();
+    if (this._zoomLevel)
+        this._requestZoom();
+
     this._createPanels();
     this._createGlobalStatusBarItems();
 
@@ -534,6 +565,20 @@ WebInspector.windowResize = function(event)
 WebInspector.setAttachedWindow = function(attached)
 {
     this.attached = attached;
+    WebInspector.updateDockToggleButton();
+}
+
+WebInspector.setDockingUnavailable = function(unavailable)
+{
+    this._isDockingUnavailable = unavailable;
+    WebInspector.updateDockToggleButton();
+}
+
+WebInspector.updateDockToggleButton = function()
+{
+    if (!this._dockToggleButton)
+        return;
+    this._dockToggleButton.disabled = this.attached ? false : this._isDockingUnavailable;
 }
 
 WebInspector.close = function(event)
@@ -597,8 +642,8 @@ WebInspector.openResource = function(resourceURL, inResourcesPanel)
 {
     var resource = WebInspector.resourceForURL(resourceURL);
     if (inResourcesPanel && resource) {
-        WebInspector.panels.resources.showResource(resource);
         WebInspector.showPanel("resources");
+        WebInspector.panels.resources.showResource(resource);
     } else
         InspectorFrontendHost.openInNewTab(resourceURL);
 }
@@ -680,20 +725,45 @@ WebInspector.documentKeyDown = function(event)
             }
             break;
         case "U+0052": // R key
-            if (WebInspector.isInEditMode(event))
-                return;
             if ((event.metaKey && isMac) || (event.ctrlKey && !isMac)) {
                 PageAgent.reload(event.shiftKey);
                 event.preventDefault();
             }
             break;
         case "F5":
-            if (!isMac && !WebInspector.isInEditMode(event)) {
+            if (!isMac) {
                 PageAgent.reload(event.ctrlKey || event.shiftKey);
                 event.preventDefault();
             }
             break;
     }
+
+    var isValidZoomShortcut = WebInspector.KeyboardShortcut.eventHasCtrlOrMeta(event) &&
+        !event.shiftKey &&
+        !event.altKey &&
+        !InspectorFrontendHost.isStub;
+    switch (event.keyCode) {
+        case 107: // +
+        case 187: // +
+            if (isValidZoomShortcut) {
+                WebInspector._zoomIn();
+                event.preventDefault();
+            }
+            break;
+        case 109: // -
+        case 189: // -
+            if (isValidZoomShortcut) {
+                WebInspector._zoomOut();
+                event.preventDefault();
+            }
+            break;
+        case 48: // 0
+            if (isValidZoomShortcut) {
+                WebInspector._resetZoom();
+                event.preventDefault();
+            }
+            break;
+    }
 }
 
 WebInspector.documentCanCopy = function(event)
diff --git a/Source/WebCore/inspector/front-end/inspectorCommon.css b/Source/WebCore/inspector/front-end/inspectorCommon.css
index 526843140..cb78b0311 100644
--- a/Source/WebCore/inspector/front-end/inspectorCommon.css
+++ b/Source/WebCore/inspector/front-end/inspectorCommon.css
@@ -78,10 +78,6 @@ iframe.view {
     pointer-events: none;
 }
 
-.timeline .resources-event-dividers {
-    height: 19px;
-}
-
 .resources-dividers-label-bar {
     position: absolute;
     top: 0;
diff --git a/Source/WebCore/inspector/front-end/scriptsPanel.css b/Source/WebCore/inspector/front-end/scriptsPanel.css
index b412f0207..e47abd636 100644
--- a/Source/WebCore/inspector/front-end/scriptsPanel.css
+++ b/Source/WebCore/inspector/front-end/scriptsPanel.css
@@ -282,6 +282,15 @@
     margin-right: 28px;
 }
 
+#scripts-editor-view .sidebar-overlay {
+    display: -webkit-box;
+    background-color: white;
+    border-right: 1px solid gray;
+    -webkit-box-shadow: rgb(90,90,90) 20px 0px 50px -25px;
+    display: -webkit-box;
+    -webkit-box-orient: vertical;
+}
+
 #scripts-editor-container-tabbed-pane .tabbed-pane-header {
     background-image: -webkit-gradient(linear, 0% 0%, 0% 100%, from(#F5F5F5), to(#E5E5E5));
 }
diff --git a/Source/WebCore/inspector/front-end/splitView.css b/Source/WebCore/inspector/front-end/splitView.css
index 1e8e96dac..1461eb840 100644
--- a/Source/WebCore/inspector/front-end/splitView.css
+++ b/Source/WebCore/inspector/front-end/splitView.css
@@ -66,4 +66,21 @@
     width: 5px;
     z-index: 500;
     cursor: ew-resize;
-}
\ No newline at end of file
+}
+
+.sidebar-overlay {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    left: 0;
+    z-index: 10;
+}
+
+.sidebar-overlay-resizer {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    width: 5px;
+    z-index: 500;
+    cursor: ew-resize;
+}
diff --git a/Source/WebCore/inspector/front-end/timelinePanel.css b/Source/WebCore/inspector/front-end/timelinePanel.css
index fd44d59fe..9cf26ec77 100644
--- a/Source/WebCore/inspector/front-end/timelinePanel.css
+++ b/Source/WebCore/inspector/front-end/timelinePanel.css
@@ -72,20 +72,11 @@
     border-right: 1px solid rgb(163, 163, 163);
 }
 
-.timeline-start-at-zero #timeline-overview-sidebar {
-    display: none;
-}
-
 #timeline-overview-grid {
-    position: absolute;
-    top: 0px;
-    bottom: 0px;
-    left: 200px;
-    right: 0px;
     background-color: rgb(255, 255, 255);
 }
 
-.timeline-start-at-zero #timeline-overview-grid {
+.timeline-vertical-overview #timeline-overview-grid {
     display: none;
 }
 
@@ -107,7 +98,7 @@
     z-index: 150;
 }
 
-.timeline-start-at-zero .timeline-overview-window {
+.timeline-vertical-overview .timeline-overview-window {
     bottom: 0;
 }
 
@@ -120,7 +111,7 @@
     position: absolute;
 }
 
-.timeline-start-at-zero .timeline-overview-dividers-background {
+.timeline-vertical-overview .timeline-overview-dividers-background {
     bottom: 0;
 }
 
@@ -163,7 +154,7 @@
     bottom: 0;
     right: 0;
     border-right: 0 none transparent;
-    overflow-y: auto;
+    overflow-y: scroll;
     overflow-x: hidden;
 }
 
@@ -284,7 +275,7 @@
     z-index: 160;
 }
 
-.timeline-start-at-zero #timeline-overview-memory {
+.timeline-vertical-overview #timeline-overview-memory {
     display: none;
 }
 
@@ -353,6 +344,10 @@
     opacity: 0.2;
 }
 
+.timeline-graph-bar.cpu {
+    opacity: 0.6;
+}
+
 .timeline-graph-side.even {
     background-color: rgba(0, 0, 0, 0.05);
 }
@@ -455,11 +450,7 @@
     -webkit-mask-position: -128px -48px;
 }
 
-.timeline-start-at-zero-status-bar-item .glyph {
-    -webkit-mask-position: -160px -48px;
-}
-
-.timeline-start-at-zero-status-bar-item.toggled-on .glyph {
+.timeline-vertical-overview-status-bar-item.toggled-on .glyph {
     background-color: rgb(66, 129, 235) !important;
 }
 
@@ -555,16 +546,25 @@
     border-top: 1px solid #AAA;
 }
 
+#memory-graphs-canvas-container {
+    border-right: 1px solid #AAA;
+}
+
+#memory-graphs-canvas-container .resources-dividers {
+    top: 15px;
+}
+
 #memory-graphs-container .split-view-contents {
     overflow: hidden;
 }
 
 .memory-counter-sidebar-info {
-    position: absolute;
-    top: 0;
-    left: 0;
-    right: 0;
     font-size: 11px;
+    margin: 10px;
+}
+
+.memory-counter-sidebar-info .swatch{
+    background-image: none;
 }
 
 .memory-counter-sidebar-info.bottom-border-visible {
@@ -573,18 +573,19 @@
 
 .memory-counter-sidebar-info .title {
     margin: 4px;
-    font-weight: bold;
 }
 
-.memory-counter-sidebar-info .counter-value {
+.memory-counter-value {
     margin: 4px;
+    font-size: 11px;
 }
 
-.timeline-overview-start-at-zero {
-    background-color: white;
+#counter-values-bar {
+    border-bottom: solid 1px lightgray;
+    min-height: 15px;
 }
 
-.timeline-overview-start-at-zero-bars {
+.timeline-vertical-overview-bars {
     display: -webkit-box;
     -webkit-box-align: end;
     background-color: white;
@@ -594,11 +595,11 @@
     background-color: rgba(255, 255, 255, 0.8);
 }
 
-.timeline-overview-start-at-zero-bars .padding {
+.timeline-vertical-overview-bars .padding {
     -webkit-box-flex: 100000;
 }
 
-.timeline-overview-start-at-zero-bars .timeline-bar-vertical {
+.timeline-vertical-overview-bars .timeline-bar-vertical {
     display: -webkit-box;
     -webkit-box-orient: vertical;
     -webkit-box-pack: end;
@@ -626,3 +627,77 @@
     background: -webkit-linear-gradient(left, rgb(213, 185, 236), rgb(137, 62, 200));
     border: solid 1px rgb(130, 59, 190);
 }
+
+.timeline .resources-event-divider {
+    height: 19px;
+    bottom: auto;
+}
+
+.timeline.timeline-vertical-overview .resources-divider {
+    height: 19px;
+    bottom: auto;
+}
+
+.timeline .resources-event-divider.timeline-frame-divider {
+    background-color: rgba(200, 185, 200, 0.8);
+    height: 100%;
+}
+
+.sidebar-tree-item .timeline-vertical-overview-status-bar-item {
+    position: absolute;
+    right: 10px;
+    top: 4px;
+}
+
+.timeline-overview-mode-selector {
+    float: right;
+    margin: 5px 10px 5px 10px;
+}
+
+.timeline-overview-mode-selector .glyph {
+    width: 32px;
+    height: 24px;
+    -webkit-mask-image: url(Images/statusbarButtonGlyphs.png);
+}
+
+.timeline-overview-mode-selector button {
+    width: 32px;
+    height: 24px;
+    margin: 0px;
+    border: none;
+    position: relative;
+}
+
+.timeline-overview-mode-selector button.toggled {
+    background-image: -webkit-linear-gradient(top, rgb(80, 80, 80), rgb(140, 140, 140) 3px, rgb(160, 160, 160));
+}
+
+.timeline-overview-mode-selector button:active {
+    background-image: -webkit-linear-gradient(top, rgb(60, 60, 60), rgb(100, 100, 100) 3px, rgb(120, 120, 120));
+}
+
+.sidebar-tree-item:not(.selected) .timeline-overview-mode-selector button {
+    opacity: 0.5;
+}
+
+.sidebar-tree-item:not(.selected) .timeline-overview-mode-selector button.toggled {
+    background-image: -webkit-linear-gradient(top, rgb(120, 120, 120), rgb(200, 200, 200) 3px, rgb(220, 220, 220));
+}
+
+.timeline-overview-mode-selector button:first-of-type {
+    border-top-left-radius: 3px;
+    border-bottom-left-radius: 3px;
+}
+
+.timeline-overview-mode-selector button:last-of-type {
+    border-top-right-radius: 3px;
+    border-bottom-right-radius: 3px;
+}
+
+.timeline-mode-vertical-bars .glyph {
+    -webkit-mask-position: -160px -48px;
+}
+
+.timeline-mode-horizontal-bars .glyph {
+    -webkit-mask-position: -192px -48px;
+}
diff --git a/Source/WebCore/inspector/front-end/treeoutline.js b/Source/WebCore/inspector/front-end/treeoutline.js
index 528f41b7e..7cd0c7830 100644
--- a/Source/WebCore/inspector/front-end/treeoutline.js
+++ b/Source/WebCore/inspector/front-end/treeoutline.js
@@ -28,8 +28,9 @@
 
 /**
  * @constructor
+ * @param {boolean=} nonFocusable
  */
-function TreeOutline(listNode)
+function TreeOutline(listNode, nonFocusable)
 {
     /**
      * @type {Array.<TreeElement>}
@@ -48,7 +49,7 @@ function TreeOutline(listNode)
     this.searchable = false;
     this.searchInputElement = null;
 
-    this._childrenListNode.tabIndex = 0;
+    this.setFocusable(!nonFocusable);
     this._childrenListNode.addEventListener("keydown", this._treeKeyDown.bind(this), true);
     this._childrenListNode.addEventListener("keypress", this._treeKeyPress.bind(this), true);
     
@@ -56,6 +57,14 @@ function TreeOutline(listNode)
     this._expandedStateMap = new Map();
 }
 
+TreeOutline.prototype.setFocusable = function(focusable)
+{
+    if (focusable)
+        this._childrenListNode.setAttribute("tabIndex", 0);
+    else
+        this._childrenListNode.removeAttribute("tabIndex");
+}
+
 TreeOutline.prototype.appendChild = function(child)
 {
     var insertionIndex;
diff --git a/Source/WebCore/inspector/front-end/utilities.js b/Source/WebCore/inspector/front-end/utilities.js
index 663317c2a..28f6105b0 100644
--- a/Source/WebCore/inspector/front-end/utilities.js
+++ b/Source/WebCore/inspector/front-end/utilities.js
@@ -758,7 +758,7 @@ String.sprintf = function(format, var_arg)
     return String.vsprintf(format, Array.prototype.slice.call(arguments, 1));
 }
 
-String.tokenizeFormatString = function(format)
+String.tokenizeFormatString = function(format, formatters)
 {
     var tokens = [];
     var substitutionIndex = 0;
@@ -773,22 +773,22 @@ String.tokenizeFormatString = function(format)
         tokens.push({ type: "specifier", specifier: specifier, precision: precision, substitutionIndex: substitutionIndex });
     }
 
+    function isDigit(c)
+    {
+        return !!/[0-9]/.exec(c);
+    }
+
     var index = 0;
     for (var precentIndex = format.indexOf("%", index); precentIndex !== -1; precentIndex = format.indexOf("%", index)) {
         addStringToken(format.substring(index, precentIndex));
         index = precentIndex + 1;
 
-        if (format[index] === "%") {
-            addStringToken("%");
-            ++index;
-            continue;
-        }
-
-        if (!isNaN(format[index])) {
+        if (isDigit(format[index])) {
             // The first character is a number, it might be a substitution index.
             var number = parseInt(format.substring(index), 10);
-            while (!isNaN(format[index]))
+            while (isDigit(format[index]))
                 ++index;
+
             // If the number is greater than zero and ends with a "$",
             // then this is a substitution index.
             if (number > 0 && format[index] === "$") {
@@ -805,10 +805,17 @@ String.tokenizeFormatString = function(format)
             precision = parseInt(format.substring(index), 10);
             if (isNaN(precision))
                 precision = 0;
-            while (!isNaN(format[index]))
+
+            while (isDigit(format[index]))
                 ++index;
         }
 
+        if (!(format[index] in formatters)) {
+            addStringToken(format.substring(precentIndex, index + 1));
+            ++index;
+            continue;
+        }
+
         addSpecifierToken(format[index], precision, substitutionIndex);
 
         ++substitutionIndex;
@@ -865,7 +872,7 @@ String.format = function(format, substitutions, formatters, initialValue, append
     }
 
     var result = initialValue;
-    var tokens = String.tokenizeFormatString(format);
+    var tokens = String.tokenizeFormatString(format, formatters);
     var usedSubstitutionIndexes = {};
 
     for (var i = 0; i < tokens.length; ++i) {
@@ -1207,11 +1214,11 @@ Map.prototype = {
         delete this._map[key.__identifier];
     },
     
-    keys: function()
+    values: function()
     {
         var result = [];
-        for (var key in this._map)
-            result.push(key);
+        for (var objectIdentifier in this._map)
+            result.push(this._map[objectIdentifier]);
         return result;
     },
     
diff --git a/Source/WebCore/loader/DocumentLoadTiming.cpp b/Source/WebCore/loader/DocumentLoadTiming.cpp
index a2f5ecbb9..874a90882 100644
--- a/Source/WebCore/loader/DocumentLoadTiming.cpp
+++ b/Source/WebCore/loader/DocumentLoadTiming.cpp
@@ -72,6 +72,12 @@ void DocumentLoadTiming::markNavigationStart(Frame* frame)
     }
 }
 
+void DocumentLoadTiming::setNavigationStart(double navigationStart)
+{
+    ASSERT(m_referenceMonotonicTime && m_referenceWallTime);
+    m_navigationStart = navigationStart;
+}
+
 void DocumentLoadTiming::addRedirect(const KURL& redirectingUrl, const KURL& redirectedUrl)
 {
     m_redirectCount++;
diff --git a/Source/WebCore/loader/DocumentLoadTiming.h b/Source/WebCore/loader/DocumentLoadTiming.h
index 0e64a182b..6e664b68b 100644
--- a/Source/WebCore/loader/DocumentLoadTiming.h
+++ b/Source/WebCore/loader/DocumentLoadTiming.h
@@ -38,6 +38,7 @@ public:
     DocumentLoadTiming();
 
     void markNavigationStart(Frame*);
+    void setNavigationStart(double);
     void addRedirect(const KURL& redirectingUrl, const KURL& redirectedUrl);
     double convertMonotonicTimeToDocumentTime(double monotonicTime) const;
 
diff --git a/Source/WebCore/loader/DocumentWriter.cpp b/Source/WebCore/loader/DocumentWriter.cpp
index 9ce3effd6..654d4e526 100644
--- a/Source/WebCore/loader/DocumentWriter.cpp
+++ b/Source/WebCore/loader/DocumentWriter.cpp
@@ -58,6 +58,7 @@ DocumentWriter::DocumentWriter(Frame* frame)
     : m_frame(frame)
     , m_hasReceivedSomeData(false)
     , m_encodingWasChosenByUser(false)
+    , m_state(NotStartedWritingState)
 {
 }
 
@@ -154,6 +155,8 @@ void DocumentWriter::begin(const KURL& urlReference, bool dispatch, Document* ow
 
     if (m_frame->view() && m_frame->loader()->client()->hasHTMLView())
         m_frame->view()->setContentsSize(IntSize());
+
+    m_state = StartedWritingState;
 }
 
 TextResourceDecoder* DocumentWriter::createDecoderIfNeeded()
@@ -203,6 +206,15 @@ void DocumentWriter::reportDataReceived()
 
 void DocumentWriter::addData(const char* bytes, size_t length)
 {
+    // Check that we're inside begin()/end().
+    // FIXME: Change these to ASSERT once https://bugs.webkit.org/show_bug.cgi?id=80427 has
+    // been resolved.
+    if (m_state == NotStartedWritingState)
+        CRASH();
+    if (m_state == FinishedWritingState)
+        CRASH();
+
+    ASSERT(m_parser);
     m_parser->appendBytes(this, bytes, length);
 }
 
@@ -219,6 +231,10 @@ void DocumentWriter::endIfNotLoadingMainResource()
     if (m_frame->loader()->isLoadingMainResource() || !m_frame->page() || !m_frame->document())
         return;
 
+    // The parser is guaranteed to be released after this point. begin() would
+    // have to be called again before we can start writing more data.
+    m_state = FinishedWritingState;
+
     // http://bugs.webkit.org/show_bug.cgi?id=10854
     // The frame's last ref may be removed and it can be deleted by checkCompleted(), 
     // so we'll add a protective refcount
@@ -243,7 +259,7 @@ void DocumentWriter::setEncoding(const String& name, bool userChosen)
 
 void DocumentWriter::setDocumentWasLoadedAsPartOfNavigation()
 {
-    ASSERT(!m_parser->isStopped());
+    ASSERT(m_parser && !m_parser->isStopped());
     m_parser->setDocumentWasLoadedAsPartOfNavigation();
 }
 
diff --git a/Source/WebCore/loader/DocumentWriter.h b/Source/WebCore/loader/DocumentWriter.h
index bf8d95f7f..34bf83016 100644
--- a/Source/WebCore/loader/DocumentWriter.h
+++ b/Source/WebCore/loader/DocumentWriter.h
@@ -53,7 +53,6 @@ public:
     void begin(const KURL&, bool dispatchWindowObjectAvailable = true, Document* ownerDocument = 0);
     void addData(const char* bytes, size_t length);
     void end();
-    void endIfNotLoadingMainResource();
     
     void setFrame(Frame* frame) { m_frame = frame; }
 
@@ -71,6 +70,7 @@ public:
 private:
     PassRefPtr<Document> createDocument(const KURL&);
     void clear();
+    void endIfNotLoadingMainResource();
 
     Frame* m_frame;
 
@@ -81,6 +81,13 @@ private:
     String m_encoding;
     RefPtr<TextResourceDecoder> m_decoder;
     RefPtr<DocumentParser> m_parser;
+
+    enum WriterState {
+        NotStartedWritingState,
+        StartedWritingState,
+        FinishedWritingState,
+    };
+    WriterState m_state;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/loader/EmptyClients.h b/Source/WebCore/loader/EmptyClients.h
index 8c4f00a52..3fc204dc2 100644
--- a/Source/WebCore/loader/EmptyClients.h
+++ b/Source/WebCore/loader/EmptyClients.h
@@ -151,9 +151,9 @@ public:
     virtual bool hasOpenedPopup() const OVERRIDE { return false; }
     virtual PassRefPtr<PopupMenu> createPopupMenu(PopupMenuClient*) const { return adoptRef(new EmptyPopupMenu()); }
     virtual PassRefPtr<SearchPopupMenu> createSearchPopupMenu(PopupMenuClient*) const { return adoptRef(new EmptySearchPopupMenu()); }
-
-#if ENABLE(CONTEXT_MENUS)
-    virtual void showContextMenu() { }
+#if ENABLE(PAGE_POPUP)
+    virtual PagePopup* openPagePopup(PagePopupClient*, const IntRect&) OVERRIDE { return 0; }
+    virtual void closePagePopup(PagePopup*) OVERRIDE { }
 #endif
 
 #if ENABLE(REGISTER_PROTOCOL_HANDLER)
@@ -398,7 +398,7 @@ public:
     virtual void registerForIconNotification(bool) { }
 
 #if USE(V8)
-    virtual void didCreateScriptContext(v8::Handle<v8::Context>, int worldId) { }
+    virtual void didCreateScriptContext(v8::Handle<v8::Context>, int extensionGroup, int worldId) { }
     virtual void willReleaseScriptContext(v8::Handle<v8::Context>, int worldId) { }
     virtual bool allowScriptExtension(const String& extensionName, int extensionGroup, int worldId) { return false; }
 #endif
@@ -498,7 +498,7 @@ public:
 
     virtual NSString* userVisibleString(NSURL*) { return 0; }
     virtual DocumentFragment* documentFragmentFromAttributedString(NSAttributedString*, Vector<RefPtr<ArchiveResource> >&) { return 0; };
-    virtual void setInsertionPasteboard(NSPasteboard*) { };
+    virtual void setInsertionPasteboard(const String&) { };
     virtual NSURL* canonicalizeURL(NSURL*) { return 0; }
     virtual NSURL* canonicalizeURLString(NSString*) { return 0; }
 #endif
@@ -566,6 +566,10 @@ public:
 #if PLATFORM(MAC)
     virtual void searchWithSpotlight() { }
 #endif
+
+#if USE(ACCESSIBILITY_CONTEXT_MENUS)
+    virtual void showContextMenu() { }
+#endif
 };
 #endif // ENABLE(CONTEXT_MENUS)
 
diff --git a/Source/WebCore/loader/FrameLoader.cpp b/Source/WebCore/loader/FrameLoader.cpp
index 5635539d7..6776ad793 100644
--- a/Source/WebCore/loader/FrameLoader.cpp
+++ b/Source/WebCore/loader/FrameLoader.cpp
@@ -46,6 +46,7 @@
 #include "ChromeClient.h"
 #include "Console.h"
 #include "ContentSecurityPolicy.h"
+#include "DatabaseContext.h"
 #include "DOMImplementation.h"
 #include "DOMWindow.h"
 #include "Document.h"
@@ -250,7 +251,6 @@ void FrameLoader::setDefersLoading(bool defers)
 
 void FrameLoader::changeLocation(SecurityOrigin* securityOrigin, const KURL& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool refresh)
 {
-    RefPtr<Frame> protect(m_frame);
     urlSelected(FrameLoadRequest(securityOrigin, ResourceRequest(url, referrer, refresh ? ReloadIgnoringCacheData : UseProtocolCachePolicy), "_self"),
         0, lockHistory, lockBackForwardList, MaybeSendReferrer, ReplaceDocumentIfJavaScriptURL);
 }
@@ -267,6 +267,7 @@ void FrameLoader::urlSelected(const FrameLoadRequest& passedRequest, PassRefPtr<
 {
     ASSERT(!m_suppressOpenerInNewFrame);
 
+    RefPtr<Frame> protect(m_frame);
     FrameLoadRequest frameRequest(passedRequest);
 
     if (m_frame->script()->executeIfJavaScriptURL(frameRequest.resourceRequest().url(), shouldReplaceDocumentIfJavaScriptURL))
@@ -418,7 +419,8 @@ void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy)
         doc->setReadyState(Document::Complete);
 
 #if ENABLE(SQL_DATABASE)
-        doc->stopDatabases(0);
+        // FIXME: Should the DatabaseContext watch for something like ActiveDOMObject::stop() rather than being special-cased here?
+        DatabaseContext::stopDatabases(doc, 0);
 #endif
     }
 
@@ -736,6 +738,7 @@ void FrameLoader::checkCompleted()
 
     // OK, completed.
     m_isComplete = true;
+    m_requestedHistoryItem = 0;
     m_frame->document()->setReadyState(Document::Complete);
 
     RefPtr<Frame> protect(m_frame);
@@ -2023,7 +2026,7 @@ void FrameLoader::open(CachedFrameBase& cachedFrame)
     KURL url = cachedFrame.url();
 
     // FIXME: I suspect this block of code doesn't do anything.
-    if (url.protocolInHTTPFamily() && !url.host().isEmpty() && url.path().isEmpty())
+    if (url.protocolIsInHTTPFamily() && !url.host().isEmpty() && url.path().isEmpty())
         url.setPath("/");
 
     m_hasReceivedFirstData = false;
@@ -2552,7 +2555,7 @@ void FrameLoader::addExtraFieldsToRequest(ResourceRequest& request, FrameLoadTyp
     }
 
     // The remaining modifications are only necessary for HTTP and HTTPS.
-    if (!request.url().isEmpty() && !request.url().protocolInHTTPFamily())
+    if (!request.url().isEmpty() && !request.url().protocolIsInHTTPFamily())
         return;
 
     applyUserAgent(request);
@@ -3171,6 +3174,7 @@ void FrameLoader::loadDifferentDocumentItem(HistoryItem* item, FrameLoadType loa
 // Loads content into this frame, as specified by history item
 void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
 {
+    m_requestedHistoryItem = item;
     HistoryItem* currentItem = history()->currentItem();
     bool sameDocumentNavigation = currentItem && item->shouldDoSameDocumentNavigationTo(currentItem);
 
diff --git a/Source/WebCore/loader/FrameLoader.h b/Source/WebCore/loader/FrameLoader.h
index 218028c64..df357d6cd 100644
--- a/Source/WebCore/loader/FrameLoader.h
+++ b/Source/WebCore/loader/FrameLoader.h
@@ -119,6 +119,7 @@ public:
 
     void open(CachedFrameBase&);
     void loadItem(HistoryItem*, FrameLoadType);
+    HistoryItem* requestedHistoryItem() const { return m_requestedHistoryItem.get(); }
 
     static void reportLocalLoadFailed(Frame*, const String& url);
 
@@ -437,6 +438,7 @@ private:
 #endif
 
     KURL m_previousUrl;
+    RefPtr<HistoryItem> m_requestedHistoryItem;
 };
 
 // This function is called by createWindow() in JSDOMWindowBase.cpp, for example, for
diff --git a/Source/WebCore/loader/FrameLoaderClient.h b/Source/WebCore/loader/FrameLoaderClient.h
index 8efa55538..235c41c83 100644
--- a/Source/WebCore/loader/FrameLoaderClient.h
+++ b/Source/WebCore/loader/FrameLoaderClient.h
@@ -280,7 +280,7 @@ namespace WebCore {
         virtual void didPerformFirstNavigation() const = 0; // "Navigation" here means a transition from one page to another that ends up in the back/forward list.
 
 #if USE(V8)
-        virtual void didCreateScriptContext(v8::Handle<v8::Context>, int worldId) = 0;
+        virtual void didCreateScriptContext(v8::Handle<v8::Context>, int extensionGroup, int worldId) = 0;
         virtual void willReleaseScriptContext(v8::Handle<v8::Context>, int worldId) = 0;
         virtual bool allowScriptExtension(const String& extensionName, int extensionGroup, int worldId) = 0;
 #endif
diff --git a/Source/WebCore/loader/HistoryController.cpp b/Source/WebCore/loader/HistoryController.cpp
index 379b6d357..e44ba1e86 100644
--- a/Source/WebCore/loader/HistoryController.cpp
+++ b/Source/WebCore/loader/HistoryController.cpp
@@ -200,9 +200,10 @@ void HistoryController::restoreDocumentState()
     
     if (!itemToRestore)
         return;
-
-    LOG(Loading, "WebCoreLoading %s: restoring form state from %p", m_frame->tree()->uniqueName().string().utf8().data(), itemToRestore);
-    doc->setStateForNewFormElements(itemToRestore->documentState());
+    if (m_frame->loader()->requestedHistoryItem() == m_currentItem.get() && !m_frame->loader()->documentLoader()->isClientRedirect()) {
+        LOG(Loading, "WebCoreLoading %s: restoring form state from %p", m_frame->tree()->uniqueName().string().utf8().data(), itemToRestore);
+        doc->setStateForNewFormElements(itemToRestore->documentState());
+    }
 }
 
 void HistoryController::invalidateCurrentItemCachedPage()
diff --git a/Source/WebCore/loader/ResourceLoadScheduler.cpp b/Source/WebCore/loader/ResourceLoadScheduler.cpp
index 86cf0a1a2..8004d8f2e 100644
--- a/Source/WebCore/loader/ResourceLoadScheduler.cpp
+++ b/Source/WebCore/loader/ResourceLoadScheduler.cpp
@@ -54,7 +54,7 @@ static const unsigned maxRequestsInFlightPerHost = 10000;
 
 ResourceLoadScheduler::HostInformation* ResourceLoadScheduler::hostForURL(const KURL& url, CreateHostPolicy createHostPolicy)
 {
-    if (!url.protocolInHTTPFamily())
+    if (!url.protocolIsInHTTPFamily())
         return m_nonHTTPProtocolHost;
 
     m_hosts.checkConsistency();
@@ -126,7 +126,7 @@ void ResourceLoadScheduler::scheduleLoad(ResourceLoader* resourceLoader, Resourc
     bool hadRequests = host->hasRequests();
     host->schedule(resourceLoader, priority);
 
-    if (priority > ResourceLoadPriorityLow || !resourceLoader->url().protocolInHTTPFamily() || (priority == ResourceLoadPriorityLow && !hadRequests)) {
+    if (priority > ResourceLoadPriorityLow || !resourceLoader->url().protocolIsInHTTPFamily() || (priority == ResourceLoadPriorityLow && !hadRequests)) {
         // Try to request important resources immediately.
         servePendingRequests(host, priority);
         return;
diff --git a/Source/WebCore/loader/ResourceLoader.cpp b/Source/WebCore/loader/ResourceLoader.cpp
index 4ec26cc0c..d8fe7dab0 100644
--- a/Source/WebCore/loader/ResourceLoader.cpp
+++ b/Source/WebCore/loader/ResourceLoader.cpp
@@ -31,8 +31,8 @@
 #include "ResourceLoader.h"
 
 #include "ApplicationCacheHost.h"
+#include "AsyncFileStream.h"
 #include "DocumentLoader.h"
-#include "FileStreamProxy.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
@@ -113,6 +113,7 @@ bool ResourceLoader::init(const ResourceRequest& r)
     
     ResourceRequest clientRequest(r);
     
+    m_defersLoading = m_frame->page()->defersLoading();
     if (m_options.securityCheck == DoSecurityCheck && !m_frame->document()->securityOrigin()->canDisplay(clientRequest.url())) {
         FrameLoader::reportLocalLoadFailed(m_frame.get(), clientRequest.url().string());
         releaseResources();
@@ -559,8 +560,8 @@ void ResourceLoader::willCacheResponse(ResourceHandle*, CacheStoragePolicy& poli
 #if ENABLE(BLOB)
 AsyncFileStream* ResourceLoader::createAsyncFileStream(FileStreamClient* client)
 {
-    // It is OK to simply return a pointer since FileStreamProxy::create adds an extra ref.
-    return FileStreamProxy::create(m_frame->document()->scriptExecutionContext(), client).get();
+    // It is OK to simply return a pointer since AsyncFileStream::create adds an extra ref.
+    return AsyncFileStream::create(m_frame->document()->scriptExecutionContext(), client).get();
 }
 #endif
 
diff --git a/Source/WebCore/loader/appcache/ApplicationCache.cpp b/Source/WebCore/loader/appcache/ApplicationCache.cpp
index 589587d30..63cd7bbbf 100644
--- a/Source/WebCore/loader/appcache/ApplicationCache.cpp
+++ b/Source/WebCore/loader/appcache/ApplicationCache.cpp
@@ -117,7 +117,7 @@ ApplicationCacheResource* ApplicationCache::resourceForURL(const String& url)
 
 bool ApplicationCache::requestIsHTTPOrHTTPSGet(const ResourceRequest& request)
 {
-    if (!request.url().protocolInHTTPFamily())
+    if (!request.url().protocolIsInHTTPFamily())
         return false;
     
     if (!equalIgnoringCase(request.httpMethod(), "GET"))
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheAllInOne.cpp b/Source/WebCore/loader/appcache/ApplicationCacheAllInOne.cpp
new file mode 100644
index 000000000..f0e13625f
--- /dev/null
+++ b/Source/WebCore/loader/appcache/ApplicationCacheAllInOne.cpp
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
+
+#include "ApplicationCache.cpp"
+#include "ApplicationCacheGroup.cpp"
+#include "ApplicationCacheHost.cpp"
+#include "ApplicationCacheResource.cpp"
+#include "ApplicationCacheStorage.cpp"
diff --git a/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index 013a78ddd..e6229c44d 100644
--- a/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/Source/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -490,6 +490,22 @@ PassRefPtr<ResourceHandle> ApplicationCacheGroup::createResourceHandle(const KUR
         }
     }
 
+#if PLATFORM(BLACKBERRY)
+    ResourceRequest::TargetType target = ResourceRequest::TargetIsUnspecified;
+    if (newestCachedResource) {
+        const String& mimeType = newestCachedResource->response().mimeType();
+        if (!mimeType.isEmpty())
+            target = ResourceRequest::targetTypeFromMimeType(mimeType);
+    }
+    if (target == ResourceRequest::TargetIsUnspecified) {
+        String mimeType = mimeTypeFromDataURL(url);
+        if (!mimeType.isEmpty())
+            target = ResourceRequest::targetTypeFromMimeType(mimeType);
+    }
+
+    request.setTargetType(target);
+#endif
+
     RefPtr<ResourceHandle> handle = ResourceHandle::create(m_frame->loader()->networkingContext(), request, this, false, true);
 #if ENABLE(INSPECTOR)
     // Because willSendRequest only gets called during redirects, we initialize
diff --git a/Source/WebCore/loader/cache/CachedRawResource.cpp b/Source/WebCore/loader/cache/CachedRawResource.cpp
index 196d7a90d..8df8fb61c 100644
--- a/Source/WebCore/loader/cache/CachedRawResource.cpp
+++ b/Source/WebCore/loader/cache/CachedRawResource.cpp
@@ -74,9 +74,10 @@ void CachedRawResource::didAddClient(CachedResourceClient* c)
         return;
     CachedRawResourceClient* client = static_cast<CachedRawResourceClient*>(c);
     client->responseReceived(this, m_response);
-    if (!hasClient(c) || !m_data)
+    if (!hasClient(c))
         return;
-    client->dataReceived(this, m_data->data(), m_data->size());
+    if (m_data)
+        client->dataReceived(this, m_data->data(), m_data->size());
     if (!hasClient(c))
        return;
     CachedResource::didAddClient(client);
diff --git a/Source/WebCore/loader/cache/CachedResource.cpp b/Source/WebCore/loader/cache/CachedResource.cpp
index 78a71c187..a74dbd6aa 100755
--- a/Source/WebCore/loader/cache/CachedResource.cpp
+++ b/Source/WebCore/loader/cache/CachedResource.cpp
@@ -91,7 +91,7 @@ static ResourceLoadPriority defaultPriorityForResourceType(CachedResource::Type
     return ResourceLoadPriorityLow;
 }
 
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
 static ResourceRequest::TargetType cachedResourceTypeToTargetType(CachedResource::Type type)
 {
     switch (type) {
@@ -191,7 +191,7 @@ void CachedResource::load(CachedResourceLoader* cachedResourceLoader, const Reso
     m_options = options;
     m_loading = true;
 
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
     if (m_resourceRequest.targetType() == ResourceRequest::TargetIsUnspecified)
         m_resourceRequest.setTargetType(cachedResourceTypeToTargetType(type()));
 #endif
@@ -299,7 +299,7 @@ double CachedResource::currentAge() const
 double CachedResource::freshnessLifetime() const
 {
     // Cache non-http resources liberally
-    if (!m_response.url().protocolInHTTPFamily())
+    if (!m_response.url().protocolIsInHTTPFamily())
         return std::numeric_limits<double>::max();
 
     // RFC2616 13.2.4
diff --git a/Source/WebCore/loader/cache/CachedResourceLoader.cpp b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
index aaf753eb8..7dc24f9c4 100644
--- a/Source/WebCore/loader/cache/CachedResourceLoader.cpp
+++ b/Source/WebCore/loader/cache/CachedResourceLoader.cpp
@@ -330,8 +330,8 @@ bool CachedResourceLoader::canRequest(CachedResource::Type type, const KURL& url
             printAccessDeniedMessage(url);
             return false;
         }
-        break;
 #endif
+        break;
     }
 
     switch (type) {
diff --git a/Source/WebCore/loader/cache/CachedShader.cpp b/Source/WebCore/loader/cache/CachedShader.cpp
index 16d780adc..b8d7c5f9a 100644
--- a/Source/WebCore/loader/cache/CachedShader.cpp
+++ b/Source/WebCore/loader/cache/CachedShader.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/loader/cache/CachedShader.h b/Source/WebCore/loader/cache/CachedShader.h
index cc38f58b4..d1de14d77 100644
--- a/Source/WebCore/loader/cache/CachedShader.h
+++ b/Source/WebCore/loader/cache/CachedShader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/loader/cache/MemoryCache.cpp b/Source/WebCore/loader/cache/MemoryCache.cpp
index f46889fd0..6796c12fb 100644
--- a/Source/WebCore/loader/cache/MemoryCache.cpp
+++ b/Source/WebCore/loader/cache/MemoryCache.cpp
@@ -77,7 +77,7 @@ KURL MemoryCache::removeFragmentIdentifierIfNeeded(const KURL& originalURL)
     // Strip away fragment identifier from HTTP URLs.
     // Data URLs must be unmodified. For file and custom URLs clients may expect resources 
     // to be unique even when they differ by the fragment identifier only.
-    if (!originalURL.protocolInHTTPFamily())
+    if (!originalURL.protocolIsInHTTPFamily())
         return originalURL;
     KURL url = originalURL;
     url.removeFragmentIdentifier();
diff --git a/Source/WebCore/loader/cache/MemoryCache.h b/Source/WebCore/loader/cache/MemoryCache.h
index a937d96d2..0ad79fce9 100644
--- a/Source/WebCore/loader/cache/MemoryCache.h
+++ b/Source/WebCore/loader/cache/MemoryCache.h
@@ -162,6 +162,12 @@ public:
     void removeResourcesWithOrigin(SecurityOrigin*);
     void getOriginsWithCache(SecurityOriginSet& origins);
 
+    unsigned minDeadCapacity() const { return m_minDeadCapacity; }
+    unsigned maxDeadCapacity() const { return m_maxDeadCapacity; }
+    unsigned capacity() const { return m_capacity; }
+    unsigned liveSize() const { return m_liveSize; }
+    unsigned deadSize() const { return m_deadSize; }
+
 private:
     MemoryCache();
     ~MemoryCache(); // Not implemented to make sure nobody accidentally calls delete -- WebCore does not delete singletons.
diff --git a/Source/WebCore/loader/icon/IconController.cpp b/Source/WebCore/loader/icon/IconController.cpp
index 2e5638cb0..b4a72c63b 100644
--- a/Source/WebCore/loader/icon/IconController.cpp
+++ b/Source/WebCore/loader/icon/IconController.cpp
@@ -257,7 +257,7 @@ IconURL IconController::defaultURL(IconType iconType)
 {
     // Don't return a favicon iconURL unless we're http or https
     KURL documentURL = m_frame->document()->url();
-    if (!documentURL.protocolInHTTPFamily())
+    if (!documentURL.protocolIsInHTTPFamily())
         return IconURL();
 
     KURL url;
diff --git a/Source/WebCore/loader/icon/IconDatabase.h b/Source/WebCore/loader/icon/IconDatabase.h
index f4abb8b13..e4d8ca73a 100644
--- a/Source/WebCore/loader/icon/IconDatabase.h
+++ b/Source/WebCore/loader/icon/IconDatabase.h
@@ -63,7 +63,10 @@ class SQLTransaction;
 // For builds with IconDatabase disabled, they'll just use a default derivation of IconDatabaseBase. Which does nothing.
 class IconDatabase : public IconDatabaseBase {
 public:
+    static PassOwnPtr<IconDatabase> create() { return adoptPtr(new IconDatabase); }
     static void delayDatabaseCleanup() { }
+    static void allowDatabaseCleanup() { }
+    static void checkIntegrityBeforeOpening() { }
     static String defaultDatabaseFilename() { return "WebpageIcons.db"; }
 };
 #else 
diff --git a/Source/WebCore/mathml/MathMLAllInOne.cpp b/Source/WebCore/mathml/MathMLAllInOne.cpp
new file mode 100644
index 000000000..76b54a9e4
--- /dev/null
+++ b/Source/WebCore/mathml/MathMLAllInOne.cpp
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
+
+#include "MathMLElement.cpp"
+#include "MathMLInlineContainerElement.cpp"
+#include "MathMLMathElement.cpp"
+#include "MathMLTextElement.cpp"
diff --git a/Source/WebCore/mathml/MathMLElement.cpp b/Source/WebCore/mathml/MathMLElement.cpp
index 4c00defa3..44a1ac3d8 100644
--- a/Source/WebCore/mathml/MathMLElement.cpp
+++ b/Source/WebCore/mathml/MathMLElement.cpp
@@ -48,11 +48,11 @@ PassRefPtr<MathMLElement> MathMLElement::create(const QualifiedName& tagName, Do
     return adoptRef(new MathMLElement(tagName, document));
 }
 
-bool MathMLElement::isPresentationAttribute(Attribute* attr) const
+bool MathMLElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == mathbackgroundAttr || attr->name() == mathsizeAttr || attr->name() == mathcolorAttr || attr->name() == fontsizeAttr || attr->name() == backgroundAttr || attr->name() == colorAttr || attr->name() == fontstyleAttr || attr->name() == fontweightAttr || attr->name() == fontfamilyAttr)
+    if (name == mathbackgroundAttr || name == mathsizeAttr || name == mathcolorAttr || name == fontsizeAttr || name == backgroundAttr || name == colorAttr || name == fontstyleAttr || name == fontweightAttr || name == fontfamilyAttr)
         return true;
-    return StyledElement::isPresentationAttribute(attr);
+    return StyledElement::isPresentationAttribute(name);
 }
 
 void MathMLElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
@@ -79,7 +79,7 @@ void MathMLElement::collectStyleForAttribute(Attribute* attr, StylePropertySet*
     else if (attr->name() == fontfamilyAttr)
         addPropertyToAttributeStyle(style, CSSPropertyFontFamily, attr->value());
     else {
-        ASSERT(!isPresentationAttribute(attr));
+        ASSERT(!isPresentationAttribute(attr->name()));
         StyledElement::collectStyleForAttribute(attr, style);
     }
 }
diff --git a/Source/WebCore/mathml/MathMLElement.h b/Source/WebCore/mathml/MathMLElement.h
index 4b092513f..753537bc3 100644
--- a/Source/WebCore/mathml/MathMLElement.h
+++ b/Source/WebCore/mathml/MathMLElement.h
@@ -42,10 +42,16 @@ protected:
 
 private:    
     virtual bool isMathMLElement() const { return true; }
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
 };
-    
+
+inline MathMLElement* toMathMLElement(Element* element)
+{
+    ASSERT(!element || element->isMathMLElement());
+    return static_cast<MathMLElement*>(element);
+}
+
 }
 
 #endif // ENABLE(MATHML)
diff --git a/Source/WebCore/mediastream/DOMWindowMediaStream.idl b/Source/WebCore/mediastream/DOMWindowMediaStream.idl
deleted file mode 100644
index 589878abe..000000000
--- a/Source/WebCore/mediastream/DOMWindowMediaStream.idl
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-module window {
-
-    interface [
-        Conditional=MEDIA_STREAM,
-        Supplemental=DOMWindow
-    ] DOMWindowMediaStream {
-        attribute [V8EnabledAtRuntime] PeerConnectionConstructor webkitPeerConnection;
-        attribute MediaStreamEventConstructor MediaStreamEvent;
-    };
-
-}
diff --git a/Source/WebCore/notifications/Notification.cpp b/Source/WebCore/notifications/Notification.cpp
index 74964dc77..5de0e527c 100644
--- a/Source/WebCore/notifications/Notification.cpp
+++ b/Source/WebCore/notifications/Notification.cpp
@@ -39,8 +39,8 @@
 #include "ErrorEvent.h"
 #include "EventNames.h"
 #include "NotificationCenter.h"
+#include "NotificationClient.h"
 #include "NotificationContents.h"
-#include "NotificationPresenter.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
 #include "ThreadableLoader.h"
@@ -59,8 +59,8 @@ Notification::Notification(const KURL& url, ScriptExecutionContext* context, Exc
     , m_state(Idle)
     , m_notificationCenter(provider)
 {
-    ASSERT(m_notificationCenter->presenter());
-    if (m_notificationCenter->presenter()->checkPermission(context) != NotificationPresenter::PermissionAllowed) {
+    ASSERT(m_notificationCenter->client());
+    if (m_notificationCenter->client()->checkPermission(context) != NotificationClient::PermissionAllowed) {
         ec = SECURITY_ERR;
         return;
     }
@@ -80,8 +80,8 @@ Notification::Notification(const NotificationContents& contents, ScriptExecution
     , m_state(Idle)
     , m_notificationCenter(provider)
 {
-    ASSERT(m_notificationCenter->presenter());
-    if (m_notificationCenter->presenter()->checkPermission(context) != NotificationPresenter::PermissionAllowed) {
+    ASSERT(m_notificationCenter->client());
+    if (m_notificationCenter->client()->checkPermission(context) != NotificationClient::PermissionAllowed) {
         ec = SECURITY_ERR;
         return;
     }
@@ -127,19 +127,19 @@ void Notification::show()
         // handling of ondisplay may rely on that.
         if (m_state == Idle) {
             m_state = Showing;
-            if (m_notificationCenter->presenter())
-                m_notificationCenter->presenter()->show(this);
+            if (m_notificationCenter->client())
+                m_notificationCenter->client()->show(this);
         }
     } else
         startLoading();
 #elif PLATFORM(MAC)
-    if (m_state == Idle && m_notificationCenter->presenter()) {
-        m_notificationCenter->presenter()->show(this);
+    if (m_state == Idle && m_notificationCenter->client()) {
+        m_notificationCenter->client()->show(this);
         m_state = Showing;
     }
 #else
     // prevent double-showing
-    if (m_state == Idle && m_notificationCenter->presenter() && m_notificationCenter->presenter()->show(this))
+    if (m_state == Idle && m_notificationCenter->client() && m_notificationCenter->client()->show(this))
         m_state = Showing;
 #endif
 }
@@ -154,8 +154,8 @@ void Notification::cancel()
         stopLoading();
         break;
     case Showing:
-        if (m_notificationCenter->presenter())
-            m_notificationCenter->presenter()->cancel(this);
+        if (m_notificationCenter->client())
+            m_notificationCenter->client()->cancel(this);
         break;
     case Cancelled:
         break;
@@ -175,8 +175,8 @@ EventTargetData* Notification::ensureEventTargetData()
 void Notification::contextDestroyed()
 {
     ActiveDOMObject::contextDestroyed();
-    if (m_notificationCenter->presenter())
-        m_notificationCenter->presenter()->notificationObjectDestroyed(this);
+    if (m_notificationCenter->client())
+        m_notificationCenter->client()->notificationObjectDestroyed(this);
 }
 
 void Notification::startLoading()
@@ -234,7 +234,7 @@ void Notification::didFailRedirectCheck()
 void Notification::finishLoading()
 {
     if (m_state == Loading) {
-        if (m_notificationCenter->presenter() && m_notificationCenter->presenter()->show(this))
+        if (m_notificationCenter->client() && m_notificationCenter->client()->show(this))
             m_state = Showing;
     }
     unsetPendingActivity(this);
diff --git a/Source/WebCore/notifications/NotificationCenter.cpp b/Source/WebCore/notifications/NotificationCenter.cpp
index 71146af8d..ff6044531 100644
--- a/Source/WebCore/notifications/NotificationCenter.cpp
+++ b/Source/WebCore/notifications/NotificationCenter.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -35,46 +36,46 @@
 #include "NotificationCenter.h"
 
 #include "Document.h"
-#include "NotificationPresenter.h"
+#include "NotificationClient.h"
 #include "VoidCallback.h"
 #include "WorkerContext.h"
 
 namespace WebCore {
 
-PassRefPtr<NotificationCenter> NotificationCenter::create(ScriptExecutionContext* context, NotificationPresenter* presenter)
+PassRefPtr<NotificationCenter> NotificationCenter::create(ScriptExecutionContext* context, NotificationClient* client)
 {
-    RefPtr<NotificationCenter> notificationCenter(adoptRef(new NotificationCenter(context, presenter)));
+    RefPtr<NotificationCenter> notificationCenter(adoptRef(new NotificationCenter(context, client)));
     notificationCenter->suspendIfNeeded();
     return notificationCenter.release();
 }
 
-NotificationCenter::NotificationCenter(ScriptExecutionContext* context, NotificationPresenter* presenter)
+NotificationCenter::NotificationCenter(ScriptExecutionContext* context, NotificationClient* client)
     : ActiveDOMObject(context, this)
-    , m_notificationPresenter(presenter) {}
+    , m_client(client) { }
 
 int NotificationCenter::checkPermission()
 {
-    if (!presenter() || !scriptExecutionContext())
-        return NotificationPresenter::PermissionDenied;
-    return m_notificationPresenter->checkPermission(scriptExecutionContext());
+    if (!client() || !scriptExecutionContext())
+        return NotificationClient::PermissionDenied;
+    return m_client->checkPermission(scriptExecutionContext());
 }
 
 void NotificationCenter::requestPermission(PassRefPtr<VoidCallback> callback)
 {
-    if (!presenter() || !scriptExecutionContext())
+    if (!client() || !scriptExecutionContext())
         return;
-    m_notificationPresenter->requestPermission(scriptExecutionContext(), callback);
+    m_client->requestPermission(scriptExecutionContext(), callback);
 }
 
 void NotificationCenter::disconnectFrame()
 {
     // Can be 0 if iframe was transferred into another page. In this case
     // this method is invoked more then once.
-    if (!m_notificationPresenter)
+    if (!m_client)
         return;
-    m_notificationPresenter->cancelRequestsForPermission(scriptExecutionContext());
-    m_notificationPresenter->clearNotifications(scriptExecutionContext());
-    m_notificationPresenter = 0;
+    m_client->cancelRequestsForPermission(scriptExecutionContext());
+    m_client->clearNotifications(scriptExecutionContext());
+    m_client = 0;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/notifications/NotificationCenter.h b/Source/WebCore/notifications/NotificationCenter.h
index 402ccba93..2cccc0dfc 100644
--- a/Source/WebCore/notifications/NotificationCenter.h
+++ b/Source/WebCore/notifications/NotificationCenter.h
@@ -45,16 +45,16 @@
 
 namespace WebCore {
 
-class NotificationPresenter;
+class NotificationClient;
 class VoidCallback;
 
 class NotificationCenter : public RefCounted<NotificationCenter>, public ActiveDOMObject {
 public:
-    static PassRefPtr<NotificationCenter> create(ScriptExecutionContext*, NotificationPresenter*);
+    static PassRefPtr<NotificationCenter> create(ScriptExecutionContext*, NotificationClient*);
 
     PassRefPtr<Notification> createHTMLNotification(const String& URI, ExceptionCode& ec)
     {
-        if (!presenter()) {
+        if (!client()) {
             ec = INVALID_STATE_ERR;
             return 0;
         }
@@ -67,7 +67,7 @@ public:
 
     PassRefPtr<Notification> createNotification(const String& iconURI, const String& title, const String& body, ExceptionCode& ec)
     {
-        if (!presenter()) {
+        if (!client()) {
             ec = INVALID_STATE_ERR;
             return 0;
         }
@@ -75,7 +75,7 @@ public:
         return Notification::create(contents, scriptExecutionContext(), ec, this);
     }
 
-    NotificationPresenter* presenter() const { return m_notificationPresenter; }
+    NotificationClient* client() const { return m_client; }
 
     int checkPermission();
     void requestPermission(PassRefPtr<VoidCallback>);
@@ -83,9 +83,9 @@ public:
     void disconnectFrame();
 
 private:
-    NotificationCenter(ScriptExecutionContext*, NotificationPresenter*);
+    NotificationCenter(ScriptExecutionContext*, NotificationClient*);
 
-    NotificationPresenter* m_notificationPresenter;
+    NotificationClient* m_client;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/notifications/NotificationPresenter.h b/Source/WebCore/notifications/NotificationClient.h
index 1935384dc..c1b339b34 100644
--- a/Source/WebCore/notifications/NotificationPresenter.h
+++ b/Source/WebCore/notifications/NotificationClient.h
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,11 +29,11 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef NotificationPresenter_h
-#define NotificationPresenter_h
+#ifndef NotificationClient_h
+#define NotificationClient_h
 
-#include <wtf/PassRefPtr.h>
 #include "VoidCallback.h"
+#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
@@ -43,7 +43,7 @@ class KURL;
 class Page;
 class ScriptExecutionContext;
 
-class NotificationPresenter {
+class NotificationClient {
 
 public:
     enum Permission {
@@ -82,11 +82,11 @@ public:
     virtual Permission checkPermission(ScriptExecutionContext*) = 0;
 
 protected:
-    virtual ~NotificationPresenter() { }
+    virtual ~NotificationClient() { }
 };
 
-void provideNotification(Page*, NotificationPresenter*);
+void provideNotification(Page*, NotificationClient*);
 
 } // namespace WebCore
 
-#endif // NotificationPresenter_h
+#endif // NotificationClient_h
diff --git a/Source/WebCore/notifications/NotificationController.cpp b/Source/WebCore/notifications/NotificationController.cpp
index cbdc3ea45..df235d3c4 100644
--- a/Source/WebCore/notifications/NotificationController.cpp
+++ b/Source/WebCore/notifications/NotificationController.cpp
@@ -28,12 +28,12 @@
 
 #if ENABLE(NOTIFICATIONS)
 
-#include "NotificationPresenter.h"
+#include "NotificationClient.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
-NotificationController::NotificationController(Page* page, NotificationPresenter* client)
+NotificationController::NotificationController(Page* page, NotificationClient* client)
     : m_page(page)
     , m_client(client)
 {
@@ -45,12 +45,12 @@ NotificationController::~NotificationController()
         m_client->notificationControllerDestroyed();
 }
 
-PassOwnPtr<NotificationController> NotificationController::create(Page* page, NotificationPresenter* client)
+PassOwnPtr<NotificationController> NotificationController::create(Page* page, NotificationClient* client)
 {
     return adoptPtr(new NotificationController(page, client));
 }
 
-NotificationPresenter* NotificationController::clientFrom(Page* page)
+NotificationClient* NotificationController::clientFrom(Page* page)
 {
     if (NotificationController* controller = NotificationController::from(page))
         return controller->client();
@@ -63,9 +63,9 @@ const AtomicString& NotificationController::supplementName()
     return name;
 }
 
-void provideNotification(Page* page, NotificationPresenter* client)
+void provideNotification(Page* page, NotificationClient* client)
 {
-    PageSupplement::provideTo(page, NotificationController::supplementName(), NotificationController::create(page, client));
+    NotificationController::provideTo(page, NotificationController::supplementName(), NotificationController::create(page, client));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/notifications/NotificationController.h b/Source/WebCore/notifications/NotificationController.h
index 33a95d516..7e9d597e3 100644
--- a/Source/WebCore/notifications/NotificationController.h
+++ b/Source/WebCore/notifications/NotificationController.h
@@ -28,33 +28,31 @@
 
 #if ENABLE(NOTIFICATIONS)
 
-#include "PageSupplement.h"
+#include "Page.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
-class NotificationPresenter;
-class Page;
+class NotificationClient;
 
-class NotificationController : public PageSupplement {
+class NotificationController : public Supplement<Page> {
     WTF_MAKE_NONCOPYABLE(NotificationController);
 public:
     ~NotificationController();
 
-    static PassOwnPtr<NotificationController> create(Page*, NotificationPresenter*);
+    static PassOwnPtr<NotificationController> create(Page*, NotificationClient*);
     static const AtomicString& supplementName();
-    static NotificationController* from(Frame* frame) { return static_cast<NotificationController*>(PageSupplement::from(frame, supplementName())); }
-    static NotificationController* from(Page* page) { return static_cast<NotificationController*>(PageSupplement::from(page, supplementName())); }
-    static NotificationPresenter* clientFrom(Page*);
+    static NotificationController* from(Page* page) { return static_cast<NotificationController*>(Supplement<Page>::from(page, supplementName())); }
+    static NotificationClient* clientFrom(Page*);
 
-    NotificationPresenter* client() { return m_client; }
+    NotificationClient* client() { return m_client; }
     
 private:
-    NotificationController(Page*, NotificationPresenter*);
+    NotificationController(Page*, NotificationClient*);
 
     Page* m_page;
-    NotificationPresenter* m_client;
+    NotificationClient* m_client;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/Chrome.cpp b/Source/WebCore/page/Chrome.cpp
index 5e0122ddd..ade262d7c 100644
--- a/Source/WebCore/page/Chrome.cpp
+++ b/Source/WebCore/page/Chrome.cpp
@@ -555,13 +555,6 @@ PassRefPtr<SearchPopupMenu> Chrome::createSearchPopupMenu(PopupMenuClient* clien
     return m_client->createSearchPopupMenu(client);
 }
 
-#if ENABLE(CONTEXT_MENUS)
-void Chrome::showContextMenu()
-{
-    m_client->showContextMenu();
-}
-#endif
-
 bool Chrome::requiresFullscreenForVideoPlayback()
 {
     return m_client->requiresFullscreenForVideoPlayback();
diff --git a/Source/WebCore/page/Chrome.h b/Source/WebCore/page/Chrome.h
index c6704c97a..841eb50c0 100644
--- a/Source/WebCore/page/Chrome.h
+++ b/Source/WebCore/page/Chrome.h
@@ -173,10 +173,6 @@ namespace WebCore {
         PassRefPtr<PopupMenu> createPopupMenu(PopupMenuClient*) const;
         PassRefPtr<SearchPopupMenu> createSearchPopupMenu(PopupMenuClient*) const;
 
-#if ENABLE(CONTEXT_MENUS)
-        void showContextMenu();
-#endif
-
     private:
         Chrome(Page*, ChromeClient*);
 
diff --git a/Source/WebCore/page/ChromeClient.h b/Source/WebCore/page/ChromeClient.h
index 33b1c4b87..26d74ab21 100644
--- a/Source/WebCore/page/ChromeClient.h
+++ b/Source/WebCore/page/ChromeClient.h
@@ -58,6 +58,8 @@ namespace WebCore {
     class NavigationAction;
     class Node;
     class Page;
+    class PagePopup;
+    class PagePopupClient;
     class PopupMenuClient;
     class SecurityOrigin;
     class GraphicsContext3D;
@@ -306,9 +308,11 @@ namespace WebCore {
         virtual bool hasOpenedPopup() const = 0;
         virtual PassRefPtr<PopupMenu> createPopupMenu(PopupMenuClient*) const = 0;
         virtual PassRefPtr<SearchPopupMenu> createSearchPopupMenu(PopupMenuClient*) const = 0;
-
-#if ENABLE(CONTEXT_MENUS)
-        virtual void showContextMenu() = 0;
+#if ENABLE(PAGE_POPUP)
+        // Creates a PagePopup object, and shows it beside originBoundsInRootView.
+        // The return value can be 0.
+        virtual PagePopup* openPagePopup(PagePopupClient*, const IntRect& originBoundsInRootView) = 0;
+        virtual void closePagePopup(PagePopup*) = 0;
 #endif
 
         virtual void postAccessibilityNotification(AccessibilityObject*, AXObjectCache::AXNotification) { }
diff --git a/Source/WebCore/page/ContentSecurityPolicy.cpp b/Source/WebCore/page/ContentSecurityPolicy.cpp
index 9602cf759..83b62465b 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.cpp
+++ b/Source/WebCore/page/ContentSecurityPolicy.cpp
@@ -487,6 +487,7 @@ ContentSecurityPolicy::ContentSecurityPolicy(ScriptExecutionContext* scriptExecu
     , m_scriptExecutionContext(scriptExecutionContext)
     , m_reportOnly(false)
     , m_haveSandboxPolicy(false)
+    , m_overrideInlineStyleAllowed(false)
 {
 }
 
@@ -622,7 +623,7 @@ bool ContentSecurityPolicy::allowInlineScript() const
 bool ContentSecurityPolicy::allowInlineStyle() const
 {
     DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to apply inline style because of Content-Security-Policy.\n"));
-    return checkInlineAndReportViolation(operativeDirective(m_styleSrc.get()), consoleMessage);
+    return m_overrideInlineStyleAllowed || checkInlineAndReportViolation(operativeDirective(m_styleSrc.get()), consoleMessage);
 }
 
 bool ContentSecurityPolicy::allowEval() const
@@ -679,6 +680,11 @@ bool ContentSecurityPolicy::allowConnectFromSource(const KURL& url) const
     return checkSourceAndReportViolation(operativeDirective(m_connectSrc.get()), url, type);
 }
 
+void ContentSecurityPolicy::setOverrideAllowInlineStyle(bool value)
+{
+    m_overrideInlineStyleAllowed = value;
+}
+
 // policy            = directive-list
 // directive-list    = [ directive *( ";" [ directive ] ) ]
 //
diff --git a/Source/WebCore/page/ContentSecurityPolicy.h b/Source/WebCore/page/ContentSecurityPolicy.h
index fa7632465..5ceeb685e 100644
--- a/Source/WebCore/page/ContentSecurityPolicy.h
+++ b/Source/WebCore/page/ContentSecurityPolicy.h
@@ -70,6 +70,8 @@ public:
     bool allowMediaFromSource(const KURL&) const;
     bool allowConnectFromSource(const KURL&) const;
 
+    void setOverrideAllowInlineStyle(bool);
+
 private:
     explicit ContentSecurityPolicy(ScriptExecutionContext*);
 
@@ -107,6 +109,7 @@ private:
     OwnPtr<CSPDirective> m_mediaSrc;
     OwnPtr<CSPDirective> m_connectSrc;
     bool m_haveSandboxPolicy;
+    bool m_overrideInlineStyleAllowed;
     Vector<KURL> m_reportURLs;
 };
 
diff --git a/Source/WebCore/page/ContextMenuClient.h b/Source/WebCore/page/ContextMenuClient.h
index c9389c058..310349bb2 100644
--- a/Source/WebCore/page/ContextMenuClient.h
+++ b/Source/WebCore/page/ContextMenuClient.h
@@ -60,6 +60,10 @@ namespace WebCore {
 #if PLATFORM(MAC)
         virtual void searchWithSpotlight() = 0;
 #endif
+
+#if USE(ACCESSIBILITY_CONTEXT_MENUS)
+        virtual void showContextMenu() = 0;
+#endif
     };
 }
 
diff --git a/Source/WebCore/page/ContextMenuController.cpp b/Source/WebCore/page/ContextMenuController.cpp
index 98b29817f..c5156753b 100644
--- a/Source/WebCore/page/ContextMenuController.cpp
+++ b/Source/WebCore/page/ContextMenuController.cpp
@@ -58,6 +58,7 @@
 #include "NavigationAction.h"
 #include "Node.h"
 #include "Page.h"
+#include "PlatformEvent.h"
 #include "RenderLayer.h"
 #include "RenderObject.h"
 #include "ReplaceSelectionCommand.h"
@@ -1270,6 +1271,17 @@ void ContextMenuController::checkOrEnableIfNeeded(ContextMenuItem& item) const
     item.setEnabled(shouldEnable);
 }
 
+#if USE(ACCESSIBILITY_CONTEXT_MENUS)
+void ContextMenuController::showContextMenuAt(Frame* frame, const IntPoint& clickPoint)
+{
+    // Simulate a click in the middle of the accessibility object.
+    PlatformMouseEvent mouseEvent(clickPoint, clickPoint, RightButton, PlatformEvent::MousePressed, 1, false, false, false, false, currentTime());
+    bool handled = frame->eventHandler()->sendContextMenuEvent(mouseEvent);
+    if (handled && client())
+        client()->showContextMenu();
+}
+#endif
+
 } // namespace WebCore
 
 #endif // ENABLE(CONTEXT_MENUS)
diff --git a/Source/WebCore/page/ContextMenuController.h b/Source/WebCore/page/ContextMenuController.h
index 3588f0371..fdae946d1 100644
--- a/Source/WebCore/page/ContextMenuController.h
+++ b/Source/WebCore/page/ContextMenuController.h
@@ -65,6 +65,10 @@ namespace WebCore {
         void setHitTestResult(const HitTestResult& result) { m_hitTestResult = result; }
         const HitTestResult& hitTestResult() { return m_hitTestResult; }
 
+#if USE(ACCESSIBILITY_CONTEXT_MENUS)
+        void showContextMenuAt(Frame*, const IntPoint& clickPoint);
+#endif
+
     private:
         ContextMenuController(Page*, ContextMenuClient*);
 
diff --git a/Source/WebCore/page/DOMSelection.idl b/Source/WebCore/page/DOMSelection.idl
index cd4b5938a..1f7d3da3f 100644
--- a/Source/WebCore/page/DOMSelection.idl
+++ b/Source/WebCore/page/DOMSelection.idl
@@ -33,7 +33,7 @@ module window {
     // https://developer.mozilla.org/En/DOM/Selection
     interface [
         JSGenerateIsReachable=ImplFrame,
-        OmitConstructor
+        InterfaceName=Selection
     ] DOMSelection {
         readonly attribute Node anchorNode;
         readonly attribute long anchorOffset;
diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
index 051bbf0db..eec969ff6 100644
--- a/Source/WebCore/page/DOMWindow.cpp
+++ b/Source/WebCore/page/DOMWindow.cpp
@@ -65,8 +65,6 @@
 #include "FrameView.h"
 #include "HTMLFrameOwnerElement.h"
 #include "History.h"
-#include "IDBFactory.h"
-#include "IDBFactoryBackendInterface.h"
 #include "InspectorInstrumentation.h"
 #include "KURL.h"
 #include "Location.h"
@@ -420,9 +418,6 @@ DOMWindow::~DOMWindow()
 #if ENABLE(NOTIFICATIONS)
     ASSERT(!m_notifications);
 #endif
-#if ENABLE(INDEXED_DATABASE)
-    ASSERT(!m_idbFactory);
-#endif
 #if ENABLE(BLOB)
     ASSERT(!m_domURL);
 #endif
@@ -463,6 +458,11 @@ void DOMWindow::setSecurityOrigin(SecurityOrigin* securityOrigin)
     m_securityOrigin = securityOrigin;
 }
 
+Page* DOMWindow::page()
+{
+    return frame() ? frame()->page() : 0;
+}
+
 void DOMWindow::frameDestroyed()
 {
     FrameDestructionObserver::frameDestroyed();
@@ -526,9 +526,6 @@ void DOMWindow::clear()
     // the rest of the DOMWindowProperties.
     resetNotifications();
 #endif
-#if ENABLE(INDEXED_DATABASE)
-    m_idbFactory = 0;
-#endif
 #if ENABLE(BLOB)
     m_domURL = 0;
 #endif
@@ -719,7 +716,7 @@ NotificationCenter* DOMWindow::webkitNotifications() const
     if (!page)
         return 0;
 
-    NotificationPresenter* provider = NotificationController::clientFrom(page);
+    NotificationClient* provider = NotificationController::clientFrom(page);
     if (provider) 
         m_notifications = NotificationCenter::create(document, provider);    
       
@@ -735,13 +732,6 @@ void DOMWindow::resetNotifications()
 }
 #endif
 
-#if ENABLE(INDEXED_DATABASE)
-void DOMWindow::setIDBFactory(PassRefPtr<IDBFactory> idbFactory)
-{
-    m_idbFactory = idbFactory;
-}
-#endif
-
 void DOMWindow::postMessage(PassRefPtr<SerializedScriptValue> message, MessagePort* port, const String& targetOrigin, DOMWindow* source, ExceptionCode& ec)
 {
     MessagePortArray ports;
@@ -1494,10 +1484,10 @@ bool DOMWindow::addEventListener(const AtomicString& eventType, PassRefPtr<Event
         addBeforeUnloadEventListener(this);
 #if ENABLE(DEVICE_ORIENTATION)
     else if (eventType == eventNames().devicemotionEvent) {
-        if (DeviceMotionController* controller = DeviceMotionController::from(frame()))
+        if (DeviceMotionController* controller = DeviceMotionController::from(page()))
             controller->addListener(this);
     } else if (eventType == eventNames().deviceorientationEvent) {
-        if (DeviceOrientationController* controller = DeviceOrientationController::from(frame()))
+        if (DeviceOrientationController* controller = DeviceOrientationController::from(page()))
             controller->addListener(this);
     }
 #endif
@@ -1521,10 +1511,10 @@ bool DOMWindow::removeEventListener(const AtomicString& eventType, EventListener
         removeBeforeUnloadEventListener(this);
 #if ENABLE(DEVICE_ORIENTATION)
     else if (eventType == eventNames().devicemotionEvent) {
-        if (DeviceMotionController* controller = DeviceMotionController::from(frame()))
+        if (DeviceMotionController* controller = DeviceMotionController::from(page()))
             controller->removeListener(this);
     } else if (eventType == eventNames().deviceorientationEvent) {
-        if (DeviceOrientationController* controller = DeviceOrientationController::from(frame()))
+        if (DeviceOrientationController* controller = DeviceOrientationController::from(page()))
             controller->removeListener(this);
     }
 #endif
@@ -1579,9 +1569,9 @@ void DOMWindow::removeAllEventListeners()
     EventTarget::removeAllEventListeners();
 
 #if ENABLE(DEVICE_ORIENTATION)
-    if (DeviceMotionController* controller = DeviceMotionController::from(frame()))
+    if (DeviceMotionController* controller = DeviceMotionController::from(page()))
         controller->removeAllListeners(this);
-    if (DeviceOrientationController* controller = DeviceOrientationController::from(frame()))
+    if (DeviceOrientationController* controller = DeviceOrientationController::from(page()))
         controller->removeAllListeners(this);
 #endif
 
diff --git a/Source/WebCore/page/DOMWindow.h b/Source/WebCore/page/DOMWindow.h
index 9fa6a5caf..cdfd322d8 100644
--- a/Source/WebCore/page/DOMWindow.h
+++ b/Source/WebCore/page/DOMWindow.h
@@ -30,6 +30,7 @@
 #include "EventTarget.h"
 #include "FrameDestructionObserver.h"
 #include "KURL.h"
+#include "Supplementable.h"
 
 namespace WebCore {
 
@@ -56,6 +57,7 @@ namespace WebCore {
     class Navigator;
     class Node;
     class NotificationCenter;
+    class Page;
     class Performance;
     class PostMessageTimer;
     class ScheduledAction;
@@ -79,7 +81,7 @@ namespace WebCore {
 
     enum SetLocationLocking { LockHistoryBasedOnGestureState, LockHistoryAndBackForwardList };
 
-    class DOMWindow : public RefCounted<DOMWindow>, public EventTarget, public FrameDestructionObserver {
+    class DOMWindow : public RefCounted<DOMWindow>, public EventTarget, public FrameDestructionObserver, public Supplementable<DOMWindow> {
     public:
         static PassRefPtr<DOMWindow> create(Frame* frame) { return adoptRef(new DOMWindow(frame)); }
         virtual ~DOMWindow();
@@ -355,7 +357,7 @@ namespace WebCore {
 #if ENABLE(NOTIFICATIONS)
         NotificationCenter* webkitNotifications() const;
         // Renders webkitNotifications object safely inoperable, disconnects
-        // if from embedder-provided NotificationPresenter.
+        // if from embedder-provided NotificationClient.
         void resetNotifications();
 #endif
 
@@ -392,14 +394,11 @@ namespace WebCore {
         // by the document that is currently active in m_frame.
         bool isCurrentlyDisplayedInFrame() const;
 
-#if ENABLE(INDEXED_DATABASE)
-        IDBFactory* idbFactory() { return m_idbFactory.get(); }
-        void setIDBFactory(PassRefPtr<IDBFactory>);
-#endif
-
     private:
         explicit DOMWindow(Frame*);
 
+        Page* page();
+
         virtual void frameDestroyed() OVERRIDE;
         virtual void willDetachPage() OVERRIDE;
 
@@ -442,11 +441,6 @@ namespace WebCore {
 
         mutable RefPtr<Storage> m_sessionStorage;
         mutable RefPtr<Storage> m_localStorage;
-
-#if ENABLE(INDEXED_DATABASE)
-        mutable RefPtr<IDBFactory> m_idbFactory;
-#endif
-
         mutable RefPtr<DOMApplicationCache> m_applicationCache;
 
 #if ENABLE(NOTIFICATIONS)
diff --git a/Source/WebCore/page/DOMWindow.idl b/Source/WebCore/page/DOMWindow.idl
index 2d8691642..14086bf20 100644
--- a/Source/WebCore/page/DOMWindow.idl
+++ b/Source/WebCore/page/DOMWindow.idl
@@ -45,7 +45,7 @@ module window {
     ] DOMWindow {
         // DOM Level 0
         attribute [Replaceable] Screen screen;
-        attribute [Replaceable, DoNotCheckSecurityOnGetter, JSCustomGetter] History history;
+        attribute [Replaceable, DoNotCheckSecurityOnGetter] History history;
         attribute [Replaceable] BarInfo locationbar;
         attribute [Replaceable] BarInfo menubar;
         attribute [Replaceable] BarInfo personalbar;
@@ -56,7 +56,7 @@ module window {
         attribute [Replaceable] Navigator clientInformation;
         readonly attribute Crypto crypto;
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
-        attribute [DoNotCheckSecurity, JSCustom, V8CustomSetter, V8Unforgeable] Location location;
+        attribute [DoNotCheckSecurity, CustomSetter, V8Unforgeable] Location location;
 #endif
         attribute [Replaceable, CustomGetter, V8CustomSetter] Event event;
 
@@ -393,9 +393,99 @@ module window {
         attribute ProcessingInstructionConstructor ProcessingInstruction;
         attribute [Conditional=SHADOW_DOM, V8EnabledAtRuntime=shadowDOM] ShadowRootConstructor WebKitShadowRoot;
 
+        attribute DOMSelectionConstructor Selection;
         attribute DOMWindowConstructor Window;
 
-        // FIXME: Should these Canvas constructors move to html/DOMWindowHTML with the rest of canvas?
+        attribute HTMLDocumentConstructor HTMLDocument;
+        attribute HTMLElementConstructor HTMLElement;
+        attribute HTMLAnchorElementConstructor HTMLAnchorElement;
+        attribute HTMLAppletElementConstructor HTMLAppletElement;
+        attribute HTMLAreaElementConstructor HTMLAreaElement;
+        attribute HTMLBRElementConstructor HTMLBRElement;
+        attribute HTMLBaseElementConstructor HTMLBaseElement;
+        attribute HTMLBaseFontElementConstructor HTMLBaseFontElement;
+        attribute HTMLBodyElementConstructor HTMLBodyElement;
+        attribute HTMLButtonElementConstructor HTMLButtonElement;
+        attribute HTMLCanvasElementConstructor HTMLCanvasElement;
+        attribute HTMLDListElementConstructor HTMLDListElement;
+        attribute HTMLDirectoryElementConstructor HTMLDirectoryElement;
+        attribute HTMLDivElementConstructor HTMLDivElement;
+        attribute HTMLEmbedElementConstructor HTMLEmbedElement;
+        attribute HTMLFieldSetElementConstructor HTMLFieldSetElement;
+        attribute HTMLFontElementConstructor HTMLFontElement;
+        attribute HTMLFormElementConstructor HTMLFormElement;
+        attribute HTMLFrameElementConstructor HTMLFrameElement;
+        attribute HTMLFrameSetElementConstructor HTMLFrameSetElement;
+        attribute HTMLHRElementConstructor HTMLHRElement;
+        attribute HTMLHeadElementConstructor HTMLHeadElement;
+        attribute HTMLHeadingElementConstructor HTMLHeadingElement;
+        attribute HTMLHtmlElementConstructor HTMLHtmlElement;
+        attribute HTMLIFrameElementConstructor HTMLIFrameElement;
+        attribute HTMLImageElementConstructor HTMLImageElement;
+        attribute HTMLInputElementConstructor HTMLInputElement;
+        attribute HTMLKeygenElementConstructor HTMLKeygenElement;
+        attribute HTMLLIElementConstructor HTMLLIElement;
+        attribute HTMLLabelElementConstructor HTMLLabelElement;
+        attribute HTMLLegendElementConstructor HTMLLegendElement;
+        attribute HTMLLinkElementConstructor HTMLLinkElement;
+        attribute HTMLMapElementConstructor HTMLMapElement;
+        attribute HTMLMarqueeElementConstructor HTMLMarqueeElement;
+        attribute HTMLMenuElementConstructor HTMLMenuElement;
+        attribute HTMLMetaElementConstructor HTMLMetaElement;
+#if defined(ENABLE_METER_TAG) && ENABLE_METER_TAG
+        attribute HTMLMeterElementConstructor HTMLMeterElement;
+#endif
+        attribute HTMLModElementConstructor HTMLModElement;
+        attribute HTMLOListElementConstructor HTMLOListElement;
+        attribute HTMLObjectElementConstructor HTMLObjectElement;
+        attribute HTMLOptGroupElementConstructor HTMLOptGroupElement;
+        attribute HTMLOptionElementConstructor HTMLOptionElement;
+        attribute HTMLOutputElementConstructor HTMLOutputElement;
+        attribute HTMLParagraphElementConstructor HTMLParagraphElement;
+        attribute HTMLParamElementConstructor HTMLParamElement;
+        attribute HTMLPreElementConstructor HTMLPreElement;
+#if defined(ENABLE_PROGRESS_TAG) && ENABLE_PROGRESS_TAG
+        attribute HTMLProgressElementConstructor HTMLProgressElement;
+#endif
+        attribute HTMLQuoteElementConstructor HTMLQuoteElement;
+        attribute HTMLScriptElementConstructor HTMLScriptElement;
+        attribute HTMLSelectElementConstructor HTMLSelectElement;
+        attribute HTMLSpanElementConstructor HTMLSpanElement;
+        attribute HTMLStyleElementConstructor HTMLStyleElement;
+        attribute HTMLTableCaptionElementConstructor HTMLTableCaptionElement;
+        attribute HTMLTableCellElementConstructor HTMLTableCellElement;
+        attribute HTMLTableColElementConstructor HTMLTableColElement;
+        attribute HTMLTableElementConstructor HTMLTableElement;
+        attribute HTMLTableRowElementConstructor HTMLTableRowElement;
+        attribute HTMLTableSectionElementConstructor HTMLTableSectionElement;
+        attribute HTMLTextAreaElementConstructor HTMLTextAreaElement;
+        attribute HTMLTitleElementConstructor HTMLTitleElement;
+        attribute HTMLUListElementConstructor HTMLUListElement;
+
+        attribute HTMLCollectionConstructor HTMLCollection;
+        attribute HTMLAllCollectionConstructor HTMLAllCollection;
+        attribute [Conditional=MICRODATA] HTMLPropertiesCollectionConstructor HTMLPropertiesCollection;
+        attribute HTMLUnknownElementConstructor HTMLUnknownElement;
+
+        attribute [JSCustomGetter, CustomConstructor] HTMLImageElementConstructorConstructor Image; // Usable with new operator
+        attribute [JSCustomGetter] HTMLOptionElementConstructorConstructor Option; // Usable with new operator
+
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] HTMLTrackElementConstructor HTMLTrackElement;
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackConstructor TextTrack;
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackCueConstructor TextTrackCue; // Usable with the new operator
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackCueListConstructor TextTrackCueList;
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TextTrackListConstructor TextTrackList;
+        attribute [Conditional=VIDEO_TRACK, V8EnabledAtRuntime=webkitVideoTrack] TrackEventConstructor TrackEvent;
+
+        attribute [JSCustomGetter, Conditional=VIDEO, V8EnabledAtRuntime] HTMLAudioElementConstructorConstructor Audio; // Usable with the new operator
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLAudioElementConstructor HTMLAudioElement;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLMediaElementConstructor HTMLMediaElement;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLVideoElementConstructor HTMLVideoElement;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] MediaErrorConstructor MediaError;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] TimeRangesConstructor TimeRanges;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] HTMLSourceElementConstructor HTMLSourceElement;
+        attribute [Conditional=VIDEO, V8EnabledAtRuntime] MediaControllerConstructor MediaController;
+
         attribute CanvasPatternConstructor CanvasPattern;
         attribute CanvasGradientConstructor CanvasGradient;
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
@@ -403,6 +493,16 @@ module window {
         attribute ImageDataConstructor ImageData;
         attribute TextMetricsConstructor TextMetrics;
 
+        attribute [Conditional=WEBGL] WebGLActiveInfoConstructor WebGLActiveInfo;
+        attribute [Conditional=WEBGL] WebGLBufferConstructor WebGLBuffer;
+        attribute [Conditional=WEBGL] WebGLFramebufferConstructor WebGLFramebuffer;
+        attribute [Conditional=WEBGL] WebGLProgramConstructor WebGLProgram;
+        attribute [Conditional=WEBGL] WebGLRenderbufferConstructor WebGLRenderbuffer;
+        attribute [Conditional=WEBGL] WebGLRenderingContextConstructor WebGLRenderingContext;
+        attribute [Conditional=WEBGL] WebGLShaderConstructor WebGLShader;
+        attribute [Conditional=WEBGL] WebGLTextureConstructor WebGLTexture;
+        attribute [Conditional=WEBGL] WebGLUniformLocationConstructor WebGLUniformLocation;
+
         attribute DOMStringMapConstructor DOMStringMap;
 
         attribute ArrayBufferConstructor ArrayBuffer; // Usable with new operator
@@ -437,6 +537,7 @@ module window {
         attribute WebKitAnimationEventConstructor WebKitAnimationEvent;
         attribute WebKitTransitionEventConstructor WebKitTransitionEvent;
         attribute WheelEventConstructor WheelEvent;
+        attribute XMLHttpRequestProgressEventConstructor XMLHttpRequestProgressEvent;
         attribute [Conditional=DEVICE_ORIENTATION, V8EnabledAtRuntime] DeviceMotionEventConstructor DeviceMotionEvent;
         attribute [Conditional=DEVICE_ORIENTATION, V8EnabledAtRuntime] DeviceOrientationEventConstructor DeviceOrientationEvent;
         attribute [Conditional=TOUCH_EVENTS] TouchEventConstructor TouchEvent;
@@ -456,6 +557,9 @@ module window {
 
         attribute ClipboardConstructor Clipboard;
 
+        attribute [Conditional=WORKERS] WorkerConstructor Worker; // Usable with the new operator
+        attribute [Conditional=SHARED_WORKERS, JSCustomGetter, V8EnabledAtRuntime] SharedWorkerConstructor SharedWorker; // Usable with the new operator
+
         attribute FileConstructor File;
         attribute FileListConstructor FileList;
         attribute BlobConstructor Blob;
@@ -466,6 +570,16 @@ module window {
 
         attribute EventSourceConstructor EventSource; // Usable with new the operator
 
+        // Mozilla has a separate XMLDocument object for XML documents. 
+        // We just use Document for this.
+        attribute DocumentConstructor XMLDocument;
+        attribute DOMParserConstructor DOMParser;
+        attribute XMLSerializerConstructor XMLSerializer;
+        attribute XMLHttpRequestConstructor XMLHttpRequest; // Usable with the new operator
+        attribute XMLHttpRequestUploadConstructor XMLHttpRequestUpload;
+        attribute XMLHttpRequestExceptionConstructor XMLHttpRequestException;
+        attribute [Conditional=XSLT] XSLTProcessorConstructor XSLTProcessor; // Usable with the new operator
+
 #if defined(ENABLE_CHANNEL_MESSAGING) && ENABLE_CHANNEL_MESSAGING
         attribute MessagePortConstructor MessagePort;
         attribute MessageChannelConstructor MessageChannel; // Usable with the new operator
@@ -491,6 +605,164 @@ module window {
         attribute XPathResultConstructor XPathResult;
         attribute XPathExceptionConstructor XPathException;
 
+        attribute [Conditional=SVG] SVGZoomEventConstructor SVGZoomEvent;
+
+#if defined(ENABLE_SVG) && ENABLE_SVG
+        // Expose all implemented SVG 1.1 interfaces, excluding the SVG MI interfaces:
+        // SVGAnimatedPathData, SVGAnimatedPoints, SVGExternalResourcesRequired,
+        // SVGFilterPrimitiveStandardAttributes, SVGFitToViewBox, SVGLangSpace, SVGLocatable
+        // SVGStylable, SVGTests, SVGTransformable, SVGURIReference, SVGZoomAndPan
+        attribute SVGAElementConstructor SVGAElement;
+        attribute SVGAngleConstructor SVGAngle;
+        attribute SVGAnimatedAngleConstructor SVGAnimatedAngle;
+        attribute SVGAnimatedBooleanConstructor SVGAnimatedBoolean;
+        attribute SVGAnimatedEnumerationConstructor SVGAnimatedEnumeration;
+        attribute SVGAnimatedIntegerConstructor SVGAnimatedInteger;
+        attribute SVGAnimatedLengthConstructor SVGAnimatedLength;
+        attribute SVGAnimatedLengthListConstructor SVGAnimatedLengthList;
+        attribute SVGAnimatedNumberConstructor SVGAnimatedNumber;
+        attribute SVGAnimatedNumberListConstructor SVGAnimatedNumberList;
+        attribute SVGAnimatedPreserveAspectRatioConstructor SVGAnimatedPreserveAspectRatio;
+        attribute SVGAnimatedRectConstructor SVGAnimatedRect;
+        attribute SVGAnimatedStringConstructor SVGAnimatedString;
+        attribute SVGAnimatedTransformListConstructor SVGAnimatedTransformList;
+        attribute SVGCircleElementConstructor SVGCircleElement;
+        attribute SVGClipPathElementConstructor SVGClipPathElement;
+        attribute SVGColorConstructor SVGColor;
+        attribute SVGCursorElementConstructor SVGCursorElement;
+//      attribute SVGCSSRuleConstructor SVGCSSRule;
+        attribute SVGDefsElementConstructor SVGDefsElement;
+        attribute SVGDescElementConstructor SVGDescElement;
+        attribute SVGDocumentConstructor SVGDocument;
+        attribute SVGElementConstructor SVGElement;
+        attribute SVGElementInstanceConstructor SVGElementInstance;
+        attribute SVGElementInstanceListConstructor SVGElementInstanceList;
+        attribute SVGEllipseElementConstructor SVGEllipseElement;
+        attribute SVGForeignObjectElementConstructor SVGForeignObjectElement;
+        attribute SVGExceptionConstructor SVGException;
+        attribute SVGGElementConstructor SVGGElement;
+        attribute SVGGradientElementConstructor SVGGradientElement;
+        attribute SVGImageElementConstructor SVGImageElement;
+        attribute SVGLengthConstructor SVGLength;
+        attribute SVGLengthListConstructor SVGLengthList;
+        attribute SVGLinearGradientElementConstructor SVGLinearGradientElement;
+        attribute SVGLineElementConstructor SVGLineElement;
+        attribute SVGMarkerElementConstructor SVGMarkerElement;
+        attribute SVGMaskElementConstructor SVGMaskElement;
+        attribute SVGMatrixConstructor SVGMatrix;
+        attribute SVGMetadataElementConstructor SVGMetadataElement;
+        attribute SVGNumberConstructor SVGNumber;
+        attribute SVGNumberListConstructor SVGNumberList;
+        attribute SVGPaintConstructor SVGPaint;
+        attribute SVGPathElementConstructor SVGPathElement;
+        attribute SVGPathSegConstructor SVGPathSeg;
+        attribute SVGPathSegArcAbsConstructor SVGPathSegArcAbs;
+        attribute SVGPathSegArcRelConstructor SVGPathSegArcRel;
+        attribute SVGPathSegClosePathConstructor SVGPathSegClosePath;
+        attribute SVGPathSegCurvetoCubicAbsConstructor SVGPathSegCurvetoCubicAbs;
+        attribute SVGPathSegCurvetoCubicRelConstructor SVGPathSegCurvetoCubicRel;
+        attribute SVGPathSegCurvetoCubicSmoothAbsConstructor SVGPathSegCurvetoCubicSmoothAbs;
+        attribute SVGPathSegCurvetoCubicSmoothRelConstructor SVGPathSegCurvetoCubicSmoothRel;
+        attribute SVGPathSegCurvetoQuadraticAbsConstructor SVGPathSegCurvetoQuadraticAbs;
+        attribute SVGPathSegCurvetoQuadraticRelConstructor SVGPathSegCurvetoQuadraticRel;
+        attribute SVGPathSegCurvetoQuadraticSmoothAbsConstructor SVGPathSegCurvetoQuadraticSmoothAbs;
+        attribute SVGPathSegCurvetoQuadraticSmoothRelConstructor SVGPathSegCurvetoQuadraticSmoothRel;
+        attribute SVGPathSegLinetoAbsConstructor SVGPathSegLinetoAbs;
+        attribute SVGPathSegLinetoHorizontalAbsConstructor SVGPathSegLinetoHorizontalAbs;
+        attribute SVGPathSegLinetoHorizontalRelConstructor SVGPathSegLinetoHorizontalRel;
+        attribute SVGPathSegLinetoRelConstructor SVGPathSegLinetoRel;
+        attribute SVGPathSegLinetoVerticalAbsConstructor SVGPathSegLinetoVerticalAbs;
+        attribute SVGPathSegLinetoVerticalRelConstructor SVGPathSegLinetoVerticalRel;
+        attribute SVGPathSegListConstructor SVGPathSegList;
+        attribute SVGPathSegMovetoAbsConstructor SVGPathSegMovetoAbs;
+        attribute SVGPathSegMovetoRelConstructor SVGPathSegMovetoRel;
+        attribute SVGPatternElementConstructor SVGPatternElement;
+        attribute SVGPointConstructor SVGPoint;
+        attribute SVGPointListConstructor SVGPointList;
+        attribute SVGPolygonElementConstructor SVGPolygonElement;
+        attribute SVGPolylineElementConstructor SVGPolylineElement;
+        attribute SVGPreserveAspectRatioConstructor SVGPreserveAspectRatio;
+        attribute SVGRadialGradientElementConstructor SVGRadialGradientElement;
+        attribute SVGRectConstructor SVGRect;
+        attribute SVGRectElementConstructor SVGRectElement;
+        attribute SVGRenderingIntentConstructor SVGRenderingIntent;
+        attribute SVGScriptElementConstructor SVGScriptElement;
+        attribute SVGStopElementConstructor SVGStopElement;
+        attribute SVGStringListConstructor SVGStringList;
+        attribute SVGStyleElementConstructor SVGStyleElement;
+        attribute SVGSVGElementConstructor SVGSVGElement;
+        attribute SVGSwitchElementConstructor SVGSwitchElement;
+        attribute SVGSymbolElementConstructor SVGSymbolElement;
+        attribute SVGTextContentElementConstructor SVGTextContentElement;
+        attribute SVGTextElementConstructor SVGTextElement;
+        attribute SVGTextPathElementConstructor SVGTextPathElement;
+        attribute SVGTextPositioningElementConstructor SVGTextPositioningElement;
+        attribute SVGTitleElementConstructor SVGTitleElement;
+        attribute SVGTransformConstructor SVGTransform;
+        attribute SVGTransformListConstructor SVGTransformList;
+        attribute SVGTRefElementConstructor SVGTRefElement;
+        attribute SVGTSpanElementConstructor SVGTSpanElement;
+        attribute SVGUnitTypesConstructor SVGUnitTypes;
+        attribute SVGUseElementConstructor SVGUseElement;
+        attribute SVGViewElementConstructor SVGViewElement;
+//      attribute SVGViewSpecConstructor SVGViewSpec;
+
+        attribute SVGAnimateColorElementConstructor SVGAnimateColorElement;
+        attribute SVGAnimateElementConstructor SVGAnimateElement;
+        attribute SVGAnimateMotionElementConstructor SVGAnimateMotionElement;
+        attribute SVGAnimateTransformElementConstructor SVGAnimateTransformElement;
+        attribute SVGMPathElementConstructor SVGMPathElement;
+        attribute SVGSetElementConstructor SVGSetElement;
+
+#if defined(ENABLE_SVG_FONTS) && ENABLE_SVG_FONTS
+        attribute SVGAltGlyphDefElementConstructor SVGAltGlyphDefElement;
+        attribute SVGAltGlyphElementConstructor SVGAltGlyphElement;
+        attribute SVGAltGlyphItemElementConstructor SVGAltGlyphItemElement;
+//      attribute SVGDefinitionSrcElementConstructor SVGDefinitionSrcElement;
+        attribute SVGFontElementConstructor SVGFontElement;
+        attribute SVGFontFaceElementConstructor SVGFontFaceElement;
+        attribute SVGFontFaceFormatElementConstructor SVGFontFaceFormatElement;
+        attribute SVGFontFaceNameElementConstructor SVGFontFaceNameElement;
+        attribute SVGFontFaceSrcElementConstructor SVGFontFaceSrcElement;
+        attribute SVGFontFaceUriElementConstructor SVGFontFaceUriElement;
+        attribute SVGGlyphElementConstructor SVGGlyphElement;
+        attribute SVGGlyphRefElementConstructor SVGGlyphRefElement;
+        attribute SVGHKernElementConstructor SVGHKernElement;
+        attribute SVGMissingGlyphElementConstructor SVGMissingGlyphElement;
+        attribute SVGVKernElementConstructor SVGVKernElement;
+#endif
+
+#if defined(ENABLE_FILTERS) && ENABLE_FILTERS
+        attribute SVGComponentTransferFunctionElementConstructor SVGComponentTransferFunctionElement;
+        attribute SVGFEBlendElementConstructor SVGFEBlendElement;
+        attribute SVGFEColorMatrixElementConstructor SVGFEColorMatrixElement;
+        attribute SVGFEComponentTransferElementConstructor SVGFEComponentTransferElement;
+        attribute SVGFECompositeElementConstructor SVGFECompositeElement;
+        attribute SVGFEConvolveMatrixElementConstructor SVGFEConvolveMatrixElement;
+        attribute SVGFEDiffuseLightingElementConstructor SVGFEDiffuseLightingElement;
+        attribute SVGFEDisplacementMapElementConstructor SVGFEDisplacementMapElement;
+        attribute SVGFEDistantLightElementConstructor SVGFEDistantLightElement;
+        attribute SVGFEDropShadowElementConstructor SVGFEDropShadowElement;
+        attribute SVGFEFloodElementConstructor SVGFEFloodElement;
+        attribute SVGFEFuncAElementConstructor SVGFEFuncAElement;
+        attribute SVGFEFuncBElementConstructor SVGFEFuncBElement;
+        attribute SVGFEFuncGElementConstructor SVGFEFuncGElement;
+        attribute SVGFEFuncRElementConstructor SVGFEFuncRElement;
+        attribute SVGFEGaussianBlurElementConstructor SVGFEGaussianBlurElement;
+        attribute SVGFEImageElementConstructor SVGFEImageElement;
+        attribute SVGFEMergeElementConstructor SVGFEMergeElement;
+        attribute SVGFEMergeNodeElementConstructor SVGFEMergeNodeElement;
+        attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
+        attribute SVGFEOffsetElementConstructor SVGFEOffsetElement;
+        attribute SVGFEPointLightElementConstructor SVGFEPointLightElement;
+        attribute SVGFESpecularLightingElementConstructor SVGFESpecularLightingElement;
+        attribute SVGFESpotLightElementConstructor SVGFESpotLightElement;
+        attribute SVGFETileElementConstructor SVGFETileElement;
+        attribute SVGFETurbulenceElementConstructor SVGFETurbulenceElement;
+        attribute SVGFilterElementConstructor SVGFilterElement;
+#endif
+#endif
+
         attribute DOMFormDataConstructor FormData;
 
         attribute [Conditional=BLOB|FILE_SYSTEM] FileErrorConstructor FileError;
diff --git a/Source/WebCore/page/DragClient.h b/Source/WebCore/page/DragClient.h
index 1d9b25bdb..b72d73da2 100644
--- a/Source/WebCore/page/DragClient.h
+++ b/Source/WebCore/page/DragClient.h
@@ -35,7 +35,6 @@
 OBJC_CLASS DOMElement;
 OBJC_CLASS NSURL;
 OBJC_CLASS NSString;
-OBJC_CLASS NSPasteboard;
 #endif
 
 namespace WebCore {
diff --git a/Source/WebCore/page/DragController.cpp b/Source/WebCore/page/DragController.cpp
index 4891aad0b..247fe3943 100644
--- a/Source/WebCore/page/DragController.cpp
+++ b/Source/WebCore/page/DragController.cpp
@@ -424,6 +424,7 @@ bool DragController::concludeEditDrag(DragData* dragData)
     ASSERT(dragData);
     ASSERT(!m_isHandlingDrag);
 
+    RefPtr<HTMLInputElement> fileInput = m_fileInputElementUnderMouse;
     if (m_fileInputElementUnderMouse) {
         m_fileInputElementUnderMouse->setCanReceiveDroppedFiles(false);
         m_fileInputElementUnderMouse = 0;
@@ -456,18 +457,13 @@ bool DragController::concludeEditDrag(DragData* dragData)
         return true;
     }
 
-    if (!m_page->dragController()->canProcessDrag(dragData)) {
-        m_page->dragCaretController()->clear();
-        return false;
-    }
-
-    if (HTMLInputElement* fileInput = asFileInput(element)) {
+    if (dragData->containsFiles() && fileInput) {
+        // fileInput should be the element we hit tested for, unless it was made
+        // display:none in a drop event handler.
+        ASSERT(fileInput == element || !fileInput->renderer());
         if (fileInput->disabled())
             return false;
 
-        if (!dragData->containsFiles())
-            return false;
-
         Vector<String> filenames;
         dragData->asFilenames(filenames);
         if (filenames.isEmpty())
@@ -477,6 +473,11 @@ bool DragController::concludeEditDrag(DragData* dragData)
         return true;
     }
 
+    if (!m_page->dragController()->canProcessDrag(dragData)) {
+        m_page->dragCaretController()->clear();
+        return false;
+    }
+
     VisibleSelection dragCaret = m_page->dragCaretController()->caretPosition();
     m_page->dragCaretController()->clear();
     RefPtr<Range> range = dragCaret.toNormalizedRange();
diff --git a/Source/WebCore/page/EditorClient.h b/Source/WebCore/page/EditorClient.h
index 2bb4f5129..1f0954f19 100644
--- a/Source/WebCore/page/EditorClient.h
+++ b/Source/WebCore/page/EditorClient.h
@@ -37,7 +37,6 @@
 
 #if PLATFORM(MAC)
 OBJC_CLASS NSAttributedString;
-OBJC_CLASS NSPasteboard;
 OBJC_CLASS NSString;
 OBJC_CLASS NSURL;
 #endif
@@ -117,7 +116,7 @@ public:
 #if PLATFORM(MAC)
     virtual NSString* userVisibleString(NSURL*) = 0;
     virtual DocumentFragment* documentFragmentFromAttributedString(NSAttributedString*, Vector< RefPtr<ArchiveResource> >&) = 0;
-    virtual void setInsertionPasteboard(NSPasteboard*) = 0;
+    virtual void setInsertionPasteboard(const String& pasteboardName) = 0;
     virtual NSURL* canonicalizeURL(NSURL*) = 0;
     virtual NSURL* canonicalizeURLString(NSString*) = 0;
 #endif
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index 4f0ddeee3..1738db896 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -83,6 +83,7 @@
 #include <wtf/Assertions.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/TemporaryChange.h>
 
 #if ENABLE(GESTURE_EVENTS)
 #include "PlatformGestureEvent.h"
@@ -126,7 +127,11 @@ using namespace SVGNames;
 // When the autoscroll or the panScroll is triggered when do the scroll every 0.05s to make it smooth
 const double autoscrollInterval = 0.05;
 
-const double fakeMouseMoveInterval = 0.1;
+// The amount of time to wait before sending a fake mouse event, triggered
+// during a scroll. The short interval is used if the content responds to the mouse events quickly enough,
+// otherwise the long interval is used.
+const double fakeMouseMoveShortInterval = 0.1;
+const double fakeMouseMoveLongInterval = 0.250;
 
 enum NoCursorChangeType { NoCursorChange };
 
@@ -143,6 +148,24 @@ private:
     Cursor m_cursor;
 };
 
+class MaximumDurationTracker {
+public:
+    explicit MaximumDurationTracker(double *maxDuration)
+        : m_maxDuration(maxDuration)
+        , m_start(monotonicallyIncreasingTime())
+    {
+    }
+
+    ~MaximumDurationTracker()
+    {
+        *m_maxDuration = max(*m_maxDuration, monotonicallyIncreasingTime() - m_start);
+    }
+
+private:
+    double* m_maxDuration;
+    double m_start;
+};
+
 #if ENABLE(TOUCH_EVENTS)
 class SyntheticTouchPoint : public PlatformTouchPoint {
 public:
@@ -210,29 +233,28 @@ public:
 };
 #endif
 
-static inline bool scrollNode(float delta, WheelEvent::Granularity granularity, ScrollDirection positiveDirection, ScrollDirection negativeDirection, Node* node, Node** stopNode)
+static inline ScrollGranularity wheelGranularityToScrollGranularity(WheelEvent::Granularity granularity)
+{
+    switch (granularity) {
+    case WheelEvent::Page:
+        return ScrollByPage;
+    case WheelEvent::Line:
+        return ScrollByLine;
+    case WheelEvent::Pixel:
+        return ScrollByPixel;
+    }
+    return ScrollByPixel;
+}
+
+static inline bool scrollNode(float delta, ScrollGranularity granularity, ScrollDirection positiveDirection, ScrollDirection negativeDirection, Node* node, Node** stopNode)
 {
     if (!delta)
         return false;
-    
     if (!node->renderer())
         return false;
-    
-    // Find the nearest enclosing box.
     RenderBox* enclosingBox = node->renderer()->enclosingBox();
-
     float absDelta = delta > 0 ? delta : -delta;
-    
-    if (granularity == WheelEvent::Page)
-        return enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPage, absDelta, stopNode);
-
-    if (granularity == WheelEvent::Line)
-        return enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByLine, absDelta, stopNode);
-
-    if (granularity == WheelEvent::Pixel)
-        return enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPixel, absDelta, stopNode);
-        
-    return false;
+    return enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, granularity, absDelta, stopNode);
 }
 
 #if !PLATFORM(MAC)
@@ -289,6 +311,8 @@ EventHandler::EventHandler(Frame* frame)
 #if ENABLE(TOUCH_EVENTS)
     , m_touchPressed(false)
 #endif
+    , m_maxMouseMovedDuration(0)
+    , m_baseEventType(PlatformEvent::NoType)
 {
 }
 
@@ -335,6 +359,10 @@ void EventHandler::clear()
 #if ENABLE(TOUCH_EVENTS)
     m_originatingTouchPointTargets.clear();
 #endif
+    m_maxMouseMovedDuration = 0;
+#if ENABLE(GESTURE_EVENTS)
+    m_baseEventType = PlatformEvent::NoType;
+#endif
 }
 
 void EventHandler::nodeWillBeRemoved(Node* nodeToBeRemoved)
@@ -1261,8 +1289,8 @@ OptionalCursor EventHandler::selectCursor(const MouseEventWithHitTestResults& ev
     const Cursor& iBeam = horizontalText ? iBeamCursor() : verticalTextCursor();
 
     // During selection, use an I-beam no matter what we're over.
-    // If you're capturing mouse events for a particular node, don't treat this as a selection.
-    if (m_mousePressed && m_mouseDownMayStartSelect && m_frame->selection()->isCaretOrRange() && !m_capturingMouseEventsNode)
+    // If a drag may be starting or we're capturing mouse events for a particular node, don't treat this as a selection.
+    if (m_mousePressed && m_mouseDownMayStartSelect && !m_mouseDownMayStartDrag && m_frame->selection()->isCaretOrRange() && !m_capturingMouseEventsNode)
         return iBeam;
 
     if (renderer) {
@@ -1635,8 +1663,10 @@ static RenderLayer* layerForNode(Node* node)
 
 bool EventHandler::mouseMoved(const PlatformMouseEvent& event)
 {
+    MaximumDurationTracker maxDurationTracker(&m_maxMouseMovedDuration);
     RefPtr<FrameView> protector(m_frame->view());
 
+
 #if ENABLE(TOUCH_EVENTS)
     // FIXME: this should be moved elsewhere to also be able to dispatch touchcancel events.
     bool defaultPrevented = dispatchSyntheticTouchEventIfEnabled(event);
@@ -2287,7 +2317,7 @@ bool EventHandler::handleWheelEvent(const PlatformWheelEvent& e)
     // Instead, the handlers should know convert vertical scrolls
     // appropriately.
     PlatformWheelEvent event = e;
-    if (shouldTurnVerticalTicksIntoHorizontal(result))
+    if (m_baseEventType != PlatformEvent::NoType && shouldTurnVerticalTicksIntoHorizontal(result))
         event = event.copyTurningVerticalTicksIntoHorizontalTicks();
 
     if (node) {
@@ -2313,20 +2343,21 @@ bool EventHandler::handleWheelEvent(const PlatformWheelEvent& e)
     
     return view->wheelEvent(event);
 }
-    
+
 void EventHandler::defaultWheelEventHandler(Node* startNode, WheelEvent* wheelEvent)
 {
     if (!startNode || !wheelEvent)
         return;
     
     Node* stopNode = m_previousWheelScrolledNode.get();
+    ScrollGranularity granularity = m_baseEventType == PlatformEvent::GestureScrollEnd ? ScrollByPixelVelocity : wheelGranularityToScrollGranularity(wheelEvent->granularity());
     
     // Break up into two scrolls if we need to.  Diagonal movement on 
     // a MacBook pro is an example of a 2-dimensional mouse wheel event (where both deltaX and deltaY can be set).
-    if (scrollNode(wheelEvent->rawDeltaX(), wheelEvent->granularity(), ScrollLeft, ScrollRight, startNode, &stopNode))
+    if (scrollNode(wheelEvent->rawDeltaX(), granularity, ScrollLeft, ScrollRight, startNode, &stopNode))
         wheelEvent->setDefaultHandled();
     
-    if (scrollNode(wheelEvent->rawDeltaY(), wheelEvent->granularity(), ScrollUp, ScrollDown, startNode, &stopNode))
+    if (scrollNode(wheelEvent->rawDeltaY(), granularity, ScrollUp, ScrollDown, startNode, &stopNode))
         wheelEvent->setDefaultHandled();
     
     if (!m_useLatchedWheelEventNode)
@@ -2336,41 +2367,60 @@ void EventHandler::defaultWheelEventHandler(Node* startNode, WheelEvent* wheelEv
 #if ENABLE(GESTURE_EVENTS)
 bool EventHandler::handleGestureEvent(const PlatformGestureEvent& gestureEvent)
 {
-    // FIXME: This should hit test and go to the correct subframe rather than 
-    // always sending gestures to the main frame only. We should also ensure
-    // that if a frame gets a gesture begin gesture, it gets the corresponding
-    // end gesture as well.
+    // FIXME: A more general scroll system (https://bugs.webkit.org/show_bug.cgi?id=80596) will
+    // eliminate the need for this.
+    TemporaryChange<PlatformEvent::Type> baseEventType(m_baseEventType, gestureEvent.type());
 
     switch (gestureEvent.type()) {
     case PlatformEvent::GestureTapDown:
+        // FIXME: Stop animation here.
         break;
-    case PlatformEvent::GestureTap: {
-        // FIXME: Refactor this code to not hit test multiple times once hit testing has been corrected as suggested above.
-        PlatformMouseEvent fakeMouseMove(gestureEvent.position(), gestureEvent.globalPosition(), NoButton, PlatformEvent::MouseMoved, /* clickCount */ 1, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
-        PlatformMouseEvent fakeMouseDown(gestureEvent.position(), gestureEvent.globalPosition(), LeftButton, PlatformEvent::MousePressed, /* clickCount */ 1, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
-        PlatformMouseEvent fakeMouseUp(gestureEvent.position(), gestureEvent.globalPosition(), LeftButton, PlatformEvent::MouseReleased, /* clickCount */ 1, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
-        mouseMoved(fakeMouseMove);
-        handleMousePressEvent(fakeMouseDown);
-        handleMouseReleaseEvent(fakeMouseUp);
-        return true;
-    }
-    case PlatformEvent::GestureScrollUpdate: {
-        const float tickDivisor = (float)WheelEvent::tickMultiplier;
-        // FIXME: Replace this interim implementation once the above fixme has been addressed.
-        IntPoint point(gestureEvent.position().x(), gestureEvent.position().y());
-        IntPoint globalPoint(gestureEvent.globalPosition().x(), gestureEvent.globalPosition().y());
-        PlatformWheelEvent syntheticWheelEvent(point, globalPoint, gestureEvent.deltaX(), gestureEvent.deltaY(), gestureEvent.deltaX() / tickDivisor, gestureEvent.deltaY() / tickDivisor, ScrollByPixelWheelEvent, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey());
-        handleWheelEvent(syntheticWheelEvent);
-        return true;
-    }
+    case PlatformEvent::GestureTap:
+        return handleGestureTap(gestureEvent);
+    case PlatformEvent::GestureScrollUpdate:
+        return handleGestureScrollUpdate(gestureEvent);
     case PlatformEvent::GestureDoubleTap:
+        break;
     case PlatformEvent::GestureScrollBegin:
+        return handleGestureScrollCore(gestureEvent, ScrollByPixelWheelEvent, false);
     case PlatformEvent::GestureScrollEnd:
-        break;
+        return handleGestureScrollCore(gestureEvent, ScrollByPixelVelocityWheelEvent, true);
     default:
         ASSERT_NOT_REACHED();
     }
-    return true;
+
+    return false;
+}
+
+bool EventHandler::handleGestureTap(const PlatformGestureEvent& gestureEvent)
+{
+    // FIXME: Refactor this code to not hit test multiple times.
+    bool defaultPrevented = false;
+    PlatformMouseEvent fakeMouseMove(gestureEvent.position(), gestureEvent.globalPosition(), NoButton, PlatformEvent::MouseMoved, /* clickCount */ 1, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
+    PlatformMouseEvent fakeMouseDown(gestureEvent.position(), gestureEvent.globalPosition(), LeftButton, PlatformEvent::MousePressed, /* clickCount */ 1, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
+    PlatformMouseEvent fakeMouseUp(gestureEvent.position(), gestureEvent.globalPosition(), LeftButton, PlatformEvent::MouseReleased, /* clickCount */ 1, gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey(), gestureEvent.timestamp());
+    mouseMoved(fakeMouseMove);
+    defaultPrevented |= handleMousePressEvent(fakeMouseDown);
+    defaultPrevented |= handleMouseReleaseEvent(fakeMouseUp);
+    return defaultPrevented;
+}
+
+bool EventHandler::handleGestureScrollUpdate(const PlatformGestureEvent& gestureEvent)
+{
+    return handleGestureScrollCore(gestureEvent, ScrollByPixelWheelEvent, true);
+}
+
+bool EventHandler::handleGestureScrollCore(const PlatformGestureEvent& gestureEvent, PlatformWheelEventGranularity granularity, bool latchedWheel)
+{
+    TemporaryChange<bool> latched(m_useLatchedWheelEventNode, latchedWheel);
+    const float tickDivisor = (float)WheelEvent::tickMultiplier;
+    IntPoint point(gestureEvent.position().x(), gestureEvent.position().y());
+    IntPoint globalPoint(gestureEvent.globalPosition().x(), gestureEvent.globalPosition().y());
+    PlatformWheelEvent syntheticWheelEvent(point, globalPoint,
+        gestureEvent.deltaX(), gestureEvent.deltaY(), gestureEvent.deltaX() / tickDivisor, gestureEvent.deltaY() / tickDivisor,
+        granularity,
+        gestureEvent.shiftKey(), gestureEvent.ctrlKey(), gestureEvent.altKey(), gestureEvent.metaKey());
+    return handleWheelEvent(syntheticWheelEvent);
 }
 #endif
 
@@ -2488,8 +2538,18 @@ void EventHandler::dispatchFakeMouseMoveEventSoon()
     if (m_mousePressed)
         return;
 
-    if (!m_fakeMouseMoveEventTimer.isActive())
-        m_fakeMouseMoveEventTimer.startOneShot(fakeMouseMoveInterval);
+    // If the content has ever taken longer than fakeMouseMoveShortInterval we
+    // reschedule the timer and use a longer time. This will cause the content
+    // to receive these moves only after the user is done scrolling, reducing
+    // pauses during the scroll.
+    if (m_maxMouseMovedDuration > fakeMouseMoveShortInterval) {
+        if (m_fakeMouseMoveEventTimer.isActive())
+            m_fakeMouseMoveEventTimer.stop();
+        m_fakeMouseMoveEventTimer.startOneShot(fakeMouseMoveLongInterval);
+    } else {
+        if (!m_fakeMouseMoveEventTimer.isActive())
+            m_fakeMouseMoveEventTimer.startOneShot(fakeMouseMoveShortInterval);
+    }
 }
 
 void EventHandler::dispatchFakeMouseMoveEventSoonInQuad(const FloatQuad& quad)
@@ -2498,11 +2558,10 @@ void EventHandler::dispatchFakeMouseMoveEventSoonInQuad(const FloatQuad& quad)
     if (!view)
         return;
 
-    if (m_mousePressed || !quad.containsPoint(view->windowToContents(m_currentMousePosition)))
+    if (!quad.containsPoint(view->windowToContents(m_currentMousePosition)))
         return;
 
-    if (!m_fakeMouseMoveEventTimer.isActive())
-        m_fakeMouseMoveEventTimer.startOneShot(fakeMouseMoveInterval);
+    dispatchFakeMouseMoveEventSoon();
 }
 
 void EventHandler::cancelFakeMouseMoveEvent()
diff --git a/Source/WebCore/page/EventHandler.h b/Source/WebCore/page/EventHandler.h
index 7733a0f65..2edba90ab 100644
--- a/Source/WebCore/page/EventHandler.h
+++ b/Source/WebCore/page/EventHandler.h
@@ -31,6 +31,7 @@
 #include "FocusDirection.h"
 #include "HitTestRequest.h"
 #include "PlatformMouseEvent.h"
+#include "PlatformWheelEvent.h"
 #include "ScrollTypes.h"
 #include "TextEventInputType.h"
 #include "TextGranularity.h"
@@ -162,6 +163,8 @@ public:
 
 #if ENABLE(GESTURE_EVENTS)
     bool handleGestureEvent(const PlatformGestureEvent&);
+    bool handleGestureTap(const PlatformGestureEvent&);
+    bool handleGestureScrollUpdate(const PlatformGestureEvent&);
 #endif
 
 #if ENABLE(CONTEXT_MENUS)
@@ -345,6 +348,10 @@ private:
     bool isKeyEventAllowedInFullScreen(const PlatformKeyboardEvent&) const;
 #endif
 
+#if ENABLE(GESTURE_EVENTS)
+    bool handleGestureScrollCore(const PlatformGestureEvent&, PlatformWheelEventGranularity, bool latchedWheel);
+#endif
+
     Frame* m_frame;
 
     bool m_mousePressed;
@@ -429,6 +436,8 @@ private:
     TouchTargetMap m_originatingTouchPointTargets;
     bool m_touchPressed;
 #endif
+    double m_maxMouseMovedDuration;
+    PlatformEvent::Type m_baseEventType;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/EventSource.idl b/Source/WebCore/page/EventSource.idl
index 9b7fe38dc..48df3ebe8 100644
--- a/Source/WebCore/page/EventSource.idl
+++ b/Source/WebCore/page/EventSource.idl
@@ -33,7 +33,6 @@ module window {
 
     interface [
         ActiveDOMObject,
-        ConstructorParameters=1,
         Constructor(in DOMString scriptUrl),
         CallWith=ScriptExecutionContext,
         ConstructorRaisesException,
diff --git a/Source/WebCore/page/FocusController.cpp b/Source/WebCore/page/FocusController.cpp
index aa98c0249..fb16df021 100644
--- a/Source/WebCore/page/FocusController.cpp
+++ b/Source/WebCore/page/FocusController.cpp
@@ -54,7 +54,7 @@
 #include "ScrollAnimator.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "SpatialNavigation.h"
 #include "Widget.h"
 #include "htmlediting.h" // For firstPositionInOrBeforeNode
@@ -155,7 +155,7 @@ void FocusController::setFocused(bool focused)
 
 static inline ShadowRoot* shadowRoot(Node* node)
 {
-    return node->isElementNode() && toElement(node)->hasShadowRoot() ? toElement(node)->shadowRootList()->youngestShadowRoot() : 0;
+    return node->isElementNode() && toElement(node)->hasShadowRoot() ? toElement(node)->shadowTree()->youngestShadowRoot() : 0;
 }
 
 static inline bool isTreeScopeOwner(Node* node)
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index ee3c068c8..ad9cab8e9 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -166,6 +166,7 @@ inline Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoader
     , m_inViewSourceMode(false)
     , m_isDisconnected(false)
     , m_excludeFromTextSearch(false)
+    , m_activeDOMObjectsAndAnimationsSuspendedCount(0)
 {
     ASSERT(page);
     AtomicString::init();
@@ -196,6 +197,11 @@ inline Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoader
 #ifndef NDEBUG
     frameCounter.increment();
 #endif
+
+    // Pause future ActiveDOMObjects if this frame is being created while the page is in a paused state.
+    Frame* parent = parentFromOwnerElement(ownerElement);
+    if (parent && parent->activeDOMObjectsAndAnimationsSuspended())
+        suspendActiveDOMObjectsAndAnimations();
 }
 
 PassRefPtr<Frame> Frame::create(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient* client)
@@ -306,6 +312,13 @@ void Frame::setDocument(PassRefPtr<Document> newDoc)
         notifyChromeClientWheelEventHandlerCountChanged();
         notifyChromeClientTouchEventHandlerCountChanged();
     }
+
+    // Suspend document if this frame was created in suspended state.
+    if (m_doc && activeDOMObjectsAndAnimationsSuspended()) {
+        m_doc->suspendScriptedAnimationControllerCallbacks();
+        m_animationController.suspendAnimationsForDocument(m_doc.get());
+        m_doc->suspendActiveDOMObjects(ActiveDOMObject::PageWillBeSuspended);
+    }
 }
 
 #if ENABLE(ORIENTATION_EVENTS)
@@ -1011,6 +1024,38 @@ float Frame::frameScaleFactor() const
     return page->pageScaleFactor();
 }
 
+void Frame::suspendActiveDOMObjectsAndAnimations()
+{
+    bool wasSuspended = activeDOMObjectsAndAnimationsSuspended();
+
+    m_activeDOMObjectsAndAnimationsSuspendedCount++;
+
+    if (wasSuspended)
+        return;
+
+    if (document()) {
+        document()->suspendScriptedAnimationControllerCallbacks();
+        animation()->suspendAnimationsForDocument(document());
+        document()->suspendActiveDOMObjects(ActiveDOMObject::PageWillBeSuspended);
+    }
+}
+
+void Frame::resumeActiveDOMObjectsAndAnimations()
+{
+    ASSERT(activeDOMObjectsAndAnimationsSuspended());
+
+    m_activeDOMObjectsAndAnimationsSuspendedCount--;
+
+    if (activeDOMObjectsAndAnimationsSuspended())
+        return;
+
+    if (document()) {
+        document()->resumeActiveDOMObjects();
+        animation()->resumeAnimationsForDocument(document());
+        document()->resumeScriptedAnimationControllerCallbacks();
+    }
+}
+
 #if USE(ACCELERATED_COMPOSITING)
 void Frame::deviceOrPageScaleFactorChanged()
 {
@@ -1094,7 +1139,7 @@ DragImageRef Frame::nodeImage(Node* node)
     LayoutRect topLevelRect;
     IntRect paintingRect = pixelSnappedIntRect(renderer->paintingRootRect(topLevelRect));
 
-    OwnPtr<ImageBuffer> buffer(ImageBuffer::create(paintingRect.size()));
+    OwnPtr<ImageBuffer> buffer(ImageBuffer::create(paintingRect.size(), 1, ColorSpaceDeviceRGB));
     if (!buffer)
         return 0;
     buffer->context()->translate(-paintingRect.x(), -paintingRect.y());
@@ -1117,7 +1162,7 @@ DragImageRef Frame::dragImageForSelection()
 
     IntRect paintingRect = enclosingIntRect(selection()->bounds());
 
-    OwnPtr<ImageBuffer> buffer(ImageBuffer::create(paintingRect.size()));
+    OwnPtr<ImageBuffer> buffer(ImageBuffer::create(paintingRect.size(), 1, ColorSpaceDeviceRGB));
     if (!buffer)
         return 0;
     buffer->context()->translate(-paintingRect.x(), -paintingRect.y());
diff --git a/Source/WebCore/page/Frame.h b/Source/WebCore/page/Frame.h
index e06c0dfc7..e25c90f84 100644
--- a/Source/WebCore/page/Frame.h
+++ b/Source/WebCore/page/Frame.h
@@ -188,13 +188,16 @@ namespace WebCore {
         String searchForLabelsAboveCell(RegularExpression*, HTMLTableCellElement*, size_t* resultDistanceFromStartOfCell);
         String searchForLabelsBeforeElement(const Vector<String>& labels, Element*, size_t* resultDistance, bool* resultIsInCellAbove);
         String matchLabelsAgainstElement(const Vector<String>& labels, Element*);
-        
+
 #if PLATFORM(MAC)
         NSImage* selectionImage(bool forceBlackText = false) const;
         NSImage* rangeImage(Range*, bool forceBlackText = false) const;
         NSImage* snapshotDragImage(Node*, NSRect* imageRect, NSRect* elementRect) const;
         NSImage* imageFromRect(NSRect) const;
 #endif
+        void suspendActiveDOMObjectsAndAnimations();
+        void resumeActiveDOMObjectsAndAnimations();
+        bool activeDOMObjectsAndAnimationsSuspended() const { return m_activeDOMObjectsAndAnimationsSuspendedCount > 0; }
 
         // Should only be called on the main frame of a page.
         void notifyChromeClientWheelEventHandlerCountChanged() const;
@@ -257,6 +260,7 @@ namespace WebCore {
         OwnPtr<TiledBackingStore> m_tiledBackingStore;
 #endif
 
+        int m_activeDOMObjectsAndAnimationsSuspendedCount;
     };
 
     inline void Frame::init()
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index 024c484f0..5ecbca363 100644
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -49,6 +49,8 @@
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInImageElement.h"
+#include "InspectorClient.h"
+#include "InspectorController.h"
 #include "InspectorInstrumentation.h"
 #include "OverflowEvent.h"
 #include "RenderArena.h"
@@ -407,10 +409,13 @@ void FrameView::setFrameRect(const IntRect& newRect)
 }
 
 #if ENABLE(REQUEST_ANIMATION_FRAME)
-void FrameView::scheduleAnimation()
+bool FrameView::scheduleAnimation()
 {
-    if (hostWindow())
+    if (hostWindow()) {
         hostWindow()->scheduleAnimation();
+        return true;
+    }
+    return false;
 }
 #endif
 
@@ -626,13 +631,6 @@ void FrameView::calculateScrollbarModesForLayout(ScrollbarMode& hMode, Scrollbar
 
 #if USE(ACCELERATED_COMPOSITING)
 
-#if ENABLE(FULLSCREEN_API)
-static bool isDocumentRunningFullScreenAnimation(Document* document)
-{
-    return document->webkitIsFullScreen() && document->fullScreenRenderer() && document->isAnimatingFullScreen();
-}
-#endif
-
 void FrameView::updateCompositingLayers()
 {
     RenderView* root = rootRenderer(this);
@@ -642,12 +640,6 @@ void FrameView::updateCompositingLayers()
     // This call will make sure the cached hasAcceleratedCompositing is updated from the pref
     root->compositor()->cacheAcceleratedCompositingFlags();
     root->compositor()->updateCompositingLayers(CompositingUpdateAfterLayoutOrStyleChange);
-    
-#if ENABLE(FULLSCREEN_API)
-    Document* document = m_frame->document();
-    if (isDocumentRunningFullScreenAnimation(document))
-        root->compositor()->updateCompositingLayers(CompositingUpdateAfterLayoutOrStyleChange, document->fullScreenRenderer()->layer());
-#endif
 }
 
 void FrameView::clearBackingStores()
@@ -722,20 +714,6 @@ bool FrameView::syncCompositingStateForThisFrame(Frame* rootFrameForSync)
 
     root->compositor()->flushPendingLayerChanges(rootFrameForSync == m_frame);
 
-#if ENABLE(FULLSCREEN_API)
-    // The fullScreenRenderer's graphicsLayer has been re-parented, and the above recursive syncCompositingState
-    // call will not cause the subtree under it to repaint.  Explicitly call the syncCompositingState on 
-    // the fullScreenRenderer's graphicsLayer here:
-    Document* document = m_frame->document();
-    if (isDocumentRunningFullScreenAnimation(document)) {
-        RenderLayerBacking* backing = document->fullScreenRenderer()->layer()->backing();
-        if (GraphicsLayer* fullScreenLayer = backing->graphicsLayer()) {
-            // FIXME: Passing frameRect() is correct only when RenderLayerCompositor uses a ScrollLayer (as in WebKit2)
-            // otherwise, the passed clip rect needs to take scrolling into account
-            fullScreenLayer->syncCompositingState(frameRect());
-        }
-    }
-#endif
     return true;
 }
 
@@ -2103,6 +2081,8 @@ void FrameView::unscheduleRelayout()
 #if ENABLE(REQUEST_ANIMATION_FRAME)
 void FrameView::serviceScriptedAnimations(DOMTimeStamp time)
 {
+    serviceScrollAnimations();
+
     Vector<AnimationController*> animations;
     for (Frame* frame = m_frame.get(); frame; frame = frame->tree()->traverseNext())
         frame->animation()->serviceAnimations();
@@ -2331,8 +2311,20 @@ void FrameView::performPostLayoutTasks()
         bool resized = !m_firstLayout && (currentSize != m_lastLayoutSize || currentZoomFactor != m_lastZoomFactor);
         m_lastLayoutSize = currentSize;
         m_lastZoomFactor = currentZoomFactor;
-        if (resized)
+        if (resized) {
             m_frame->eventHandler()->sendResizeEvent();
+
+#if ENABLE(INSPECTOR)
+            if (InspectorInstrumentation::hasFrontends()) {
+                if (Page* page = m_frame->page()) {
+                    if (page->mainFrame() == m_frame) {
+                        if (InspectorClient* inspectorClient = page->inspectorController()->inspectorClient())
+                            inspectorClient->didResizeMainFrame(m_frame.get());
+                    }
+                }
+            }
+#endif
+        }
     }
 }
 
@@ -2702,6 +2694,9 @@ void FrameView::paintScrollCorner(GraphicsContext* context, const IntRect& corne
     }
 
     if (m_scrollCorner) {
+        bool needsBackgorund = m_frame->page() && m_frame->page()->mainFrame() == m_frame;
+        if (needsBackgorund)
+            context->fillRect(cornerRect, baseBackgroundColor(), ColorSpaceDeviceRGB);
         m_scrollCorner->paintIntoRect(context, cornerRect.location(), cornerRect);
         return;
     }
@@ -2709,6 +2704,18 @@ void FrameView::paintScrollCorner(GraphicsContext* context, const IntRect& corne
     ScrollView::paintScrollCorner(context, cornerRect);
 }
 
+void FrameView::paintScrollbar(GraphicsContext* context, Scrollbar* bar, const IntRect& rect)
+{
+    bool needsBackgorund = bar->isCustomScrollbar() && (m_frame->page() && m_frame->page()->mainFrame() == m_frame);
+    if (needsBackgorund) {
+        IntRect toFill = bar->frameRect();
+        toFill.intersect(rect);
+        context->fillRect(toFill, baseBackgroundColor(), ColorSpaceDeviceRGB);
+    }
+
+    ScrollView::paintScrollbar(context, bar, rect);
+}
+
 Color FrameView::documentBackgroundColor() const
 {
     // <https://bugs.webkit.org/show_bug.cgi?id=59540> We blend the background color of
@@ -3024,11 +3031,15 @@ void FrameView::enableAutoSizeMode(bool enable, const IntSize& minSize, const In
     m_minAutoSize = minSize;
     m_maxAutoSize = maxSize;
 
-    if (!m_shouldAutoSize)
-        return;
-
     setNeedsLayout();
     scheduleRelayout();
+    if (m_shouldAutoSize)
+        return;
+
+    // Since autosize mode forces the scrollbar mode, change them to being auto.
+    setVerticalScrollbarLock(false);
+    setHorizontalScrollbarLock(false);
+    setScrollbarModes(ScrollbarAuto, ScrollbarAuto);
 }
 
 void FrameView::forceLayout(bool allowSubtree)
diff --git a/Source/WebCore/page/FrameView.h b/Source/WebCore/page/FrameView.h
index cfd35a36c..1f90bc3b8 100644
--- a/Source/WebCore/page/FrameView.h
+++ b/Source/WebCore/page/FrameView.h
@@ -69,7 +69,7 @@ public:
     virtual void setFrameRect(const IntRect&);
 
 #if ENABLE(REQUEST_ANIMATION_FRAME)
-    void scheduleAnimation();
+    virtual bool scheduleAnimation();
 #endif
 
     Frame* frame() const { return m_frame.get(); }
@@ -99,6 +99,7 @@ public:
     bool isInLayout() const { return m_inLayout; }
 
     RenderObject* layoutRoot(bool onlyDuringLayout = false) const;
+    void clearLayoutRoot() { m_layoutRoot = 0; }
     int layoutCount() const { return m_layoutCount; }
 
     bool needsLayout() const;
@@ -229,6 +230,7 @@ public:
 
     virtual void paintOverhangAreas(GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
     virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect);
+    virtual void paintScrollbar(GraphicsContext*, Scrollbar*, const IntRect&) OVERRIDE;
 
     Color documentBackgroundColor() const;
 
diff --git a/Source/WebCore/page/Navigator.cpp b/Source/WebCore/page/Navigator.cpp
index 76328a7a5..49e362b1e 100644
--- a/Source/WebCore/page/Navigator.cpp
+++ b/Source/WebCore/page/Navigator.cpp
@@ -51,17 +51,6 @@ Navigator::~Navigator()
 {
 }
 
-void Navigator::provideSupplement(const AtomicString& name, PassOwnPtr<NavigatorSupplement> supplement)
-{
-    ASSERT(!m_suppliments.get(name.impl()));
-    m_suppliments.set(name.impl(), supplement);
-}
-
-NavigatorSupplement* Navigator::requireSupplement(const AtomicString& name)
-{
-    return m_suppliments.get(name.impl());
-}
-
 // If this function returns true, we need to hide the substring "4." that would otherwise
 // appear in the appVersion string. This is to avoid problems with old versions of a
 // library called OpenCube QuickMenu, which as of this writing is still being used on
diff --git a/Source/WebCore/page/Navigator.h b/Source/WebCore/page/Navigator.h
index 750eeaa57..b362b16f8 100644
--- a/Source/WebCore/page/Navigator.h
+++ b/Source/WebCore/page/Navigator.h
@@ -22,7 +22,7 @@
 
 #include "DOMWindowProperty.h"
 #include "NavigatorBase.h"
-#include "NavigatorSupplement.h"
+#include "Supplementable.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
@@ -39,7 +39,7 @@ class PluginData;
 
 typedef int ExceptionCode;
 
-class Navigator : public NavigatorBase, public RefCounted<Navigator>, public DOMWindowProperty {
+class Navigator : public NavigatorBase, public RefCounted<Navigator>, public DOMWindowProperty, public Supplementable<Navigator> {
 public:
     static PassRefPtr<Navigator> create(Frame* frame) { return adoptRef(new Navigator(frame)); }
     virtual ~Navigator();
@@ -60,15 +60,9 @@ public:
     // Relinquishes the storage lock, if one exists.
     void getStorageUpdates();
 
-    void provideSupplement(const AtomicString&, PassOwnPtr<NavigatorSupplement>);
-    NavigatorSupplement* requireSupplement(const AtomicString&);
-
 private:
     explicit Navigator(Frame*);
 
-    typedef HashMap<AtomicStringImpl*, OwnPtr<NavigatorSupplement> > NavigatorSupplementMap;
-    NavigatorSupplementMap m_suppliments;
-
     mutable RefPtr<DOMPluginArray> m_plugins;
     mutable RefPtr<DOMMimeTypeArray> m_mimeTypes;
 #if ENABLE(POINTER_LOCK)
diff --git a/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp b/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp
index a773b57dd..8635b9075 100644
--- a/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp
+++ b/Source/WebCore/page/NavigatorRegisterProtocolHandler.cpp
@@ -142,4 +142,4 @@ void NavigatorRegisterProtocolHandler::registerProtocolHandler(Navigator* naviga
 
 } // namespace WebCore
 
-#endif // ENABLE(WEB_INTENTS)
+#endif // ENABLE(REGISTER_PROTOCOL_HANDLER)
diff --git a/Source/WebCore/page/Page.cpp b/Source/WebCore/page/Page.cpp
index 1bad0a47b..7b6b9fe78 100644
--- a/Source/WebCore/page/Page.cpp
+++ b/Source/WebCore/page/Page.cpp
@@ -1009,28 +1009,45 @@ PageVisibilityState Page::visibilityState() const
 }
 #endif
 
+// FIXME: gPaintedObjectCounterThreshold is no longer used for calculating relevant repainted areas,
+// and it should be removed. For the time being, it is useful because it allows us to avoid doing
+// any of this work for ports that don't make sure of didNewFirstVisuallyNonEmptyLayout. We should
+// remove this when we resolve <rdar://problem/10791680> Need to merge didFirstVisuallyNonEmptyLayout 
+// and didNewFirstVisuallyNonEmptyLayout
 static uint64_t gPaintedObjectCounterThreshold = 0;
 
+// These are magical constants that might be tweaked over time.
+static double gMinimumPaintedAreaRatio = 0.1;
+static double gMaximumUnpaintedAreaRatio = 0.04;
+
 void Page::setRelevantRepaintedObjectsCounterThreshold(uint64_t threshold)
 {
     gPaintedObjectCounterThreshold = threshold;
 }
 
+bool Page::isCountingRelevantRepaintedObjects() const
+{
+    return m_isCountingRelevantRepaintedObjects && gPaintedObjectCounterThreshold > 0;
+}
+
 void Page::startCountingRelevantRepaintedObjects()
 {
     m_isCountingRelevantRepaintedObjects = true;
 
-    // Clear the HashSet in case we didn't hit the threshold last time.
-    m_relevantPaintedRenderObjects.clear();
+    // Reset everything in case we didn't hit the threshold last time.
+    resetRelevantPaintedObjectCounter();
 }
 
-void Page::addRelevantRepaintedObject(RenderObject* object, const IntRect& objectPaintRect)
+void Page::resetRelevantPaintedObjectCounter()
 {
-    if (!m_isCountingRelevantRepaintedObjects)
-        return;
+    m_relevantUnpaintedRenderObjects.clear();
+    m_relevantPaintedRegion = Region();
+    m_relevantUnpaintedRegion = Region();
+}
 
-    // We don't need to do anything if there is no counter threshold.
-    if (!gPaintedObjectCounterThreshold)
+void Page::addRelevantRepaintedObject(RenderObject* object, const IntRect& objectPaintRect)
+{
+    if (!isCountingRelevantRepaintedObjects())
         return;
 
     // The objects are only relevant if they are being painted within the viewRect().
@@ -1039,25 +1056,56 @@ void Page::addRelevantRepaintedObject(RenderObject* object, const IntRect& objec
             return;
     }
 
-    m_relevantPaintedRenderObjects.add(object);
+    // If this object was previously counted as an unpainted object, remove it from that HashSet
+    // and corresponding Region. FIXME: This doesn't do the right thing if the objects overlap.
+    if (m_relevantUnpaintedRenderObjects.contains(object)) {
+        m_relevantUnpaintedRenderObjects.remove(object);
+        m_relevantUnpaintedRegion.subtract(objectPaintRect);
+    }
+
+    m_relevantPaintedRegion.unite(objectPaintRect);
+
+    RenderView* view = object->view();
+    if (!view)
+        return;
+    
+    float viewArea = view->viewRect().width() * view->viewRect().height();
+    float ratioOfViewThatIsPainted = m_relevantPaintedRegion.totalArea() / viewArea;
+    float ratioOfViewThatIsUnpainted = m_relevantUnpaintedRegion.totalArea() / viewArea;
 
-    if (m_relevantPaintedRenderObjects.size() == static_cast<int>(gPaintedObjectCounterThreshold)) {
+    if (ratioOfViewThatIsPainted > gMinimumPaintedAreaRatio && ratioOfViewThatIsUnpainted < gMaximumUnpaintedAreaRatio) {
         m_isCountingRelevantRepaintedObjects = false;
-        m_relevantPaintedRenderObjects.clear();
+        resetRelevantPaintedObjectCounter();
         if (Frame* frame = mainFrame())
             frame->loader()->didNewFirstVisuallyNonEmptyLayout();
     }
 }
 
-void Page::provideSupplement(const AtomicString& name, PassOwnPtr<PageSupplement> supplement)
+void Page::addRelevantUnpaintedObject(RenderObject* object, const IntRect& objectPaintRect)
 {
-    ASSERT(!m_supplements.get(name.impl()));
-    m_supplements.set(name.impl(), supplement);
+    if (!isCountingRelevantRepaintedObjects())
+        return;
+
+    // The objects are only relevant if they are being painted within the viewRect().
+    if (RenderView* view = object->view()) {
+        if (!objectPaintRect.intersects(pixelSnappedIntRect(view->viewRect())))
+            return;
+    }
+
+    m_relevantUnpaintedRenderObjects.add(object);
+    m_relevantUnpaintedRegion.unite(objectPaintRect);
+}
+
+void Page::suspendActiveDOMObjectsAndAnimations()
+{
+    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext())
+        frame->suspendActiveDOMObjectsAndAnimations();
 }
 
-PageSupplement* Page::requireSupplement(const AtomicString& name)
+void Page::resumeActiveDOMObjectsAndAnimations()
 {
-    return m_supplements.get(name.impl());
+    for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext())
+        frame->resumeActiveDOMObjectsAndAnimations();
 }
 
 Page::PageClients::PageClients()
diff --git a/Source/WebCore/page/Page.h b/Source/WebCore/page/Page.h
index 685eed7e7..cdf7fe619 100644
--- a/Source/WebCore/page/Page.h
+++ b/Source/WebCore/page/Page.h
@@ -24,10 +24,11 @@
 #include "FrameLoaderTypes.h"
 #include "FindOptions.h"
 #include "LayoutTypes.h"
-#include "PageSupplement.h"
 #include "PageVisibilityState.h"
 #include "PlatformScreen.h"
 #include "PlatformString.h"
+#include "Region.h"
+#include "Supplementable.h"
 #include "ViewportArguments.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
@@ -89,7 +90,7 @@ namespace WebCore {
 
     float deviceScaleFactor(Frame*);
 
-    class Page {
+    class Page : public Supplementable<Page> {
         WTF_MAKE_NONCOPYABLE(Page);
         friend class Settings;
     public:
@@ -320,19 +321,19 @@ namespace WebCore {
 
         PlatformDisplayID displayID() const { return m_displayID; }
 
+        bool isCountingRelevantRepaintedObjects() const;
         void setRelevantRepaintedObjectsCounterThreshold(uint64_t);
         void startCountingRelevantRepaintedObjects();
+        void resetRelevantPaintedObjectCounter();
         void addRelevantRepaintedObject(RenderObject*, const IntRect& objectPaintRect);
+        void addRelevantUnpaintedObject(RenderObject*, const IntRect& objectPaintRect);
 
-        void provideSupplement(const AtomicString&, PassOwnPtr<PageSupplement>);
-        PageSupplement* requireSupplement(const AtomicString&);
+        void suspendActiveDOMObjectsAndAnimations();
+        void resumeActiveDOMObjectsAndAnimations();
 
     private:
         void initGroup();
 
-        typedef HashMap<AtomicStringImpl*, OwnPtr<PageSupplement> > PageSupplementMap;
-        PageSupplementMap m_supplements;
-
 #if ASSERT_DISABLED
         void checkFrameCountConsistency() const { }
 #else
@@ -424,7 +425,9 @@ namespace WebCore {
 #endif
         PlatformDisplayID m_displayID;
 
-        HashSet<RenderObject*> m_relevantPaintedRenderObjects;
+        HashSet<RenderObject*> m_relevantUnpaintedRenderObjects;
+        Region m_relevantPaintedRegion;
+        Region m_relevantUnpaintedRegion;
         bool m_isCountingRelevantRepaintedObjects;
     };
 
diff --git a/Source/WebCore/page/PageGroup.cpp b/Source/WebCore/page/PageGroup.cpp
index 97ca5467b..731e1fc07 100644
--- a/Source/WebCore/page/PageGroup.cpp
+++ b/Source/WebCore/page/PageGroup.cpp
@@ -31,7 +31,6 @@
 #include "Document.h"
 #include "Frame.h"
 #include "GroupSettings.h"
-#include "IDBFactoryBackendInterface.h"
 #include "Page.h"
 #include "PageCache.h"
 #include "SecurityOrigin.h"
@@ -261,17 +260,6 @@ StorageNamespace* PageGroup::localStorage()
     return m_localStorage.get();
 }
 
-#if ENABLE(INDEXED_DATABASE)
-IDBFactoryBackendInterface* PageGroup::idbFactory()
-{
-    // Do not add page setting based access control here since this object is shared by all pages in
-    // the group and having per-page controls is misleading.
-    if (!m_factoryBackend)
-        m_factoryBackend = IDBFactoryBackendInterface::create();
-    return m_factoryBackend.get();
-}
-#endif
-
 void PageGroup::addUserScriptToWorld(DOMWrapperWorld* world, const String& source, const KURL& url,
                                      PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
                                      UserScriptInjectionTime injectionTime, UserContentInjectedFrames injectedFrames)
diff --git a/Source/WebCore/page/PageGroup.h b/Source/WebCore/page/PageGroup.h
index d391049f6..1362d17e2 100644
--- a/Source/WebCore/page/PageGroup.h
+++ b/Source/WebCore/page/PageGroup.h
@@ -29,6 +29,7 @@
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include "LinkHash.h"
+#include "Supplementable.h"
 #include "UserScript.h"
 #include "UserStyleSheet.h"
 #include <wtf/text/StringHash.h>
@@ -42,7 +43,7 @@ namespace WebCore {
     class SecurityOrigin;
     class StorageNamespace;
 
-    class PageGroup {
+    class PageGroup : public Supplementable<PageGroup> {
         WTF_MAKE_NONCOPYABLE(PageGroup); WTF_MAKE_FAST_ALLOCATED;
     public:
         PageGroup(const String& name);
@@ -81,11 +82,6 @@ namespace WebCore {
         StorageNamespace* localStorage();
         bool hasLocalStorage() { return m_localStorage; }
 
-#if ENABLE(INDEXED_DATABASE)
-        IDBFactoryBackendInterface* idbFactory();
-        bool hasIDBFactory() { return m_factoryBackend; }
-#endif
-
         void addUserScriptToWorld(DOMWrapperWorld*, const String& source, const KURL&,
                                   PassOwnPtr<Vector<String> > whitelist, PassOwnPtr<Vector<String> > blacklist,
                                   UserScriptInjectionTime, UserContentInjectedFrames);
@@ -122,9 +118,6 @@ namespace WebCore {
 
         unsigned m_identifier;
         RefPtr<StorageNamespace> m_localStorage;
-#if ENABLE(INDEXED_DATABASE)
-        RefPtr<IDBFactoryBackendInterface> m_factoryBackend;
-#endif
 
         OwnPtr<UserScriptMap> m_userScripts;
         OwnPtr<UserStyleSheetMap> m_userStyleSheets;
diff --git a/Source/WebCore/websockets/DOMWindowWebSocket.idl b/Source/WebCore/page/PagePopup.h
index fd9a18db4..26713cb82 100644
--- a/Source/WebCore/websockets/DOMWindowWebSocket.idl
+++ b/Source/WebCore/page/PagePopup.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Google Inc.  All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,16 +28,19 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-module window {
+#ifndef PagePopup_h
+#define PagePopup_h
 
-    interface [
-        Conditional=WEB_SOCKETS,
-        Supplemental=DOMWindow
-    ] DOMWindowWebSocket {
-#if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
-        attribute CloseEventConstructor CloseEvent;
-        attribute [JSCustomGetter, V8EnabledAtRuntime] WebSocketConstructor WebSocket; // Usable with the new operator
-#endif
-    };
+#if ENABLE(PAGE_POPUP)
+namespace WebCore {
+
+// A PagePopup object is created by ChromeClient::openPagePopup(), and deleted
+// by ChromeClient::closePagePopup().
+class PagePopup {
+protected:
+    virtual ~PagePopup() { }
+};
 
 }
+#endif
+#endif
diff --git a/Source/WebCore/bindings/v8/custom/V8ElementCustom.cpp b/Source/WebCore/page/PagePopupClient.h
index e9b9336f3..450c2d730 100644
--- a/Source/WebCore/bindings/v8/custom/V8ElementCustom.cpp
+++ b/Source/WebCore/page/PagePopupClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2009 Google Inc. All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,41 +28,40 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include "config.h"
-#include "V8Element.h"
+#ifndef PagePopupClient_h
+#define PagePopupClient_h
 
-#include "Attr.h"
-#include "Document.h"
-#include "Element.h"
-#include "ExceptionCode.h"
-#include "HTMLFrameElementBase.h"
-#include "HTMLNames.h"
-#include "Node.h"
+#if ENABLE(PAGE_POPUP)
 
-#include "V8Attr.h"
-#include "V8Binding.h"
-#include "V8BindingState.h"
-#include "V8HTMLElement.h"
-#include "V8Proxy.h"
+#include "IntSize.h"
+#include <wtf/text/WTFString.h>
 
-#if ENABLE(SVG)
-#include "V8SVGElement.h"
-#endif
+namespace WebCore {
 
-#include <wtf/RefPtr.h>
+class DocumentWriter;
 
-namespace WebCore {
+class PagePopupClient {
+public:
+    virtual IntSize contentSize() = 0;
+
+    // Provide an HTML source through the specified DocumentWriter. The HTML
+    // source is rendered in a PagePopup.
+    // The content HTML supports:
+    //  - No <select> popups
+    //  - No window.resizeBy() and resizeTo()
+    //  - window.setValueAndClosePopup(number, string).
+    virtual void writeDocument(DocumentWriter&) = 0;
+
+    // This is called by the content HTML of a PagePopup.
+    // An implementation of this function should call ChromeClient::closePagePopup().
+    virtual void setValueAndClosePopup(int numValue, const String& stringValue) = 0;
+
+    // This is called whenever a PagePopup was closed.
+    virtual void didClosePopup() = 0;
+
+    virtual ~PagePopupClient() { }
+};
 
-v8::Handle<v8::Value> toV8(Element* impl, bool forceNewObject)
-{
-    if (!impl)
-        return v8::Null();
-    if (impl->isHTMLElement())
-        return toV8(toHTMLElement(impl), forceNewObject);
-#if ENABLE(SVG)
-    if (impl->isSVGElement())
-        return toV8(static_cast<SVGElement*>(impl), forceNewObject);
-#endif
-    return V8Element::wrap(impl, forceNewObject);
 }
-} // namespace WebCore
+#endif
+#endif
diff --git a/Source/WebCore/page/PageSerializer.cpp b/Source/WebCore/page/PageSerializer.cpp
index 64d901b7a..9d50211cc 100644
--- a/Source/WebCore/page/PageSerializer.cpp
+++ b/Source/WebCore/page/PageSerializer.cpp
@@ -52,6 +52,7 @@
 #include "Page.h"
 #include "StyleCachedImage.h"
 #include "StyleImage.h"
+#include "StyleRule.h"
 #include "Text.h"
 #include "TextEncoding.h"
 #include <wtf/text/CString.h>
@@ -227,7 +228,7 @@ void PageSerializer::serializeFrame(Frame* frame)
         Element* element = toElement(node);
         // We have to process in-line style as it might contain some resources (typically background images).
         if (element->isStyledElement())
-            retrieveResourcesForCSSDeclaration(static_cast<StyledElement*>(element)->inlineStyleDecl(), document);
+            retrieveResourcesForProperties(static_cast<StyledElement*>(element)->inlineStyle(), document);
 
         if (element->hasTagName(HTMLNames::imgTag)) {
             HTMLImageElement* imageElement = static_cast<HTMLImageElement*>(element);
@@ -275,7 +276,7 @@ void PageSerializer::serializeCSSStyleSheet(CSSStyleSheet* styleSheet, const KUR
             // FIXME: Add support for font face rule. It is not clear to me at this point if the actual otf/eot file can
             // be retrieved from the CSSFontFaceRule object.
         } else if (rule->isStyleRule())
-            retrieveResourcesForCSSRule(static_cast<CSSStyleRule*>(rule), document);
+            retrieveResourcesForRule(static_cast<CSSStyleRule*>(rule)->styleRule(), document);
     }
 
     if (url.isValid() && !m_resourceURLs.contains(url)) {
@@ -302,12 +303,12 @@ void PageSerializer::addImageToResources(CachedImage* image, RenderObject* image
     m_resourceURLs.add(url);
 }
 
-void PageSerializer::retrieveResourcesForCSSRule(CSSStyleRule* rule, Document* document)
+void PageSerializer::retrieveResourcesForRule(StyleRule* rule, Document* document)
 {
-    retrieveResourcesForCSSDeclaration(rule->declaration(), document);
+    retrieveResourcesForProperties(rule->properties(), document);
 }
 
-void PageSerializer::retrieveResourcesForCSSDeclaration(StylePropertySet* styleDeclaration, Document* document)
+void PageSerializer::retrieveResourcesForProperties(const StylePropertySet* styleDeclaration, Document* document)
 {
     if (!styleDeclaration)
         return;
diff --git a/Source/WebCore/page/PageSerializer.h b/Source/WebCore/page/PageSerializer.h
index a900f150a..4e81579e2 100644
--- a/Source/WebCore/page/PageSerializer.h
+++ b/Source/WebCore/page/PageSerializer.h
@@ -41,13 +41,13 @@
 namespace WebCore {
 
 class CachedImage;
-class CSSStyleRule;
 class CSSStyleSheet;
 class Document;
 class Frame;
 class Page;
 class RenderObject;
 class StylePropertySet;
+class StyleRule;
 
 // This class is used to serialize a page contents back to text (typically HTML).
 // It serializes all the page frames and retrieves resources such as images and CSS stylesheets.
@@ -78,8 +78,8 @@ private:
     void serializeCSSStyleSheet(CSSStyleSheet*, const KURL&);
 
     void addImageToResources(CachedImage*, RenderObject*, const KURL&);
-    void retrieveResourcesForCSSDeclaration(StylePropertySet*, Document*);
-    void retrieveResourcesForCSSRule(CSSStyleRule*, Document*);
+    void retrieveResourcesForProperties(const StylePropertySet*, Document*);
+    void retrieveResourcesForRule(StyleRule*, Document*);
 
     Vector<Resource>* m_resources;
     ListHashSet<KURL> m_resourceURLs;
diff --git a/Source/WebCore/page/Settings.cpp b/Source/WebCore/page/Settings.cpp
index ec50f88c8..1e6a75ce9 100644
--- a/Source/WebCore/page/Settings.cpp
+++ b/Source/WebCore/page/Settings.cpp
@@ -115,8 +115,9 @@ Settings::Settings(Page* page)
     , m_minimumLogicalFontSize(0)
     , m_defaultFontSize(0)
     , m_defaultFixedFontSize(0)
+    , m_defaultDeviceScaleFactor(1)
     , m_validationMessageTimerMagnification(50)
-    , m_minimumAccelerated2dCanvasSize(128 * 128)
+    , m_minimumAccelerated2dCanvasSize(257 * 256)
     , m_layoutFallbackWidth(980)
     , m_deviceDPI(240)
     , m_maximumDecodedImageSize(numeric_limits<size_t>::max())
@@ -363,6 +364,11 @@ void Settings::setDefaultFixedFontSize(int defaultFontSize)
     m_page->setNeedsRecalcStyleInAllFrames();
 }
 
+void Settings::setDefaultDeviceScaleFactor(int defaultDeviceScaleFactor)
+{
+    m_defaultDeviceScaleFactor = defaultDeviceScaleFactor;
+}
+
 void Settings::setLoadsImagesAutomatically(bool loadsImagesAutomatically)
 {
     m_loadsImagesAutomatically = loadsImagesAutomatically;
diff --git a/Source/WebCore/page/Settings.h b/Source/WebCore/page/Settings.h
index d3906f1e5..32aabd843 100644
--- a/Source/WebCore/page/Settings.h
+++ b/Source/WebCore/page/Settings.h
@@ -103,6 +103,9 @@ namespace WebCore {
         void setDefaultFixedFontSize(int);
         int defaultFixedFontSize() const { return m_defaultFixedFontSize; }
 
+        void setDefaultDeviceScaleFactor(int);
+        int defaultDeviceScaleFactor() const { return m_defaultDeviceScaleFactor; }
+
         // Unlike areImagesEnabled, this only suppresses the network load of
         // the image URL.  A cached image will still be rendered if requested.
         void setLoadsImagesAutomatically(bool);
@@ -562,6 +565,7 @@ namespace WebCore {
         int m_minimumLogicalFontSize;
         int m_defaultFontSize;
         int m_defaultFixedFontSize;
+        int m_defaultDeviceScaleFactor;
         int m_validationMessageTimerMagnification;
         int m_minimumAccelerated2dCanvasSize;
         int m_layoutFallbackWidth;
diff --git a/Source/WebCore/page/SpeechInput.cpp b/Source/WebCore/page/SpeechInput.cpp
index 4d7290c3f..0128ef8a4 100644
--- a/Source/WebCore/page/SpeechInput.cpp
+++ b/Source/WebCore/page/SpeechInput.cpp
@@ -125,7 +125,7 @@ const AtomicString& SpeechInput::supplementName()
 
 void provideSpeechInputTo(Page* page, SpeechInputClient* client)
 {
-    PageSupplement::provideTo(page, SpeechInput::supplementName(), SpeechInput::create(client));
+    SpeechInput::provideTo(page, SpeechInput::supplementName(), SpeechInput::create(client));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/SpeechInput.h b/Source/WebCore/page/SpeechInput.h
index bab9e3643..01148f3e5 100644
--- a/Source/WebCore/page/SpeechInput.h
+++ b/Source/WebCore/page/SpeechInput.h
@@ -33,7 +33,7 @@
 
 #if ENABLE(INPUT_SPEECH)
 
-#include "PageSupplement.h"
+#include "Page.h"
 #include "SpeechInputListener.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
@@ -49,15 +49,14 @@ class SpeechInputListener;
 // speech recognition engine. It provides methods for the input elements to activate speech
 // recognition and methods for the speech recognition engine to return back the results.
 class SpeechInput : public SpeechInputListener,
-                    public PageSupplement {
+                    public Supplement<Page> {
     WTF_MAKE_NONCOPYABLE(SpeechInput);
 public:
     virtual ~SpeechInput();
 
     static PassOwnPtr<SpeechInput> create(SpeechInputClient*);
     static const AtomicString& supplementName();
-    static SpeechInput* from(Frame* frame) { return static_cast<SpeechInput*>(PageSupplement::from(frame, supplementName())); }
-    static SpeechInput* from(Page* page) { return static_cast<SpeechInput*>(PageSupplement::from(page, supplementName())); }
+    static SpeechInput* from(Page* page) { return static_cast<SpeechInput*>(Supplement<Page>::from(page, supplementName())); }
 
     // Generates a unique ID for the given listener to be used for speech requests.
     // This should be the first call made by listeners before anything else.
diff --git a/Source/WebCore/page/animation/AnimationController.cpp b/Source/WebCore/page/animation/AnimationController.cpp
index 4930b54f4..812d18d86 100644
--- a/Source/WebCore/page/animation/AnimationController.cpp
+++ b/Source/WebCore/page/animation/AnimationController.cpp
@@ -115,19 +115,6 @@ double AnimationControllerPrivate::updateAnimations(SetChanged callSetChanged/*
     return timeToNextService;
 }
 
-void AnimationControllerPrivate::updateAnimationTimerForRenderer(RenderObject* renderer)
-{
-    double timeToNextService = 0;
-
-    RefPtr<CompositeAnimation> compAnim = m_compositeAnimations.get(renderer);
-    if (!compAnim->suspended() && compAnim->hasAnimations())
-        timeToNextService = compAnim->timeToNextService();
-
-    if (m_animationTimer.isActive())
-        m_animationTimer.stop();
-    m_animationTimer.startOneShot(timeToNextService);
-}
-
 void AnimationControllerPrivate::updateAnimationTimer(SetChanged callSetChanged/* = DoNotCallSetChanged*/)
 {
     double timeToNextService = updateAnimations(callSetChanged);
@@ -530,7 +517,7 @@ PassRefPtr<RenderStyle> AnimationController::updateAnimations(RenderObject* rend
     RefPtr<RenderStyle> blendedStyle = rendererAnimations->animate(renderer, oldStyle, newStyle);
 
     if (renderer->parent() || newStyle->animations() || (oldStyle && oldStyle->animations())) {
-        m_data->updateAnimationTimerForRenderer(renderer);
+        m_data->updateAnimationTimer();
 #if ENABLE(REQUEST_ANIMATION_FRAME)
         if (FrameView* view = renderer->document()->view())
             view->scheduleAnimation();
diff --git a/Source/WebCore/page/animation/AnimationControllerPrivate.h b/Source/WebCore/page/animation/AnimationControllerPrivate.h
index 8f3ee7f6c..2c2051eff 100644
--- a/Source/WebCore/page/animation/AnimationControllerPrivate.h
+++ b/Source/WebCore/page/animation/AnimationControllerPrivate.h
@@ -108,8 +108,6 @@ public:
     void animationWillBeRemoved(AnimationBase*);
 
     PassRefPtr<WebKitAnimationList> animationsForRenderer(RenderObject*) const;
-
-    void updateAnimationTimerForRenderer(RenderObject*);
     
 private:
     void animationTimerFired(Timer<AnimationControllerPrivate>*);
diff --git a/Source/WebCore/page/blackberry/FrameBlackBerry.cpp b/Source/WebCore/page/blackberry/FrameBlackBerry.cpp
deleted file mode 100644
index 64bb1bb53..000000000
--- a/Source/WebCore/page/blackberry/FrameBlackBerry.cpp
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
- * Copyright (C) 2010, 2011 Research In Motion Limited. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-#include "config.h"
-#include "Frame.h"
-
-#include "NotImplemented.h"
-
-namespace WebCore {
-
-DragImageRef Frame::dragImageForSelection()
-{
-    notImplemented();
-    return 0;
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp b/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
index 5c14d995d..df2961bd8 100644
--- a/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingCoordinator.cpp
@@ -53,6 +53,7 @@ namespace WebCore {
 
 ScrollingCoordinator::ScrollingCoordinator(Page* page)
     : m_page(page)
+    , m_forceMainThreadScrollLayerPositionUpdates(false)
 #if ENABLE(THREADED_SCROLLING)
     , m_scrollingTreeState(ScrollingTreeState::create())
     , m_scrollingTree(ScrollingTree::create(this))
@@ -265,7 +266,14 @@ void ScrollingCoordinator::updateMainFrameScrollPosition(const IntPoint& scrollP
 void ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition(const IntPoint& scrollPosition)
 {
 #if USE(ACCELERATED_COMPOSITING)
+    ASSERT(isMainThread());
+
+    if (!m_page)
+        return;
+
     FrameView* frameView = m_page->mainFrame()->view();
+    if (!frameView)
+        return;
 
     // Make sure to update the main frame scroll position before changing the scroll layer position,
     // otherwise we'll introduce jittering on pages with slow repaint objects (like background-attachment: fixed).
@@ -279,6 +287,22 @@ void ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition(c
 #endif
 }
 
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
+void ScrollingCoordinator::handleWheelEventPhase(PlatformWheelEventPhase phase)
+{
+    ASSERT(isMainThread());
+
+    if (!m_page)
+        return;
+
+    FrameView* frameView = m_page->mainFrame()->view();
+    if (!frameView)
+        return;
+
+    frameView->scrollAnimator()->handleWheelEventPhase(phase);
+}
+#endif
+
 void ScrollingCoordinator::recomputeWheelEventHandlerCount()
 {
     unsigned wheelEventHandlerCount = 0;
@@ -294,7 +318,16 @@ void ScrollingCoordinator::updateShouldUpdateScrollLayerPositionOnMainThread()
     FrameView* frameView = m_page->mainFrame()->view();
 
     // FIXME: Having fixed objects on the page should not trigger the slow path.
-    setShouldUpdateScrollLayerPositionOnMainThread(frameView->hasSlowRepaintObjects() || frameView->hasFixedObjects());
+    setShouldUpdateScrollLayerPositionOnMainThread(m_forceMainThreadScrollLayerPositionUpdates || frameView->hasSlowRepaintObjects() || frameView->hasFixedObjects());
+}
+
+void ScrollingCoordinator::setForceMainThreadScrollLayerPositionUpdates(bool forceMainThreadScrollLayerPositionUpdates)
+{
+    if (m_forceMainThreadScrollLayerPositionUpdates == forceMainThreadScrollLayerPositionUpdates)
+        return;
+
+    m_forceMainThreadScrollLayerPositionUpdates = forceMainThreadScrollLayerPositionUpdates;
+    updateShouldUpdateScrollLayerPositionOnMainThread();
 }
 
 #if ENABLE(THREADED_SCROLLING)
diff --git a/Source/WebCore/page/scrolling/ScrollingCoordinator.h b/Source/WebCore/page/scrolling/ScrollingCoordinator.h
index 00b289fe2..ff5440041 100644
--- a/Source/WebCore/page/scrolling/ScrollingCoordinator.h
+++ b/Source/WebCore/page/scrolling/ScrollingCoordinator.h
@@ -28,6 +28,7 @@
 
 #include "GraphicsLayer.h"
 #include "IntRect.h"
+#include "PlatformWheelEvent.h"
 #include "ScrollTypes.h"
 #include "Timer.h"
 #include <wtf/Forward.h>
@@ -46,7 +47,6 @@ namespace WebCore {
 class FrameView;
 class GraphicsLayer;
 class Page;
-class PlatformWheelEvent;
 class Region;
 class ScrollingCoordinatorPrivate;
 class ScrollingTreeState;
@@ -107,6 +107,14 @@ public:
     // Dispatched by the scrolling tree whenever the main frame scroll position changes and the scroll layer position needs to be updated as well.
     void updateMainFrameScrollPositionAndScrollLayerPosition(const IntPoint&);
 
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
+    // Dispatched by the scrolling tree during handleWheelEvent. This is required as long as scrollbars are painted on the main thread.
+    void handleWheelEventPhase(PlatformWheelEventPhase);
+#endif
+
+    // Force all scroll layer position updates to happen on the main thread.
+    void setForceMainThreadScrollLayerPositionUpdates(bool);
+
 private:
     explicit ScrollingCoordinator(Page*);
 
@@ -123,6 +131,8 @@ private:
 
     Page* m_page;
 
+    bool m_forceMainThreadScrollLayerPositionUpdates;
+
 #if ENABLE(THREADED_SCROLLING)
     void scheduleTreeStateCommit();
 
diff --git a/Source/WebCore/page/scrolling/ScrollingThread.cpp b/Source/WebCore/page/scrolling/ScrollingThread.cpp
index f92969cc5..4d804677f 100644
--- a/Source/WebCore/page/scrolling/ScrollingThread.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingThread.cpp
@@ -85,8 +85,6 @@ void ScrollingThread::threadCallback(void* scrollingThread)
 
 void ScrollingThread::threadBody()
 {
-    ASSERT(isCurrentThread());
-
     initializeRunLoop();
 }
 
diff --git a/Source/WebCore/page/scrolling/ScrollingTree.cpp b/Source/WebCore/page/scrolling/ScrollingTree.cpp
index d58c62bd3..9d63fae81 100644
--- a/Source/WebCore/page/scrolling/ScrollingTree.cpp
+++ b/Source/WebCore/page/scrolling/ScrollingTree.cpp
@@ -174,6 +174,16 @@ void ScrollingTree::updateMainFrameScrollPositionAndScrollLayerPosition(const In
     callOnMainThread(bind(&ScrollingCoordinator::updateMainFrameScrollPositionAndScrollLayerPosition, m_scrollingCoordinator.get(), scrollPosition));
 }
 
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
+void ScrollingTree::handleWheelEventPhase(PlatformWheelEventPhase phase)
+{
+    if (!m_scrollingCoordinator)
+        return;
+
+    callOnMainThread(bind(&ScrollingCoordinator::handleWheelEventPhase, m_scrollingCoordinator.get(), phase));
+}
+#endif
+
 bool ScrollingTree::canGoBack()
 {
     MutexLocker lock(m_swipeStateMutex);
diff --git a/Source/WebCore/page/scrolling/ScrollingTree.h b/Source/WebCore/page/scrolling/ScrollingTree.h
index 00d2584c0..65e2ad98b 100644
--- a/Source/WebCore/page/scrolling/ScrollingTree.h
+++ b/Source/WebCore/page/scrolling/ScrollingTree.h
@@ -28,6 +28,7 @@
 
 #if ENABLE(THREADED_SCROLLING)
 
+#include "PlatformWheelEvent.h"
 #include "Region.h"
 #include <wtf/Functional.h>
 #include <wtf/OwnPtr.h>
@@ -39,7 +40,6 @@
 namespace WebCore {
 
 class IntPoint;
-class PlatformWheelEvent;
 class ScrollingCoordinator;
 class ScrollingTreeNode;
 class ScrollingTreeState;
@@ -80,6 +80,10 @@ public:
     void updateMainFrameScrollPosition(const IntPoint& scrollPosition);
     void updateMainFrameScrollPositionAndScrollLayerPosition(const IntPoint& scrollPosition);
 
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
+    void handleWheelEventPhase(PlatformWheelEventPhase);
+#endif
+
     bool canGoBack();
     bool canGoForward();
 
diff --git a/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp b/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp
index e590138a6..9504dfa86 100644
--- a/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp
+++ b/Source/WebCore/page/scrolling/chromium/ScrollingCoordinatorChromium.cpp
@@ -27,8 +27,15 @@
 
 #include "ScrollingCoordinator.h"
 
+#include "Frame.h"
+#include "FrameView.h"
 #include "LayerChromium.h"
 #include "Region.h"
+#include "RenderLayerCompositor.h"
+#include "RenderView.h"
+#include "ScrollbarLayerChromium.h"
+#include "ScrollbarTheme.h"
+#include "cc/CCProxy.h"
 
 namespace WebCore {
 
@@ -58,14 +65,61 @@ ScrollingCoordinator::~ScrollingCoordinator()
     delete m_private;
 }
 
-void ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange(FrameView*, GraphicsLayer* horizontalScrollbarLayer)
+static GraphicsLayer* scrollLayerForFrameView(FrameView* frameView)
 {
-    // FIXME: Implement!
+#if USE(ACCELERATED_COMPOSITING)
+    Frame* frame = frameView->frame();
+    if (!frame)
+        return 0;
+
+    RenderView* renderView = frame->contentRenderer();
+    if (!renderView)
+        return 0;
+    return renderView->compositor()->scrollLayer();
+#else
+    return 0;
+#endif
 }
 
-void ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange(FrameView*, GraphicsLayer* verticalScrollbarLayer)
+static void scrollbarLayerDidChange(Scrollbar* scrollbar, LayerChromium* scrollLayer, GraphicsLayer* scrollbarGraphicsLayer)
 {
-    // FIXME: Implement!
+    ASSERT(scrollbar);
+    ASSERT(scrollLayer);
+    ASSERT(scrollbarGraphicsLayer);
+
+    if (scrollbar->isCustomScrollbar() || !CCProxy::hasImplThread()) {
+        scrollbarGraphicsLayer->setContentsToMedia(0);
+        scrollbarGraphicsLayer->setDrawsContent(true);
+        return;
+    }
+
+    RefPtr<ScrollbarLayerChromium> scrollbarLayer = ScrollbarLayerChromium::create(scrollbar, scrollLayer->id());
+    scrollbarGraphicsLayer->setContentsToMedia(scrollbarLayer.get());
+    scrollbarGraphicsLayer->setDrawsContent(false);
+}
+
+void ScrollingCoordinator::frameViewHorizontalScrollbarLayerDidChange(FrameView* frameView, GraphicsLayer* horizontalScrollbarLayer)
+{
+    if (!horizontalScrollbarLayer || !coordinatesScrollingForFrameView(frameView))
+        return;
+
+    LayerChromium* scrollLayer = m_private->scrollLayer();
+    if (!scrollLayer) // FIXME: sometimes we get called before setScrollLayer, workaround by finding the scroll layout ourselves.
+        scrollLayer = scrollLayerForFrameView(frameView)->platformLayer();
+
+    scrollbarLayerDidChange(frameView->horizontalScrollbar(), scrollLayer, horizontalScrollbarLayer);
+}
+
+void ScrollingCoordinator::frameViewVerticalScrollbarLayerDidChange(FrameView* frameView, GraphicsLayer* verticalScrollbarLayer)
+{
+    if (!verticalScrollbarLayer || !coordinatesScrollingForFrameView(frameView))
+        return;
+
+    LayerChromium* scrollLayer = m_private->scrollLayer();
+    if (!scrollLayer) // FIXME: sometimes we get called before setScrollLayer, workaround by finding the scroll layout ourselves.
+        scrollLayer = scrollLayerForFrameView(frameView)->platformLayer();
+
+    scrollbarLayerDidChange(frameView->verticalScrollbar(), scrollLayer, verticalScrollbarLayer);
 }
 
 void ScrollingCoordinator::setScrollLayer(GraphicsLayer* scrollLayer)
@@ -73,9 +127,10 @@ void ScrollingCoordinator::setScrollLayer(GraphicsLayer* scrollLayer)
     m_private->setScrollLayer(scrollLayer ? scrollLayer->platformLayer() : 0);
 }
 
-void ScrollingCoordinator::setNonFastScrollableRegion(const Region&)
+void ScrollingCoordinator::setNonFastScrollableRegion(const Region& region)
 {
-    // FIXME: Implement!
+    if (LayerChromium* layer = m_private->scrollLayer())
+        layer->setNonFastScrollableRegion(region);
 }
 
 void ScrollingCoordinator::setScrollParameters(ScrollElasticity horizontalScrollElasticity, ScrollElasticity verticalScrollElasticity,
@@ -93,7 +148,8 @@ void ScrollingCoordinator::setWheelEventHandlerCount(unsigned wheelEventHandlerC
 
 void ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread(bool should)
 {
-    // FIXME: Implement!
+    if (LayerChromium* layer = m_private->scrollLayer())
+        layer->setShouldScrollOnMainThread(should);
 }
 
 }
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm b/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm
index 94335b0b2..dbe821338 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm
+++ b/Source/WebCore/page/scrolling/mac/ScrollingCoordinatorMac.mm
@@ -32,6 +32,7 @@
 #import "FrameView.h"
 #import "Page.h"
 #import "ScrollingThread.h"
+#import "ScrollingTree.h"
 #import "ScrollingTreeState.h"
 #import <QuartzCore/QuartzCore.h>
 #import <wtf/Functional.h>
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingThreadMac.mm b/Source/WebCore/page/scrolling/mac/ScrollingThreadMac.mm
index a6a768113..064696e42 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingThreadMac.mm
+++ b/Source/WebCore/page/scrolling/mac/ScrollingThreadMac.mm
@@ -45,6 +45,8 @@ void ScrollingThread::initializeRunLoop()
         m_initializeRunLoopCondition.broadcast();
     }
 
+    ASSERT(isCurrentThread());
+
     CFRunLoopRun();
 }
 
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
index 97b3d22bc..f056ff9f0 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
+++ b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.h
@@ -76,6 +76,7 @@ private:
     RetainPtr<CFRunLoopTimerRef> m_snapRubberbandTimer;
 
     RetainPtr<CALayer> m_scrollLayer;
+    IntPoint m_probableMainThreadScrollPosition;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
index 966b2e18f..a9e54b574 100644
--- a/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
+++ b/Source/WebCore/page/scrolling/mac/ScrollingTreeNodeMac.mm
@@ -60,11 +60,19 @@ void ScrollingTreeNodeMac::update(ScrollingTreeState* state)
 
     if (state->changedProperties() & (ScrollingTreeState::ScrollLayer | ScrollingTreeState::ContentsSize | ScrollingTreeState::ViewportRect))
         updateMainFramePinState(scrollPosition());
+
+    if ((state->changedProperties() & ScrollingTreeState::ShouldUpdateScrollLayerPositionOnMainThread) && shouldUpdateScrollLayerPositionOnMainThread()) {
+        // We're transitioning to the slow "update scroll layer position on the main thread" mode.
+        // Initialize the probable main thread scroll position with the current scroll layer position.
+        CGPoint scrollLayerPosition = m_scrollLayer.get().position;
+        m_probableMainThreadScrollPosition = IntPoint(-scrollLayerPosition.x, -scrollLayerPosition.y);
+    }
 }
 
 void ScrollingTreeNodeMac::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
 {
     m_scrollElasticityController.handleWheelEvent(wheelEvent);
+    scrollingTree()->handleWheelEventPhase(wheelEvent.phase());
 }
 
 void ScrollingTreeNodeMac::setScrollPosition(const IntPoint& scrollPosition)
@@ -72,6 +80,7 @@ void ScrollingTreeNodeMac::setScrollPosition(const IntPoint& scrollPosition)
     updateMainFramePinState(scrollPosition);
 
     if (shouldUpdateScrollLayerPositionOnMainThread()) {
+        m_probableMainThreadScrollPosition = scrollPosition;
         scrollingTree()->updateMainFrameScrollPositionAndScrollLayerPosition(scrollPosition);
         return;
     }
@@ -214,6 +223,9 @@ void ScrollingTreeNodeMac::stopSnapRubberbandTimer()
 
 IntPoint ScrollingTreeNodeMac::scrollPosition() const
 {
+    if (shouldUpdateScrollLayerPositionOnMainThread())
+        return m_probableMainThreadScrollPosition;
+
     CGPoint scrollLayerPosition = m_scrollLayer.get().position;
     return IntPoint(-scrollLayerPosition.x, -scrollLayerPosition.y);
 }
diff --git a/Source/WebCore/platform/ActivePlatformGestureAnimation.cpp b/Source/WebCore/platform/ActivePlatformGestureAnimation.cpp
new file mode 100644
index 000000000..7f6e7c2c9
--- /dev/null
+++ b/Source/WebCore/platform/ActivePlatformGestureAnimation.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "ActivePlatformGestureAnimation.h"
+
+#include "PlatformGestureCurve.h"
+#include "PlatformGestureCurveTarget.h"
+
+namespace WebCore {
+
+PassOwnPtr<ActivePlatformGestureAnimation> ActivePlatformGestureAnimation::create(double startTime, PassOwnPtr<PlatformGestureCurve> curve, PlatformGestureCurveTarget* target)
+{
+    return adoptPtr(new ActivePlatformGestureAnimation(startTime, curve, target));
+}
+
+ActivePlatformGestureAnimation::~ActivePlatformGestureAnimation()
+{
+}
+
+ActivePlatformGestureAnimation::ActivePlatformGestureAnimation(double startTime, PassOwnPtr<PlatformGestureCurve> curve, PlatformGestureCurveTarget* target)
+    : m_startTime(startTime)
+    , m_curve(curve)
+    , m_target(target)
+{
+}
+
+bool ActivePlatformGestureAnimation::animate(double time)
+{
+    // All PlatformGestureCurves assume zero-based time, so we subtract
+    // the animation start time before passing to the curve.
+    return m_curve->apply(time - m_startTime, m_target);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/ActivePlatformGestureAnimation.h b/Source/WebCore/platform/ActivePlatformGestureAnimation.h
new file mode 100644
index 000000000..aae40de7b
--- /dev/null
+++ b/Source/WebCore/platform/ActivePlatformGestureAnimation.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ActivePlatformGestureAnimation_h
+#define ActivePlatformGestureAnimation_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class PlatformGestureCurve;
+class PlatformGestureCurveTarget;
+
+// Implements a gesture animation (fling scroll, etc.) using a curve with a generic interface
+// to define the animation parameters as a function of time, and applies the animation
+// to a target, again via a generic interface. It is assumed that animate() is called
+// on a more-or-less regular basis by the owner.
+class ActivePlatformGestureAnimation {
+    WTF_MAKE_NONCOPYABLE(ActivePlatformGestureAnimation);
+public:
+    static PassOwnPtr<ActivePlatformGestureAnimation> create(double startTime, PassOwnPtr<PlatformGestureCurve>, PlatformGestureCurveTarget*);
+    ~ActivePlatformGestureAnimation();
+
+    bool animate(double time);
+
+private:
+    // Assumes a valid PlatformGestureCurveTarget that outlives the animation.
+    ActivePlatformGestureAnimation(double startTime, PassOwnPtr<PlatformGestureCurve>, PlatformGestureCurveTarget*);
+
+    double m_startTime;
+    OwnPtr<PlatformGestureCurve> m_curve;
+    PlatformGestureCurveTarget* m_target;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/AsyncFileSystem.h b/Source/WebCore/platform/AsyncFileSystem.h
index bbef6a4e3..7792101c5 100644
--- a/Source/WebCore/platform/AsyncFileSystem.h
+++ b/Source/WebCore/platform/AsyncFileSystem.h
@@ -140,6 +140,13 @@ public:
     // AsyncFileSystemCallbacks::didFail() is called otherwise.
     virtual void createWriter(AsyncFileWriterClient* client, const String& path, PassOwnPtr<AsyncFileSystemCallbacks>) = 0;
 
+    // Creates a snapshot file and read its metadata for a new File object.
+    // In local filesystem cases the backend may simply return the metadata of the file itself (as well as readMetadata does),
+    // while in remote filesystem case the backend may download the file into a temporary snapshot file and return the metadata of the temporary file.
+    // AsyncFileSystemCallbacks::didReadMetadata() is called when the metadata for the snapshot file is successfully returned.
+    // AsyncFileSystemCallbacks::didFail() is called otherwise.
+    virtual void createSnapshotFileAndReadMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>) = 0;
+
     Type type() const { return m_type; }
 
 protected:
diff --git a/Source/WebCore/platform/AsyncFileSystemCallbacks.h b/Source/WebCore/platform/AsyncFileSystemCallbacks.h
index cee8d90d0..d8a85e747 100644
--- a/Source/WebCore/platform/AsyncFileSystemCallbacks.h
+++ b/Source/WebCore/platform/AsyncFileSystemCallbacks.h
@@ -33,36 +33,35 @@
 
 #if ENABLE(FILE_SYSTEM)
 
+#include "AsyncFileSystem.h"
+#include "AsyncFileWriter.h"
+#include "FileMetadata.h"
 #include "PlatformString.h"
 
 namespace WebCore {
 
-class AsyncFileSystem;
-class AsyncFileWriter;
-struct FileMetadata;
-
 class AsyncFileSystemCallbacks {
     WTF_MAKE_NONCOPYABLE(AsyncFileSystemCallbacks);
 public:
-    AsyncFileSystemCallbacks() { }    
+    AsyncFileSystemCallbacks() { }
 
     // Called when a requested operation is completed successfully.
-    virtual void didSucceed() = 0;
+    virtual void didSucceed() { ASSERT_NOT_REACHED(); }
 
     // Called when a requested file system is opened.
-    virtual void didOpenFileSystem(const String& name, PassOwnPtr<AsyncFileSystem>) = 0;
+    virtual void didOpenFileSystem(const String& name, PassOwnPtr<AsyncFileSystem>) { ASSERT_NOT_REACHED(); }
 
     // Called when a file metadata is read successfully.
-    virtual void didReadMetadata(const FileMetadata&) = 0;
+    virtual void didReadMetadata(const FileMetadata&) { ASSERT_NOT_REACHED(); }
 
     // Called when a directory entry is read.
-    virtual void didReadDirectoryEntry(const String& name, bool isDirectory) = 0;
+    virtual void didReadDirectoryEntry(const String& name, bool isDirectory) { ASSERT_NOT_REACHED(); }
 
-    // Called after a chunk of directory entries have been read (i.e. indicates it's good time to call back to the application).  If hasMore is true there can be more chunks.
-    virtual void didReadDirectoryEntries(bool hasMore) = 0;
+    // Called after a chunk of directory entries have been read (i.e. indicates it's good time to call back to the application). If hasMore is true there can be more chunks.
+    virtual void didReadDirectoryEntries(bool hasMore) { ASSERT_NOT_REACHED(); }
 
     // Called when an AsyncFileWrter has been created successfully.
-    virtual void didCreateFileWriter(PassOwnPtr<AsyncFileWriter> writer, long long length) = 0;
+    virtual void didCreateFileWriter(PassOwnPtr<AsyncFileWriter>, long long length) { ASSERT_NOT_REACHED(); }
 
     // Called when there was an error.
     virtual void didFail(int code) = 0;
diff --git a/Source/WebCore/platform/CalculationValue.cpp b/Source/WebCore/platform/CalculationValue.cpp
index b9e38581a..57413fbfe 100755
--- a/Source/WebCore/platform/CalculationValue.cpp
+++ b/Source/WebCore/platform/CalculationValue.cpp
@@ -31,6 +31,43 @@
 #include "config.h"
 #include "CalculationValue.h"
 
+#include <limits>
+
 namespace WebCore {
 
+float CalcExpressionBinaryOperation::evaluate(float maxValue) const
+{
+    float left = m_leftSide->evaluate(maxValue);
+    float right = m_rightSide->evaluate(maxValue);
+    switch (m_operator) {
+    case CalcAdd:
+        return left + right;
+    case CalcSubtract:
+        return left - right;
+    case CalcMultiply:
+        return left * right;
+    case CalcDivide:
+        if (!right)
+            return std::numeric_limits<float>::quiet_NaN();
+        return left / right;
+    }
+    ASSERT_NOT_REACHED();
+    return std::numeric_limits<float>::quiet_NaN();
+}
+
+PassRefPtr<CalculationValue> CalculationValue::create(PassOwnPtr<CalcExpressionNode> value, CalculationPermittedValueRange range)
+{
+    return adoptRef(new CalculationValue(value, range));
+}
+
+float CalculationValue::evaluate(float maxValue) const
+{
+    float result = m_value->evaluate(maxValue);
+    // FIXME calc https://webkit.org/b/80411 : result is NaN when there is a division 
+    // by zero which isn't found at parse time. 
+    if (isnan(result))
+        return 0;
+    return m_isNonNegative && result < 0 ? 0 : result;
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/CalculationValue.h b/Source/WebCore/platform/CalculationValue.h
index d89445e80..c55845542 100755
--- a/Source/WebCore/platform/CalculationValue.h
+++ b/Source/WebCore/platform/CalculationValue.h
@@ -50,6 +50,80 @@ enum CalculationPermittedValueRange {
     CalculationRangeAll,
     CalculationRangeNonNegative
 };
+        
+class CalcExpressionNode {
+public:
+    virtual ~CalcExpressionNode()
+    {
+    }
+    
+    virtual float evaluate(float maxValue) const = 0;
+};
+    
+class CalculationValue : public RefCounted<CalculationValue> {
+public:
+    static PassRefPtr<CalculationValue> create(PassOwnPtr<CalcExpressionNode> value, CalculationPermittedValueRange);
+    float evaluate(float maxValue) const;
+    
+private:
+    CalculationValue(PassOwnPtr<CalcExpressionNode> value, CalculationPermittedValueRange range)
+        : m_value(value)
+        , m_isNonNegative(range == CalculationRangeNonNegative)
+    {
+    }
+    
+    OwnPtr<CalcExpressionNode> m_value;
+    bool m_isNonNegative;
+};
+
+class CalcExpressionNumber : public CalcExpressionNode {
+public:
+    explicit CalcExpressionNumber(float value)
+        : m_value(value)
+    {
+    }
+
+    virtual float evaluate(float) const 
+    {
+        return m_value;
+    }
+    
+private:
+    float m_value;
+};
+
+class CalcExpressionLength : public CalcExpressionNode {
+public:
+    explicit CalcExpressionLength(Length length)
+        : m_length(length)
+    {
+    }
+
+    virtual float evaluate(float maxValue) const
+    {
+        return m_length.calcFloatValue(maxValue);
+    }
+    
+private:
+    Length m_length;
+};
+
+class CalcExpressionBinaryOperation : public CalcExpressionNode {
+public:
+    CalcExpressionBinaryOperation(PassOwnPtr<CalcExpressionNode> leftSide, PassOwnPtr<CalcExpressionNode> rightSide, CalcOperator op)
+        : m_leftSide(leftSide)
+        , m_rightSide(rightSide)
+        , m_operator(op)
+    {
+    }
+
+    virtual float evaluate(float) const;
+
+private:
+    OwnPtr<CalcExpressionNode> m_leftSide;
+    OwnPtr<CalcExpressionNode> m_rightSide;
+    CalcOperator m_operator;
+};
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/ContextMenu.cpp b/Source/WebCore/platform/ContextMenu.cpp
index a51d81839..014d58f87 100644
--- a/Source/WebCore/platform/ContextMenu.cpp
+++ b/Source/WebCore/platform/ContextMenu.cpp
@@ -38,7 +38,7 @@ static const ContextMenuItem* findItemWithAction(unsigned action, const Vector<C
 {
     for (size_t i = 0; i < items.size(); ++i) {
         const ContextMenuItem& item = items[i];
-        if (item.action() == action)
+        if (item.action() == static_cast<ContextMenuAction>(action))
             return &item;
         if (item.type() != SubmenuType)
             continue;
diff --git a/Source/WebCore/platform/DragData.h b/Source/WebCore/platform/DragData.h
index ff818de4a..6737b8f16 100644
--- a/Source/WebCore/platform/DragData.h
+++ b/Source/WebCore/platform/DragData.h
@@ -46,8 +46,6 @@ typedef id <NSDraggingInfo> DragDataRef;
 typedef void* DragDataRef;
 #endif
 
-OBJC_CLASS NSPasteboard;
-
 #elif PLATFORM(QT)
 QT_BEGIN_NAMESPACE
 class QMimeData;
diff --git a/Source/WebCore/platform/FileStream.cpp b/Source/WebCore/platform/FileStream.cpp
index 5c77e082b..e0b29e042 100644
--- a/Source/WebCore/platform/FileStream.cpp
+++ b/Source/WebCore/platform/FileStream.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include "FileStream.h"
 
@@ -147,4 +147,4 @@ bool FileStream::truncate(long long)
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
diff --git a/Source/WebCore/platform/FileStream.h b/Source/WebCore/platform/FileStream.h
index c369eb094..baa3948dc 100644
--- a/Source/WebCore/platform/FileStream.h
+++ b/Source/WebCore/platform/FileStream.h
@@ -31,7 +31,7 @@
 #ifndef FileStream_h
 #define FileStream_h
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 #include "FileSystem.h"
 #include <wtf/Forward.h>
@@ -95,6 +95,6 @@ private:
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
 
 #endif // FileStream_h
diff --git a/Source/WebCore/platform/FileStreamClient.h b/Source/WebCore/platform/FileStreamClient.h
index 4066d9f65..b4539a631 100644
--- a/Source/WebCore/platform/FileStreamClient.h
+++ b/Source/WebCore/platform/FileStreamClient.h
@@ -31,33 +31,28 @@
 #ifndef FileStreamClient_h
 #define FileStreamClient_h
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(BLOB)
 
 namespace WebCore {
 
 class FileStreamClient {
 public:
-    // For reading.
-    virtual void didRead(int) { }
-
-    // For writing.
-    virtual void didWrite(int) { }
-    virtual void didTruncate(bool) { }
+    virtual void didOpen(bool) { } // false signals failure.
+    virtual void didStop() { }
+    virtual void didGetSize(long long) { } // -1 signals failure.
+    virtual void didRead(int) { } // -1 signals failure.
+    virtual void didWrite(int) { } // -1 signals failure.
+    virtual void didTruncate(bool) { } // false signals failure.
 
     // FIXME: To be removed when we switch to using BlobData.
     virtual void didStart() { }
 
-    // For both reading and writing.
-    virtual void didOpen(bool) { }
-    virtual void didStop() { }
-    virtual void didGetSize(long long) { }
-
 protected:
     virtual ~FileStreamClient() { }
 };
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
 
 #endif // FileStreamClient_h
diff --git a/Source/WebCore/platform/FileSystem.h b/Source/WebCore/platform/FileSystem.h
index 9168ea6bb..a202fa036 100644
--- a/Source/WebCore/platform/FileSystem.h
+++ b/Source/WebCore/platform/FileSystem.h
@@ -194,6 +194,10 @@ String encodeForFileName(const String&);
 RetainPtr<CFURLRef> pathAsURL(const String&);
 #endif
 
+#if PLATFORM(MAC)
+void setMetadataURL(String& URLString, const String& referrer, const String& path);
+#endif
+
 #if PLATFORM(GTK)
 String filenameToString(const char*);
 String filenameForDisplay(const String&);
diff --git a/Source/WebCore/platform/KURL.cpp b/Source/WebCore/platform/KURL.cpp
index a3812c6a2..ad5feea3b 100644
--- a/Source/WebCore/platform/KURL.cpp
+++ b/Source/WebCore/platform/KURL.cpp
@@ -30,7 +30,9 @@
 #include "TextEncoding.h"
 #include <stdio.h>
 #include <wtf/HashMap.h>
+#if !USE(WTFURL)
 #include <wtf/HexNumber.h>
+#endif
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/CString.h>
 #include <wtf/text/StringBuilder.h>
@@ -66,7 +68,7 @@ static inline bool isLetterMatchIgnoringCase(UChar character, char lowercaseLett
     return (character | 0x20) == lowercaseLetter;
 }
 
-#if !USE(GOOGLEURL)
+#if !USE(GOOGLEURL) && !USE(WTFURL)
 
 static const char wsScheme[] = {'w', 's'};
 static const char ftpScheme[] = {'f', 't', 'p'};
@@ -634,33 +636,6 @@ bool KURL::hasFragmentIdentifier() const
     return m_fragmentEnd != m_queryEnd;
 }
 
-void KURL::copyParsedQueryTo(ParsedURLParameters& parameters) const
-{
-    const UChar* pos = m_string.characters() + m_pathEnd + 1;
-    const UChar* end = m_string.characters() + m_queryEnd;
-    while (pos < end) {
-        const UChar* parameterStart = pos;
-        while (pos < end && *pos != '&')
-            ++pos;
-        const UChar* parameterEnd = pos;
-        if (pos < end) {
-            ASSERT(*pos == '&');
-            ++pos;
-        }
-        if (parameterStart == parameterEnd)
-            continue;
-        const UChar* nameStart = parameterStart;
-        const UChar* equalSign = parameterStart;
-        while (equalSign < parameterEnd && *equalSign != '=')
-            ++equalSign;
-        if (equalSign == nameStart)
-            continue;
-        String name(nameStart, equalSign - nameStart);
-        String value = equalSign == parameterEnd ? String() : String(equalSign + 1, parameterEnd - equalSign - 1);
-        parameters.set(name, value);
-    }
-}
-
 String KURL::baseAsString() const
 {
     return m_string.left(m_pathAfterLastSlash);
@@ -872,54 +847,6 @@ void KURL::setPath(const String& s)
     parse(m_string.left(m_portEnd) + encodeWithURLEscapeSequences(path) + m_string.substring(m_pathEnd));
 }
 
-String KURL::deprecatedString() const
-{
-    if (!m_isValid)
-        return m_string;
-
-    StringBuilder result;
-
-    result.append(protocol());
-    result.append(':');
-
-    StringBuilder authority;
-
-    if (m_hostEnd != m_passwordEnd) {
-        if (m_userEnd != m_userStart) {
-            authority.append(user());
-            authority.append('@');
-        }
-        authority.append(host());
-        if (hasPort()) {
-            authority.append(':');
-            authority.append(String::number(port()));
-        }
-    }
-
-    if (!authority.isEmpty()) {
-        result.append('/');
-        result.append('/');
-        result.append(authority.characters(), authority.length());
-    } else if (protocolIs("file")) {
-        result.append('/');
-        result.append('/');
-    }
-
-    result.append(path());
-
-    if (m_pathEnd != m_queryEnd) {
-        result.append('?');
-        result.append(query());
-    }
-
-    if (m_fragmentEnd != m_queryEnd) {
-        result.append('#');
-        result.append(fragmentIdentifier());
-    }
-
-    return result.toString();
-}
-
 String decodeURLEscapeSequences(const String& string)
 {
     return decodeEscapeSequences<URLEscapeSequence>(string, UTF8Encoding());
@@ -1796,7 +1723,7 @@ void KURL::print() const
 }
 #endif
 
-#endif // !USE(GOOGLEURL)
+#endif // !USE(GOOGLEURL) && !USE(WTFURL)
 
 String KURL::strippedForUseAsReferrer() const
 {
@@ -1961,17 +1888,4 @@ String mimeTypeFromDataURL(const String& url)
     return "";
 }
 
-bool protocolIsInHTTPFamily(const String& url)
-{
-    unsigned length = url.length();
-    const UChar* characters = url.characters();
-    return length > 4
-        && isLetterMatchIgnoringCase(characters[0], 'h')
-        && isLetterMatchIgnoringCase(characters[1], 't')
-        && isLetterMatchIgnoringCase(characters[2], 't')
-        && isLetterMatchIgnoringCase(characters[3], 'p')
-        && (characters[4] == ':'
-            || (isLetterMatchIgnoringCase(characters[4], 's') && length > 5 && characters[5] == ':'));
-}
-
 }
diff --git a/Source/WebCore/platform/KURL.h b/Source/WebCore/platform/KURL.h
index a464dc3de..3cba090aa 100644
--- a/Source/WebCore/platform/KURL.h
+++ b/Source/WebCore/platform/KURL.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,7 @@
 #ifndef KURL_h
 #define KURL_h
 
+#include "KURLWTFURLImpl.h"
 #include "PlatformString.h"
 #include <wtf/HashMap.h>
 
@@ -56,8 +57,6 @@ namespace WebCore {
 class TextEncoding;
 struct KURLHash;
 
-typedef HashMap<String, String> ParsedURLParameters;
-
 enum ParsedURLStringTag { ParsedURLString };
 
 class KURL {
@@ -71,10 +70,16 @@ public:
     KURL(ParsedURLStringTag, const String&);
 #if USE(GOOGLEURL)
     KURL(WTF::HashTableDeletedValueType) : m_url(WTF::HashTableDeletedValue) { }
+#elif USE(WTFURL)
+    KURL(WTF::HashTableDeletedValueType) : m_urlImpl(WTF::HashTableDeletedValue) { }
 #else
     KURL(WTF::HashTableDeletedValueType) : m_string(WTF::HashTableDeletedValue) { }
 #endif
+#if !USE(WTFURL)
     bool isHashTableDeletedValue() const { return string().isHashTableDeletedValue(); }
+#else
+    bool isHashTableDeletedValue() const { return m_urlImpl.isHashTableDeletedValue(); }
+#endif
 
     // Resolves the relative URL with the given base URL. If provided, the
     // TextEncoding is used to encode non-ASCII characers. The base URL can be
@@ -121,6 +126,9 @@ public:
 
 #if USE(GOOGLEURL)
     const String& string() const { return m_url.string(); }
+#elif USE(WTFURL)
+    // FIXME: Split this in URLString and InvalidURLString, get rid of the implicit conversions.
+    const String& string() const;
 #else
     const String& string() const { return m_string; }
 #endif
@@ -137,13 +145,8 @@ public:
     String fragmentIdentifier() const;
     bool hasFragmentIdentifier() const;
 
-    void copyParsedQueryTo(ParsedURLParameters&) const;
-
     String baseAsString() const;
 
-    // This function is only used by location.href. It's likely we shouldn't
-    // use it for that purpose, but more study is necessary before we remove it.
-    String deprecatedString() const;
     String fileSystemPath() const;
 
     // Returns true if the current URL's protocol is the same as the null-
@@ -225,9 +228,6 @@ public:
     void print() const;
 #endif
 
-    // FIXME: Remove this after changing all callers to use protocolIsInHTTPFamily.
-    bool protocolInHTTPFamily() const { return protocolIsInHTTPFamily(); }
-
 private:
     void invalidate();
     bool isHierarchical() const;
@@ -235,6 +235,8 @@ private:
 #if USE(GOOGLEURL)
     friend class KURLGooglePrivate;
     KURLGooglePrivate m_url;
+#elif USE(WTFURL)
+    RefPtr<KURLWTFURLImpl> m_urlImpl;
 #else  // !USE(GOOGLEURL)
     void init(const KURL&, const String&, const TextEncoding&);
     void copyToBuffer(Vector<char, 512>& buffer) const;
@@ -280,7 +282,6 @@ const KURL& blankURL();
 // This is especially important because valid javascript URLs are not necessarily considered valid by KURL.
 
 bool protocolIs(const String& url, const char* protocol);
-bool protocolIsInHTTPFamily(const String& url);
 bool protocolIsJavaScript(const String& url);
 
 bool isDefaultPortForProtocol(unsigned short port, const String& protocol);
@@ -330,7 +331,7 @@ inline bool operator!=(const String& a, const KURL& b)
     return a != b.string();
 }
 
-#if !USE(GOOGLEURL)
+#if !USE(GOOGLEURL) && !USE(WTFURL)
 
 // Inline versions of some non-GoogleURL functions so we can get inlining
 // without having to have a lot of ugly ifdefs in the class definition.
@@ -385,7 +386,7 @@ inline unsigned KURL::pathAfterLastSlash() const
     return m_pathAfterLastSlash;
 }
 
-#endif  // !USE(GOOGLEURL)
+#endif // !USE(GOOGLEURL) && !USE(WTFURL)
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/KURLGoogle.cpp b/Source/WebCore/platform/KURLGoogle.cpp
index 0507a2412..e34410024 100644
--- a/Source/WebCore/platform/KURLGoogle.cpp
+++ b/Source/WebCore/platform/KURLGoogle.cpp
@@ -578,34 +578,6 @@ bool KURL::hasFragmentIdentifier() const
     return m_url.m_parsed.ref.len >= 0;
 }
 
-void KURL::copyParsedQueryTo(ParsedURLParameters& parameters) const
-{
-    String query = m_url.componentString(m_url.m_parsed.query);
-    const UChar* pos = query.characters();
-    const UChar* end = query.characters() + query.length();
-    while (pos < end) {
-        const UChar* parameterStart = pos;
-        while (pos < end && *pos != '&')
-            ++pos;
-        const UChar* parameterEnd = pos;
-        if (pos < end) {
-            ASSERT(*pos == '&');
-            ++pos;
-        }
-        if (parameterStart == parameterEnd)
-            continue;
-        const UChar* nameStart = parameterStart;
-        const UChar* equalSign = parameterStart;
-        while (equalSign < parameterEnd && *equalSign != '=')
-            ++equalSign;
-        if (equalSign == nameStart)
-            continue;
-        String name(nameStart, equalSign - nameStart);
-        String value = equalSign == parameterEnd ? String() : String(equalSign + 1, parameterEnd - equalSign - 1);
-        parameters.set(name, value);
-    }
-}
-
 String KURL::baseAsString() const
 {
     // FIXME: There is probably a more efficient way to do this?
@@ -799,16 +771,6 @@ void KURL::setPath(const String& path)
     m_url.replaceComponents(replacements);
 }
 
-// On Mac, this just seems to return the same URL, but with "/foo/bar" for
-// file: URLs instead of file:///foo/bar. We don't bother with any of this,
-// at least for now.
-String KURL::deprecatedString() const
-{
-    if (!m_url.m_isValid)
-        return String();
-    return m_url.string();
-}
-
 String decodeURLEscapeSequences(const String& str)
 {
     return decodeURLEscapeSequences(str, UTF8Encoding());
diff --git a/Source/WebCore/platform/KURLWTFURL.cpp b/Source/WebCore/platform/KURLWTFURL.cpp
new file mode 100644
index 000000000..4ff13d948
--- /dev/null
+++ b/Source/WebCore/platform/KURLWTFURL.cpp
@@ -0,0 +1,377 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "KURL.h"
+
+#if USE(WTFURL)
+
+using namespace WTF;
+
+namespace WebCore {
+
+static const unsigned maximumValidPortNumber = 0xFFFE;
+static const unsigned invalidPortNumber = 0xFFFF;
+
+static inline void detach(RefPtr<KURLWTFURLImpl>& urlImpl)
+{
+    if (!urlImpl)
+        return;
+
+    if (urlImpl->hasOneRef())
+        return;
+
+    urlImpl = urlImpl->copy();
+}
+
+KURL::KURL(ParsedURLStringTag, const String& urlString)
+    : m_urlImpl(adoptRef(new KURLWTFURLImpl()))
+{
+    m_urlImpl->m_parsedURL = ParsedURL(urlString);
+    ASSERT(m_urlImpl->m_parsedURL.isValid());
+}
+
+KURL::KURL(const KURL&, const String&)
+{
+    // FIXME: Add WTFURL Implementation.
+}
+
+KURL::KURL(const KURL&, const String&, const TextEncoding&)
+{
+    // FIXME: Add WTFURL Implementation.
+}
+
+KURL KURL::copy() const
+{
+    KURL other;
+    if (!isNull())
+        other.m_urlImpl = m_urlImpl->copy();
+    return other;
+}
+
+bool KURL::isNull() const
+{
+    return !m_urlImpl;
+}
+
+// FIXME: Can we get rid of the concept of EmptyURL? Can an null URL be enough?
+// If we cannot get rid of the concept, we should make a shared empty URL.
+bool KURL::isEmpty() const
+{
+    return !m_urlImpl
+           || (!m_urlImpl->m_parsedURL.isValid() && m_urlImpl->m_invalidUrlString.isEmpty());
+}
+
+bool KURL::isValid() const
+{
+    if (!m_urlImpl)
+        return false;
+
+    bool isParsedURLValid = m_urlImpl->m_parsedURL.isValid();
+#ifndef NDEBUG
+    if (isParsedURLValid)
+        ASSERT_WITH_MESSAGE(m_urlImpl->m_invalidUrlString.isNull(), "A valid URL should never have a valid invalidUrlString.");
+#endif
+    return isParsedURLValid;
+}
+
+const String &KURL::string() const
+{
+    if (isNull()) {
+        DEFINE_STATIC_LOCAL(const String, nullString, ());
+        return nullString;
+    }
+
+    if (!m_urlImpl->m_invalidUrlString.isNull()) {
+        ASSERT(!isValid());
+        return m_urlImpl->m_invalidUrlString;
+    }
+
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.spec().string();
+}
+
+String KURL::protocol() const
+{
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.scheme();
+}
+
+String KURL::host() const
+{
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.host();
+}
+
+bool KURL::hasPort() const
+{
+    ASSERT(isValid());
+    return !m_urlImpl->m_parsedURL.port().isNull();
+}
+
+unsigned short KURL::port() const
+{
+    ASSERT(isValid());
+
+    String portString = m_urlImpl->m_parsedURL.port();
+    bool ok = false;
+    unsigned portValue = portString.toUIntStrict(&ok);
+
+    if (!ok || portValue > maximumValidPortNumber)
+        return invalidPortNumber;
+
+    return static_cast<unsigned short>(portValue);
+}
+
+String KURL::user() const
+{
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.username();
+}
+
+String KURL::pass() const
+{
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.password();
+}
+
+bool KURL::hasPath() const
+{
+    ASSERT(isValid());
+    return !path().isEmpty();
+}
+
+String KURL::path() const
+{
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.path();
+}
+
+String KURL::lastPathComponent() const
+{
+    ASSERT(isValid());
+
+    String pathString = path();
+    size_t index = pathString.reverseFind('/');
+
+    if (index == notFound)
+        return pathString;
+
+    return pathString.substring(index + 1);
+}
+
+String KURL::query() const
+{
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.query();
+}
+
+bool KURL::hasFragmentIdentifier() const
+{
+    ASSERT(isValid());
+    return !fragmentIdentifier().isNull();
+}
+
+String KURL::fragmentIdentifier() const
+{
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.fragment();
+}
+
+// FIXME: track an fix the bad use of this method.
+String KURL::baseAsString() const
+{
+    ASSERT(isValid());
+    return m_urlImpl->m_parsedURL.baseAsString();
+}
+
+// FIXME: Get rid of this function from KURL.
+String KURL::fileSystemPath() const
+{
+    return String();
+}
+
+bool KURL::protocolIs(const char* testProtocol) const
+{
+    ASSERT(isValid());
+    return WebCore::protocolIs(protocol(), testProtocol);
+}
+
+bool KURL::protocolIsInHTTPFamily() const
+{
+    return protocolIs("http") || protocolIs("https");
+}
+
+bool KURL::setProtocol(const String&)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+    return false;
+}
+
+void KURL::setHost(const String&)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::removePort()
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::setPort(unsigned short)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::setHostAndPort(const String&)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::setUser(const String&)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::setPass(const String&)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::setPath(const String&)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::setQuery(const String&)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::setFragmentIdentifier(const String&)
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+void KURL::removeFragmentIdentifier()
+{
+    detach(m_urlImpl);
+    // FIXME: Add WTFURL Implementation.
+}
+
+unsigned KURL::hostStart() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return 0;
+}
+
+unsigned KURL::hostEnd() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return 0;
+}
+
+unsigned KURL::pathStart() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return 0;
+}
+
+unsigned KURL::pathEnd() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return 0;
+}
+
+unsigned KURL::pathAfterLastSlash() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return 0;
+}
+
+void KURL::invalidate()
+{
+    m_urlImpl = nullptr;
+}
+
+bool KURL::isHierarchical() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return false;
+}
+
+bool protocolIs(const String&, const char*)
+{
+    // FIXME: Add WTFURL Implementation.
+    return false;
+}
+
+bool equalIgnoringFragmentIdentifier(const KURL&, const KURL&)
+{
+    // FIXME: Add WTFURL Implementation.
+    return false;
+}
+
+bool protocolHostAndPortAreEqual(const KURL& a, const KURL& b)
+{
+    if (!a.isValid() || !b.isValid())
+        return false;
+
+    return a.protocol() == b.protocol()
+           && a.host() == b.host()
+           && a.port() == b.port();
+}
+
+String encodeWithURLEscapeSequences(const String&)
+{
+    // FIXME: Add WTFURL Implementation.
+    return String();
+}
+
+String decodeURLEscapeSequences(const String&)
+{
+    // FIXME: Add WTFURL Implementation.
+    return String();
+}
+
+String decodeURLEscapeSequences(const String&, const TextEncoding&)
+{
+    // FIXME: Add WTFURL Implementation.
+    return String();
+}
+
+}
+
+#endif // USE(WTFURL)
diff --git a/Source/WebCore/platform/KURLWTFURLImpl.h b/Source/WebCore/platform/KURLWTFURLImpl.h
new file mode 100644
index 000000000..379c492ad
--- /dev/null
+++ b/Source/WebCore/platform/KURLWTFURLImpl.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef KURLWTFURLImpl_h
+#define KURLWTFURLImpl_h
+
+#if USE(WTFURL)
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/WTFString.h>
+#include <wtf/url/api/ParsedURL.h>
+
+namespace WebCore {
+
+class KURLWTFURLImpl : public RefCounted<KURLWTFURLImpl> {
+public:
+    WTF::ParsedURL m_parsedURL;
+    String m_invalidUrlString;
+
+    PassRefPtr<KURLWTFURLImpl> copy() const;
+};
+
+inline PassRefPtr<KURLWTFURLImpl> KURLWTFURLImpl::copy() const
+{
+    RefPtr<KURLWTFURLImpl> clone = adoptRef(new KURLWTFURLImpl);
+    clone->m_parsedURL = m_parsedURL.isolatedCopy();
+    clone->m_invalidUrlString = m_invalidUrlString.isolatedCopy();
+    return clone.release();
+}
+
+} // namespace WebCore
+
+#endif // USE(WTFURL)
+
+#endif // KURLWTFURLImpl_h
diff --git a/Source/WebCore/platform/Length.cpp b/Source/WebCore/platform/Length.cpp
index a6bc01939..5166c0d16 100644
--- a/Source/WebCore/platform/Length.cpp
+++ b/Source/WebCore/platform/Length.cpp
@@ -25,6 +25,7 @@
 #include "config.h"
 #include "Length.h"
 
+#include "CalculationValue.h"
 #include "PlatformString.h"
 #include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
@@ -148,6 +149,88 @@ PassOwnArrayPtr<Length> newLengthArray(const String& string, int& len)
 
     return r.release();
 }
+        
+class CalculationValueHandleMap {
+public:
+    CalculationValueHandleMap() 
+        : m_index(1) 
+    {
+    }
+    
+    int insert(PassRefPtr<CalculationValue> calcValue)
+    {
+        ASSERT(m_index);
+        // FIXME calc(): https://bugs.webkit.org/show_bug.cgi?id=80489
+        // This monotonically increasing handle generation scheme is potentially wasteful
+        // of the handle space. Consider reusing empty handles.
+        while (m_map.contains(m_index))
+            m_index++;
+        
+        m_map.set(m_index, calcValue);       
+        
+        return m_index;
+    }
+
+    void remove(int index)
+    {
+        ASSERT(m_map.contains(index));
+        m_map.remove(index);
+    }
+    
+    PassRefPtr<CalculationValue> get(int index)
+    {
+        ASSERT(m_map.contains(index));
+        return m_map.get(index);
+    }
+    
+private:        
+    int m_index;
+    HashMap<int, RefPtr<CalculationValue> > m_map;
+};
+    
+static CalculationValueHandleMap& calcHandles()
+{
+    DEFINE_STATIC_LOCAL(CalculationValueHandleMap, handleMap, ());
+    return handleMap;
+}
+
+Length::Length(PassRefPtr<CalculationValue> calc)
+    : m_quirk(false)
+    , m_type(Calculated)
+    , m_isFloat(false)
+{
+    m_intValue = calcHandles().insert(calc);
+}
+    
+PassRefPtr<CalculationValue> Length::calculationValue() const
+{
+    ASSERT(isCalculated());
+    return calcHandles().get(calculationHandle());
+}
+    
+void Length::incrementCalculatedRef() const
+{
+    ASSERT(isCalculated());
+    calculationValue()->ref();
+}
+
+void Length::decrementCalculatedRef() const
+{
+    ASSERT(isCalculated());
+    RefPtr<CalculationValue> calcLength = calculationValue();
+    if (calcLength->hasOneRef())
+        calcHandles().remove(calculationHandle());
+    calcLength->deref();
+}    
+
+float Length::nonNanCalculatedValue(int maxValue) const
+{
+    ASSERT(isCalculated());
+    float result = calculationValue()->evaluate(maxValue);
+    if (isnan(result))
+        return 0;
+    return result;
+}
 
 class SameSizeAsLength {
     int32_t value;
diff --git a/Source/WebCore/platform/Length.h b/Source/WebCore/platform/Length.h
index 53b0260c2..2bcf93262 100644
--- a/Source/WebCore/platform/Length.h
+++ b/Source/WebCore/platform/Length.h
@@ -26,6 +26,7 @@
 #include <wtf/Assertions.h>
 #include <wtf/FastAllocBase.h>
 #include <wtf/Forward.h>
+#include <wtf/HashMap.h>
 #include <wtf/MathExtras.h>
 #include <wtf/PassOwnArrayPtr.h>
 
@@ -34,8 +35,10 @@ namespace WebCore {
 const int intMaxForLength = 0x7ffffff; // max value for a 28-bit int
 const int intMinForLength = (-0x7ffffff - 1); // min value for a 28-bit int
 
-enum LengthType { Auto, Relative, Percent, Fixed, Intrinsic, MinIntrinsic, Undefined };
-
+enum LengthType { Auto, Relative, Percent, Fixed, Intrinsic, MinIntrinsic, Calculated, Undefined };
+ 
+class CalculationValue;    
+    
 struct Length {
     WTF_MAKE_FAST_ALLOCATED;
 public:
@@ -65,11 +68,35 @@ public:
         m_floatValue = static_cast<float>(v);    
     }
 
+    explicit Length(PassRefPtr<CalculationValue>);
+
+    Length(const Length& length)
+    {
+        initFromLength(length);
+    }
+    
+    Length& operator=(const Length& length)
+    {
+        initFromLength(length);
+        return *this;
+    }
+    
+    ~Length()
+    {
+        if (isCalculated())
+            decrementCalculatedRef();
+    }  
+    
     bool operator==(const Length& o) const { return (m_type == o.m_type) && (m_quirk == o.m_quirk) && (isUndefined() || (getFloatValue() == o.getFloatValue())); }
     bool operator!=(const Length& o) const { return !(*this == o); }
 
     const Length& operator*=(float v)
-    {        
+    {       
+        if (isCalculated()) {
+            ASSERT_NOT_REACHED();
+            return *this;
+        }
+        
         if (m_isFloat)
             m_floatValue = static_cast<float>(m_floatValue * v);
         else        
@@ -80,6 +107,10 @@ public:
     
     int value() const
     {
+        if (isCalculated()) {
+            ASSERT_NOT_REACHED();
+            return 0;
+        }
         return getIntValue();
     }
 
@@ -89,6 +120,8 @@ public:
         return getFloatValue();
     }
 
+    PassRefPtr<CalculationValue> calculationValue() const;
+
     LengthType type() const { return static_cast<LengthType>(m_type); }
     bool quirk() const { return m_quirk; }
 
@@ -106,6 +139,10 @@ public:
 
     void setValue(int value)
     {
+        if (isCalculated()) {
+            ASSERT_NOT_REACHED();
+            return;
+        }
         setValue(Fixed, value);
     }
 
@@ -121,13 +158,12 @@ public:
         *this = Length(value, Fixed);
     }
 
-    // Note: May only be called for Fixed, Percent and Auto lengths.
-    // Other types will ASSERT in order to catch invalid length calculations.
     int calcValue(int maxValue, bool roundPercentages = false) const
     {
         switch (type()) {
             case Fixed:
             case Percent:
+            case Calculated:
                 return calcMinValue(maxValue, roundPercentages);
             case Auto:
                 return maxValue;
@@ -152,6 +188,8 @@ public:
                     return static_cast<int>(round(maxValue * percent() / 100.0f));
                 // Don't remove the extra cast to float. It is needed for rounding on 32-bit Intel machines that use the FPU stack.
                 return static_cast<int>(static_cast<float>(maxValue * percent() / 100.0f));
+            case Calculated:
+                return nonNanCalculatedValue(maxValue);
             case Auto:
                 return 0;
             case Relative:
@@ -174,6 +212,8 @@ public:
                 return static_cast<float>(maxValue * percent() / 100.0f);
             case Auto:
                 return static_cast<float>(maxValue);
+            case Calculated:
+                return nonNanCalculatedValue(maxValue);                
             case Relative:
             case Intrinsic:
             case MinIntrinsic:
@@ -186,21 +226,43 @@ public:
     }
 
     bool isUndefined() const { return type() == Undefined; }
+
+    // FIXME calc: https://bugs.webkit.org/show_bug.cgi?id=80357. A calculated Length 
+    // always contains a percentage, and without a maxValue passed to these functions
+    // it's impossible to determine the sign or zero-ness. We assume all calc values
+    // are positive and non-zero for now.    
     bool isZero() const 
     {
         ASSERT(!isUndefined());
+        if (isCalculated())
+            return false;
+            
         return m_isFloat ? !m_floatValue : !m_intValue;
     }
+    bool isPositive() const
+    {
+        if (isUndefined())
+            return false;
+        if (isCalculated())
+            return true;
+                
+        return getFloatValue() > 0;
+    }
+    bool isNegative() const
+    {
+        if (isUndefined() || isCalculated())
+            return false;
+            
+        return getFloatValue() < 0;
+    }
     
-    bool isPositive() const { return isUndefined() ? false : getFloatValue() > 0; }
-    bool isNegative() const { return isUndefined() ? false : getFloatValue() < 0; }
-
     bool isAuto() const { return type() == Auto; }
     bool isRelative() const { return type() == Relative; }
-    bool isPercent() const { return type() == Percent; }
+    bool isPercent() const { return type() == Percent || type() == Calculated; }
     bool isFixed() const { return type() == Fixed; }
     bool isIntrinsicOrAuto() const { return type() == Auto || type() == MinIntrinsic || type() == Intrinsic; }
-    bool isSpecified() const { return type() == Fixed || type() == Percent; }
+    bool isSpecified() const { return type() == Fixed || type() == Percent || type() == Calculated; }
+    bool isCalculated() const { return type() == Calculated; }
 
     Length blend(const Length& from, double progress) const
     {
@@ -239,6 +301,30 @@ private:
         return m_isFloat ? m_floatValue : m_intValue;
     }
 
+    void initFromLength(const Length &length) 
+    {
+        m_quirk = length.m_quirk;
+        m_type = length.m_type;
+        m_isFloat = length.m_isFloat;
+        
+        if (m_isFloat)
+            m_floatValue = length.m_floatValue;
+        else
+            m_intValue = length.m_intValue;
+        
+        if (isCalculated())
+            incrementCalculatedRef();
+    }
+    
+    float nonNanCalculatedValue(int maxValue) const;
+    int calculationHandle() const
+    {
+        ASSERT(isCalculated());
+        return getIntValue();
+    }
+    void incrementCalculatedRef() const;
+    void decrementCalculatedRef() const;    
+    
     union {
         int m_intValue;
         float m_floatValue;
diff --git a/Source/WebCore/platform/LocalizedStrings.cpp b/Source/WebCore/platform/LocalizedStrings.cpp
index 0383de6f7..27d17f03f 100644
--- a/Source/WebCore/platform/LocalizedStrings.cpp
+++ b/Source/WebCore/platform/LocalizedStrings.cpp
@@ -48,13 +48,22 @@ namespace WebCore {
 //  2) It doesn't handle the %2$d syntax.
 // Note that because |format| is used as the second parameter to va_start, it cannot be a reference
 // type according to section 18.7/3 of the C++ N1905 standard.
-static String formatLocalizedString(String format, ...)
+static String formatLocalizedString(const String& format, ...)
 {
 #if USE(CF)
     va_list arguments;
     va_start(arguments, format);
     RetainPtr<CFStringRef> formatCFString(AdoptCF, format.createCFString());
+
+#if COMPILER(CLANG)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wformat-nonliteral"
+#endif
     RetainPtr<CFStringRef> result(AdoptCF, CFStringCreateWithFormatAndArguments(0, 0, formatCFString.get(), arguments));
+#if COMPILER(CLANG)
+#pragma clang diagnostic pop
+#endif
+
     va_end(arguments);
     return result.get();
 #else
diff --git a/Source/WebCore/platform/MIMETypeRegistry.cpp b/Source/WebCore/platform/MIMETypeRegistry.cpp
index b5f2d4551..8e1e8e8aa 100644
--- a/Source/WebCore/platform/MIMETypeRegistry.cpp
+++ b/Source/WebCore/platform/MIMETypeRegistry.cpp
@@ -39,7 +39,7 @@
 #include <ApplicationServices/ApplicationServices.h>
 #include <wtf/RetainPtr.h>
 #endif
-#if PLATFORM(QT)
+#if PLATFORM(QT) && USE(QT_IMAGE_DECODER)
 #include <qimagereader.h>
 #include <qimagewriter.h>
 #endif
@@ -229,7 +229,7 @@ static void initializeSupportedImageMIMETypes()
     supportedImageMIMETypes->remove("application/pdf");
     supportedImageMIMETypes->remove("application/postscript");
 
-#elif PLATFORM(QT)
+#elif PLATFORM(QT) && USE(QT_IMAGE_DECODER)
     QList<QByteArray> formats = QImageReader::supportedImageFormats();
     for (size_t i = 0; i < static_cast<size_t>(formats.size()); ++i) {
 #if ENABLE(SVG)
@@ -289,7 +289,7 @@ static void initializeSupportedImageMIMETypesForEncoding()
     supportedImageMIMETypesForEncoding->add("image/jpeg");
     supportedImageMIMETypesForEncoding->add("image/gif");
 #endif
-#elif PLATFORM(QT)
+#elif PLATFORM(QT) && USE(QT_IMAGE_DECODER)
     QList<QByteArray> formats = QImageWriter::supportedImageFormats();
     for (int i = 0; i < formats.size(); ++i) {
         String mimeType = MIMETypeRegistry::getMIMETypeForExtension(formats.at(i).constData());
diff --git a/Source/WebCore/platform/Pasteboard.h b/Source/WebCore/platform/Pasteboard.h
index 17dadd072..f12c854b7 100644
--- a/Source/WebCore/platform/Pasteboard.h
+++ b/Source/WebCore/platform/Pasteboard.h
@@ -44,7 +44,6 @@
 
 #if PLATFORM(MAC)
 OBJC_CLASS NSFileWrapper;
-OBJC_CLASS NSPasteboard;
 OBJC_CLASS NSArray;
 #endif
 
diff --git a/Source/WebCore/platform/PlatformGestureCurve.h b/Source/WebCore/platform/PlatformGestureCurve.h
new file mode 100644
index 000000000..922199147
--- /dev/null
+++ b/Source/WebCore/platform/PlatformGestureCurve.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PlatformGestureCurve_h
+#define PlatformGestureCurve_h
+
+namespace WebCore {
+
+class PlatformGestureCurveTarget;
+
+// Abstract interface for curves used by ActivePlatformGestureAnimation. A
+// PlatformGestureCurve defines the animation parameters as a function of time
+// (zero-based), and applies the parameters directly to the target of the
+// animation.
+class PlatformGestureCurve {
+public:
+    virtual ~PlatformGestureCurve() { }
+
+    // Returns false if curve has finished and can no longer be applied.
+    virtual bool apply(double time, PlatformGestureCurveTarget*) = 0;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/PlatformGestureCurveTarget.h b/Source/WebCore/platform/PlatformGestureCurveTarget.h
new file mode 100644
index 000000000..bfb0aebcd
--- /dev/null
+++ b/Source/WebCore/platform/PlatformGestureCurveTarget.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PlatformGestureCurveTarget_h
+#define PlatformGestureCurveTarget_h
+
+namespace WebCore {
+
+class IntPoint;
+
+class PlatformGestureCurveTarget {
+public:
+    virtual void setScrollIncrement(const IntPoint&) = 0;
+    // FIXME: add interfaces for setScroll(), setPageScaleAndScroll(), etc.
+
+protected:
+    virtual ~PlatformGestureCurveTarget() { }
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/PlatformWheelEvent.h b/Source/WebCore/platform/PlatformWheelEvent.h
index 64e0f2463..084b45553 100644
--- a/Source/WebCore/platform/PlatformWheelEvent.h
+++ b/Source/WebCore/platform/PlatformWheelEvent.h
@@ -64,7 +64,8 @@ namespace WebCore {
     // up and down (you get the same behavior as if the user was clicking in a scrollbar track to page up or page down).
     enum PlatformWheelEventGranularity {
         ScrollByPageWheelEvent,
-        ScrollByPixelWheelEvent
+        ScrollByPixelWheelEvent,
+        ScrollByPixelVelocityWheelEvent
     };
 
 #if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
diff --git a/Source/WebCore/platform/RunLoop.h b/Source/WebCore/platform/RunLoop.h
index 1f19c836d..f08a04224 100644
--- a/Source/WebCore/platform/RunLoop.h
+++ b/Source/WebCore/platform/RunLoop.h
@@ -37,10 +37,6 @@
 
 #if PLATFORM(GTK)
 #include <wtf/gobject/GRefPtr.h>
-typedef struct _GSource GSource;
-typedef struct _GMainLoop GMainLoop;
-typedef struct _GMainContext GMainContext;
-typedef int gboolean;
 #endif
 
 namespace WebCore {
@@ -155,10 +151,12 @@ private:
 #elif PLATFORM(GTK)
 public:
     static gboolean queueWork(RunLoop*);
-    GMainLoop* mainLoop();
+    GMainLoop* innermostLoop();
+    void pushNestedMainLoop(GMainLoop*);
+    void popNestedMainLoop();
 private:
-    GMainContext* m_runLoopContext;
-    GMainLoop* m_runLoopMain;
+    GRefPtr<GMainContext> m_runLoopContext;
+    Vector<GRefPtr<GMainLoop> > m_runLoopMainLoops;
 #endif
 };
 
diff --git a/Source/WebCore/platform/SchemeRegistry.cpp b/Source/WebCore/platform/SchemeRegistry.cpp
index d5d36f151..b25ce1a0d 100644
--- a/Source/WebCore/platform/SchemeRegistry.cpp
+++ b/Source/WebCore/platform/SchemeRegistry.cpp
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  */
 #include "config.h"
@@ -100,16 +100,14 @@ static URLSchemesMap& canDisplayOnlyIfCanRequestSchemes()
 {
     DEFINE_STATIC_LOCAL(URLSchemesMap, canDisplayOnlyIfCanRequestSchemes, ());
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
-    if (canDisplayOnlyIfCanRequestSchemes.isEmpty()) {
 #if ENABLE(BLOB)
+    if (canDisplayOnlyIfCanRequestSchemes.isEmpty()) {
         canDisplayOnlyIfCanRequestSchemes.add("blob");
-#endif
 #if ENABLE(FILE_SYSTEM)
         canDisplayOnlyIfCanRequestSchemes.add("filesystem");
 #endif
     }
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(BLOB)
 
     return canDisplayOnlyIfCanRequestSchemes;
 }
@@ -155,7 +153,7 @@ static URLSchemesMap& schemesAllowingDatabaseAccessInPrivateBrowsing()
 
 static URLSchemesMap& CORSEnabledSchemes()
 {
-    // FIXME: http://bugs.webkit.org/show_bug.cgi?id=77160  
+    // FIXME: http://bugs.webkit.org/show_bug.cgi?id=77160
     DEFINE_STATIC_LOCAL(URLSchemesMap, CORSEnabledSchemes, ());
 
     if (CORSEnabledSchemes.isEmpty()) {
@@ -251,7 +249,7 @@ void SchemeRegistry::registerAsCanDisplayOnlyIfCanRequest(const String& scheme)
     canDisplayOnlyIfCanRequestSchemes().add(scheme);
 }
 
-void SchemeRegistry::registerURLSchemeAsNotAllowingJavascriptURLs(const String& scheme) 
+void SchemeRegistry::registerURLSchemeAsNotAllowingJavascriptURLs(const String& scheme)
 {
     notAllowingJavascriptURLsSchemes().add(scheme);
 }
diff --git a/Source/WebCore/platform/ScrollAnimator.cpp b/Source/WebCore/platform/ScrollAnimator.cpp
index d4ded3483..1cd4ff1e9 100644
--- a/Source/WebCore/platform/ScrollAnimator.cpp
+++ b/Source/WebCore/platform/ScrollAnimator.cpp
@@ -98,6 +98,12 @@ bool ScrollAnimator::handleWheelEvent(const PlatformWheelEvent& e)
         || (deltaY < 0 && maxForwardScrollDelta.height() > 0)
         || (deltaY > 0 && maxBackwardScrollDelta.height() > 0)) {
         handled = true;
+        if (e.granularity() == ScrollByPixelVelocityWheelEvent) {
+            scroll(VerticalScrollbar, ScrollByPixelVelocity, 0, -deltaY);
+            scroll(HorizontalScrollbar, ScrollByPixelVelocity, 0, -deltaX);
+            return handled;
+        }
+
         if (deltaY) {
             if (e.granularity() == ScrollByPageWheelEvent) {
                 bool negative = deltaY < 0;
@@ -118,10 +124,15 @@ bool ScrollAnimator::handleWheelEvent(const PlatformWheelEvent& e)
             scroll(HorizontalScrollbar, ScrollByPixel, horizontalScrollbar->pixelStep(), -deltaX);
         }
     }
-
     return handled;
 }
 
+void ScrollAnimator::setCurrentPosition(const FloatPoint& position)
+{
+    m_currentPosX = position.x();
+    m_currentPosY = position.y();
+}
+
 FloatPoint ScrollAnimator::currentPosition() const
 {
     return FloatPoint(m_currentPosX, m_currentPosY);
diff --git a/Source/WebCore/platform/ScrollAnimator.h b/Source/WebCore/platform/ScrollAnimator.h
index 814d674e3..a3c4ca7e0 100644
--- a/Source/WebCore/platform/ScrollAnimator.h
+++ b/Source/WebCore/platform/ScrollAnimator.h
@@ -31,20 +31,16 @@
 #ifndef ScrollAnimator_h
 #define ScrollAnimator_h
 
+#include "PlatformWheelEvent.h"
 #include "ScrollTypes.h"
 #include <wtf/Forward.h>
 
 namespace WebCore {
 
 class FloatPoint;
-class PlatformWheelEvent;
 class ScrollableArea;
 class Scrollbar;
 
-#if ENABLE(GESTURE_EVENTS)
-class PlatformGestureEvent;
-#endif
-
 class ScrollAnimator {
 public:
     static PassOwnPtr<ScrollAnimator> create(ScrollableArea*);
@@ -65,9 +61,15 @@ public:
 
     virtual bool handleWheelEvent(const PlatformWheelEvent&);
 
+#if PLATFORM(MAC) || (PLATFORM(CHROMIUM) && OS(DARWIN))
+    virtual void handleWheelEventPhase(PlatformWheelEventPhase) { }
+#endif
+
+    void setCurrentPosition(const FloatPoint&);
     FloatPoint currentPosition() const;
 
     virtual void cancelAnimations() { }
+    virtual void serviceScrollAnimations() { }
 
     virtual void contentAreaWillPaint() const { }
     virtual void mouseEnteredContentArea() const { }
diff --git a/Source/WebCore/platform/ScrollAnimatorNone.cpp b/Source/WebCore/platform/ScrollAnimatorNone.cpp
index 083a18a70..96844f7eb 100644
--- a/Source/WebCore/platform/ScrollAnimatorNone.cpp
+++ b/Source/WebCore/platform/ScrollAnimatorNone.cpp
@@ -235,9 +235,12 @@ void ScrollAnimatorNone::PerAxisData::reset()
 
 bool ScrollAnimatorNone::PerAxisData::updateDataFromParameters(float step, float multiplier, float scrollableSize, double currentTime, Parameters* parameters)
 {
-    if (!m_startTime)
+    float delta = step * multiplier;
+    if (!m_startTime || !delta || (delta < 0) != (m_desiredPosition - *m_currentPosition < 0)) {
         m_desiredPosition = *m_currentPosition;
-    float newPosition = m_desiredPosition + (step * multiplier);
+        m_startTime = 0;
+    }
+    float newPosition = m_desiredPosition + delta;
 
     if (newPosition < 0 || newPosition > scrollableSize)
         newPosition = max(min(newPosition, scrollableSize), 0.0f);
@@ -375,7 +378,10 @@ ScrollAnimatorNone::ScrollAnimatorNone(ScrollableArea* scrollableArea)
     : ScrollAnimator(scrollableArea)
     , m_horizontalData(this, &m_currentPosX, scrollableArea->visibleWidth())
     , m_verticalData(this, &m_currentPosY, scrollableArea->visibleHeight())
-    , m_animationTimer(this, &ScrollAnimatorNone::animationTimerFired)
+    , m_animationActive(false)
+    , m_firstVelocity(0)
+    , m_firstVelocitySet(false)
+    , m_firstVelocityIsVertical(false)
 {
 }
 
@@ -384,6 +390,11 @@ ScrollAnimatorNone::~ScrollAnimatorNone()
     stopAnimationTimerIfNeeded();
 }
 
+void ScrollAnimatorNone::fireUpAnAnimation(FloatPoint fp)
+{
+    UNUSED_PARAM(fp);
+}
+
 bool ScrollAnimatorNone::scroll(ScrollbarOrientation orientation, ScrollGranularity granularity, float step, float multiplier)
 {
     if (!m_scrollableArea->scrollAnimatorEnabled())
@@ -409,8 +420,21 @@ bool ScrollAnimatorNone::scroll(ScrollbarOrientation orientation, ScrollGranular
     case ScrollByPixel:
         parameters = Parameters(true, 11 * kTickTime, 2 * kTickTime, Cubic, 3 * kTickTime, Cubic, 3 * kTickTime, Quadratic, 1.25);
         break;
-    default:
-        break;
+    case ScrollByPixelVelocity:
+        // FIXME: Generalize the scroll interface to support a richer set of parameters.
+        if (m_firstVelocitySet) {
+            float x = m_firstVelocityIsVertical ? multiplier : m_firstVelocity;
+            float y = m_firstVelocityIsVertical ? m_firstVelocity : multiplier;
+            FloatPoint fp(x, y);
+            fireUpAnAnimation(fp);
+            m_firstVelocitySet = false;
+            m_firstVelocityIsVertical = false;
+        } else {
+            m_firstVelocitySet = true;
+            m_firstVelocityIsVertical = orientation == VerticalScrollbar;
+            m_firstVelocity = multiplier;
+        }
+        return true;
     }
 
     // If the individual input setting is disabled, bail.
@@ -422,9 +446,9 @@ bool ScrollAnimatorNone::scroll(ScrollbarOrientation orientation, ScrollGranular
 
     PerAxisData& data = (orientation == VerticalScrollbar) ? m_verticalData : m_horizontalData;
     bool needToScroll = data.updateDataFromParameters(step, multiplier, scrollableSize, WTF::monotonicallyIncreasingTime(), &parameters);
-    if (needToScroll && !m_animationTimer.isActive()) {
+    if (needToScroll && !animationTimerActive()) {
         m_startTime = data.m_startTime;
-        animationTimerFired(&m_animationTimer);
+        animationTimerFired();
     }
     return needToScroll;
 }
@@ -444,6 +468,17 @@ void ScrollAnimatorNone::scrollToOffsetWithoutAnimation(const FloatPoint& offset
     notifyPositionChanged();
 }
 
+void ScrollAnimatorNone::cancelAnimations()
+{
+    m_animationActive = false;
+}
+
+void ScrollAnimatorNone::serviceScrollAnimations()
+{
+    if (m_animationActive)
+        animationTimerFired();
+}
+
 void ScrollAnimatorNone::willEndLiveResize()
 {
     updateVisibleLengths();
@@ -465,7 +500,7 @@ void ScrollAnimatorNone::updateVisibleLengths()
     m_verticalData.updateVisibleLength(scrollableArea()->visibleHeight());
 }
 
-void ScrollAnimatorNone::animationTimerFired(Timer<ScrollAnimatorNone>* timer)
+void ScrollAnimatorNone::animationTimerFired()
 {
 #if PLATFORM(CHROMIUM)
     TRACE_EVENT("ScrollAnimatorNone::animationTimerFired", this, 0);
@@ -473,17 +508,18 @@ void ScrollAnimatorNone::animationTimerFired(Timer<ScrollAnimatorNone>* timer)
 
     double currentTime = WTF::monotonicallyIncreasingTime();
     double deltaToNextFrame = ceil((currentTime - m_startTime) * kFrameRate) / kFrameRate - (currentTime - m_startTime);
+    currentTime += deltaToNextFrame;
 
     bool continueAnimation = false;
-    if (m_horizontalData.m_startTime && m_horizontalData.animateScroll(currentTime + deltaToNextFrame))
+    if (m_horizontalData.m_startTime && m_horizontalData.animateScroll(currentTime))
         continueAnimation = true;
-    if (m_verticalData.m_startTime && m_verticalData.animateScroll(currentTime + deltaToNextFrame))
+    if (m_verticalData.m_startTime && m_verticalData.animateScroll(currentTime))
         continueAnimation = true;
 
-    if (continueAnimation) {
-        double nextTimerInterval = max(kMinimumTimerInterval, deltaToNextFrame);
-        timer->startOneShot(nextTimerInterval);
-    }
+    if (continueAnimation)
+        startNextTimer();
+    else
+        m_animationActive = false;
 
 #if PLATFORM(CHROMIUM)
     TRACE_EVENT("ScrollAnimatorNone::notifyPositionChanged", this, 0);
@@ -491,10 +527,21 @@ void ScrollAnimatorNone::animationTimerFired(Timer<ScrollAnimatorNone>* timer)
     notifyPositionChanged();
 }
 
+void ScrollAnimatorNone::startNextTimer()
+{
+    if (scrollableArea()->scheduleAnimation())
+        m_animationActive = true;
+}
+
+bool ScrollAnimatorNone::animationTimerActive()
+{
+    return m_animationActive;
+}
+
 void ScrollAnimatorNone::stopAnimationTimerIfNeeded()
 {
-    if (m_animationTimer.isActive())
-        m_animationTimer.stop();
+    if (animationTimerActive())
+        m_animationActive = false;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/ScrollAnimatorNone.h b/Source/WebCore/platform/ScrollAnimatorNone.h
index 4d69a7c4a..495e0cdda 100644
--- a/Source/WebCore/platform/ScrollAnimatorNone.h
+++ b/Source/WebCore/platform/ScrollAnimatorNone.h
@@ -33,6 +33,11 @@
 
 #if ENABLE(SMOOTH_SCROLLING)
 
+#if !ENABLE(REQUEST_ANIMATION_FRAME)
+#error "SMOOTH_SCROLLING requires REQUEST_ANIMATION_FRAME to be enabled."
+#endif
+
+#include "FloatPoint.h"
 #include "ScrollAnimator.h"
 #include "Timer.h"
 
@@ -50,6 +55,9 @@ public:
     virtual bool scroll(ScrollbarOrientation, ScrollGranularity, float step, float multiplier);
     virtual void scrollToOffsetWithoutAnimation(const FloatPoint&);
 
+    virtual void cancelAnimations();
+    virtual void serviceScrollAnimations();
+
     virtual void willEndLiveResize();
     virtual void didAddVerticalScrollbar(Scrollbar*);
     virtual void didAddHorizontalScrollbar(Scrollbar*);
@@ -126,15 +134,23 @@ protected:
         int m_visibleLength;
     };
 
-    void animationTimerFired(Timer<ScrollAnimatorNone>*);
+    void startNextTimer();
+    void animationTimerFired();
+
     void stopAnimationTimerIfNeeded();
+    bool animationTimerActive();
     void updateVisibleLengths();
+    virtual void fireUpAnAnimation(FloatPoint);
 
     PerAxisData m_horizontalData;
     PerAxisData m_verticalData;
 
     double m_startTime;
-    Timer<ScrollAnimatorNone> m_animationTimer;
+    bool m_animationActive;
+
+    float m_firstVelocity;
+    bool m_firstVelocitySet;
+    bool m_firstVelocityIsVertical;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/ScrollTypes.h b/Source/WebCore/platform/ScrollTypes.h
index a02198d0b..087b50d1e 100644
--- a/Source/WebCore/platform/ScrollTypes.h
+++ b/Source/WebCore/platform/ScrollTypes.h
@@ -105,7 +105,8 @@ namespace WebCore {
         ScrollByLine,
         ScrollByPage,
         ScrollByDocument,
-        ScrollByPixel
+        ScrollByPixel,
+        ScrollByPixelVelocity
     };
 
     enum ScrollElasticity {
diff --git a/Source/WebCore/platform/ScrollView.cpp b/Source/WebCore/platform/ScrollView.cpp
index 4d14805ef..6af2aa696 100644
--- a/Source/WebCore/platform/ScrollView.cpp
+++ b/Source/WebCore/platform/ScrollView.cpp
@@ -844,8 +844,8 @@ void ScrollView::setFrameRect(const IntRect& newRect)
     frameRectsChanged();
 
     updateScrollbars(scrollOffset());
-    
-    if (!m_useFixedLayout)
+
+    if (!m_useFixedLayout && oldRect.size() != newRect.size())
         contentsResized();
 }
 
@@ -970,6 +970,11 @@ void ScrollView::paintScrollCorner(GraphicsContext* context, const IntRect& corn
     ScrollbarTheme::theme()->paintScrollCorner(this, context, cornerRect);
 }
 
+void ScrollView::paintScrollbar(GraphicsContext* context, Scrollbar* bar, const IntRect& rect)
+{
+    bar->paint(context, rect);
+}
+
 void ScrollView::invalidateScrollCornerRect(const IntRect& rect)
 {
     invalidateRect(rect);
@@ -982,13 +987,13 @@ void ScrollView::paintScrollbars(GraphicsContext* context, const IntRect& rect)
         && !layerForHorizontalScrollbar()
 #endif
                                       )
-        m_horizontalScrollbar->paint(context, rect);
+        paintScrollbar(context, m_horizontalScrollbar.get(), rect);
     if (m_verticalScrollbar
 #if USE(ACCELERATED_COMPOSITING)
         && !layerForVerticalScrollbar()
 #endif
                                     )
-        m_verticalScrollbar->paint(context, rect);
+        paintScrollbar(context, m_verticalScrollbar.get(), rect);
 
 #if USE(ACCELERATED_COMPOSITING)
     if (layerForScrollCorner())
@@ -1000,7 +1005,10 @@ void ScrollView::paintScrollbars(GraphicsContext* context, const IntRect& rect)
 void ScrollView::paintPanScrollIcon(GraphicsContext* context)
 {
     static Image* panScrollIcon = Image::loadPlatformResource("panIcon").leakRef();
-    context->drawImage(panScrollIcon, ColorSpaceDeviceRGB, m_panScrollIconPoint);
+    IntPoint iconGCPoint = m_panScrollIconPoint;
+    if (parent())
+        iconGCPoint = parent()->windowToContents(iconGCPoint);
+    context->drawImage(panScrollIcon, ColorSpaceDeviceRGB, iconGCPoint);
 }
 
 void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
diff --git a/Source/WebCore/platform/ScrollView.h b/Source/WebCore/platform/ScrollView.h
index 70511f16f..4c1b5de5c 100644
--- a/Source/WebCore/platform/ScrollView.h
+++ b/Source/WebCore/platform/ScrollView.h
@@ -272,6 +272,7 @@ public:
     virtual bool scrollbarCornerPresent() const;
     virtual IntRect scrollCornerRect() const;
     virtual void paintScrollCorner(GraphicsContext*, const IntRect& cornerRect);
+    virtual void paintScrollbar(GraphicsContext*, Scrollbar*, const IntRect&);
 
     virtual IntRect convertFromScrollbarToContainingView(const Scrollbar*, const IntRect&) const;
     virtual IntRect convertFromContainingViewToScrollbar(const Scrollbar*, const IntRect&) const;
diff --git a/Source/WebCore/platform/ScrollableArea.cpp b/Source/WebCore/platform/ScrollableArea.cpp
index 58ad24205..871760304 100644
--- a/Source/WebCore/platform/ScrollableArea.cpp
+++ b/Source/WebCore/platform/ScrollableArea.cpp
@@ -101,9 +101,11 @@ bool ScrollableArea::scroll(ScrollDirection direction, ScrollGranularity granula
     case ScrollByPixel:
         step = scrollbar->pixelStep();
         break;
+    case ScrollByPixelVelocity:
+        break;
     }
 
-    if (direction == ScrollUp || direction == ScrollLeft)
+    if (granularity != ScrollByPixelVelocity && (direction == ScrollUp || direction == ScrollLeft))
         multiplier = -multiplier;
 
     return scrollAnimator()->scroll(orientation, granularity, step, multiplier);
@@ -124,6 +126,12 @@ void ScrollableArea::scrollToOffsetWithoutAnimation(ScrollbarOrientation orienta
 
 void ScrollableArea::notifyScrollPositionChanged(const IntPoint& position)
 {
+    scrollPositionChanged(position);
+    scrollAnimator()->setCurrentPosition(position);
+}
+
+void ScrollableArea::scrollPositionChanged(const IntPoint& position)
+{
     // Tell the derived class to scroll its contents.
     setScrollOffset(position);
 
@@ -169,7 +177,7 @@ void ScrollableArea::setScrollOffsetFromAnimation(const IntPoint& offset)
     if (requestScrollPositionUpdate(offset))
         return;
 
-    notifyScrollPositionChanged(offset);
+    scrollPositionChanged(offset);
 }
 
 void ScrollableArea::willStartLiveResize()
@@ -286,11 +294,13 @@ void ScrollableArea::invalidateScrollbar(Scrollbar* scrollbar, const IntRect& re
     if (scrollbar == horizontalScrollbar()) {
         if (GraphicsLayer* graphicsLayer = layerForHorizontalScrollbar()) {
             graphicsLayer->setNeedsDisplay();
+            graphicsLayer->setContentsNeedsDisplay();
             return;
         }
     } else if (scrollbar == verticalScrollbar()) {
         if (GraphicsLayer* graphicsLayer = layerForVerticalScrollbar()) {
             graphicsLayer->setNeedsDisplay();
+            graphicsLayer->setContentsNeedsDisplay();
             return;
         }
     }
@@ -336,4 +346,9 @@ bool ScrollableArea::hasLayerForScrollCorner() const
 #endif
 }
 
+void ScrollableArea::serviceScrollAnimations()
+{
+    scrollAnimator()->serviceScrollAnimations();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/ScrollableArea.h b/Source/WebCore/platform/ScrollableArea.h
index 8244ce833..617873afd 100644
--- a/Source/WebCore/platform/ScrollableArea.h
+++ b/Source/WebCore/platform/ScrollableArea.h
@@ -156,6 +156,11 @@ public:
     // NOTE: Only called from Internals for testing.
     void setScrollOffsetFromInternals(const IntPoint&);
 
+    // Let subclasses provide a way of asking for and servicing scroll
+    // animations.
+    virtual bool scheduleAnimation() { return false; }
+    void serviceScrollAnimations();
+
 protected:
     ScrollableArea();
     virtual ~ScrollableArea();
@@ -179,6 +184,8 @@ protected:
     bool hasLayerForScrollCorner() const;
 
 private:
+    void scrollPositionChanged(const IntPoint&);
+    
     // NOTE: Only called from the ScrollAnimator.
     friend class ScrollAnimator;
     void setScrollOffsetFromAnimation(const IntPoint&);
diff --git a/Source/WebCore/platform/Scrollbar.cpp b/Source/WebCore/platform/Scrollbar.cpp
index 3b9c195cf..dfd46497a 100644
--- a/Source/WebCore/platform/Scrollbar.cpp
+++ b/Source/WebCore/platform/Scrollbar.cpp
@@ -112,6 +112,27 @@ Scrollbar::~Scrollbar()
     m_theme->unregisterScrollbar(this);
 }
 
+ScrollbarOverlayStyle Scrollbar::scrollbarOverlayStyle() const
+{
+    return m_scrollableArea ? ScrollbarOverlayStyleDefault : m_scrollableArea->scrollbarOverlayStyle();
+}
+
+void Scrollbar::getTickmarks(Vector<IntRect>& tickmarks) const
+{
+    if (m_scrollableArea)
+        m_scrollableArea->getTickmarks(tickmarks);
+}
+
+bool Scrollbar::isScrollableAreaActive() const
+{
+    return m_scrollableArea && m_scrollableArea->isActive();
+}
+
+bool Scrollbar::isScrollViewScrollbar() const
+{
+    return parent() && parent()->isFrameView() && static_cast<FrameView*>(parent())->isScrollViewScrollbar(this);
+}
+
 void Scrollbar::offsetDidChange()
 {
     ASSERT(m_scrollableArea);
@@ -434,7 +455,7 @@ bool Scrollbar::mouseDown(const PlatformMouseEvent& evt)
 
 void Scrollbar::setFrameRect(const IntRect& rect)
 {
-    // Get our window resizer rect and see if we overlap.  Adjust to avoid the overlap
+    // Get our window resizer rect and see if we overlap. Adjust to avoid the overlap
     // if necessary.
     IntRect adjustedRect(rect);
     bool overlapsResizer = false;
diff --git a/Source/WebCore/platform/Scrollbar.h b/Source/WebCore/platform/Scrollbar.h
index 39ac25465..171413a85 100644
--- a/Source/WebCore/platform/Scrollbar.h
+++ b/Source/WebCore/platform/Scrollbar.h
@@ -26,6 +26,7 @@
 #ifndef Scrollbar_h
 #define Scrollbar_h
 
+#include "ScrollbarThemeClient.h"
 #include "ScrollTypes.h"
 #include "Timer.h"
 #include "Widget.h"
@@ -40,13 +41,60 @@ class PlatformMouseEvent;
 class ScrollableArea;
 class ScrollbarTheme;
 
-class Scrollbar : public Widget {
+class Scrollbar : public Widget,
+                  public ScrollbarThemeClient {
+
 public:
     // Must be implemented by platforms that can't simply use the Scrollbar base class.  Right now the only platform that is not using the base class is GTK.
     static PassRefPtr<Scrollbar> createNativeScrollbar(ScrollableArea*, ScrollbarOrientation orientation, ScrollbarControlSize size);
 
     virtual ~Scrollbar();
 
+    // ScrollbarThemeClient implementation.
+    virtual int x() const { return Widget::x(); }
+    virtual int y() const { return Widget::y(); }
+    virtual int width() const { return Widget::width(); }
+    virtual int height() const { return Widget::height(); }
+    virtual IntSize size() const { return Widget::size(); }
+    virtual IntPoint location() const { return Widget::location(); }
+
+    virtual ScrollView* parent() const { return Widget::parent(); }
+    virtual ScrollView* root() const { return Widget::root(); }
+
+    virtual void setFrameRect(const IntRect&);
+    virtual IntRect frameRect() const { return Widget::frameRect(); }
+
+    virtual void invalidate() { Widget::invalidate(); }
+    virtual void invalidateRect(const IntRect&);
+
+    virtual ScrollbarOverlayStyle scrollbarOverlayStyle() const;
+    virtual void getTickmarks(Vector<IntRect>&) const;
+    virtual bool isScrollableAreaActive() const;
+    virtual bool isScrollViewScrollbar() const;
+
+    virtual IntPoint convertFromContainingWindow(const IntPoint& windowPoint) { return Widget::convertFromContainingWindow(windowPoint); }
+
+    virtual bool isCustomScrollbar() const { return false; }
+    virtual ScrollbarOrientation orientation() const { return m_orientation; }
+
+    virtual int value() const { return lroundf(m_currentPos); }
+    virtual float currentPos() const { return m_currentPos; }
+    virtual int visibleSize() const { return m_visibleSize; }
+    virtual int totalSize() const { return m_totalSize; }
+    virtual int maximum() const { return m_totalSize - m_visibleSize; }
+    virtual ScrollbarControlSize controlSize() const { return m_controlSize; }
+
+    virtual int lineStep() const { return m_lineStep; }
+    virtual int pageStep() const { return m_pageStep; }
+
+    virtual ScrollbarPart pressedPart() const { return m_pressedPart; }
+    virtual ScrollbarPart hoveredPart() const { return m_hoveredPart; }
+
+    virtual void styleChanged() { }
+
+    virtual bool enabled() const { return m_enabled; }
+    virtual void setEnabled(bool);
+
     // Called by the ScrollableArea when the scroll offset changes.
     void offsetDidChange();
 
@@ -57,34 +105,18 @@ public:
     void disconnectFromScrollableArea() { m_scrollableArea = 0; }
     ScrollableArea* scrollableArea() const { return m_scrollableArea; }
 
-    virtual bool isCustomScrollbar() const { return false; }
-    ScrollbarOrientation orientation() const { return m_orientation; }
-
-    int value() const { return lroundf(m_currentPos); }
-    float currentPos() const { return m_currentPos; }
     int pressedPos() const { return m_pressedPos; }
-    int visibleSize() const { return m_visibleSize; }
-    int totalSize() const { return m_totalSize; }
-    int maximum() const { return m_totalSize - m_visibleSize; }        
-    ScrollbarControlSize controlSize() const { return m_controlSize; }
 
-    int lineStep() const { return m_lineStep; }
-    int pageStep() const { return m_pageStep; }
     float pixelStep() const { return m_pixelStep; }
 
-    ScrollbarPart pressedPart() const { return m_pressedPart; }
-    ScrollbarPart hoveredPart() const { return m_hoveredPart; }
     virtual void setHoveredPart(ScrollbarPart);
     virtual void setPressedPart(ScrollbarPart);
 
     void setSteps(int lineStep, int pageStep, int pixelsPerStep = 1);
     void setProportion(int visibleSize, int totalSize);
     void setPressedPos(int p) { m_pressedPos = p; }
-    
-    virtual void paint(GraphicsContext*, const IntRect& damageRect);
 
-    bool enabled() const { return m_enabled; }
-    virtual void setEnabled(bool e);
+    virtual void paint(GraphicsContext*, const IntRect& damageRect);
 
     virtual bool isOverlayScrollbar() const;
     bool shouldParticipateInHitTesting();
@@ -97,7 +129,7 @@ public:
     bool mouseMoved(const PlatformMouseEvent&);
     void mouseEntered();
     bool mouseExited();
-    
+
     // Used by some platform scrollbars to know when they've been released from capture.
     bool mouseUp(const PlatformMouseEvent&);
 
@@ -106,18 +138,13 @@ public:
     ScrollbarTheme* theme() const { return m_theme; }
 
     virtual void setParent(ScrollView*);
-    virtual void setFrameRect(const IntRect&);
 
-    virtual void invalidateRect(const IntRect&);
-    
     bool suppressInvalidation() const { return m_suppressInvalidation; }
     void setSuppressInvalidation(bool s) { m_suppressInvalidation = s; }
 
-    virtual void styleChanged() { }
-
     virtual IntRect convertToContainingView(const IntRect&) const;
     virtual IntRect convertFromContainingView(const IntRect&) const;
-    
+
     virtual IntPoint convertToContainingView(const IntPoint&) const;
     virtual IntPoint convertFromContainingView(const IntPoint&) const;
 
@@ -160,7 +187,7 @@ protected:
 
     Timer<Scrollbar> m_scrollTimer;
     bool m_overlapsResizer;
-    
+
     bool m_suppressInvalidation;
 
 private:
diff --git a/Source/WebCore/platform/ScrollbarTheme.h b/Source/WebCore/platform/ScrollbarTheme.h
index 2a83d5385..5fe45b1a4 100644
--- a/Source/WebCore/platform/ScrollbarTheme.h
+++ b/Source/WebCore/platform/ScrollbarTheme.h
@@ -33,7 +33,7 @@
 namespace WebCore {
 
 class PlatformMouseEvent;
-class Scrollbar;
+class ScrollbarThemeClient;
 class ScrollView;
 
 #if USE(ACCELERATED_COMPOSITING) && ENABLE(RUBBER_BANDING)
@@ -46,10 +46,10 @@ public:
     ScrollbarTheme() { }
     virtual ~ScrollbarTheme() {};
 
-    virtual void updateEnabledState(Scrollbar*) { };
+    virtual void updateEnabledState(ScrollbarThemeClient*) { };
 
-    virtual bool paint(Scrollbar*, GraphicsContext*, const IntRect& /*damageRect*/) { return false; }
-    virtual ScrollbarPart hitTest(Scrollbar*, const PlatformMouseEvent&) { return NoPart; }
+    virtual bool paint(ScrollbarThemeClient*, GraphicsContext*, const IntRect& /*damageRect*/) { return false; }
+    virtual ScrollbarPart hitTest(ScrollbarThemeClient*, const PlatformMouseEvent&) { return NoPart; }
     
     virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar) { return 0; }
 
@@ -57,13 +57,13 @@ public:
 
     virtual bool supportsControlTints() const { return false; }
     virtual bool usesOverlayScrollbars() const { return false; }
-    virtual void updateScrollbarOverlayStyle(Scrollbar*) { }
+    virtual void updateScrollbarOverlayStyle(ScrollbarThemeClient*) { }
 
     virtual void themeChanged() {}
     
     virtual bool invalidateOnMouseEnterExit() { return false; }
 
-    void invalidateParts(Scrollbar* scrollbar, ScrollbarControlPartMask mask)
+    void invalidateParts(ScrollbarThemeClient* scrollbar, ScrollbarControlPartMask mask)
     {
         if (mask & BackButtonStartPart)
             invalidatePart(scrollbar, BackButtonStartPart);
@@ -81,7 +81,7 @@ public:
             invalidatePart(scrollbar, ForwardButtonEndPart);
     }
 
-    virtual void invalidatePart(Scrollbar*, ScrollbarPart) {}
+    virtual void invalidatePart(ScrollbarThemeClient*, ScrollbarPart) { }
 
     virtual void paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect) { defaultPaintScrollCorner(context, cornerRect); }
     static void defaultPaintScrollCorner(GraphicsContext* context, const IntRect& cornerRect) { context->fillRect(cornerRect, Color::white, ColorSpaceDeviceRGB); }
@@ -93,21 +93,21 @@ public:
     virtual void setUpContentShadowLayer(GraphicsLayer*) { }
 #endif
 
-    virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&) { return false; }
-    virtual bool shouldSnapBackToDragOrigin(Scrollbar*, const PlatformMouseEvent&) { return false; }
-    virtual bool shouldDragDocumentInsteadOfThumb(Scrollbar*, const PlatformMouseEvent&) { return false; }
-    virtual int thumbPosition(Scrollbar*) { return 0; } // The position of the thumb relative to the track.
-    virtual int thumbLength(Scrollbar*) { return 0; } // The length of the thumb along the axis of the scrollbar.
-    virtual int trackPosition(Scrollbar*) { return 0; } // The position of the track relative to the scrollbar.
-    virtual int trackLength(Scrollbar*) { return 0; } // The length of the track along the axis of the scrollbar.
+    virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&) { return false; }
+    virtual bool shouldSnapBackToDragOrigin(ScrollbarThemeClient*, const PlatformMouseEvent&) { return false; }
+    virtual bool shouldDragDocumentInsteadOfThumb(ScrollbarThemeClient*, const PlatformMouseEvent&) { return false; }
+    virtual int thumbPosition(ScrollbarThemeClient*) { return 0; } // The position of the thumb relative to the track.
+    virtual int thumbLength(ScrollbarThemeClient*) { return 0; } // The length of the thumb along the axis of the scrollbar.
+    virtual int trackPosition(ScrollbarThemeClient*) { return 0; } // The position of the track relative to the scrollbar.
+    virtual int trackLength(ScrollbarThemeClient*) { return 0; } // The length of the track along the axis of the scrollbar.
 
     virtual int maxOverlapBetweenPages() { return std::numeric_limits<int>::max(); }
 
     virtual double initialAutoscrollTimerDelay() { return 0.25; }
     virtual double autoscrollTimerDelay() { return 0.05; }
 
-    virtual void registerScrollbar(Scrollbar*) {}
-    virtual void unregisterScrollbar(Scrollbar*) {}
+    virtual void registerScrollbar(ScrollbarThemeClient*) { }
+    virtual void unregisterScrollbar(ScrollbarThemeClient*) { }
 
     virtual bool isMockTheme() const { return false; }
 
diff --git a/Source/WebCore/platform/ScrollbarThemeClient.h b/Source/WebCore/platform/ScrollbarThemeClient.h
new file mode 100644
index 000000000..871c52e90
--- /dev/null
+++ b/Source/WebCore/platform/ScrollbarThemeClient.h
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScrollbarThemeClient_h
+#define ScrollbarThemeClient_h
+
+#include "IntPoint.h"
+#include "IntRect.h"
+#include "IntSize.h"
+#include "ScrollTypes.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class ScrollView;
+
+class ScrollbarThemeClient {
+public:
+    virtual int x() const = 0;
+    virtual int y() const = 0;
+    virtual int width() const = 0;
+    virtual int height() const = 0;
+    virtual IntSize size() const = 0;
+    virtual IntPoint location() const = 0;
+
+    virtual ScrollView* parent() const = 0;
+    virtual ScrollView* root() const = 0;
+
+    virtual void setFrameRect(const IntRect&) = 0;
+    virtual IntRect frameRect() const = 0;
+
+    virtual void invalidate() = 0;
+    virtual void invalidateRect(const IntRect&) = 0;
+
+    virtual ScrollbarOverlayStyle scrollbarOverlayStyle() const = 0;
+    virtual void getTickmarks(Vector<IntRect>&) const = 0;
+    virtual bool isScrollableAreaActive() const = 0;
+    virtual bool isScrollViewScrollbar() const = 0;
+
+    virtual IntPoint convertFromContainingWindow(const IntPoint& windowPoint) = 0;
+
+    virtual bool isCustomScrollbar() const = 0;
+    virtual ScrollbarOrientation orientation() const = 0;
+
+    virtual int value() const = 0;
+    virtual float currentPos() const = 0;
+    virtual int visibleSize() const = 0;
+    virtual int totalSize() const = 0;
+    virtual int maximum() const = 0;
+    virtual ScrollbarControlSize controlSize() const = 0;
+
+    virtual int lineStep() const = 0;
+    virtual int pageStep() const = 0;
+
+    virtual ScrollbarPart pressedPart() const = 0;
+    virtual ScrollbarPart hoveredPart() const = 0;
+
+    virtual void styleChanged() = 0;
+
+    virtual bool enabled() const = 0;
+    virtual void setEnabled(bool) = 0;
+
+protected:
+    virtual ~ScrollbarThemeClient() { }
+};
+
+} // namespace WebCore
+
+#endif // ScollbarThemeClient_h
diff --git a/Source/WebCore/platform/ScrollbarThemeComposite.cpp b/Source/WebCore/platform/ScrollbarThemeComposite.cpp
index 62fd5e5d2..9d833742f 100644
--- a/Source/WebCore/platform/ScrollbarThemeComposite.cpp
+++ b/Source/WebCore/platform/ScrollbarThemeComposite.cpp
@@ -33,15 +33,14 @@
 #include "GraphicsContext.h"
 #include "Page.h"
 #include "PlatformMouseEvent.h"
-#include "Scrollbar.h"
-#include "ScrollableArea.h"
+#include "ScrollbarThemeClient.h"
 #include "Settings.h"
 
 using namespace std;
 
 namespace WebCore {
 
-bool ScrollbarThemeComposite::paint(Scrollbar* scrollbar, GraphicsContext* graphicsContext, const IntRect& damageRect)
+bool ScrollbarThemeComposite::paint(ScrollbarThemeClient* scrollbar, GraphicsContext* graphicsContext, const IntRect& damageRect)
 {
     // Create the ScrollbarControlPartMask based on the damageRect
     ScrollbarControlPartMask scrollMask = NoPart;
@@ -116,7 +115,7 @@ bool ScrollbarThemeComposite::paint(Scrollbar* scrollbar, GraphicsContext* graph
     return true;
 }
 
-ScrollbarPart ScrollbarThemeComposite::hitTest(Scrollbar* scrollbar, const PlatformMouseEvent& evt)
+ScrollbarPart ScrollbarThemeComposite::hitTest(ScrollbarThemeClient* scrollbar, const PlatformMouseEvent& evt)
 {
     ScrollbarPart result = NoPart;
     if (!scrollbar->enabled())
@@ -155,7 +154,7 @@ ScrollbarPart ScrollbarThemeComposite::hitTest(Scrollbar* scrollbar, const Platf
     return result;
 }
 
-void ScrollbarThemeComposite::invalidatePart(Scrollbar* scrollbar, ScrollbarPart part)
+void ScrollbarThemeComposite::invalidatePart(ScrollbarThemeClient* scrollbar, ScrollbarPart part)
 {
     if (part == NoPart)
         return;
@@ -195,7 +194,7 @@ void ScrollbarThemeComposite::invalidatePart(Scrollbar* scrollbar, ScrollbarPart
     scrollbar->invalidateRect(result);
 }
 
-void ScrollbarThemeComposite::splitTrack(Scrollbar* scrollbar, const IntRect& unconstrainedTrackRect, IntRect& beforeThumbRect, IntRect& thumbRect, IntRect& afterThumbRect)
+void ScrollbarThemeComposite::splitTrack(ScrollbarThemeClient* scrollbar, const IntRect& unconstrainedTrackRect, IntRect& beforeThumbRect, IntRect& thumbRect, IntRect& afterThumbRect)
 {
     // This function won't even get called unless we're big enough to have some combination of these three rects where at least
     // one of them is non-empty.
@@ -215,7 +214,7 @@ void ScrollbarThemeComposite::splitTrack(Scrollbar* scrollbar, const IntRect& un
 
 // Returns the size represented by track taking into account scrolling past
 // the end of the document.
-static float usedTotalSize(Scrollbar* scrollbar)
+static float usedTotalSize(ScrollbarThemeClient* scrollbar)
 {
     float overhangAtStart = -scrollbar->currentPos();
     float overhangAtEnd = scrollbar->currentPos() + scrollbar->visibleSize() - scrollbar->totalSize();
@@ -223,7 +222,7 @@ static float usedTotalSize(Scrollbar* scrollbar)
     return scrollbar->totalSize() + overhang;
 }
 
-int ScrollbarThemeComposite::thumbPosition(Scrollbar* scrollbar)
+int ScrollbarThemeComposite::thumbPosition(ScrollbarThemeClient* scrollbar)
 {
     if (scrollbar->enabled()) {
         float size = usedTotalSize(scrollbar) - scrollbar->visibleSize();
@@ -236,7 +235,7 @@ int ScrollbarThemeComposite::thumbPosition(Scrollbar* scrollbar)
     return 0;
 }
 
-int ScrollbarThemeComposite::thumbLength(Scrollbar* scrollbar)
+int ScrollbarThemeComposite::thumbLength(ScrollbarThemeClient* scrollbar)
 {
     if (!scrollbar->enabled())
         return 0;
@@ -250,18 +249,18 @@ int ScrollbarThemeComposite::thumbLength(Scrollbar* scrollbar)
     return length;
 }
 
-int ScrollbarThemeComposite::minimumThumbLength(Scrollbar* scrollbar)
+int ScrollbarThemeComposite::minimumThumbLength(ScrollbarThemeClient* scrollbar)
 {
     return scrollbarThickness(scrollbar->controlSize());
 }
 
-int ScrollbarThemeComposite::trackPosition(Scrollbar* scrollbar)
+int ScrollbarThemeComposite::trackPosition(ScrollbarThemeClient* scrollbar)
 {
     IntRect constrainedTrackRect = constrainTrackRectToTrackPieces(scrollbar, trackRect(scrollbar));
     return (scrollbar->orientation() == HorizontalScrollbar) ? constrainedTrackRect.x() - scrollbar->x() : constrainedTrackRect.y() - scrollbar->y();
 }
 
-int ScrollbarThemeComposite::trackLength(Scrollbar* scrollbar)
+int ScrollbarThemeComposite::trackLength(ScrollbarThemeClient* scrollbar)
 {
     IntRect constrainedTrackRect = constrainTrackRectToTrackPieces(scrollbar, trackRect(scrollbar));
     return (scrollbar->orientation() == HorizontalScrollbar) ? constrainedTrackRect.width() : constrainedTrackRect.height();
diff --git a/Source/WebCore/platform/ScrollbarThemeComposite.h b/Source/WebCore/platform/ScrollbarThemeComposite.h
index 11b3bd470..8f629133e 100644
--- a/Source/WebCore/platform/ScrollbarThemeComposite.h
+++ b/Source/WebCore/platform/ScrollbarThemeComposite.h
@@ -32,40 +32,40 @@ namespace WebCore {
 
 class ScrollbarThemeComposite : public ScrollbarTheme {
 public:
-    virtual bool paint(Scrollbar*, GraphicsContext* context, const IntRect& damageRect);
+    virtual bool paint(ScrollbarThemeClient*, GraphicsContext*, const IntRect& damageRect);
 
-    virtual ScrollbarPart hitTest(Scrollbar*, const PlatformMouseEvent&);
+    virtual ScrollbarPart hitTest(ScrollbarThemeClient*, const PlatformMouseEvent&);
 
-    virtual void invalidatePart(Scrollbar*, ScrollbarPart);
+    virtual void invalidatePart(ScrollbarThemeClient*, ScrollbarPart);
 
-    virtual int thumbPosition(Scrollbar*);
-    virtual int thumbLength(Scrollbar*);
-    virtual int trackPosition(Scrollbar*);
-    virtual int trackLength(Scrollbar*);
+    virtual int thumbPosition(ScrollbarThemeClient*);
+    virtual int thumbLength(ScrollbarThemeClient*);
+    virtual int trackPosition(ScrollbarThemeClient*);
+    virtual int trackLength(ScrollbarThemeClient*);
 
     virtual void paintScrollCorner(ScrollView*, GraphicsContext*, const IntRect& cornerRect);
     virtual void paintOverhangAreas(ScrollView*, GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
 
 protected:
-    virtual bool hasButtons(Scrollbar*) = 0;
-    virtual bool hasThumb(Scrollbar*) = 0;
+    virtual bool hasButtons(ScrollbarThemeClient*) = 0;
+    virtual bool hasThumb(ScrollbarThemeClient*) = 0;
 
-    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false) = 0;
-    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false) = 0;
-    virtual IntRect trackRect(Scrollbar*, bool painting = false) = 0;
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false) = 0;
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false) = 0;
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false) = 0;
 
-    virtual void splitTrack(Scrollbar*, const IntRect& track, IntRect& startTrack, IntRect& thumb, IntRect& endTrack);
+    virtual void splitTrack(ScrollbarThemeClient*, const IntRect& track, IntRect& startTrack, IntRect& thumb, IntRect& endTrack);
     
-    virtual int minimumThumbLength(Scrollbar*);
+    virtual int minimumThumbLength(ScrollbarThemeClient*);
 
-    virtual void paintScrollbarBackground(GraphicsContext*, Scrollbar*) {}
-    virtual void paintTrackBackground(GraphicsContext*, Scrollbar*, const IntRect&) {}
-    virtual void paintTrackPiece(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart) {}
-    virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart) {}
-    virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&) {}
-    virtual void paintTickmarks(GraphicsContext*, Scrollbar*, const IntRect&) {}
+    virtual void paintScrollbarBackground(GraphicsContext*, ScrollbarThemeClient*) { }
+    virtual void paintTrackBackground(GraphicsContext*, ScrollbarThemeClient*, const IntRect&) { }
+    virtual void paintTrackPiece(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart) { }
+    virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart) { }
+    virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&) { }
+    virtual void paintTickmarks(GraphicsContext*, ScrollbarThemeClient*, const IntRect&) { }
 
-    virtual IntRect constrainTrackRectToTrackPieces(Scrollbar*, const IntRect& rect) { return rect; }
+    virtual IntRect constrainTrackRectToTrackPieces(ScrollbarThemeClient*, const IntRect& rect) { return rect; }
 };
 
 }
diff --git a/Source/WebCore/platform/SharedBuffer.cpp b/Source/WebCore/platform/SharedBuffer.cpp
index 5b5953edc..ee6a29fd5 100644
--- a/Source/WebCore/platform/SharedBuffer.cpp
+++ b/Source/WebCore/platform/SharedBuffer.cpp
@@ -65,12 +65,20 @@ SharedBuffer::SharedBuffer()
 SharedBuffer::SharedBuffer(const char* data, int size)
     : m_size(0)
 {
+    // FIXME: Use unsigned consistently, and check for invalid casts when calling into SharedBuffer from other code.
+    if (size < 0)
+        CRASH();
+
     append(data, size);
 }
 
 SharedBuffer::SharedBuffer(const unsigned char* data, int size)
     : m_size(0)
 {
+    // FIXME: Use unsigned consistently, and check for invalid casts when calling into SharedBuffer from other code.
+    if (size < 0)
+        CRASH();
+
     append(reinterpret_cast<const char*>(data), size);
 }
     
diff --git a/Source/WebCore/platform/Supplementable.h b/Source/WebCore/platform/Supplementable.h
new file mode 100644
index 000000000..84dc906e2
--- /dev/null
+++ b/Source/WebCore/platform/Supplementable.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2012 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Supplementable_h
+#define Supplementable_h
+
+#include <wtf/HashMap.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/text/AtomicString.h>
+#include <wtf/text/AtomicStringHash.h>
+
+namespace WebCore {
+
+template<typename T>
+class Supplementable;
+
+template<typename T>
+class Supplement {
+public:
+    virtual ~Supplement() { }
+
+    static void provideTo(Supplementable<T>* host, const AtomicString& key, PassOwnPtr<Supplement<T> > supplement)
+    {
+        host->provideSupplement(key, supplement);
+    }
+
+    static Supplement<T>* from(Supplementable<T>* host, const AtomicString& key)
+    {
+        return host ? host->requireSupplement(key) : 0;
+    }
+};
+
+template<typename T>
+class Supplementable {
+public:
+    void provideSupplement(const AtomicString& key, PassOwnPtr<Supplement<T> > supplement)
+    {
+        ASSERT(!m_supplements.get(key.impl()));
+        m_supplements.set(key, supplement);
+    }
+
+    Supplement<T>* requireSupplement(const AtomicString& key)
+    {
+        return m_supplements.get(key);
+    }
+
+private:
+    typedef HashMap<AtomicString, OwnPtr<Supplement<T> > > SupplementMap;
+    SupplementMap m_supplements;
+};
+
+} // namespace WebCore
+
+#endif // Supplementable_h
diff --git a/Source/WebCore/platform/ThemeTypes.h b/Source/WebCore/platform/ThemeTypes.h
index bdef724eb..f2515fc1a 100644
--- a/Source/WebCore/platform/ThemeTypes.h
+++ b/Source/WebCore/platform/ThemeTypes.h
@@ -48,7 +48,7 @@ typedef unsigned ControlStates;
 enum ControlPart {
     NoControlPart, CheckboxPart, RadioPart, PushButtonPart, SquareButtonPart, ButtonPart,
     ButtonBevelPart, DefaultButtonPart, InnerSpinButtonPart, InputSpeechButtonPart, ListButtonPart, ListboxPart, ListItemPart,
-    MediaFullscreenButtonPart, MediaMuteButtonPart, MediaPlayButtonPart, MediaSeekBackButtonPart, 
+    MediaFullscreenButtonPart, MediaFullScreenVolumeSliderPart, MediaFullScreenVolumeSliderThumbPart, MediaMuteButtonPart, MediaPlayButtonPart, MediaSeekBackButtonPart, 
     MediaSeekForwardButtonPart, MediaRewindButtonPart, MediaReturnToRealtimeButtonPart, MediaToggleClosedCaptionsButtonPart,
     MediaSliderPart, MediaSliderThumbPart, MediaVolumeSliderContainerPart, MediaVolumeSliderPart, MediaVolumeSliderThumbPart,
     MediaVolumeSliderMuteButtonPart, MediaControlsBackgroundPart, MediaControlsFullscreenBackgroundPart, MediaCurrentTimePart, MediaTimeRemainingPart,
diff --git a/Source/WebCore/platform/ThreadGlobalData.cpp b/Source/WebCore/platform/ThreadGlobalData.cpp
index 166eb47ba..da846f8db 100644
--- a/Source/WebCore/platform/ThreadGlobalData.cpp
+++ b/Source/WebCore/platform/ThreadGlobalData.cpp
@@ -29,6 +29,7 @@
 
 #include "DOMImplementation.h"
 #include "EventNames.h"
+#include "InspectorCounters.h"
 #include "ThreadTimers.h"
 #include <wtf/MainThread.h>
 #include <wtf/UnusedParam.h>
@@ -70,6 +71,9 @@ ThreadGlobalData::ThreadGlobalData()
 #if PLATFORM(MAC)
     , m_cachedConverterTEC(adoptPtr(new TECConverterWrapper))
 #endif
+#if ENABLE(INSPECTOR)
+    , m_inspectorCounters(adoptPtr(new ThreadLocalInspectorCounters()))
+#endif
 {
     // This constructor will have been called on the main thread before being called on
     // any other thread, and is only called once per thread - this makes this a convenient
@@ -93,6 +97,10 @@ void ThreadGlobalData::destroy()
     m_cachedConverterICU.clear();
 #endif
 
+#if ENABLE(INSPECTOR)
+    m_inspectorCounters.clear();
+#endif
+
     m_eventNames.clear();
     m_threadTimers.clear();
     m_xmlTypeRegExp.clear();
diff --git a/Source/WebCore/platform/ThreadGlobalData.h b/Source/WebCore/platform/ThreadGlobalData.h
index bb9f1a8e1..42f05afe3 100644
--- a/Source/WebCore/platform/ThreadGlobalData.h
+++ b/Source/WebCore/platform/ThreadGlobalData.h
@@ -42,6 +42,7 @@ using WTF::ThreadSpecific;
 namespace WebCore {
 
     class EventNames;
+    class ThreadLocalInspectorCounters;
     class ThreadTimers;
     class XMLMIMETypeRegExp;
 
@@ -67,6 +68,10 @@ namespace WebCore {
         TECConverterWrapper& cachedConverterTEC() { return *m_cachedConverterTEC; }
 #endif
 
+#if ENABLE(INSPECTOR)
+        ThreadLocalInspectorCounters& inspectorCounters() { return *m_inspectorCounters; }
+#endif
+
     private:
         OwnPtr<EventNames> m_eventNames;
         OwnPtr<ThreadTimers> m_threadTimers;
@@ -84,6 +89,10 @@ namespace WebCore {
         OwnPtr<TECConverterWrapper> m_cachedConverterTEC;
 #endif
 
+#if ENABLE(INSPECTOR)
+        OwnPtr<ThreadLocalInspectorCounters> m_inspectorCounters;
+#endif
+
 #if ENABLE(WORKERS)
         static ThreadSpecific<ThreadGlobalData>* staticData;
 #else
diff --git a/Source/WebCore/platform/TouchFlingPlatformGestureCurve.cpp b/Source/WebCore/platform/TouchFlingPlatformGestureCurve.cpp
new file mode 100644
index 000000000..076099583
--- /dev/null
+++ b/Source/WebCore/platform/TouchFlingPlatformGestureCurve.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "TouchFlingPlatformGestureCurve.h"
+
+#include "PlatformGestureCurveTarget.h"
+#include <math.h>
+
+namespace WebCore {
+
+using namespace std;
+
+PassOwnPtr<PlatformGestureCurve> TouchFlingPlatformGestureCurve::create(const FloatPoint& velocity)
+{
+    return adoptPtr(new TouchFlingPlatformGestureCurve(velocity));
+}
+
+TouchFlingPlatformGestureCurve::TouchFlingPlatformGestureCurve(const FloatPoint& velocity)
+    : m_velocity(velocity)
+    , m_timeScaleFactor(1000 / max(1.f, max(fabs(velocity.x()), fabs(velocity.y()))))
+{
+    ASSERT(velocity != FloatPoint::zero());
+}
+
+TouchFlingPlatformGestureCurve::~TouchFlingPlatformGestureCurve()
+{
+}
+
+bool TouchFlingPlatformGestureCurve::apply(double time, PlatformGestureCurveTarget* target)
+{
+    // Here we implement a cubic bezier curve with parameters [1 1 0 0] which gives
+    // v(0) = 1, a(0) = 0, v(1) = 0, a(1) = 0. The curve is scaled by the initial
+    // velocity, and the time parameter is re-scaled so that larger initial velocities
+    // lead to longer initial animations. This should allow the animation to smoothly
+    // continue the velocity at the end of the GestureScroll, and smoothly come to a rest
+    // at the end. Finally, we have integrated the curve so we can deal with displacement
+    // as a function of time, and not velocity.
+    // Finally, we place a constant velocity from ts = 0 .. 0.5, and run the Bezier curve
+    // from ts = 0.5 .. 1.5 to give a longer run-out.
+    time *= m_timeScaleFactor;
+
+    float displacement;
+    if (time <= 0.5)
+        displacement = time;
+    else if (time <= 1.5) {
+        double t = time - 0.5;
+        displacement = t * (1 + t * t * (0.5 * t - 1)) + 0.5;
+    } else
+        displacement = 1.0;
+
+    // Keep track of integer portion of scroll thus far, and prepare increment.
+    IntPoint scroll(displacement * m_velocity.x(), displacement * m_velocity.y());
+    IntPoint scrollIncrement(scroll - m_cumulativeScroll);
+    m_cumulativeScroll = scroll;
+
+    if (time < 1.5 || scrollIncrement != IntPoint::zero()) {
+        target->setScrollIncrement(scrollIncrement);
+        return true;
+    }
+
+    return false;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/TouchFlingPlatformGestureCurve.h b/Source/WebCore/platform/TouchFlingPlatformGestureCurve.h
new file mode 100644
index 000000000..fd52bc4ec
--- /dev/null
+++ b/Source/WebCore/platform/TouchFlingPlatformGestureCurve.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TouchFlingPlatformGestureCurve_h
+#define TouchFlingPlatformGestureCurve_h
+
+#include "FloatPoint.h"
+#include "PlatformGestureCurve.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class PlatformGestureCurveTarget;
+
+// Implementation of PlatformGestureCurve suitable for touch pad/screen-based
+// fling scroll. Starts with a flat velocity profile based on 'velocity', which
+// tails off to zero. Time is scaled to that duration of the fling is proportional
+// the initial velocity.
+class TouchFlingPlatformGestureCurve : public PlatformGestureCurve {
+public:
+    static PassOwnPtr<PlatformGestureCurve> create(const FloatPoint& velocity);
+    virtual ~TouchFlingPlatformGestureCurve();
+
+    virtual bool apply(double time, PlatformGestureCurveTarget*);
+
+private:
+    explicit TouchFlingPlatformGestureCurve(const FloatPoint& velocity);
+
+    FloatPoint m_velocity;
+    float m_timeScaleFactor;
+    IntPoint m_cumulativeScroll;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/WheelFlingPlatformGestureCurve.cpp b/Source/WebCore/platform/WheelFlingPlatformGestureCurve.cpp
new file mode 100644
index 000000000..fab57cd5f
--- /dev/null
+++ b/Source/WebCore/platform/WheelFlingPlatformGestureCurve.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "WheelFlingPlatformGestureCurve.h"
+
+#include "PlatformGestureCurveTarget.h"
+#include <math.h>
+
+namespace WebCore {
+
+PassOwnPtr<PlatformGestureCurve> WheelFlingPlatformGestureCurve::create(const FloatPoint& velocity)
+{
+    return adoptPtr(new WheelFlingPlatformGestureCurve(velocity));
+}
+
+WheelFlingPlatformGestureCurve::WheelFlingPlatformGestureCurve(const FloatPoint& velocity)
+    : m_velocity(velocity)
+{
+    ASSERT(velocity != FloatPoint::zero());
+}
+
+WheelFlingPlatformGestureCurve::~WheelFlingPlatformGestureCurve()
+{
+}
+
+bool WheelFlingPlatformGestureCurve::apply(double time, PlatformGestureCurveTarget* target)
+{
+    // Use a Rayleigh distribution for the curve. This simulates a velocity profile
+    // that starts at 0, increases to a maximum, then decreases again smoothly. By
+    // using the cumulative distribution function (CDF) instead of the point-mass function,
+    // we can isolate timing jitter by remembering the CDF value at the last tick. Since
+    // the CDF maxes out at 1, scale it by the input velocity.
+    //
+    // CDF -> F(x; sigma) = 1 - exp{-x^2/2\sigma^2}
+    // ref: http://en.wikipedia.org/wiki/Rayleigh_distribution
+    // FIXME: consider making the value of sigma settable in the constructor.
+    static double twoSigmaSquaredInverse = 16; // sigma = 0.25
+    float cdf = 1 - exp(-time * time * twoSigmaSquaredInverse);
+    IntPoint scroll(cdf * m_velocity.x(), cdf * m_velocity.y());
+    IntPoint scrollIncrement(scroll - m_cumulativeScroll);
+    m_cumulativeScroll = scroll;
+
+    if (cdf < 0.5 || scrollIncrement != IntPoint::zero()) {
+        target->setScrollIncrement(scrollIncrement);
+        return true;
+    }
+
+    return false;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/WheelFlingPlatformGestureCurve.h b/Source/WebCore/platform/WheelFlingPlatformGestureCurve.h
new file mode 100644
index 000000000..b72146165
--- /dev/null
+++ b/Source/WebCore/platform/WheelFlingPlatformGestureCurve.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WheelFlingPlatformGestureCurve_h
+#define WheelFlingPlatformGestureCurve_h
+
+#include "FloatPoint.h"
+#include "PlatformGestureCurve.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class PlatformGestureCurveTarget;
+
+// Implementation of PlatformGestureCurve suitable for mouse wheel-based fling
+// scroll. A Rayleigh distribtution curve is used to define the velocity profile,
+// so velocity starts at zero, accelerates to a maximum proportional to 'velocity',
+// then gently tails off to zero again.
+class WheelFlingPlatformGestureCurve : public PlatformGestureCurve {
+public:
+    static PassOwnPtr<PlatformGestureCurve> create(const FloatPoint& velocity);
+    virtual ~WheelFlingPlatformGestureCurve();
+
+    virtual bool apply(double time, PlatformGestureCurveTarget*);
+
+private:
+    WheelFlingPlatformGestureCurve(const FloatPoint& velocity);
+
+    FloatPoint m_velocity;
+    IntPoint m_cumulativeScroll;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/audio/AudioUtilities.cpp b/Source/WebCore/platform/audio/AudioUtilities.cpp
index 7ec833ccd..57c00528b 100644
--- a/Source/WebCore/platform/audio/AudioUtilities.cpp
+++ b/Source/WebCore/platform/audio/AudioUtilities.cpp
@@ -49,11 +49,9 @@ float linearToDecibels(float linear)
     return 20 * log10f(linear);
 }
 
-float discreteTimeConstantForSampleRate(float timeConstant, float sampleRate)
+double discreteTimeConstantForSampleRate(double timeConstant, double sampleRate)
 {
-    // hardcoded value is temporary build fix for Windows.
-    // FIXME: replace hardcode 2.718282 with M_E until the correct MathExtras.h solution is determined.
-    return 1 - powf(1 / 2.718282f, 1 / (sampleRate * timeConstant));
+    return 1 - exp(-1 / (sampleRate * timeConstant));
 }
 
 size_t timeToSampleFrame(double time, double sampleRate)
diff --git a/Source/WebCore/platform/audio/AudioUtilities.h b/Source/WebCore/platform/audio/AudioUtilities.h
index ed2945fb6..c191e871c 100644
--- a/Source/WebCore/platform/audio/AudioUtilities.h
+++ b/Source/WebCore/platform/audio/AudioUtilities.h
@@ -36,7 +36,7 @@ float decibelsToLinear(float);
 // timeConstant is the time it takes a first-order linear time-invariant system
 // to reach the value 1 - 1/e (around 63.2%) given a step input response.
 // discreteTimeConstantForSampleRate() will return the discrete time-constant for the specific sampleRate.
-float discreteTimeConstantForSampleRate(float timeConstant, float sampleRate);
+double discreteTimeConstantForSampleRate(double timeConstant, double sampleRate);
 
 // Convert the time to a sample frame at the given sample rate.
 size_t timeToSampleFrame(double time, double sampleRate);
diff --git a/Source/WebCore/platform/audio/Biquad.cpp b/Source/WebCore/platform/audio/Biquad.cpp
index cfee9cfd9..d6799c69d 100644
--- a/Source/WebCore/platform/audio/Biquad.cpp
+++ b/Source/WebCore/platform/audio/Biquad.cpp
@@ -53,22 +53,35 @@ Biquad::Biquad()
     m_outputBuffer.allocate(kBufferSize + 2);
 #endif
 
+#if USE(WEBAUDIO_IPP)
+    int bufferSize;
+    ippsIIRGetStateSize64f_BiQuad_32f(1, &bufferSize);
+    m_ippInternalBuffer = ippsMalloc_8u(bufferSize);
+#endif // USE(WEBAUDIO_IPP)
+
     // Initialize as pass-thru (straight-wire, no filter effect)
-    m_b0 = 1;
-    m_b1 = 0;
-    m_b2 = 0;
-    m_a1 = 0;
-    m_a2 = 0;
+    setNormalizedCoefficients(1, 0, 0, 1, 0, 0);
 
     reset(); // clear filter memory
 }
 
+Biquad::~Biquad()
+{
+#if USE(WEBAUDIO_IPP)
+    ippsFree(m_ippInternalBuffer);
+#endif // USE(WEBAUDIO_IPP)
+}
+
 void Biquad::process(const float* sourceP, float* destP, size_t framesToProcess)
 {
 #if OS(DARWIN)
     // Use vecLib if available
     processFast(sourceP, destP, framesToProcess);
-#else
+
+#elif USE(WEBAUDIO_IPP)
+    ippsIIR64f_32f(sourceP, destP, static_cast<int>(framesToProcess), m_biquadState);
+#else // USE(WEBAUDIO_IPP)
+
     int n = framesToProcess;
 
     // Create local copies of member variables
@@ -171,8 +184,6 @@ void Biquad::processSliceFast(double* sourceP, double* destP, double* coefficien
 
 void Biquad::reset()
 {
-    m_x1 = m_x2 = m_y1 = m_y2 = 0;
-
 #if OS(DARWIN)
     // Two extra samples for filter history
     double* inputP = m_inputBuffer.data();
@@ -182,89 +193,88 @@ void Biquad::reset()
     double* outputP = m_outputBuffer.data();
     outputP[0] = 0;
     outputP[1] = 0;
+
+#elif USE(WEBAUDIO_IPP)
+    int bufferSize;
+    ippsIIRGetStateSize64f_BiQuad_32f(1, &bufferSize);
+    ippsZero_8u(m_ippInternalBuffer, bufferSize);
+
+#else
+    m_x1 = m_x2 = m_y1 = m_y2 = 0;
 #endif
 }
 
 void Biquad::setLowpassParams(double cutoff, double resonance)
 {
-    resonance = std::max(0.0, resonance); // can't go negative
     // Limit cutoff to 0 to 1.
     cutoff = std::max(0.0, std::min(cutoff, 1.0));
     
-    double g = pow(10.0, 0.05 * resonance);
-    double d = sqrt((4 - sqrt(16 - 16 / (g * g))) / 2);
-
     if (cutoff == 1) {
         // When cutoff is 1, the z-transform is 1.
-        m_b0 = 1;
-        m_b1 = 0;
-        m_b2 = 0;
-        m_a1 = 0;
-        m_a2 = 0;
+        setNormalizedCoefficients(1, 0, 0,
+                                  1, 0, 0);
     } else if (cutoff > 0) {
         // Compute biquad coefficients for lowpass filter
+        resonance = std::max(0.0, resonance); // can't go negative
+        double g = pow(10.0, 0.05 * resonance);
+        double d = sqrt((4 - sqrt(16 - 16 / (g * g))) / 2);
+
         double theta = piDouble * cutoff;
         double sn = 0.5 * d * sin(theta);
         double beta = 0.5 * (1 - sn) / (1 + sn);
         double gamma = (0.5 + beta) * cos(theta);
         double alpha = 0.25 * (0.5 + beta - gamma);
 
-        m_b0 = 2 * alpha;
-        m_b1 = 2 * 2 * alpha;
-        m_b2 = 2 * alpha;
-        m_a1 = 2 * -gamma;
-        m_a2 = 2 * beta;
+        double b0 = 2 * alpha;
+        double b1 = 2 * 2 * alpha;
+        double b2 = 2 * alpha;
+        double a1 = 2 * -gamma;
+        double a2 = 2 * beta;
+
+        setNormalizedCoefficients(b0, b1, b2, 1, a1, a2);
     } else {
         // When cutoff is zero, nothing gets through the filter, so set
         // coefficients up correctly.
-        m_b0 = 0;
-        m_b1 = 0;
-        m_b2 = 0;
-        m_a1 = 0;
-        m_a2 = 0;
+        setNormalizedCoefficients(0, 0, 0,
+                                  1, 0, 0);
     }
 }
 
 void Biquad::setHighpassParams(double cutoff, double resonance)
 {
-    resonance = std::max(0.0, resonance); // can't go negative
-
     // Limit cutoff to 0 to 1.
     cutoff = std::max(0.0, std::min(cutoff, 1.0));
 
-    double g = pow(10.0, 0.05 * resonance);
-    double d = sqrt((4 - sqrt(16 - 16 / (g * g))) / 2);
-
     if (cutoff == 1) {
         // The z-transform is 0.
-        m_b0 = 0;
-        m_b1 = 0;
-        m_b2 = 0;
-        m_a1 = 0;
-        m_a2 = 0;
+        setNormalizedCoefficients(0, 0, 0,
+                                  1, 0, 0);
     } else if (cutoff > 0) {
         // Compute biquad coefficients for highpass filter
+        resonance = std::max(0.0, resonance); // can't go negative
+        double g = pow(10.0, 0.05 * resonance);
+        double d = sqrt((4 - sqrt(16 - 16 / (g * g))) / 2);
+
         double theta = piDouble * cutoff;
         double sn = 0.5 * d * sin(theta);
         double beta = 0.5 * (1 - sn) / (1 + sn);
         double gamma = (0.5 + beta) * cos(theta);
         double alpha = 0.25 * (0.5 + beta + gamma);
 
-        m_b0 = 2 * alpha;
-        m_b1 = 2 * -2 * alpha;
-        m_b2 = 2 * alpha;
-        m_a1 = 2 * -gamma;
-        m_a2 = 2 * beta;
+        double b0 = 2 * alpha;
+        double b1 = 2 * -2 * alpha;
+        double b2 = 2 * alpha;
+        double a1 = 2 * -gamma;
+        double a2 = 2 * beta;
+
+        setNormalizedCoefficients(b0, b1, b2, 1, a1, a2);
     } else {
       // When cutoff is zero, we need to be careful because the above
       // gives a quadratic divided by the same quadratic, with poles
       // and zeros on the unit circle in the same place. When cutoff
       // is zero, the z-transform is 1.
-      m_b0 = 1;
-      m_b1 = 0;
-      m_b2 = 0;
-      m_a1 = 0;
-      m_a2 = 0;
+        setNormalizedCoefficients(1, 0, 0,
+                                  1, 0, 0);
     }
 }
 
@@ -277,6 +287,19 @@ void Biquad::setNormalizedCoefficients(double b0, double b1, double b2, double a
     m_b2 = b2 * a0Inverse;
     m_a1 = a1 * a0Inverse;
     m_a2 = a2 * a0Inverse;
+
+#if USE(WEBAUDIO_IPP)
+    Ipp64f taps[6];
+    taps[0] = m_b0;
+    taps[1] = m_b1;
+    taps[2] = m_b2;
+    taps[3] = 1;
+    taps[4] = m_a1;
+    taps[5] = m_a2;
+    m_biquadState = 0;
+
+    ippsIIRInit64f_BiQuad_32f(&m_biquadState, taps, 1, 0, m_ippInternalBuffer);
+#endif // USE(WEBAUDIO_IPP)
 }
 
 void Biquad::setLowShelfParams(double frequency, double dbGain)
@@ -501,16 +524,17 @@ void Biquad::setBandpassParams(double frequency, double Q)
 
 void Biquad::setZeroPolePairs(const Complex &zero, const Complex &pole)
 {
-    m_b0 = 1;
-    m_b1 = -2 * zero.real();
+    double b0 = 1;
+    double b1 = -2 * zero.real();
 
     double zeroMag = abs(zero);
-    m_b2 = zeroMag * zeroMag;
+    double b2 = zeroMag * zeroMag;
 
-    m_a1 = -2 * pole.real();
+    double a1 = -2 * pole.real();
 
     double poleMag = abs(pole);
-    m_a2 = poleMag * poleMag;
+    double a2 = poleMag * poleMag;
+    setNormalizedCoefficients(b0, b1, b2, 1, a1, a2);
 }
 
 void Biquad::setAllpassPole(const Complex &pole)
diff --git a/Source/WebCore/platform/audio/Biquad.h b/Source/WebCore/platform/audio/Biquad.h
index 78381158b..494c03092 100644
--- a/Source/WebCore/platform/audio/Biquad.h
+++ b/Source/WebCore/platform/audio/Biquad.h
@@ -34,6 +34,10 @@
 #include <wtf/Complex.h>
 #include <wtf/Platform.h>
  
+#if USE(WEBAUDIO_IPP)
+#include <ipps.h>
+#endif // USE(WEBAUDIO_IPP)
+
 namespace WebCore {
 
 // A basic biquad (two-zero / two-pole digital filter)
@@ -44,7 +48,7 @@ namespace WebCore {
 class Biquad {
 public:   
     Biquad();
-    virtual ~Biquad() { }
+    virtual ~Biquad();
 
     void process(const float* sourceP, float* destP, size_t framesToProcess);
 
@@ -89,18 +93,23 @@ private:
     double m_a1;
     double m_a2;
 
-    // Filter memory
-    double m_x1; // input delayed by 1 sample
-    double m_x2; // input delayed by 2 samples
-    double m_y1; // output delayed by 1 sample
-    double m_y2; // output delayed by 2 samples
-
 #if OS(DARWIN)
     void processFast(const float* sourceP, float* destP, size_t framesToProcess);
     void processSliceFast(double* sourceP, double* destP, double* coefficientsP, size_t framesToProcess);
 
     AudioDoubleArray m_inputBuffer;
     AudioDoubleArray m_outputBuffer;
+
+#elif USE(WEBAUDIO_IPP)
+    IppsIIRState64f_32f* m_biquadState;
+    Ipp8u* m_ippInternalBuffer;
+
+#else
+    // Filter memory
+    double m_x1; // input delayed by 1 sample
+    double m_x2; // input delayed by 2 samples
+    double m_y1; // output delayed by 1 sample
+    double m_y2; // output delayed by 2 samples
 #endif
 };
 
diff --git a/Source/WebCore/platform/audio/DynamicsCompressor.cpp b/Source/WebCore/platform/audio/DynamicsCompressor.cpp
index d0f27b05f..c943b9801 100644
--- a/Source/WebCore/platform/audio/DynamicsCompressor.cpp
+++ b/Source/WebCore/platform/audio/DynamicsCompressor.cpp
@@ -42,6 +42,7 @@ using namespace AudioUtilities;
     
 DynamicsCompressor::DynamicsCompressor(float sampleRate, unsigned numberOfChannels)
     : m_numberOfChannels(numberOfChannels)
+    , m_sampleRate(sampleRate)
     , m_compressor(sampleRate, numberOfChannels)
 {
     // Uninitialized state - for parameter recalculation.
@@ -53,12 +54,20 @@ DynamicsCompressor::DynamicsCompressor(float sampleRate, unsigned numberOfChanne
     initializeParameters();
 }
 
+void DynamicsCompressor::setParameterValue(unsigned parameterID, float value)
+{
+    ASSERT(parameterID < ParamLast);
+    if (parameterID < ParamLast)
+        m_parameters[parameterID] = value;
+}
+
 void DynamicsCompressor::initializeParameters()
 {
     // Initializes compressor to default values.
     
     m_parameters[ParamThreshold] = -24; // dB
-    m_parameters[ParamHeadroom] = 21; // dB
+    m_parameters[ParamKnee] = 30; // dB
+    m_parameters[ParamRatio] = 12; // unit-less
     m_parameters[ParamAttack] = 0.003f; // seconds
     m_parameters[ParamRelease] = 0.250f; // seconds
     m_parameters[ParamPreDelay] = 0.006f; // seconds
@@ -74,6 +83,7 @@ void DynamicsCompressor::initializeParameters()
     m_parameters[ParamFilterAnchor] = 15000 / nyquist();
     
     m_parameters[ParamPostGain] = 0; // dB
+    m_parameters[ParamReduction] = 0; // dB
 
     // Linear crossfade (0 -> 1).
     m_parameters[ParamEffectBlend] = 1;
@@ -180,7 +190,8 @@ void DynamicsCompressor::process(const AudioBus* sourceBus, AudioBus* destinatio
     }
 
     float dbThreshold = parameterValue(ParamThreshold);
-    float dbHeadroom = parameterValue(ParamHeadroom);
+    float dbKnee = parameterValue(ParamKnee);
+    float ratio = parameterValue(ParamRatio);
     float attackTime = parameterValue(ParamAttack);
     float releaseTime = parameterValue(ParamRelease);
     float preDelayTime = parameterValue(ParamPreDelay);
@@ -206,7 +217,8 @@ void DynamicsCompressor::process(const AudioBus* sourceBus, AudioBus* destinatio
                          framesToProcess,
 
                          dbThreshold,
-                         dbHeadroom,
+                         dbKnee,
+                         ratio,
                          attackTime,
                          releaseTime,
                          preDelayTime,
@@ -218,6 +230,9 @@ void DynamicsCompressor::process(const AudioBus* sourceBus, AudioBus* destinatio
                          releaseZone3,
                          releaseZone4
                          );
+                         
+    // Update the compression amount.                     
+    setParameterValue(ParamReduction, m_compressor.meteringGain());
 
     // Apply de-emphasis filter.
     for (unsigned i = 0; i < numberOfChannels; ++i) {
diff --git a/Source/WebCore/platform/audio/DynamicsCompressor.h b/Source/WebCore/platform/audio/DynamicsCompressor.h
index d949f3068..b35294d6a 100644
--- a/Source/WebCore/platform/audio/DynamicsCompressor.h
+++ b/Source/WebCore/platform/audio/DynamicsCompressor.h
@@ -48,7 +48,8 @@ class DynamicsCompressor {
 public:
     enum {
         ParamThreshold,
-        ParamHeadroom,
+        ParamKnee,
+        ParamRatio,
         ParamAttack,
         ParamRelease,
         ParamPreDelay,
@@ -61,6 +62,7 @@ public:
         ParamFilterStageRatio,
         ParamFilterAnchor,
         ParamEffectBlend,
+        ParamReduction,
         ParamLast
     };
 
@@ -70,6 +72,7 @@ public:
     void reset();
     void setNumberOfChannels(unsigned);
 
+    void setParameterValue(unsigned parameterID, float value);
     float parameterValue(unsigned parameterID);
 
     float sampleRate() const { return m_sampleRate; }
diff --git a/Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp b/Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp
index 3e943d120..9d4e30cfb 100644
--- a/Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp
+++ b/Source/WebCore/platform/audio/DynamicsCompressorKernel.cpp
@@ -45,25 +45,30 @@ using namespace AudioUtilities;
 
 // Metering hits peaks instantly, but releases this fast (in seconds).
 const float meteringReleaseTimeConstant = 0.325f;
-    
-// Exponential saturation curve.
-static float saturate(float x, float k)
-{
-    return 1 - exp(-k * x);
-}
+
+const float uninitializedValue = -1;
 
 DynamicsCompressorKernel::DynamicsCompressorKernel(float sampleRate, unsigned numberOfChannels)
     : m_sampleRate(sampleRate)
     , m_lastPreDelayFrames(DefaultPreDelayFrames)
     , m_preDelayReadIndex(0)
     , m_preDelayWriteIndex(DefaultPreDelayFrames)
+    , m_ratio(uninitializedValue)
+    , m_slope(uninitializedValue)
+    , m_linearThreshold(uninitializedValue)
+    , m_dbThreshold(uninitializedValue)
+    , m_dbKnee(uninitializedValue)
+    , m_kneeThreshold(uninitializedValue)
+    , m_kneeThresholdDb(uninitializedValue)
+    , m_ykneeThresholdDb(uninitializedValue)
+    , m_K(uninitializedValue)
 {
     setNumberOfChannels(numberOfChannels);
 
     // Initializes most member variables
     reset();
-    
-    m_meteringReleaseK = discreteTimeConstantForSampleRate(meteringReleaseTimeConstant, sampleRate);
+
+    m_meteringReleaseK = static_cast<float>(discreteTimeConstantForSampleRate(meteringReleaseTimeConstant, sampleRate));
 }
 
 void DynamicsCompressorKernel::setNumberOfChannels(unsigned numberOfChannels)
@@ -82,7 +87,7 @@ void DynamicsCompressorKernel::setPreDelayTime(float preDelayTime)
     unsigned preDelayFrames = preDelayTime * sampleRate();
     if (preDelayFrames > MaxPreDelayFrames - 1)
         preDelayFrames = MaxPreDelayFrames - 1;
-        
+
     if (m_lastPreDelayFrames != preDelayFrames) {
         m_lastPreDelayFrames = preDelayFrames;
         for (unsigned i = 0; i < m_preDelayBuffers.size(); ++i)
@@ -93,13 +98,117 @@ void DynamicsCompressorKernel::setPreDelayTime(float preDelayTime)
     }
 }
 
+// Exponential curve for the knee.
+// It is 1st derivative matched at m_linearThreshold and asymptotically approaches the value m_linearThreshold + 1 / k.
+float DynamicsCompressorKernel::kneeCurve(float x, float k)
+{
+    // Linear up to threshold.
+    if (x < m_linearThreshold)
+        return x;
+
+    return m_linearThreshold + (1 - expf(-k * (x - m_linearThreshold))) / k;
+}
+
+// Full compression curve with constant ratio after knee.
+float DynamicsCompressorKernel::saturate(float x, float k)
+{
+    float y;
+
+    if (x < m_kneeThreshold)
+        y = kneeCurve(x, k);
+    else {
+        // Constant ratio after knee.
+        float xDb = linearToDecibels(x);
+        float yDb = m_ykneeThresholdDb + m_slope * (xDb - m_kneeThresholdDb);
+
+        y = decibelsToLinear(yDb);
+    }
+
+    return y;
+}
+
+// Approximate 1st derivative with input and output expressed in dB.
+// This slope is equal to the inverse of the compression "ratio".
+// In other words, a compression ratio of 20 would be a slope of 1/20.
+float DynamicsCompressorKernel::slopeAt(float x, float k)
+{
+    if (x < m_linearThreshold)
+        return 1;
+
+    float x2 = x * 1.001;
+
+    float xDb = linearToDecibels(x);
+    float x2Db = linearToDecibels(x2);
+
+    float yDb = linearToDecibels(kneeCurve(x, k));
+    float y2Db = linearToDecibels(kneeCurve(x2, k));
+
+    float m = (y2Db - yDb) / (x2Db - xDb);
+
+    return m;
+}
+
+float DynamicsCompressorKernel::kAtSlope(float desiredSlope)
+{
+    float xDb = m_dbThreshold + m_dbKnee;
+    float x = decibelsToLinear(xDb);
+
+    // Approximate k given initial values.
+    float minK = 0.1;
+    float maxK = 10000;
+    float k = 5;
+
+    for (int i = 0; i < 15; ++i) {
+        // A high value for k will more quickly asymptotically approach a slope of 0.
+        float slope = slopeAt(x, k);
+
+        if (slope < desiredSlope) {
+            // k is too high.
+            maxK = k;
+        } else {
+            // k is too low.
+            minK = k;
+        }
+
+        // Re-calculate based on geometric mean.
+        k = sqrtf(minK * maxK);
+    }
+
+    return k;
+}
+
+float DynamicsCompressorKernel::updateStaticCurveParameters(float dbThreshold, float dbKnee, float ratio)
+{
+    if (dbThreshold != m_dbThreshold || dbKnee != m_dbKnee || ratio != m_ratio) {
+        // Threshold and knee.
+        m_dbThreshold = dbThreshold;
+        m_linearThreshold = decibelsToLinear(dbThreshold);
+        m_dbKnee = dbKnee;
+
+        // Compute knee parameters.
+        m_ratio = ratio;
+        m_slope = 1 / m_ratio;
+
+        float k = kAtSlope(1 / m_ratio);
+
+        m_kneeThresholdDb = dbThreshold + dbKnee;
+        m_kneeThreshold = decibelsToLinear(m_kneeThresholdDb);
+
+        m_ykneeThresholdDb = linearToDecibels(kneeCurve(m_kneeThreshold, k));
+
+        m_K = k;
+    }
+    return m_K;
+}
+
 void DynamicsCompressorKernel::process(float* sourceChannels[],
                                        float* destinationChannels[],
                                        unsigned numberOfChannels,
                                        unsigned framesToProcess,
 
                                        float dbThreshold,
-                                       float dbHeadroom,
+                                       float dbKnee,
+                                       float ratio,
                                        float attackTime,
                                        float releaseTime,
                                        float preDelayTime,
@@ -119,17 +228,12 @@ void DynamicsCompressorKernel::process(float* sourceChannels[],
     float dryMix = 1 - effectBlend;
     float wetMix = effectBlend;
 
-    // Threshold and headroom.
-    float linearThreshold = decibelsToLinear(dbThreshold);
-    float linearHeadroom = decibelsToLinear(dbHeadroom);
+    float k = updateStaticCurveParameters(dbThreshold, dbKnee, ratio);
 
     // Makeup gain.
-    float maximum = 1.05f * linearHeadroom * linearThreshold;
-    float kk = (maximum - linearThreshold);
-    float inverseKK = 1 / kk;
-
-    float fullRangeGain = (linearThreshold + kk * saturate(1 - linearThreshold, 1));
+    float fullRangeGain = saturate(1, k);
     float fullRangeMakeupGain = 1 / fullRangeGain;
+
     // Empirical/perceptual tuning.
     fullRangeMakeupGain = powf(fullRangeMakeupGain, 0.6f);
 
@@ -141,7 +245,7 @@ void DynamicsCompressorKernel::process(float* sourceChannels[],
 
     // Release parameters.
     float releaseFrames = sampleRate * releaseTime;
-    
+
     // Detector release time.
     float satReleaseTime = 0.0025f;
     float satReleaseFrames = satReleaseTime * sampleRate;
@@ -170,7 +274,7 @@ void DynamicsCompressorKernel::process(float* sourceChannels[],
     // y calculates adaptive release frames depending on the amount of compression.
 
     setPreDelayTime(preDelayTime);
-    
+
     const int nDivisionFrames = 32;
 
     const int nDivisions = framesToProcess / nDivisionFrames;
@@ -285,9 +389,10 @@ void DynamicsCompressorKernel::process(float* sourceChannels[],
                 float absInput = scaledInput > 0 ? scaledInput : -scaledInput;
 
                 // Put through shaping curve.
-                // This is linear up to the threshold, then exponentially approaches the maximum (headroom amount above threshold).
-                // The transition from the threshold to the exponential portion is smooth (1st derivative matched).
-                float shapedInput = absInput < linearThreshold ? absInput : linearThreshold + kk * saturate(absInput - linearThreshold, inverseKK);
+                // This is linear up to the threshold, then enters a "knee" portion followed by the "ratio" portion.
+                // The transition from the threshold to the knee is smooth (1st derivative matched).
+                // The transition from the knee to the ratio portion is smooth (1st derivative matched).
+                float shapedInput = saturate(absInput, k);
 
                 float attenuation = absInput <= 0.0001f ? 1 : shapedInput / absInput;
 
diff --git a/Source/WebCore/platform/audio/DynamicsCompressorKernel.h b/Source/WebCore/platform/audio/DynamicsCompressorKernel.h
index da8e4c8be..645425104 100644
--- a/Source/WebCore/platform/audio/DynamicsCompressorKernel.h
+++ b/Source/WebCore/platform/audio/DynamicsCompressorKernel.h
@@ -49,7 +49,8 @@ public:
                  unsigned framesToProcess,
 
                  float dbThreshold,
-                 float dbHeadroom,
+                 float dbKnee,
+                 float ratio,
                  float attackTime,
                  float releaseTime,
                  float preDelayTime,
@@ -68,6 +69,8 @@ public:
 
     float sampleRate() const { return m_sampleRate; }
 
+    float meteringGain() const { return m_meteringGain; }
+
 protected:
     float m_sampleRate;
 
@@ -90,6 +93,35 @@ protected:
     int m_preDelayWriteIndex;
 
     float m_maxAttackCompressionDiffDb;
+
+    // Static compression curve.
+    float kneeCurve(float x, float k);
+    float saturate(float x, float k);
+    float slopeAt(float x, float k);
+    float kAtSlope(float desiredSlope);
+
+    float updateStaticCurveParameters(float dbThreshold, float dbKnee, float ratio);
+
+    // Amount of input change in dB required for 1 dB of output change.
+    // This applies to the portion of the curve above m_kneeThresholdDb (see below).
+    float m_ratio;
+    float m_slope; // Inverse ratio.
+
+    // The input to output change below the threshold is linear 1:1.
+    float m_linearThreshold;
+    float m_dbThreshold;
+
+    // m_dbKnee is the number of dB above the threshold before we enter the "ratio" portion of the curve.
+    // m_kneeThresholdDb = m_dbThreshold + m_dbKnee
+    // The portion between m_dbThreshold and m_kneeThresholdDb is the "soft knee" portion of the curve
+    // which transitions smoothly from the linear portion to the ratio portion.
+    float m_dbKnee;
+    float m_kneeThreshold;
+    float m_kneeThresholdDb;
+    float m_ykneeThresholdDb;
+
+    // Internal parameter for the knee portion of the curve.
+    float m_K;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/audio/VectorMath.cpp b/Source/WebCore/platform/audio/VectorMath.cpp
index 5693c1b89..60be4e0c1 100644
--- a/Source/WebCore/platform/audio/VectorMath.cpp
+++ b/Source/WebCore/platform/audio/VectorMath.cpp
@@ -117,7 +117,7 @@ void vsma(const float* sourceP, int sourceStride, const float* scale, float* des
     if ((sourceStride == 1) && (destStride == 1)) {
         float k = *scale;
 
-        // If the sourceP address is not 16-byte aligned, the first several frames (at most three) should be processed seperately.
+        // If the sourceP address is not 16-byte aligned, the first several frames (at most three) should be processed separately.
         while ((reinterpret_cast<uintptr_t>(sourceP) & 0x0F) && n) {
             *destP += k * *sourceP;
             sourceP++;
@@ -125,9 +125,9 @@ void vsma(const float* sourceP, int sourceStride, const float* scale, float* des
             n--;
         }
 
-        // Now the sourceP address aligned and start to apply SSE.
+        // Now the sourceP is aligned, use SSE.
         int tailFrames = n % 4;
-        float* endP = destP + n - tailFrames;
+        const float* endP = destP + n - tailFrames;
 
         __m128 pSource;
         __m128 dest;
@@ -172,7 +172,7 @@ void vsmul(const float* sourceP, int sourceStride, const float* scale, float* de
         int n = framesToProcess;
         float k = *scale;
 
-        // If the sourceP address is not 16-byte aligned, the first several frames (at most three) should be processed seperately.
+        // If the sourceP address is not 16-byte aligned, the first several frames (at most three) should be processed separately.
         while ((reinterpret_cast<size_t>(sourceP) & 0x0F) && n) {
             *destP = k * *sourceP;
             sourceP++;
@@ -237,7 +237,7 @@ void vadd(const float* source1P, int sourceStride1, const float* source2P, int s
 
         int n = framesToProcess;
 
-        // If the sourceP address is not 16-byte aligned, the first several frames (at most three) should be processed seperately.
+        // If the sourceP address is not 16-byte aligned, the first several frames (at most three) should be processed separately.
         while ((reinterpret_cast<size_t>(source1P) & 0x0F) && n) {
             *destP = *source1P + *source2P;
             source1P++;
@@ -335,8 +335,7 @@ void vmul(const float* source1P, int sourceStride1, const float* source2P, int s
 
 #ifdef __SSE2__
     if ((sourceStride1 == 1) && (sourceStride2 == 1) && (destStride == 1)) {
-
-        // If the source1P address is not 16-byte aligned, the first several frames (at most three) should be processed seperately.
+        // If the source1P address is not 16-byte aligned, the first several frames (at most three) should be processed separately.
         while ((reinterpret_cast<uintptr_t>(source1P) & 0x0F) && n) {
             *destP = *source1P * *source2P;
             source1P++;
@@ -347,7 +346,7 @@ void vmul(const float* source1P, int sourceStride1, const float* source2P, int s
 
         // Now the source1P address aligned and start to apply SSE.
         int tailFrames = n % 4;
-        float* endP = destP + n - tailFrames;
+        const float* endP = destP + n - tailFrames;
         __m128 pSource1;
         __m128 pSource2;
         __m128 dest;
@@ -430,9 +429,40 @@ void zvmul(const float* real1P, const float* imag1P, const float* real2P, const
 
 void vsvesq(const float* sourceP, int sourceStride, float* sumP, size_t framesToProcess)
 {
-    // FIXME: optimize for SSE
     int n = framesToProcess;
     float sum = 0;
+
+#ifdef __SSE2__ 
+    if (sourceStride == 1) { 
+        // If the sourceP address is not 16-byte aligned, the first several frames (at most three) should be processed separately. 
+        while ((reinterpret_cast<uintptr_t>(sourceP) & 0x0F) && n) { 
+            float sample = *sourceP; 
+            sum += sample * sample; 
+            sourceP++; 
+            n--; 
+        } 
+ 
+        // Now the sourceP is aligned, use SSE.
+        int tailFrames = n % 4; 
+        const float* endP = sourceP + n - tailFrames; 
+        __m128 source; 
+        __m128 mSum = _mm_setzero_ps(); 
+ 
+        while (sourceP < endP) { 
+            source = _mm_load_ps(sourceP); 
+            source = _mm_mul_ps(source, source); 
+            mSum = _mm_add_ps(mSum, source); 
+            sourceP += 4; 
+        } 
+ 
+        // Summarize the SSE results. 
+        const float* groupSumP = reinterpret_cast<float*>(&mSum); 
+        sum += groupSumP[0] + groupSumP[1] + groupSumP[2] + groupSumP[3]; 
+ 
+        n = tailFrames; 
+    } 
+#endif
+
     while (n--) {
         float sample = *sourceP;
         sum += sample * sample;
@@ -445,9 +475,45 @@ void vsvesq(const float* sourceP, int sourceStride, float* sumP, size_t framesTo
 
 void vmaxmgv(const float* sourceP, int sourceStride, float* maxP, size_t framesToProcess)
 {
-    // FIXME: optimize for SSE
     int n = framesToProcess;
     float max = 0;
+
+#ifdef __SSE2__
+    if (sourceStride == 1) {
+        // If the sourceP address is not 16-byte aligned, the first several frames (at most three) should be processed separately.
+        while ((reinterpret_cast<uintptr_t>(sourceP) & 0x0F) && n) {
+            max = std::max(max, fabsf(*sourceP));
+            sourceP++;
+            n--;
+        }
+
+        // Now the sourceP is aligned, use SSE.
+        int tailFrames = n % 4;
+        const float* endP = sourceP + n - tailFrames;
+        __m128 source;
+        __m128 mMax = _mm_setzero_ps();
+        int mask = 0x7FFFFFFF;
+        __m128 mMask = _mm_set1_ps(*reinterpret_cast<float*>(&mask));
+
+        while (sourceP < endP) {
+            source = _mm_load_ps(sourceP);
+            // Calculate the absolute value by anding source with mask, the sign bit is set to 0.
+            source = _mm_and_ps(source, mMask);
+            mMax = _mm_max_ps(mMax, source);
+            sourceP += 4;
+        }
+
+        // Get max from the SSE results.
+        const float* groupMaxP = reinterpret_cast<float*>(&mMax);
+        max = std::max(max, groupMaxP[0]);
+        max = std::max(max, groupMaxP[1]);
+        max = std::max(max, groupMaxP[2]);
+        max = std::max(max, groupMaxP[3]);
+
+        n = tailFrames;
+    }
+#endif
+
     while (n--) {
         max = std::max(max, fabsf(*sourceP));
         sourceP += sourceStride;
diff --git a/Source/WebCore/platform/blackberry/ClipboardBlackBerry.cpp b/Source/WebCore/platform/blackberry/ClipboardBlackBerry.cpp
index b224d5cb0..66b7710d1 100644
--- a/Source/WebCore/platform/blackberry/ClipboardBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/ClipboardBlackBerry.cpp
@@ -19,7 +19,6 @@
 #include "config.h"
 #include "ClipboardBlackBerry.h"
 
-#include "DOMStringList.h"
 #include "FileList.h"
 #include "NotImplemented.h"
 
@@ -56,9 +55,8 @@ void ClipboardBlackBerry::clearAllData()
     BlackBerry::Platform::Clipboard::clearClipboard();
 }
 
-String ClipboardBlackBerry::getData(const String& type, bool& success) const
+String ClipboardBlackBerry::getData(const String& type) const
 {
-    success = true;
     return String::fromUTF8(BlackBerry::Platform::Clipboard::readClipboardByType(type.utf8().data()).c_str());
 }
 
@@ -73,14 +71,14 @@ bool ClipboardBlackBerry::setData(const String& type, const String& text)
     return true;
 }
 
-PassRefPtr<DOMStringList> ClipboardBlackBerry::types() const
+HashSet<String> ClipboardBlackBerry::types() const
 {
     // We use hardcoded list here since there seems to be no API to get the list.
-    RefPtr<DOMStringList> ret = DOMStringList::create();
-    ret->append("text/plain");
-    ret->append("text/html");
-    ret->append("text/url");
-    return ret.release();
+    HashSet<String> ret;
+    ret.add("text/plain");
+    ret.add("text/html");
+    ret.add("text/url");
+    return ret;
 }
 
 PassRefPtr<FileList> ClipboardBlackBerry::files() const
diff --git a/Source/WebCore/platform/blackberry/ClipboardBlackBerry.h b/Source/WebCore/platform/blackberry/ClipboardBlackBerry.h
index 255d6aa28..fed1627e0 100644
--- a/Source/WebCore/platform/blackberry/ClipboardBlackBerry.h
+++ b/Source/WebCore/platform/blackberry/ClipboardBlackBerry.h
@@ -32,11 +32,11 @@ public:
 
     void clearData(const String& type);
     void clearAllData();
-    String getData(const String& type, bool& success) const;
+    String getData(const String& type) const;
     bool setData(const String& type, const String& data);
 
     // extensions beyond IE's API
-    virtual PassRefPtr<DOMStringList> types() const;
+    virtual HashSet<String> types() const;
     virtual PassRefPtr<FileList> files() const;
     virtual DragImageRef createDragImage(IntPoint&) const;
     virtual void declareAndWriteDragImage(Element*, const KURL&, const String& title, Frame*);
diff --git a/Source/WebCore/platform/blackberry/CookieManager.cpp b/Source/WebCore/platform/blackberry/CookieManager.cpp
index d79380fd9..34b9ff05f 100644
--- a/Source/WebCore/platform/blackberry/CookieManager.cpp
+++ b/Source/WebCore/platform/blackberry/CookieManager.cpp
@@ -120,7 +120,7 @@ CookieManager::~CookieManager()
 static bool cookieSorter(ParsedCookie* a, ParsedCookie* b)
 {
     if (a->path().length() == b->path().length())
-        return a->creationTime() <= b->creationTime();
+        return a->creationTime() < b->creationTime();
     return a->path().length() > b->path().length();
 }
 
@@ -218,6 +218,41 @@ String CookieManager::getCookie(const KURL& url, CookieFilter filter) const
     return cookieStringBuilder.toString();
 }
 
+String CookieManager::generateHtmlFragmentForCookies()
+{
+    CookieLog("CookieManager - generateHtmlFragmentForCookies\n");
+
+    Vector<ParsedCookie*> cookieCandidates;
+    for (HashMap<String, CookieMap*>::iterator it = m_managerMap.begin(); it != m_managerMap.end(); ++it)
+        it->second->getAllChildCookies(&cookieCandidates);
+
+    String result;
+    ParsedCookie* cookie = 0;
+    result.append(String("<table style=\"word-wrap:break-word\" cellSpacing=\"0\" cellPadding=\"0\" border=\"1\"><tr><th>Domain</th><th>Path</th><th>Protocol</th><th>Name</th><th>Value</th><th>Secure</th><th>HttpOnly</th><th>Session</th></tr>"));
+    for (size_t i = 0; i < cookieCandidates.size(); ++i) {
+        cookie = cookieCandidates[i];
+        result.append(String("<tr><td align=\"center\">"));
+        result.append(cookie->domain());
+        result.append(String("<td align=\"center\">"));
+        result.append(cookie->path());
+        result.append(String("<td align=\"center\">"));
+        result.append(cookie->protocol());
+        result.append(String("<td align=\"center\">"));
+        result.append(cookie->name());
+        result.append(String("<td align=\"center\" style= \"word-break:break-all\">"));
+        result.append(cookie->value());
+        result.append(String("<td align=\"center\">"));
+        result.append(String(cookie->isSecure() ? "Yes" : "No"));
+        result.append(String("<td align=\"center\">"));
+        result.append(String(cookie->isHttpOnly() ? "Yes" : "No"));
+        result.append(String("<td align=\"center\">"));
+        result.append(String(cookie->isSession() ? "Yes" : "No"));
+        result.append(String("</td></tr>"));
+    }
+    result.append(String("</table>"));
+    return result;
+}
+
 void CookieManager::getRawCookies(Vector<ParsedCookie*> &stackOfCookies, const KURL& requestURL, CookieFilter filter) const
 {
     CookieLog("CookieManager - getRawCookies - processing url with domain - %s & protocol: %s & path: %s\n", requestURL.host().utf8().data(), requestURL.protocol().utf8().data(), requestURL.path().utf8().data());
@@ -300,7 +335,7 @@ void CookieManager::getRawCookies(Vector<ParsedCookie*> &stackOfCookies, const K
         }
     }
 
-    std::sort(stackOfCookies.begin(), stackOfCookies.end(), cookieSorter);
+    std::stable_sort(stackOfCookies.begin(), stackOfCookies.end(), cookieSorter);
 }
 
 void CookieManager::removeAllCookies(BackingStoreRemovalPolicy backingStoreRemoval)
@@ -370,32 +405,59 @@ void CookieManager::checkAndTreatCookie(ParsedCookie* candidateCookie, BackingSt
         if (postToBackingStore == BackingStoreCookieEntry)
             m_cookieBackingStore->remove(candidateCookie);
         else if (curMap) {
-            bool cookieAlreadyExists = curMap->existsCookie(candidateCookie);
-            if (cookieAlreadyExists) {
-                CookieLog("CookieManager - expired cookie exists in memory");
-                ParsedCookie* expired = curMap->removeCookie(candidateCookie);
-                // Cookie is useless, Remove the cookie from the backingstore if it exists
-                // Backup check for BackingStoreCookieEntry incase someone incorrectly uses this enum
-                if (postToBackingStore != BackingStoreCookieEntry && !expired->isSession()) {
-                    CookieLog("CookieManager - expired cookie is nonsession, deleting from db");
-                    m_cookieBackingStore->remove(expired);
-                }
-                delete expired;
+            // RemoveCookie will return 0 if the cookie doesn't exist.
+            ParsedCookie* expired = curMap->removeCookie(candidateCookie);
+            // Cookie is useless, Remove the cookie from the backingstore if it exists.
+            // Backup check for BackingStoreCookieEntry incase someone incorrectly uses this enum.
+            if (expired && postToBackingStore != BackingStoreCookieEntry && !expired->isSession()) {
+                CookieLog("CookieManager - expired cookie is nonsession, deleting from db");
+                m_cookieBackingStore->remove(expired);
             }
+            delete expired;
+
         } else
             delete candidateCookie;
     } else {
         ASSERT(curMap);
-        bool cookieAlreadyExists = curMap->existsCookie(candidateCookie);
-        if (cookieAlreadyExists)
-            update(curMap, candidateCookie, postToBackingStore);
-        else
-            addCookieToMap(curMap, candidateCookie, postToBackingStore);
+        addCookieToMap(curMap, candidateCookie, postToBackingStore);
     }
 }
 
 void CookieManager::addCookieToMap(CookieMap* targetMap, ParsedCookie* candidateCookie, BackingStoreRemovalPolicy postToBackingStore)
 {
+    ParsedCookie* prevCookie = targetMap->addOrReplaceCookie(candidateCookie);
+    if (prevCookie) {
+
+        CookieLog("CookieManager - updating new cookie - %s.\n", candidateCookie->toString().utf8().data());
+
+        // A cookie was replaced in targetMap.
+        // If old cookie is non-session and new one is, we have to delete it from backingstore
+        // If new cookie is non-session and old one is, we have to add it to backingstore
+        // If both sessions are non-session, then we update it in the backingstore
+        bool newIsSession = candidateCookie->isSession();
+        bool oldIsSession = prevCookie->isSession();
+
+        if (postToBackingStore == RemoveFromBackingStore) {
+            if (!newIsSession && !oldIsSession)
+                m_cookieBackingStore->update(candidateCookie);
+            else if (newIsSession && !oldIsSession) {
+                // Must manually decrease the counter because it was not counted when
+                // the cookie was removed in cookieVector.
+                removedCookie();
+                m_cookieBackingStore->remove(prevCookie);
+            } else if (!newIsSession && oldIsSession) {
+                // Must manually increase the counter because it was not counted when
+                // the cookie was added in cookieVector.
+                addedCookie();
+                m_cookieBackingStore->insert(candidateCookie);
+            }
+        }
+        delete prevCookie;
+        return;
+    }
+
+    CookieLog("CookieManager - adding new cookie - %s.\n", candidateCookie->toString().utf8().data());
+
     ParsedCookie* oldestCookie = 0;
     // Check if we have not reached the per cookie domain limit.
     // If that is not true, we check if the global limit has been reached if backingstore mode is on
@@ -408,18 +470,14 @@ void CookieManager::addCookieToMap(CookieMap* targetMap, ParsedCookie* candidate
     //    then it means the global count will never exceed the limit
 
     CookieLimitLog("CookieManager - local count: %d  global count: %d", targetMap->count(), m_count);
-    if (targetMap->count() >= s_maxCookieCountPerHost) {
+    if (targetMap->count() > s_maxCookieCountPerHost) {
         CookieLog("CookieManager - deleting oldest cookie from this map due to domain count.\n");
         oldestCookie = targetMap->removeOldestCookie();
-    } else if (m_count >= s_globalMaxCookieCount && (postToBackingStore != DoNotRemoveFromBackingStore)) {
+    } else if (m_count > s_globalMaxCookieCount && (postToBackingStore != DoNotRemoveFromBackingStore)) {
         CookieLimitLog("CookieManager - Global limit reached, initiate cookie limit clean up.");
         initiateCookieLimitCleanUp();
     }
 
-    CookieLog("CookieManager - adding new cookie - %s.\n", candidateCookie->toString().utf8().data());
-
-    targetMap->addCookie(candidateCookie);
-
     // Only add non session cookie to the backing store.
     if (postToBackingStore == RemoveFromBackingStore) {
         if (oldestCookie && !oldestCookie->isSession()) {
@@ -433,38 +491,6 @@ void CookieManager::addCookieToMap(CookieMap* targetMap, ParsedCookie* candidate
         delete oldestCookie;
 }
 
-void CookieManager::update(CookieMap* targetMap, ParsedCookie* newCookie, BackingStoreRemovalPolicy postToBackingStore)
-{
-    // If old cookie is non-session and new one is, we have to delete it from backingstore
-    // If new cookie is non-session and old one is, we have to add it to backingstore
-    // If both sessions are non-session, then we update it in the backingstore
-
-    CookieLog("CookieManager - updating new cookie - %s.\n", newCookie->toString().utf8().data());
-
-    ParsedCookie* oldCookie = targetMap->updateCookie(newCookie);
-
-    ASSERT(oldCookie);
-
-    if (postToBackingStore == RemoveFromBackingStore) {
-        bool newIsSession = newCookie->isSession();
-        bool oldIsSession = oldCookie->isSession();
-        if (!newIsSession && !oldIsSession)
-            m_cookieBackingStore->update(newCookie);
-        else if (newIsSession && !oldIsSession) {
-            // Must manually decrease the counter because it was not counted when
-            // the cookie was removed in cookieMap.
-            removedCookie();
-            m_cookieBackingStore->remove(oldCookie);
-        } else if (!newIsSession && oldIsSession) {
-            // Must manually increase the counter because it was not counted when
-            // the cookie was added in cookieMap.
-            addedCookie();
-            m_cookieBackingStore->insert(newCookie);
-        }
-    }
-    delete oldCookie;
-}
-
 void CookieManager::getBackingStoreCookies()
 {
     // This method should be called just after having created the cookieManager
diff --git a/Source/WebCore/platform/blackberry/CookieManager.h b/Source/WebCore/platform/blackberry/CookieManager.h
index b97b9f962..4dcd3f477 100644
--- a/Source/WebCore/platform/blackberry/CookieManager.h
+++ b/Source/WebCore/platform/blackberry/CookieManager.h
@@ -103,6 +103,7 @@ public:
     CookieStorageAcceptPolicy cookiePolicy() const { return m_policy; }
     void setPrivateMode(const bool);
 
+    String generateHtmlFragmentForCookies();
     String getCookie(const KURL& requestURL, CookieFilter) const;
 
     // Returns all cookies that are associated with the specified URL as raw cookies.
@@ -120,8 +121,7 @@ private:
 
     bool shouldRejectForSecurityReason(const ParsedCookie*, const KURL&);
 
-    void addCookieToMap(CookieMap*, ParsedCookie*, BackingStoreRemovalPolicy);
-    void update(CookieMap*, ParsedCookie*, BackingStoreRemovalPolicy);
+    void addCookieToMap(CookieMap* targetMap, ParsedCookie* candidateCookie, BackingStoreRemovalPolicy postToBackingStore);
 
     CookieMap* findOrCreateCookieMap(CookieMap* protocolMap, const String& domain, bool findOnly);
 
diff --git a/Source/WebCore/platform/blackberry/CookieMap.cpp b/Source/WebCore/platform/blackberry/CookieMap.cpp
index 4c6d541ad..b217b2e48 100644
--- a/Source/WebCore/platform/blackberry/CookieMap.cpp
+++ b/Source/WebCore/platform/blackberry/CookieMap.cpp
@@ -54,45 +54,35 @@ CookieMap::~CookieMap()
     deleteAllCookiesAndDomains();
 }
 
-bool CookieMap::existsCookie(const ParsedCookie* cookie) const
+ParsedCookie* CookieMap::addOrReplaceCookie(ParsedCookie* cookie)
 {
-    String key = cookie->name() + cookie->path();
-    return m_cookieMap.contains(key);
-}
-
-void CookieMap::addCookie(ParsedCookie* cookie)
-{
-    String key = cookie->name() + cookie->path();
-
     CookieLog("CookieMap - Attempting to add cookie - %s", cookie->name().utf8().data());
 
-    ASSERT(!m_cookieMap.contains(key));
-    m_cookieMap.add(key, cookie);
+    ParsedCookie* prevCookie = 0;
+    size_t cookieCount = m_cookieVector.size();
+    for (size_t i = 0; i < cookieCount; i++) {
+        if (m_cookieVector[i]->name() == cookie->name() && m_cookieVector[i]->path() == cookie->path()) {
+            prevCookie = m_cookieVector[i];
+            m_cookieVector[i] = cookie;
+            if (prevCookie == m_oldestCookie)
+                updateOldestCookie();
+            return prevCookie;
+        }
+    }
+
+    m_cookieVector.append(cookie);
     if (!cookie->isSession())
         cookieManager().addedCookie();
     if (!m_oldestCookie || m_oldestCookie->lastAccessed() > cookie->lastAccessed())
         m_oldestCookie = cookie;
+    return 0;
 }
 
-ParsedCookie* CookieMap::updateCookie(ParsedCookie* newCookie)
-{
-    String key = newCookie->name() + newCookie->path();
-    ParsedCookie* oldCookie = m_cookieMap.take(key);
-    ASSERT(oldCookie);
-    m_cookieMap.add(key, newCookie);
-    if (oldCookie == m_oldestCookie)
-        updateOldestCookie();
-    return oldCookie;
-}
-
-ParsedCookie* CookieMap::removeCookie(const ParsedCookie* cookie)
+ParsedCookie* CookieMap::removeCookieAtIndex(int position, const ParsedCookie* cookie)
 {
-    // Find a previous entry for deletion
-    String key = cookie->name() + cookie->path();
-    ParsedCookie* prevCookie = m_cookieMap.take(key);
-
-    if (!prevCookie)
-        return 0;
+    ASSERT(0 <= position && position < m_cookieVector.size());
+    ParsedCookie* prevCookie = m_cookieVector[position];
+    m_cookieVector.remove(position);
 
     if (prevCookie == m_oldestCookie)
         updateOldestCookie();
@@ -109,6 +99,16 @@ ParsedCookie* CookieMap::removeCookie(const ParsedCookie* cookie)
     return prevCookie;
 }
 
+ParsedCookie* CookieMap::removeCookie(const ParsedCookie* cookie)
+{
+    size_t cookieCount = m_cookieVector.size();
+    for (size_t position = 0; position < cookieCount; ++position) {
+        if (m_cookieVector[position]->name() == cookie->name() && m_cookieVector[position]->path() == cookie->path())
+            return removeCookieAtIndex(position, cookie);
+    }
+    return 0;
+}
+
 CookieMap* CookieMap::getSubdomainMap(const String& subdomain)
 {
 #if ENABLE_COOKIE_DEBUG
@@ -126,19 +126,22 @@ void CookieMap::addSubdomainMap(const String& subdomain, CookieMap* newDomain)
 
 void CookieMap::getAllCookies(Vector<ParsedCookie*>* stackOfCookies)
 {
-    CookieLog("CookieMap - Attempting to copy Map:%s cookies with %d cookies into vectors", m_name.utf8().data(), m_cookieMap.size());
+    CookieLog("CookieMap - Attempting to copy Map:%s cookies with %d cookies into vectors", m_name.utf8().data(), m_cookieVector.size());
+
+    stackOfCookies->reserveCapacity(stackOfCookies->size() + m_cookieVector.size());
 
-    Vector<ParsedCookie*> newCookies;
-    copyValuesToVector(m_cookieMap, newCookies);
-    for (size_t i = 0; i < newCookies.size(); i++) {
-        ParsedCookie* newCookie = newCookies[i];
+    size_t position = 0;
+    while (position < m_cookieVector.size()) {
+        ParsedCookie* newCookie = m_cookieVector[position];
         if (newCookie->hasExpired()) {
             // Notice that we don't delete from backingstore. These expired cookies will be
             // deleted when manager loads the backingstore again.
-            ParsedCookie* expired = removeCookie(newCookie);
+            ParsedCookie* expired = removeCookieAtIndex(position, newCookie);
             delete expired;
-        } else
+        } else {
             stackOfCookies->append(newCookie);
+            position++;
+        }
     }
 
     CookieLog("CookieMap - stack of cookies now have %d cookies in it", (*stackOfCookies).size());
@@ -177,15 +180,16 @@ ParsedCookie* CookieMap::removeOldestCookie()
 
 void CookieMap::updateOldestCookie()
 {
-    if (!m_cookieMap.size())
+    size_t size = m_cookieVector.size();
+    if (!size) {
         m_oldestCookie = 0;
-    else {
-        HashMap<String, ParsedCookie*>::iterator it = m_cookieMap.begin();
-        m_oldestCookie = it->second;
-        ++it;
-        for (; it != m_cookieMap.end(); ++it)
-            if (m_oldestCookie->lastAccessed() > it->second->lastAccessed())
-                m_oldestCookie = it->second;
+        return;
+    }
+
+    m_oldestCookie = m_cookieVector[0];
+    for (size_t i = 1; i < size; ++i) {
+        if (m_oldestCookie->lastAccessed() > m_cookieVector[i]->lastAccessed())
+            m_oldestCookie = m_cookieVector[i];
     }
 }
 
@@ -193,8 +197,8 @@ void CookieMap::deleteAllCookiesAndDomains()
 {
     deleteAllValues(m_subdomains);
     m_subdomains.clear();
-    deleteAllValues(m_cookieMap);
-    m_cookieMap.clear();
+    deleteAllValues(m_cookieVector);
+    m_cookieVector.clear();
 
     m_oldestCookie = 0;
 }
diff --git a/Source/WebCore/platform/blackberry/CookieMap.h b/Source/WebCore/platform/blackberry/CookieMap.h
index 73ba13fac..86968576d 100644
--- a/Source/WebCore/platform/blackberry/CookieMap.h
+++ b/Source/WebCore/platform/blackberry/CookieMap.h
@@ -51,17 +51,14 @@ public:
     CookieMap(const String& name = "");
     ~CookieMap();
 
-    unsigned int count() const { return m_cookieMap.size(); }
+    unsigned int count() const { return m_cookieVector.size(); }
     const String& getName() const { return m_name; }
 
-    void addCookie(ParsedCookie*);
-
     // Returning the original cookie object so manager can keep a reference to the updates in the database queue.
-    ParsedCookie* updateCookie(ParsedCookie*);
+    ParsedCookie* addOrReplaceCookie(ParsedCookie*);
 
     // Need to return the reference to the removed cookie so manager can deal with it (garbage collect).
     ParsedCookie* removeCookie(const ParsedCookie*);
-    bool existsCookie(const ParsedCookie*) const;
 
     // Returns a map with that given subdomain.
     CookieMap* getSubdomainMap(const String&);
@@ -74,11 +71,9 @@ public:
 
 private:
     void updateOldestCookie();
+    ParsedCookie* removeCookieAtIndex(int position, const ParsedCookie*);
 
-    // The key is the tuple (name, path).
-    // The spec asks to have also domain, which is implied by choosing the CookieMap relevant to the domain.
-    HashMap<String, ParsedCookie*> m_cookieMap;
-
+    Vector<ParsedCookie*> m_cookieVector;
     // The key is a subsection of the domain.
     // ex: if inserting accounts.google.com & this cookiemap is "com", this subdomain map will contain "google"
     // the "google" cookiemap will contain "accounts" in its subdomain map.
diff --git a/Source/WebCore/platform/blackberry/LocalizedStringsBlackBerry.cpp b/Source/WebCore/platform/blackberry/LocalizedStringsBlackBerry.cpp
index a93e38109..7f5bef726 100644
--- a/Source/WebCore/platform/blackberry/LocalizedStringsBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/LocalizedStringsBlackBerry.cpp
@@ -21,6 +21,7 @@
 
 #include "IntSize.h"
 #include "NotImplemented.h"
+#include "PlatformString.h"
 #include <BlackBerryPlatformClient.h>
 #include <LocalizeResource.h>
 #include <wtf/Vector.h>
@@ -56,8 +57,7 @@ String submitButtonDefaultLabel()
 
 String inputElementAltText()
 {
-    notImplemented();
-    return String();
+    return String::fromUTF8(s_resource.getString(BlackBerry::Platform::SUBMIT_BUTTON_LABEL));
 }
 
 static String platformLanguage()
@@ -369,10 +369,9 @@ String searchMenuClearRecentSearchesText()
     return String();
 }
 
-String imageTitle(String const&, IntSize const&)
+String imageTitle(String const& filename, IntSize const& size)
 {
-    notImplemented();
-    return String();
+    return filename + " (" + String::number(size.width()) + "x" + String::number(size.height()) + ")";
 }
 
 String AXButtonActionVerb()
@@ -577,4 +576,9 @@ String defaultDetailsSummaryText()
     return String::fromUTF8(s_resource.getString(BlackBerry::Platform::DETAILS_SUMMARY));
 }
 
+String fileButtonNoFilesSelectedLabel()
+{
+    return String::fromUTF8(s_resource.getString(BlackBerry::Platform::FILE_BUTTON_NO_FILE_SELECTED_LABEL));
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/MIMETypeRegistryBlackBerry.cpp b/Source/WebCore/platform/blackberry/MIMETypeRegistryBlackBerry.cpp
index ba48f1cc6..71e48d01a 100644
--- a/Source/WebCore/platform/blackberry/MIMETypeRegistryBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/MIMETypeRegistryBlackBerry.cpp
@@ -97,6 +97,9 @@ static const ExtensionMap extensionMap[] = {
     { "m3u8", "application/vnd.apple.mpegurl" },
     { "m3url", "audio/mpegurl" },
     { "m3u", "audio/mpegurl" },
+    { "flac", "audio/x-flac" },
+    { "ogg", "audio/ogg" },
+    { "oga", "audio/ogg" },
     // FIXME: wince also maps ttf and otf to text/plain. Should we do that too?
     { 0, 0 }
 };
diff --git a/Source/WebCore/platform/blackberry/PasteboardBlackBerry.cpp b/Source/WebCore/platform/blackberry/PasteboardBlackBerry.cpp
index 9365a6c43..98a420592 100644
--- a/Source/WebCore/platform/blackberry/PasteboardBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/PasteboardBlackBerry.cpp
@@ -56,6 +56,11 @@ void Pasteboard::writeImage(Node*, KURL const&, String const&)
     notImplemented();
 }
 
+void Pasteboard::writeClipboard(Clipboard*)
+{
+    notImplemented();
+}
+
 void Pasteboard::writeSelection(Range* selectedRange, bool, Frame* frame)
 {
     std::string text = frame->editor()->selectedText().utf8().data();
diff --git a/Source/WebCore/platform/blackberry/PlatformScreenBlackBerry.cpp b/Source/WebCore/platform/blackberry/PlatformScreenBlackBerry.cpp
index d26e55664..5ccc2aa39 100644
--- a/Source/WebCore/platform/blackberry/PlatformScreenBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/PlatformScreenBlackBerry.cpp
@@ -43,12 +43,12 @@ int screenDepth(Widget*)
 
 FloatRect screenAvailableRect(Widget* widget)
 {
-    return FloatRect(FloatPoint(), FloatSize(IntSize(BlackBerry::Platform::Graphics::Screen::size())));
+    return FloatRect(FloatPoint(), FloatSize(IntSize(BlackBerry::Platform::Graphics::Screen::primaryScreen()->size())));
 }
 
 FloatRect screenRect(Widget* widget)
 {
-    return FloatRect(FloatPoint(), FloatSize(IntSize(BlackBerry::Platform::Graphics::Screen::size())));
+    return FloatRect(FloatPoint(), FloatSize(IntSize(BlackBerry::Platform::Graphics::Screen::primaryScreen()->size())));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/blackberry/PlatformTouchEventBlackBerry.cpp b/Source/WebCore/platform/blackberry/PlatformTouchEventBlackBerry.cpp
index 3e79d1032..5f5dbbcb2 100644
--- a/Source/WebCore/platform/blackberry/PlatformTouchEventBlackBerry.cpp
+++ b/Source/WebCore/platform/blackberry/PlatformTouchEventBlackBerry.cpp
@@ -40,6 +40,11 @@ static PlatformEvent::Type touchEventType(BlackBerry::Platform::TouchEvent* even
     case BlackBerry::Platform::TouchEvent::TouchCancel:
         return PlatformEvent::TouchCancel;
     }
+
+    ASSERT_NOT_REACHED();
+    // Returning TouchCancel just to satisfy the compiler's wish to return a valid type in a non-void function.
+    // This code should not be reached.
+    return PlatformEvent::TouchCancel;
 }
 
 PlatformTouchEvent::PlatformTouchEvent(BlackBerry::Platform::TouchEvent* event)
diff --git a/Source/WebCore/platform/blackberry/RunLoopBlackBerry.cpp b/Source/WebCore/platform/blackberry/RunLoopBlackBerry.cpp
new file mode 100644
index 000000000..e820788d6
--- /dev/null
+++ b/Source/WebCore/platform/blackberry/RunLoopBlackBerry.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 ProFUSION embedded systems. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RunLoop.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+RunLoop::RunLoop()
+{
+    notImplemented();
+}
+
+RunLoop::~RunLoop()
+{
+    notImplemented();
+}
+
+void RunLoop::wakeUp()
+{
+    notImplemented();
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/cf/KURLCFNet.cpp b/Source/WebCore/platform/cf/KURLCFNet.cpp
index b3a58652b..fd8084b90 100644
--- a/Source/WebCore/platform/cf/KURLCFNet.cpp
+++ b/Source/WebCore/platform/cf/KURLCFNet.cpp
@@ -33,6 +33,8 @@ using namespace std;
 
 namespace WebCore {
 
+#if !USE(WTFURL)
+
 typedef Vector<char, 512> CharBuffer;
 
 CFURLRef createCFURLFromBuffer(const CharBuffer&);
@@ -91,4 +93,21 @@ String KURL::fileSystemPath() const
     return RetainPtr<CFStringRef>(AdoptCF, CFURLCopyFileSystemPath(cfURL.get(), pathStyle)).get();
 }
 #endif
+
+#else // USE(WTFURL)
+
+KURL::KURL(CFURLRef)
+{
+    // FIXME: Add WTFURL Implementation.
+    invalidate();
+}
+
+CFURLRef KURL::createCFURL() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return 0;
+}
+
+#endif // USE(WTFURL)
+
 }
diff --git a/Source/WebCore/platform/chromium/ChromiumDataObject.cpp b/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
index d6b73e5f0..c1b7aa281 100644
--- a/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
+++ b/Source/WebCore/platform/chromium/ChromiumDataObject.cpp
@@ -101,36 +101,36 @@ bool ChromiumDataObject::hasData() const
         || m_fileContent;
 }
 
-PassRefPtr<DOMStringList> ChromiumDataObject::types() const
+HashSet<String> ChromiumDataObject::types() const
 {
-    RefPtr<DOMStringList> results = DOMStringList::create();
-
     if (m_storageMode == Pasteboard) {
         bool ignoredContainsFilenames;
-        HashSet<String> hashedResults = PlatformSupport::clipboardReadAvailableTypes(
-            currentPasteboardBuffer(), &ignoredContainsFilenames);
-        for (HashSet<String>::const_iterator it = hashedResults.begin(); it != hashedResults.end(); ++it)
-          results->append(*it);
-        return results.release();
+        return PlatformSupport::clipboardReadAvailableTypes(currentPasteboardBuffer(),
+                                                            &ignoredContainsFilenames);
     }
 
+    HashSet<String> results;
+
     if (!m_plainText.isEmpty()) {
-        results->append(mimeTypeText);
-        results->append(mimeTypeTextPlain);
+        results.add(mimeTypeText);
+        results.add(mimeTypeTextPlain);
     }
 
     if (!m_uriList.isEmpty())
-        results->append(mimeTypeTextURIList);
+        results.add(mimeTypeTextURIList);
 
     if (!m_textHtml.isEmpty())
-        results->append(mimeTypeTextHTML);
+        results.add(mimeTypeTextHTML);
+
+    if (!m_downloadMetadata.isEmpty())
+        results.add(mimeTypeDownloadURL);
 
     for (HashMap<String, String>::const_iterator::Keys it = m_customData.begin().keys();
          it != m_customData.end().keys(); ++it) {
-        results->append(*it);
+        results.add(*it);
     }
 
-    return results.release();
+    return results;
 }
 
 String ChromiumDataObject::getData(const String& type, bool& success) const
diff --git a/Source/WebCore/platform/chromium/ChromiumDataObject.h b/Source/WebCore/platform/chromium/ChromiumDataObject.h
index 9a6f562d1..7e675bf93 100644
--- a/Source/WebCore/platform/chromium/ChromiumDataObject.h
+++ b/Source/WebCore/platform/chromium/ChromiumDataObject.h
@@ -31,11 +31,11 @@
 #ifndef ChromiumDataObject_h
 #define ChromiumDataObject_h
 
-#include "DOMStringList.h"
 #include "KURL.h"
 #include "PlatformString.h"
 #include "SharedBuffer.h"
 #include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 #include <wtf/text/StringHash.h>
@@ -75,7 +75,7 @@ public:
 
     bool hasData() const;
 
-    PassRefPtr<DOMStringList> types() const;
+    HashSet<String> types() const;
     String getData(const String& type, bool& success) const;
     bool setData(const String& type, const String& data);
 
diff --git a/Source/WebCore/platform/chromium/ClipboardChromium.cpp b/Source/WebCore/platform/chromium/ClipboardChromium.cpp
index 1b1536e35..e238b2dfd 100644
--- a/Source/WebCore/platform/chromium/ClipboardChromium.cpp
+++ b/Source/WebCore/platform/chromium/ClipboardChromium.cpp
@@ -31,7 +31,6 @@
 #include "ChromiumDataObject.h"
 #include "ClipboardMimeTypes.h"
 #include "ClipboardUtilitiesChromium.h"
-#include "DOMStringList.h"
 #include "DataTransferItemChromium.h"
 #include "DataTransferItemListChromium.h"
 #include "Document.h"
@@ -263,16 +262,16 @@ void ClipboardChromium::clearAllData()
     m_dataObject->clearAll();
 }
 
-String ClipboardChromium::getData(const String& type, bool& success) const
+String ClipboardChromium::getData(const String& type) const
 {
-    success = false;
+    bool ignoredSuccess = false;
     if (policy() != ClipboardReadable || !m_dataObject)
         return String();
 
     if (isForCopyAndPaste() && platformClipboardChanged())
         return String();
 
-    return m_dataObject->getData(normalizeType(type), success);
+    return m_dataObject->getData(normalizeType(type), ignoredSuccess);
 }
 
 bool ClipboardChromium::setData(const String& type, const String& data)
@@ -290,20 +289,21 @@ bool ClipboardChromium::platformClipboardChanged() const
 }
 
 // extensions beyond IE's API
-PassRefPtr<DOMStringList> ClipboardChromium::types() const
+HashSet<String> ClipboardChromium::types() const
 {
+    HashSet<String> results;
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
-        return DOMStringList::create();
+        return results;
 
     if (!m_dataObject)
-        return DOMStringList::create();
+        return results;
 
-    RefPtr<DOMStringList> results = m_dataObject->types();
+    results = m_dataObject->types();
 
     if (m_dataObject->containsFilenames())
-        results->append(mimeTypeFiles);
+        results.add(mimeTypeFiles);
 
-    return results.release();
+    return results;
 }
 
 PassRefPtr<FileList> ClipboardChromium::files() const
@@ -518,9 +518,9 @@ void ClipboardChromium::mayUpdateItems(Vector<RefPtr<DataTransferItem> >& items)
 
     if (isForCopyAndPaste() && policy() == ClipboardReadable) {
         // Iterate through the types and add them.
-        RefPtr<DOMStringList> types = m_dataObject->types();
-        for (size_t i = 0; i < types->length(); ++i)
-            items.append(DataTransferItemChromium::createFromPasteboard(this, scriptExecutionContext, types->item(i)));
+        HashSet<String> types = m_dataObject->types();
+        for (HashSet<String>::const_iterator it = types.begin(); it != types.end(); ++it)
+            items.append(DataTransferItemChromium::createFromPasteboard(this, scriptExecutionContext, *it));
         return;
     }
 
diff --git a/Source/WebCore/platform/chromium/ClipboardChromium.h b/Source/WebCore/platform/chromium/ClipboardChromium.h
index ae9eb711b..3777ad5c9 100644
--- a/Source/WebCore/platform/chromium/ClipboardChromium.h
+++ b/Source/WebCore/platform/chromium/ClipboardChromium.h
@@ -58,12 +58,12 @@ namespace WebCore {
 
         virtual void clearData(const String& type);
         void clearAllData();
-        String getData(const String& type, bool& success) const;
+        String getData(const String& type) const;
         bool setData(const String& type, const String& data);
         bool platformClipboardChanged() const;
 
         // extensions beyond IE's API
-        virtual PassRefPtr<DOMStringList> types() const;
+        virtual HashSet<String> types() const;
         virtual PassRefPtr<FileList> files() const;
 
         void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/chromium/DragDataChromium.cpp b/Source/WebCore/platform/chromium/DragDataChromium.cpp
index a7a853559..3d94a19b2 100644
--- a/Source/WebCore/platform/chromium/DragDataChromium.cpp
+++ b/Source/WebCore/platform/chromium/DragDataChromium.cpp
@@ -45,19 +45,19 @@ namespace WebCore {
 
 static bool containsHTML(const ChromiumDataObject* dropData)
 {
-    return dropData->types()->contains(mimeTypeTextHTML);
+    return dropData->types().contains(mimeTypeTextHTML);
 }
 
 bool DragData::containsURL(Frame*, FilenameConversionPolicy filenamePolicy) const
 {
-    return m_platformDragData->types()->contains(mimeTypeTextURIList)
+    return m_platformDragData->types().contains(mimeTypeTextURIList)
         || (filenamePolicy == ConvertFilenames && m_platformDragData->containsFilenames());
 }
 
 String DragData::asURL(Frame*, FilenameConversionPolicy filenamePolicy, String* title) const
 {
     String url;
-    if (m_platformDragData->types()->contains(mimeTypeTextURIList)) {
+    if (m_platformDragData->types().contains(mimeTypeTextURIList)) {
         bool ignoredSuccess;
         url = m_platformDragData->getData(mimeTypeURL, ignoredSuccess);
         if (title)
@@ -87,7 +87,7 @@ void DragData::asFilenames(Vector<String>& result) const
 
 bool DragData::containsPlainText() const
 {
-    return m_platformDragData->types()->contains(mimeTypeTextPlain);
+    return m_platformDragData->types().contains(mimeTypeTextPlain);
 }
 
 String DragData::asPlainText(Frame*) const
@@ -108,8 +108,8 @@ bool DragData::canSmartReplace() const
     // This is allowed whenever the drag data contains a 'range' (ie.,
     // ClipboardWin::writeRange is called).  For example, dragging a link
     // should not result in a space being added.
-    return m_platformDragData->types()->contains(mimeTypeTextPlain)
-        && !m_platformDragData->types()->contains(mimeTypeTextURIList);
+    return m_platformDragData->types().contains(mimeTypeTextPlain)
+        && !m_platformDragData->types().contains(mimeTypeTextURIList);
 }
 
 bool DragData::containsCompatibleContent() const
@@ -141,7 +141,7 @@ PassRefPtr<DocumentFragment> DragData::asFragment(Frame* frame, PassRefPtr<Range
         //    return fragment;
     }
 
-    if (m_platformDragData->types()->contains(mimeTypeTextHTML)) {
+    if (m_platformDragData->types().contains(mimeTypeTextHTML)) {
         bool ignoredSuccess;
         RefPtr<DocumentFragment> fragment = createFragmentFromMarkup(frame->document(),
             m_platformDragData->getData(mimeTypeTextHTML, ignoredSuccess), m_platformDragData->htmlBaseUrl(), FragmentScriptingNotAllowed);
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
index f8cb28154..682d82d5b 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
@@ -39,14 +39,14 @@
 
 namespace WebCore {
 
-bool ScrollbarThemeChromium::hasThumb(Scrollbar* scrollbar)
+bool ScrollbarThemeChromium::hasThumb(ScrollbarThemeClient* scrollbar)
 {
     // This method is just called as a paint-time optimization to see if
     // painting the thumb can be skipped.  We don't have to be exact here.
     return thumbLength(scrollbar) > 0;
 }
 
-IntRect ScrollbarThemeChromium::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+IntRect ScrollbarThemeChromium::backButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool)
 {
     // Windows and Linux just have single arrows.
     if (part == BackButtonEndPart)
@@ -56,7 +56,7 @@ IntRect ScrollbarThemeChromium::backButtonRect(Scrollbar* scrollbar, ScrollbarPa
     return IntRect(scrollbar->x(), scrollbar->y(), size.width(), size.height());
 }
 
-IntRect ScrollbarThemeChromium::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+IntRect ScrollbarThemeChromium::forwardButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool)
 {
     // Windows and Linux just have single arrows.
     if (part == ForwardButtonStartPart)
@@ -74,7 +74,7 @@ IntRect ScrollbarThemeChromium::forwardButtonRect(Scrollbar* scrollbar, Scrollba
     return IntRect(x, y, size.width(), size.height());
 }
 
-IntRect ScrollbarThemeChromium::trackRect(Scrollbar* scrollbar, bool)
+IntRect ScrollbarThemeChromium::trackRect(ScrollbarThemeClient* scrollbar, bool)
 {
     IntSize bs = buttonSize(scrollbar);
     // The buttons at the top and bottom of the scrollbar are square, so the
@@ -92,14 +92,14 @@ IntRect ScrollbarThemeChromium::trackRect(Scrollbar* scrollbar, bool)
     return IntRect(scrollbar->x(), scrollbar->y() + bs.height(), thickness, scrollbar->height() - 2 * bs.height());
 }
 
-void ScrollbarThemeChromium::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeChromium::paintTrackBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     // Just assume a forward track part.  We only paint the track as a single piece when there is no thumb.
     if (!hasThumb(scrollbar))
         paintTrackPiece(context, scrollbar, rect, ForwardTrackPart);
 }
 
-void ScrollbarThemeChromium::paintTickmarks(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeChromium::paintTickmarks(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     if (scrollbar->orientation() != VerticalScrollbar)
         return;
@@ -109,7 +109,7 @@ void ScrollbarThemeChromium::paintTickmarks(GraphicsContext* context, Scrollbar*
 
     // Get the tickmarks for the frameview.
     Vector<IntRect> tickmarks;
-    scrollbar->scrollableArea()->getTickmarks(tickmarks);
+    scrollbar->getTickmarks(tickmarks);
     if (!tickmarks.size())
         return;
 
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromium.h b/Source/WebCore/platform/chromium/ScrollbarThemeChromium.h
index 117812569..cf671dd98 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromium.h
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromium.h
@@ -41,17 +41,17 @@ namespace WebCore {
     // Windows and Linux.
     class ScrollbarThemeChromium : public ScrollbarThemeComposite {
     protected:
-        virtual bool hasButtons(Scrollbar*) { return true; }
-        virtual bool hasThumb(Scrollbar*);
+        virtual bool hasButtons(ScrollbarThemeClient*) { return true; }
+        virtual bool hasThumb(ScrollbarThemeClient*);
 
-        virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-        virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-        virtual IntRect trackRect(Scrollbar*, bool painting = false);
+        virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+        virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+        virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false);
 
-        virtual void paintTrackBackground(GraphicsContext*, Scrollbar*, const IntRect&);
-        virtual void paintTickmarks(GraphicsContext*, Scrollbar*, const IntRect&);
+        virtual void paintTrackBackground(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+        virtual void paintTickmarks(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
 
-        virtual IntSize buttonSize(Scrollbar*) = 0;
+        virtual IntSize buttonSize(ScrollbarThemeClient*) = 0;
     };
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.cpp
index 1dbefa649..e1e55a1fc 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.cpp
@@ -57,7 +57,7 @@ int ScrollbarThemeChromiumAndroid::scrollbarThickness(ScrollbarControlSize contr
     return scrollbarThicknessValue;
 }
 
-void ScrollbarThemeChromiumAndroid::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
+void ScrollbarThemeChromiumAndroid::paintScrollbarBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar)
 {
     // Paint black background in DumpRenderTree, otherwise the pixels in the scrollbar area depend
     // on their previous state, which makes the dumped result undetermined.
@@ -65,12 +65,12 @@ void ScrollbarThemeChromiumAndroid::paintScrollbarBackground(GraphicsContext* co
         context->fillRect(scrollbar->frameRect(), Color::black, ColorSpaceDeviceRGB);
 }
 
-bool ScrollbarThemeChromiumAndroid::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
+bool ScrollbarThemeChromiumAndroid::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& evt)
 {
     return true;
 }
 
-IntSize ScrollbarThemeChromiumAndroid::buttonSize(Scrollbar* scrollbar)
+IntSize ScrollbarThemeChromiumAndroid::buttonSize(ScrollbarThemeClient* scrollbar)
 {
     if (scrollbar->orientation() == VerticalScrollbar)
         return IntSize(scrollbarThicknessValue, buttonLength);
@@ -78,7 +78,7 @@ IntSize ScrollbarThemeChromiumAndroid::buttonSize(Scrollbar* scrollbar)
     return IntSize(buttonLength, scrollbarThicknessValue);
 }
 
-int ScrollbarThemeChromiumAndroid::minimumThumbLength(Scrollbar* scrollbar)
+int ScrollbarThemeChromiumAndroid::minimumThumbLength(ScrollbarThemeClient* scrollbar)
 {
     return 2 * scrollbarThickness(scrollbar->controlSize());
 }
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.h b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.h
index f07c90167..f3db80e52 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.h
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumAndroid.h
@@ -35,10 +35,10 @@ public:
     virtual int scrollbarThickness(ScrollbarControlSize);
 
 protected:
-    virtual void paintScrollbarBackground(GraphicsContext*, Scrollbar*);
-    virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
-    virtual IntSize buttonSize(Scrollbar*);
-    virtual int minimumThumbLength(Scrollbar*);
+    virtual void paintScrollbarBackground(GraphicsContext*, ScrollbarThemeClient*);
+    virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
+    virtual IntSize buttonSize(ScrollbarThemeClient*);
+    virtual int minimumThumbLength(ScrollbarThemeClient*);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
index ec68407e9..6b4dafc37 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
@@ -50,7 +50,7 @@ int ScrollbarThemeChromiumLinux::scrollbarThickness(ScrollbarControlSize control
     return scrollbarSize.width();
 }
 
-void ScrollbarThemeChromiumLinux::paintTrackPiece(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart partType)
+void ScrollbarThemeChromiumLinux::paintTrackPiece(GraphicsContext* gc, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart partType)
 {
     PlatformSupport::ThemePaintState state = scrollbar->hoveredPart() == partType ? PlatformSupport::StateHover : PlatformSupport::StateNormal;
     IntRect alignRect = trackRect(scrollbar, false);
@@ -67,7 +67,7 @@ void ScrollbarThemeChromiumLinux::paintTrackPiece(GraphicsContext* gc, Scrollbar
         &extraParams);
 }
 
-void ScrollbarThemeChromiumLinux::paintButton(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+void ScrollbarThemeChromiumLinux::paintButton(GraphicsContext* gc, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
     PlatformSupport::ThemePart paintPart;
     PlatformSupport::ThemePaintState state = PlatformSupport::StateNormal;
@@ -102,7 +102,7 @@ void ScrollbarThemeChromiumLinux::paintButton(GraphicsContext* gc, Scrollbar* sc
     PlatformSupport::paintThemePart(gc, paintPart, state, rect, 0);
 }
 
-void ScrollbarThemeChromiumLinux::paintThumb(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeChromiumLinux::paintThumb(GraphicsContext* gc, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     PlatformSupport::ThemePaintState state;
 
@@ -120,12 +120,12 @@ void ScrollbarThemeChromiumLinux::paintThumb(GraphicsContext* gc, Scrollbar* scr
         0);
 }
 
-bool ScrollbarThemeChromiumLinux::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
+bool ScrollbarThemeChromiumLinux::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& evt)
 {
     return (evt.shiftKey() && evt.button() == LeftButton) || (evt.button() == MiddleButton);
 }
 
-IntSize ScrollbarThemeChromiumLinux::buttonSize(Scrollbar* scrollbar)
+IntSize ScrollbarThemeChromiumLinux::buttonSize(ScrollbarThemeClient* scrollbar)
 {
     if (scrollbar->orientation() == VerticalScrollbar) {
         IntSize size = PlatformSupport::getThemePartSize(PlatformSupport::PartScrollbarUpArrow);
@@ -137,7 +137,7 @@ IntSize ScrollbarThemeChromiumLinux::buttonSize(Scrollbar* scrollbar)
     return IntSize(scrollbar->width() < 2 * size.width() ? scrollbar->width() / 2 : size.width(), size.height());
 }
 
-int ScrollbarThemeChromiumLinux::minimumThumbLength(Scrollbar* scrollbar)
+int ScrollbarThemeChromiumLinux::minimumThumbLength(ScrollbarThemeClient* scrollbar)
 {
     if (scrollbar->orientation() == VerticalScrollbar) {
         IntSize size = PlatformSupport::getThemePartSize(PlatformSupport::PartScrollbarVerticalThumb);
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.h b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.h
index 8e802e734..330d03fb0 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.h
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.h
@@ -39,12 +39,12 @@ namespace WebCore {
         virtual int scrollbarThickness(ScrollbarControlSize);
 
     protected:
-        virtual void paintTrackPiece(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-        virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-        virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
-        virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
-        virtual IntSize buttonSize(Scrollbar*);
-        virtual int minimumThumbLength(Scrollbar*);
+        virtual void paintTrackPiece(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+        virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+        virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+        virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
+        virtual IntSize buttonSize(ScrollbarThemeClient*);
+        virtual int minimumThumbLength(ScrollbarThemeClient*);
     };
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h
index 41a198e3f..19346e723 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.h
@@ -36,12 +36,12 @@ public:
     ScrollbarThemeChromiumMac();
     virtual ~ScrollbarThemeChromiumMac();
 
-    virtual bool paint(Scrollbar*, GraphicsContext* context, const IntRect& damageRect);
+    virtual bool paint(ScrollbarThemeClient*, GraphicsContext*, const IntRect& damageRect);
 
     virtual void paintOverhangAreas(ScrollView*, GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
     
 private:
-    void paintGivenTickmarks(GraphicsContext*, Scrollbar*, const IntRect&, const Vector<IntRect>&);
+    void paintGivenTickmarks(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, const Vector<IntRect>&);
 
     RefPtr<Pattern> m_overhangPattern;
 };
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
index 459a58b07..d02b42125 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
@@ -61,11 +61,11 @@ ScrollbarThemeChromiumMac::~ScrollbarThemeChromiumMac()
 {
 }
 
-static PlatformSupport::ThemePaintState scrollbarStateToThemeState(Scrollbar* scrollbar)
+static PlatformSupport::ThemePaintState scrollbarStateToThemeState(ScrollbarThemeClient* scrollbar)
 {
     if (!scrollbar->enabled())
         return PlatformSupport::StateDisabled;
-    if (!scrollbar->scrollableArea()->isActive())
+    if (!scrollbar->isScrollableAreaActive())
         return PlatformSupport::StateInactive;
     if (scrollbar->pressedPart() == ThumbPart)
         return PlatformSupport::StatePressed;
@@ -94,11 +94,11 @@ static void scrollbarPainterPaintTrack(ScrollbarPainter scrollbarPainter, bool e
 //     - drawing using PlatformSupport functions
 //     - drawing tickmarks
 //     - Skia specific changes
-bool ScrollbarThemeChromiumMac::paint(Scrollbar* scrollbar, GraphicsContext* context, const IntRect& damageRect)
+bool ScrollbarThemeChromiumMac::paint(ScrollbarThemeClient* scrollbar, GraphicsContext* context, const IntRect& damageRect)
 {
     // Get the tickmarks for the frameview.
     Vector<IntRect> tickmarks;
-    scrollbar->scrollableArea()->getTickmarks(tickmarks);
+    scrollbar->getTickmarks(tickmarks);
 
     if (isScrollbarOverlayAPIAvailable()) {
         float value = 0;
@@ -188,7 +188,7 @@ bool ScrollbarThemeChromiumMac::paint(Scrollbar* scrollbar, GraphicsContext* con
     if (!scrollbar->enabled())
         trackInfo.enableState = kThemeTrackDisabled;
     else
-        trackInfo.enableState = scrollbar->scrollableArea()->isActive() ? kThemeTrackActive : kThemeTrackInactive;
+        trackInfo.enableState = scrollbar->isScrollableAreaActive() ? kThemeTrackActive : kThemeTrackInactive;
 
     if (!hasButtons(scrollbar))
         trackInfo.enableState = kThemeTrackNothingToScroll;
@@ -243,7 +243,7 @@ bool ScrollbarThemeChromiumMac::paint(Scrollbar* scrollbar, GraphicsContext* con
     if (hasThumb(scrollbar)) {
         PlatformSupport::ThemePaintScrollbarInfo scrollbarInfo;
         scrollbarInfo.orientation = scrollbar->orientation() == HorizontalScrollbar ? PlatformSupport::ScrollbarOrientationHorizontal : PlatformSupport::ScrollbarOrientationVertical;
-        scrollbarInfo.parent = scrollbar->parent() && scrollbar->parent()->isFrameView() && static_cast<FrameView*>(scrollbar->parent())->isScrollViewScrollbar(scrollbar) ? PlatformSupport::ScrollbarParentScrollView : PlatformSupport::ScrollbarParentRenderLayer;
+        scrollbarInfo.parent = scrollbar->isScrollViewScrollbar() ? PlatformSupport::ScrollbarParentScrollView : PlatformSupport::ScrollbarParentRenderLayer;
         scrollbarInfo.maxValue = scrollbar->maximum();
         scrollbarInfo.currentValue = scrollbar->currentPos();
         scrollbarInfo.visibleSize = scrollbar->visibleSize();
@@ -263,7 +263,7 @@ bool ScrollbarThemeChromiumMac::paint(Scrollbar* scrollbar, GraphicsContext* con
     return true;
 }
 
-void ScrollbarThemeChromiumMac::paintGivenTickmarks(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, const Vector<IntRect>& tickmarks)
+void ScrollbarThemeChromiumMac::paintGivenTickmarks(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect, const Vector<IntRect>& tickmarks)
 {
     if (scrollbar->orientation() != VerticalScrollbar)
         return;
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
index f435839d8..a08198347 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
@@ -73,7 +73,7 @@ bool ScrollbarThemeChromiumWin::invalidateOnMouseEnterExit()
     return windowsVersion() >= WindowsVista;
 }
 
-bool ScrollbarThemeChromiumWin::shouldSnapBackToDragOrigin(Scrollbar* scrollbar, const PlatformMouseEvent& evt)
+bool ScrollbarThemeChromiumWin::shouldSnapBackToDragOrigin(ScrollbarThemeClient* scrollbar, const PlatformMouseEvent& evt)
 {
     // Find the rect within which we shouldn't snap, by expanding the track rect
     // in both dimensions.
@@ -91,7 +91,7 @@ bool ScrollbarThemeChromiumWin::shouldSnapBackToDragOrigin(Scrollbar* scrollbar,
     return !rect.contains(mousePosition);
 }
 
-void ScrollbarThemeChromiumWin::paintTrackPiece(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart partType)
+void ScrollbarThemeChromiumWin::paintTrackPiece(GraphicsContext* gc, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart partType)
 {
     bool horz = scrollbar->orientation() == HorizontalScrollbar;
 
@@ -113,7 +113,7 @@ void ScrollbarThemeChromiumWin::paintTrackPiece(GraphicsContext* gc, Scrollbar*
         alignRect);
 }
 
-void ScrollbarThemeChromiumWin::paintButton(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+void ScrollbarThemeChromiumWin::paintButton(GraphicsContext* gc, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
     bool horz = scrollbar->orientation() == HorizontalScrollbar;
 
@@ -131,7 +131,7 @@ void ScrollbarThemeChromiumWin::paintButton(GraphicsContext* gc, Scrollbar* scro
         rect);
 }
 
-void ScrollbarThemeChromiumWin::paintThumb(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeChromiumWin::paintThumb(GraphicsContext* gc, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     bool horz = scrollbar->orientation() == HorizontalScrollbar;
 
@@ -152,7 +152,7 @@ void ScrollbarThemeChromiumWin::paintThumb(GraphicsContext* gc, Scrollbar* scrol
         rect);
 }
 
-int ScrollbarThemeChromiumWin::getThemeState(Scrollbar* scrollbar, ScrollbarPart part) const
+int ScrollbarThemeChromiumWin::getThemeState(ScrollbarThemeClient* scrollbar, ScrollbarPart part) const
 {
     // When dragging the thumb, draw thumb pressed and other segments normal
     // regardless of where the cursor actually is.  See also four places in
@@ -171,7 +171,7 @@ int ScrollbarThemeChromiumWin::getThemeState(Scrollbar* scrollbar, ScrollbarPart
     return (scrollbar->pressedPart() == part) ? SCRBS_PRESSED : SCRBS_NORMAL;
 }
 
-int ScrollbarThemeChromiumWin::getThemeArrowState(Scrollbar* scrollbar, ScrollbarPart part) const
+int ScrollbarThemeChromiumWin::getThemeArrowState(ScrollbarThemeClient* scrollbar, ScrollbarPart part) const
 {
     // We could take advantage of knowing the values in the state enum to write
     // some simpler code, but treating the state enum as a black box seems
@@ -221,7 +221,7 @@ int ScrollbarThemeChromiumWin::getThemeArrowState(Scrollbar* scrollbar, Scrollba
     return (scrollbar->pressedPart() == part) ? ABS_DOWNPRESSED : ABS_DOWNNORMAL;
 }
 
-int ScrollbarThemeChromiumWin::getClassicThemeState(Scrollbar* scrollbar, ScrollbarPart part) const
+int ScrollbarThemeChromiumWin::getClassicThemeState(ScrollbarThemeClient* scrollbar, ScrollbarPart part) const
 {
     // When dragging the thumb, draw the buttons normal even when hovered.
     if (scrollbar->pressedPart() == ThumbPart)
@@ -235,12 +235,12 @@ int ScrollbarThemeChromiumWin::getClassicThemeState(Scrollbar* scrollbar, Scroll
     return (scrollbar->pressedPart() == part) ? (DFCS_PUSHED | DFCS_FLAT) : 0;
 }
 
-bool ScrollbarThemeChromiumWin::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
+bool ScrollbarThemeChromiumWin::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& evt)
 {
     return evt.shiftKey() && evt.button() == LeftButton;
 }
 
-IntSize ScrollbarThemeChromiumWin::buttonSize(Scrollbar* scrollbar)
+IntSize ScrollbarThemeChromiumWin::buttonSize(ScrollbarThemeClient* scrollbar)
 {
     // Our desired rect is essentially thickness by thickness.
 
diff --git a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.h b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.h
index 69cfa131c..ac8881f93 100644
--- a/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.h
+++ b/Source/WebCore/platform/chromium/ScrollbarThemeChromiumWin.h
@@ -38,19 +38,19 @@ namespace WebCore {
     public:
         virtual int scrollbarThickness(ScrollbarControlSize);
         virtual bool invalidateOnMouseEnterExit();
-        virtual bool shouldSnapBackToDragOrigin(Scrollbar*, const PlatformMouseEvent&);
+        virtual bool shouldSnapBackToDragOrigin(ScrollbarThemeClient*, const PlatformMouseEvent&);
 
     protected:
-        virtual void paintTrackPiece(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-        virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-        virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
-        virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
-        virtual IntSize buttonSize(Scrollbar*);
+        virtual void paintTrackPiece(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+        virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+        virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+        virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
+        virtual IntSize buttonSize(ScrollbarThemeClient*);
 
     private:
-        int getThemeState(Scrollbar*, ScrollbarPart) const;
-        int getThemeArrowState(Scrollbar*, ScrollbarPart) const;
-        int getClassicThemeState(Scrollbar*, ScrollbarPart) const;
+        int getThemeState(ScrollbarThemeClient*, ScrollbarPart) const;
+        int getThemeArrowState(ScrollbarThemeClient*, ScrollbarPart) const;
+        int getClassicThemeState(ScrollbarThemeClient*, ScrollbarPart) const;
     };
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/efl/ClipboardEfl.cpp b/Source/WebCore/platform/efl/ClipboardEfl.cpp
index 60152726a..884d387e5 100644
--- a/Source/WebCore/platform/efl/ClipboardEfl.cpp
+++ b/Source/WebCore/platform/efl/ClipboardEfl.cpp
@@ -21,7 +21,6 @@
 #include "config.h"
 #include "ClipboardEfl.h"
 
-#include "DOMStringList.h"
 #include "DataTransferItemList.h"
 #include "Editor.h"
 #include "FileList.h"
@@ -65,10 +64,9 @@ void ClipboardEfl::clearAllData()
     notImplemented();
 }
 
-String ClipboardEfl::getData(const String&, bool &success) const
+String ClipboardEfl::getData(const String&) const
 {
     notImplemented();
-    success = false;
     return String();
 }
 
@@ -78,10 +76,10 @@ bool ClipboardEfl::setData(const String&, const String&)
     return false;
 }
 
-PassRefPtr<DOMStringList> ClipboardEfl::types() const
+HashSet<String> ClipboardEfl::types() const
 {
     notImplemented();
-    return DOMStringList::create();
+    return HashSet<String>();
 }
 
 PassRefPtr<FileList> ClipboardEfl::files() const
diff --git a/Source/WebCore/platform/efl/ClipboardEfl.h b/Source/WebCore/platform/efl/ClipboardEfl.h
index 56455190f..3da598ecb 100644
--- a/Source/WebCore/platform/efl/ClipboardEfl.h
+++ b/Source/WebCore/platform/efl/ClipboardEfl.h
@@ -36,10 +36,10 @@ public:
 
     void clearData(const String&);
     void clearAllData();
-    String getData(const String&, bool&) const;
+    String getData(const String&) const;
     bool setData(const String&, const String&);
 
-    PassRefPtr<DOMStringList> types() const;
+    HashSet<String> types() const;
     virtual PassRefPtr<FileList> files() const;
 
     IntPoint dragLocation() const;
diff --git a/Source/WebCore/platform/efl/EflKeyboardUtilities.cpp b/Source/WebCore/platform/efl/EflKeyboardUtilities.cpp
index 2c42bbf7f..35ef84ccb 100644
--- a/Source/WebCore/platform/efl/EflKeyboardUtilities.cpp
+++ b/Source/WebCore/platform/efl/EflKeyboardUtilities.cpp
@@ -166,7 +166,7 @@ static void createWindowsKeyMap()
     }
 }
 
-String keyIdentifierForEvasKeyName(String& keyName)
+String keyIdentifierForEvasKeyName(const String& keyName)
 {
     if (keyMap().isEmpty())
         createKeyMap();
@@ -177,7 +177,18 @@ String keyIdentifierForEvasKeyName(String& keyName)
     return keyName;
 }
 
-int windowsKeyCodeForEvasKeyName(String& keyName)
+String singleCharacterString(const String& keyName)
+{
+    if (keyName == "Return")
+        return String("\r");
+    if (keyName == "BackSpace")
+        return String("\x8");
+    if (keyName == "Tab")
+        return String("\t");
+    return keyName;
+}
+
+int windowsKeyCodeForEvasKeyName(const String& keyName)
 {
     if (windowsKeyMap().isEmpty())
         createWindowsKeyMap();
diff --git a/Source/WebCore/platform/efl/EflKeyboardUtilities.h b/Source/WebCore/platform/efl/EflKeyboardUtilities.h
index d79170b29..ad36327f4 100644
--- a/Source/WebCore/platform/efl/EflKeyboardUtilities.h
+++ b/Source/WebCore/platform/efl/EflKeyboardUtilities.h
@@ -34,8 +34,9 @@ class String;
 
 namespace WebCore {
 
-WTF::String keyIdentifierForEvasKeyName(WTF::String&);
-int windowsKeyCodeForEvasKeyName(WTF::String&);
+WTF::String keyIdentifierForEvasKeyName(const WTF::String&);
+WTF::String singleCharacterString(const WTF::String&);
+int windowsKeyCodeForEvasKeyName(const WTF::String&);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp b/Source/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp
index 63963e95e..656564d2c 100644
--- a/Source/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp
+++ b/Source/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp
@@ -42,29 +42,30 @@ namespace WebCore {
 
 PlatformKeyboardEvent::PlatformKeyboardEvent(const Evas_Event_Key_Down* event)
     : PlatformEvent(PlatformEvent::KeyDown, evas_key_modifier_is_set(event->modifiers, "Shift"), evas_key_modifier_is_set(event->modifiers, "Control"), evas_key_modifier_is_set(event->modifiers, "Alt"), evas_key_modifier_is_set(event->modifiers, "Meta"), currentTime())
-    , m_text(String::fromUTF8(event->string))
-    , m_unmodifiedText(String::fromUTF8(event->string))
+    , m_text(singleCharacterString(String::fromUTF8(event->string)))
+    , m_unmodifiedText(singleCharacterString(String::fromUTF8(event->string)))
+    , m_keyIdentifier(keyIdentifierForEvasKeyName(String(event->key)))
+    , m_windowsVirtualKeyCode(windowsKeyCodeForEvasKeyName(String(event->key)))
+    , m_nativeVirtualKeyCode(0)
+    , m_macCharCode(0)
+    , m_autoRepeat(false)
+    , m_isKeypad(false)
+    , m_isSystemKey(false)
 {
-    String keyName = String(event->key);
-    m_keyIdentifier = keyIdentifierForEvasKeyName(keyName);
-    m_windowsVirtualKeyCode = windowsKeyCodeForEvasKeyName(keyName);
-
-    // FIXME:
-    m_isKeypad = false;
-    m_autoRepeat = false;
 }
 
 PlatformKeyboardEvent::PlatformKeyboardEvent(const Evas_Event_Key_Up* event)
     : PlatformEvent(PlatformEvent::KeyUp, evas_key_modifier_is_set(event->modifiers, "Shift"), evas_key_modifier_is_set(event->modifiers, "Control"), evas_key_modifier_is_set(event->modifiers, "Alt"), evas_key_modifier_is_set(event->modifiers, "Meta"), currentTime())
-    , m_text(String::fromUTF8(event->string))
+    , m_text(singleCharacterString(String::fromUTF8(event->string)))
+    , m_unmodifiedText(singleCharacterString(String::fromUTF8(event->string)))
+    , m_keyIdentifier(keyIdentifierForEvasKeyName(String(event->key)))
+    , m_windowsVirtualKeyCode(windowsKeyCodeForEvasKeyName(String(event->key)))
+    , m_nativeVirtualKeyCode(0)
+    , m_macCharCode(0)
+    , m_autoRepeat(false)
+    , m_isKeypad(false)
+    , m_isSystemKey(false)
 {
-    String keyName = String(event->key);
-    m_keyIdentifier = keyIdentifierForEvasKeyName(keyName);
-    m_windowsVirtualKeyCode = windowsKeyCodeForEvasKeyName(keyName);
-
-    // FIXME:
-    m_isKeypad = false;
-    m_autoRepeat = false;
 }
 
 void PlatformKeyboardEvent::disambiguateKeyDownEvent(Type type, bool)
diff --git a/Source/WebCore/platform/efl/RunLoopEfl.cpp b/Source/WebCore/platform/efl/RunLoopEfl.cpp
new file mode 100644
index 000000000..e820788d6
--- /dev/null
+++ b/Source/WebCore/platform/efl/RunLoopEfl.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2012 ProFUSION embedded systems. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RunLoop.h"
+
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+RunLoop::RunLoop()
+{
+    notImplemented();
+}
+
+RunLoop::~RunLoop()
+{
+    notImplemented();
+}
+
+void RunLoop::wakeUp()
+{
+    notImplemented();
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/efl/ScrollbarThemeEfl.cpp b/Source/WebCore/platform/efl/ScrollbarThemeEfl.cpp
index 62df005d6..240b50147 100644
--- a/Source/WebCore/platform/efl/ScrollbarThemeEfl.cpp
+++ b/Source/WebCore/platform/efl/ScrollbarThemeEfl.cpp
@@ -49,11 +49,11 @@ int ScrollbarThemeEfl::scrollbarThickness(ScrollbarControlSize controlSize)
     return 0; // we paint on top
 }
 
-void ScrollbarThemeEfl::registerScrollbar(Scrollbar* scrollbar)
+void ScrollbarThemeEfl::registerScrollbar(ScrollbarThemeClient* scrollbar)
 {
 }
 
-void ScrollbarThemeEfl::unregisterScrollbar(Scrollbar* scrollbar)
+void ScrollbarThemeEfl::unregisterScrollbar(ScrollbarThemeClient* scrollbar)
 {
 }
 
diff --git a/Source/WebCore/platform/efl/ScrollbarThemeEfl.h b/Source/WebCore/platform/efl/ScrollbarThemeEfl.h
index 0fe16881e..28c163ed3 100644
--- a/Source/WebCore/platform/efl/ScrollbarThemeEfl.h
+++ b/Source/WebCore/platform/efl/ScrollbarThemeEfl.h
@@ -39,8 +39,8 @@ public:
 
     virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
 
-    virtual void registerScrollbar(Scrollbar* scrollbar);
-    virtual void unregisterScrollbar(Scrollbar* scrollbar);
+    virtual void registerScrollbar(ScrollbarThemeClient*);
+    virtual void unregisterScrollbar(ScrollbarThemeClient*);
 };
 
 }
diff --git a/Source/WebCore/platform/efl/SharedBufferEfl.cpp b/Source/WebCore/platform/efl/SharedBufferEfl.cpp
index a4337a0b2..9e7646d1c 100644
--- a/Source/WebCore/platform/efl/SharedBufferEfl.cpp
+++ b/Source/WebCore/platform/efl/SharedBufferEfl.cpp
@@ -61,10 +61,10 @@ PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String& fi
         return 0;
     }
 
-    fread(result->m_buffer.data(), 1, fileStat.st_size, file);
+    const size_t bytesRead = fread(result->m_buffer.data(), 1, fileStat.st_size, file);
     fclose(file);
 
-    return result.release();
+    return bytesRead == static_cast<unsigned>(fileStat.st_size) ? result.release() : 0;
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/CrossfadeGeneratedImage.cpp b/Source/WebCore/platform/graphics/CrossfadeGeneratedImage.cpp
index 0350da0fc..708dcd065 100644
--- a/Source/WebCore/platform/graphics/CrossfadeGeneratedImage.cpp
+++ b/Source/WebCore/platform/graphics/CrossfadeGeneratedImage.cpp
@@ -95,7 +95,7 @@ void CrossfadeGeneratedImage::draw(GraphicsContext* context, const FloatRect& ds
 
 void CrossfadeGeneratedImage::drawPattern(GraphicsContext* context, const FloatRect& srcRect, const AffineTransform& patternTransform, const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator compositeOp, const FloatRect& dstRect)
 {
-    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(m_size, ColorSpaceDeviceRGB, context->isAcceleratedContext() ? Accelerated : Unaccelerated);
+    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(m_size, 1, ColorSpaceDeviceRGB, context->isAcceleratedContext() ? Accelerated : Unaccelerated);
     if (!imageBuffer)
         return;
 
diff --git a/Source/WebCore/platform/graphics/Extensions3D.h b/Source/WebCore/platform/graphics/Extensions3D.h
index ffc5f527c..7c1004991 100644
--- a/Source/WebCore/platform/graphics/Extensions3D.h
+++ b/Source/WebCore/platform/graphics/Extensions3D.h
@@ -65,6 +65,7 @@ public:
     //   GL_EXT_texture_compression_s3tc
     //   GL_OES_compressed_ETC1_RGB8_texture
     //   GL_IMG_texture_compression_pvrtc
+    //   EXT_texture_filter_anisotropic
 
     // Takes full name of extension; for example,
     // "GL_EXT_texture_format_BGRA8888".
@@ -135,6 +136,10 @@ public:
         COMPRESSED_RGB_PVRTC_2BPPV1_IMG = 0x8C01,
         COMPRESSED_RGBA_PVRTC_4BPPV1_IMG = 0x8C02,
         COMPRESSED_RGBA_PVRTC_2BPPV1_IMG = 0x8C03,
+
+        // GL_EXT_texture_filter_anisotropic
+        TEXTURE_MAX_ANISOTROPY_EXT = 0x84FE,
+        MAX_TEXTURE_MAX_ANISOTROPY_EXT = 0x84FF,
     };
 
     // GL_ARB_robustness
diff --git a/Source/WebCore/platform/graphics/FloatPoint.h b/Source/WebCore/platform/graphics/FloatPoint.h
index 094304d83..a601a9dff 100644
--- a/Source/WebCore/platform/graphics/FloatPoint.h
+++ b/Source/WebCore/platform/graphics/FloatPoint.h
@@ -31,6 +31,14 @@
 #include "IntPoint.h"
 #include <wtf/MathExtras.h>
 
+#if PLATFORM(BLACKBERRY)
+namespace BlackBerry {
+namespace Platform {
+class FloatPoint;
+}
+}
+#endif
+
 #if USE(CG) || USE(SKIA_ON_MAC_CHROMIUM)
 typedef struct CGPoint CGPoint;
 #endif
@@ -156,6 +164,11 @@ public:
     operator QPointF() const;
 #endif
 
+#if PLATFORM(BLACKBERRY)
+    FloatPoint(const BlackBerry::Platform::FloatPoint&);
+    operator BlackBerry::Platform::FloatPoint() const;
+#endif
+
 #if USE(SKIA)
     operator SkPoint() const;
     FloatPoint(const SkPoint&);
diff --git a/Source/WebCore/platform/graphics/FloatRect.h b/Source/WebCore/platform/graphics/FloatRect.h
index 4d4eadfd0..66b29f84b 100644
--- a/Source/WebCore/platform/graphics/FloatRect.h
+++ b/Source/WebCore/platform/graphics/FloatRect.h
@@ -52,6 +52,14 @@ QT_END_NAMESPACE
 class wxRect2DDouble;
 #endif
 
+#if PLATFORM(BLACKBERRY)
+namespace BlackBerry {
+namespace Platform {
+class FloatRect;
+}
+}
+#endif
+
 #if USE(SKIA)
 struct SkRect;
 #endif
@@ -181,6 +189,11 @@ public:
     void fitToPoints(const FloatPoint& p0, const FloatPoint& p1, const FloatPoint& p2);
     void fitToPoints(const FloatPoint& p0, const FloatPoint& p1, const FloatPoint& p2, const FloatPoint& p3);
 
+#if PLATFORM(BLACKBERRY)
+    FloatRect(const BlackBerry::Platform::FloatRect&);
+    operator BlackBerry::Platform::FloatRect() const;
+#endif
+
 #if USE(CG) || USE(SKIA_ON_MAC_CHROMIUM)
     FloatRect(const CGRect&);
     operator CGRect() const;
diff --git a/Source/WebCore/platform/graphics/FloatSize.h b/Source/WebCore/platform/graphics/FloatSize.h
index 2b5545030..3b35510be 100644
--- a/Source/WebCore/platform/graphics/FloatSize.h
+++ b/Source/WebCore/platform/graphics/FloatSize.h
@@ -31,6 +31,14 @@
 #include "IntPoint.h"
 #include <wtf/MathExtras.h>
 
+#if PLATFORM(BLACKBERRY)
+namespace BlackBerry {
+namespace Platform {
+class FloatSize;
+}
+}
+#endif
+
 #if USE(CG) || (PLATFORM(WX) && OS(DARWIN)) || USE(SKIA_ON_MAC_CHROMIUM)
 typedef struct CGSize CGSize;
 #endif
@@ -106,6 +114,11 @@ public:
         return FloatSize(m_height, m_width);
     }
 
+#if PLATFORM(BLACKBERRY)
+    FloatSize(const BlackBerry::Platform::FloatSize&);
+    operator BlackBerry::Platform::FloatSize() const;
+#endif
+
 #if USE(CG) || (PLATFORM(WX) && OS(DARWIN)) || USE(SKIA_ON_MAC_CHROMIUM)
     explicit FloatSize(const CGSize&); // don't do this implicitly since it's lossy
     operator CGSize() const;
diff --git a/Source/WebCore/platform/graphics/FractionalLayoutRect.h b/Source/WebCore/platform/graphics/FractionalLayoutRect.h
index e16655517..e64feb8b1 100644
--- a/Source/WebCore/platform/graphics/FractionalLayoutRect.h
+++ b/Source/WebCore/platform/graphics/FractionalLayoutRect.h
@@ -65,6 +65,13 @@ public:
     FractionalLayoutUnit width() const { return m_size.width(); }
     FractionalLayoutUnit height() const { return m_size.height(); }
 
+    int pixelSnappedX() const { return x().round(); }
+    int pixelSnappedY() const { return y().round(); }
+    int pixelSnappedWidth() const { return snapSizeToPixel(width(), x()); }
+    int pixelSnappedHeight() const { return snapSizeToPixel(height(), y()); }
+    int pixelSnappedMaxX() const { return pixelSnappedX() + pixelSnappedWidth(); }
+    int pixelSnappedMaxY() const { return pixelSnappedY() + pixelSnappedHeight(); }
+
     void setX(FractionalLayoutUnit x) { m_location.setX(x); }
     void setY(FractionalLayoutUnit y) { m_location.setY(y); }
     void setWidth(FractionalLayoutUnit width) { m_size.setWidth(width); }
diff --git a/Source/WebCore/platform/graphics/GraphicsContext.cpp b/Source/WebCore/platform/graphics/GraphicsContext.cpp
index f77b8a138..8f7f4cd1c 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext.cpp
+++ b/Source/WebCore/platform/graphics/GraphicsContext.cpp
@@ -487,7 +487,7 @@ void GraphicsContext::drawImage(Image* image, ColorSpace styleColorSpace, const
         image->draw(this, FloatRect(dest.location(), FloatSize(tw, th)), FloatRect(src.location(), FloatSize(tsw, tsh)), styleColorSpace, op);
 }
 
-void GraphicsContext::drawTiledImage(Image* image, ColorSpace styleColorSpace, const IntRect& rect, const IntPoint& srcPoint, const IntSize& tileSize, CompositeOperator op, bool useLowQualityScale)
+void GraphicsContext::drawTiledImage(Image* image, ColorSpace styleColorSpace, const IntRect& destRect, const IntPoint& srcPoint, const IntSize& tileSize, CompositeOperator op, bool useLowQualityScale)
 {
     if (paintingDisabled() || !image)
         return;
@@ -495,10 +495,10 @@ void GraphicsContext::drawTiledImage(Image* image, ColorSpace styleColorSpace, c
     if (useLowQualityScale) {
         InterpolationQuality previousInterpolationQuality = imageInterpolationQuality();
         setImageInterpolationQuality(InterpolationLow);
-        image->drawTiled(this, rect, srcPoint, tileSize, styleColorSpace, op);
+        image->drawTiled(this, destRect, srcPoint, tileSize, styleColorSpace, op);
         setImageInterpolationQuality(previousInterpolationQuality);
     } else
-        image->drawTiled(this, rect, srcPoint, tileSize, styleColorSpace, op);
+        image->drawTiled(this, destRect, srcPoint, tileSize, styleColorSpace, op);
 }
 
 void GraphicsContext::drawTiledImage(Image* image, ColorSpace styleColorSpace, const IntRect& dest, const IntRect& srcRect,
@@ -553,14 +553,14 @@ void GraphicsContext::drawImageBuffer(ImageBuffer* image, ColorSpace styleColorS
     float th = dest.height();
 
     if (tsw == -1)
-        tsw = image->width();
+        tsw = image->logicalSize().width();
     if (tsh == -1)
-        tsh = image->height();
+        tsh = image->logicalSize().height();
 
     if (tw == -1)
-        tw = image->width();
+        tw = image->logicalSize().width();
     if (th == -1)
-        th = image->height();
+        th = image->logicalSize().height();
 
     if (useLowQualityScale) {
         InterpolationQuality previousInterpolationQuality = imageInterpolationQuality();
@@ -754,7 +754,7 @@ PassOwnPtr<ImageBuffer> GraphicsContext::createCompatibleBuffer(const IntSize& s
     AffineTransform transform = getCTM();
     IntSize scaledSize(static_cast<int>(ceil(size.width() * transform.xScale())), static_cast<int>(ceil(size.height() * transform.yScale())));
 
-    OwnPtr<ImageBuffer> buffer = ImageBuffer::create(scaledSize, ColorSpaceDeviceRGB, isAcceleratedContext() ? Accelerated : Unaccelerated);
+    OwnPtr<ImageBuffer> buffer = ImageBuffer::create(scaledSize, 1, ColorSpaceDeviceRGB, isAcceleratedContext() ? Accelerated : Unaccelerated);
     if (!buffer)
         return nullptr;
 
diff --git a/Source/WebCore/platform/graphics/GraphicsContext3D.h b/Source/WebCore/platform/graphics/GraphicsContext3D.h
index 17ae9845f..455ffe2bc 100644
--- a/Source/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/Source/WebCore/platform/graphics/GraphicsContext3D.h
@@ -26,13 +26,14 @@
 #ifndef GraphicsContext3D_h
 #define GraphicsContext3D_h
 
+#include "IntRect.h"
 #include "GraphicsLayer.h"
 #include "GraphicsTypes3D.h"
 #include "PlatformString.h"
-
 #include <wtf/HashMap.h>
 #include <wtf/ListHashSet.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/RefCounted.h>
 
 // FIXME: Find a better way to avoid the name confliction for NO_ERROR.
 #if ((PLATFORM(CHROMIUM) && OS(WINDOWS)) || PLATFORM(WIN) || (PLATFORM(QT) && OS(WINDOWS)))
@@ -442,6 +443,7 @@ public:
             , preserveDrawingBuffer(false)
             , noExtensions(false)
             , shareResources(true)
+            , preferDiscreteGPU(false)
         {
         }
 
@@ -454,6 +456,7 @@ public:
         bool preserveDrawingBuffer;
         bool noExtensions;
         bool shareResources;
+        bool preferDiscreteGPU;
     };
 
     enum RenderStyle {
@@ -756,26 +759,25 @@ public:
     void texParameteri(GC3Denum target, GC3Denum pname, GC3Dint param);
     void texSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xoffset, GC3Dint yoffset, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, const void* pixels);
 
-    // FIXME: change the argument orders to match OpenGL's.
     void uniform1f(GC3Dint location, GC3Dfloat x);
-    void uniform1fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei size);
+    void uniform1fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
     void uniform1i(GC3Dint location, GC3Dint x);
-    void uniform1iv(GC3Dint location, GC3Dint* v, GC3Dsizei size);
-    void uniform2f(GC3Dint location, GC3Dfloat x, float y);
-    void uniform2fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei size);
+    void uniform1iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
+    void uniform2f(GC3Dint location, GC3Dfloat x, GC3Dfloat y);
+    void uniform2fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
     void uniform2i(GC3Dint location, GC3Dint x, GC3Dint y);
-    void uniform2iv(GC3Dint location, GC3Dint* v, GC3Dsizei size);
+    void uniform2iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
     void uniform3f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z);
-    void uniform3fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei size);
+    void uniform3fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
     void uniform3i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z);
-    void uniform3iv(GC3Dint location, GC3Dint* v, GC3Dsizei size);
+    void uniform3iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
     void uniform4f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z, GC3Dfloat w);
-    void uniform4fv(GC3Dint location, GC3Dfloat* v, GC3Dsizei size);
+    void uniform4fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
     void uniform4i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z, GC3Dint w);
-    void uniform4iv(GC3Dint location, GC3Dint* v, GC3Dsizei size);
-    void uniformMatrix2fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei size);
-    void uniformMatrix3fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei size);
-    void uniformMatrix4fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* value, GC3Dsizei size);
+    void uniform4iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
+    void uniformMatrix2fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
+    void uniformMatrix3fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
+    void uniformMatrix4fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
 
     void useProgram(Platform3DObject);
     void validateProgram(Platform3DObject);
@@ -913,7 +915,7 @@ public:
 #endif
 
     bool reshapeFBOs(const IntSize&);
-    void resolveMultisamplingIfNecessary(const IntRect&);
+    void resolveMultisamplingIfNecessary(const IntRect& = IntRect());
 
     int m_currentWidth, m_currentHeight;
     bool isResourceSafe();
diff --git a/Source/WebCore/platform/graphics/GraphicsLayer.h b/Source/WebCore/platform/graphics/GraphicsLayer.h
index dabbdaf1e..b41ea0618 100644
--- a/Source/WebCore/platform/graphics/GraphicsLayer.h
+++ b/Source/WebCore/platform/graphics/GraphicsLayer.h
@@ -343,7 +343,8 @@ public:
     virtual void setNeedsDisplay() = 0;
     // mark the given rect (in layer coords) as needing dispay. Never goes deep.
     virtual void setNeedsDisplayInRect(const FloatRect&) = 0;
-    
+    virtual bool needsDisplay() const { return false; }
+
     virtual void setContentsNeedsDisplay() { };
 
     // Set that the position/size of the contents (image or video).
@@ -428,7 +429,7 @@ public:
     bool usingTiledLayer() const { return m_usingTiledLayer; }
 
     // Called whenever the visible rect of the given GraphicsLayer changed.
-    virtual void visibleRectChanged() { }
+    virtual void visibleRectChanged(const IntRect&) { }
 
 #if PLATFORM(QT) || PLATFORM(GTK)
     // This allows several alternative GraphicsLayer implementations in the same port,
diff --git a/Source/WebCore/platform/graphics/ImageBuffer.cpp b/Source/WebCore/platform/graphics/ImageBuffer.cpp
index 5391c3815..e4a9fd857 100644
--- a/Source/WebCore/platform/graphics/ImageBuffer.cpp
+++ b/Source/WebCore/platform/graphics/ImageBuffer.cpp
@@ -71,7 +71,7 @@ void ImageBuffer::transformColorSpace(ColorSpace srcColorSpace, ColorSpace dstCo
 
 inline void ImageBuffer::genericConvertToLuminanceMask()
 {
-    IntRect luminanceRect(IntPoint(), size());
+    IntRect luminanceRect(IntPoint(), internalSize());
     RefPtr<ByteArray> srcPixelArray = getUnmultipliedImageData(luminanceRect);
     
     unsigned pixelArrayLength = srcPixelArray->length();
diff --git a/Source/WebCore/platform/graphics/ImageBuffer.h b/Source/WebCore/platform/graphics/ImageBuffer.h
index f97dc7939..53e86db48 100644
--- a/Source/WebCore/platform/graphics/ImageBuffer.h
+++ b/Source/WebCore/platform/graphics/ImageBuffer.h
@@ -31,6 +31,7 @@
 #include "AffineTransform.h"
 #include "ColorSpace.h"
 #include "FloatRect.h"
+#include "GraphicsContext.h"
 #if USE(ACCELERATED_COMPOSITING)
 #include "GraphicsLayer.h"
 #endif
@@ -46,7 +47,6 @@
 
 namespace WebCore {
 
-    class GraphicsContext;
     class Image;
     class ImageData;
     class IntPoint;
@@ -77,23 +77,29 @@ namespace WebCore {
         WTF_MAKE_NONCOPYABLE(ImageBuffer); WTF_MAKE_FAST_ALLOCATED;
     public:
         // Will return a null pointer on allocation failure.
-        static PassOwnPtr<ImageBuffer> create(const IntSize& size, ColorSpace colorSpace = ColorSpaceDeviceRGB, RenderingMode renderingMode = Unaccelerated, DeferralMode deferralMode = NonDeferred)
+        static PassOwnPtr<ImageBuffer> create(const IntSize& size, float resolutionScale = 1, ColorSpace colorSpace = ColorSpaceDeviceRGB, RenderingMode renderingMode = Unaccelerated, DeferralMode deferralMode = NonDeferred)
         {
             bool success = false;
-            OwnPtr<ImageBuffer> buf = adoptPtr(new ImageBuffer(size, colorSpace, renderingMode, deferralMode, success));
-            if (success)
-                return buf.release();
-            return nullptr;
+            float scaledWidth = ceilf(resolutionScale * size.width());
+            float scaledHeight = ceilf(resolutionScale * size.height());
+            IntSize internalSize(scaledWidth, scaledHeight);
+
+            OwnPtr<ImageBuffer> buf = adoptPtr(new ImageBuffer(internalSize, colorSpace, renderingMode, deferralMode, success));
+            if (!success)
+                return nullptr;
+
+            buf->m_logicalSize = size;
+            buf->m_resolutionScale = resolutionScale;
+            buf->context()->scale(FloatSize(resolutionScale, resolutionScale));
+            return buf.release();
         }
 
         ~ImageBuffer();
 
-        const IntSize& size() const { return m_size; }
-        int width() const { return m_size.width(); }
-        int height() const { return m_size.height(); }
-        
-        size_t dataSize() const;
-        
+        // The actual resolution of the backing store
+        const IntSize& internalSize() const { return m_size; }
+        const IntSize& logicalSize() const { return m_logicalSize; }
+
         GraphicsContext* context() const;
 
         PassRefPtr<Image> copyImage(BackingStoreCopy = CopyBackingStore) const;
@@ -111,7 +117,7 @@ namespace WebCore {
         void transformColorSpace(ColorSpace srcColorSpace, ColorSpace dstColorSpace);
         void platformTransformColorSpace(const Vector<int>&);
 #else
-        AffineTransform baseTransform() const { return AffineTransform(1, 0, 0, -1, 0, m_size.height()); }
+        AffineTransform baseTransform() const { return AffineTransform(1, 0, 0, -1, 0, internalSize().height()); }
 #endif
 #if USE(ACCELERATED_COMPOSITING)
         PlatformLayer* platformLayer() const;
@@ -121,7 +127,6 @@ namespace WebCore {
 #if USE(CG)
         NativeImagePtr copyNativeImage(BackingStoreCopy = CopyBackingStore) const;
 #endif
-
         void clip(GraphicsContext*, const FloatRect&) const;
 
         void draw(GraphicsContext*, ColorSpace, const FloatRect& destRect, const FloatRect& srcRect = FloatRect(0, 0, -1, -1), CompositeOperator = CompositeSourceOver, bool useLowQualityScale = false);
@@ -136,8 +141,9 @@ namespace WebCore {
 
     private:
         ImageBufferData m_data;
-
         IntSize m_size;
+        IntSize m_logicalSize;
+        float m_resolutionScale;
         OwnPtr<GraphicsContext> m_context;
 
 #if !USE(CG)
diff --git a/Source/WebCore/platform/graphics/ImageSource.h b/Source/WebCore/platform/graphics/ImageSource.h
index 7ce7e08b6..1d0220257 100644
--- a/Source/WebCore/platform/graphics/ImageSource.h
+++ b/Source/WebCore/platform/graphics/ImageSource.h
@@ -92,6 +92,10 @@ typedef cairo_surface_t* NativeImagePtr;
 typedef WebCore::NativeImageSkia* NativeImagePtr;
 #elif OS(WINCE)
 typedef RefPtr<SharedBitmap> NativeImagePtr;
+#elif PLATFORM(BLACKBERRY)
+class ImageDecoder;
+typedef ImageDecoder* NativeImageSourcePtr;
+typedef void* NativeImagePtr;
 #endif
 #endif
 
diff --git a/Source/WebCore/platform/graphics/IntRect.h b/Source/WebCore/platform/graphics/IntRect.h
index 3ea8229f4..600c21d0d 100644
--- a/Source/WebCore/platform/graphics/IntRect.h
+++ b/Source/WebCore/platform/graphics/IntRect.h
@@ -53,6 +53,12 @@ typedef struct _GdkRectangle GdkRectangle;
 #endif
 #elif PLATFORM(EFL)
 typedef struct _Eina_Rectangle Eina_Rectangle;
+#elif PLATFORM(BLACKBERRY)
+namespace BlackBerry {
+namespace Platform {
+class IntRect;
+}
+}
 #endif
 
 #if USE(CAIRO)
@@ -97,6 +103,15 @@ public:
     int width() const { return m_size.width(); }
     int height() const { return m_size.height(); }
 
+    // FIXME: These methods are here only to ease the transition to sub-pixel layout. They should
+    // be removed when we close http://webkit.org/b/60318
+    int pixelSnappedX() const { return m_location.x(); }
+    int pixelSnappedY() const { return m_location.y(); }
+    int pixelSnappedMaxX() const { return x() + width(); }
+    int pixelSnappedMaxY() const { return y() + height(); }
+    int pixelSnappedWidth() const { return m_size.width(); }
+    int pixelSnappedHeight() const { return m_size.height(); }
+
     void setX(int x) { m_location.setX(x); }
     void setY(int y) { m_location.setY(y); }
     void setWidth(int width) { m_size.setWidth(width); }
@@ -214,6 +229,11 @@ public:
     operator NSRect() const;
 #endif
 
+#if PLATFORM(BLACKBERRY)
+    IntRect(const BlackBerry::Platform::IntRect&);
+    operator BlackBerry::Platform::IntRect() const;
+#endif
+
 private:
     IntPoint m_location;
     IntSize m_size;
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.cpp b/Source/WebCore/platform/graphics/MediaPlayer.cpp
index 9813eeee1..ed6a13fa8 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.cpp
+++ b/Source/WebCore/platform/graphics/MediaPlayer.cpp
@@ -937,6 +937,14 @@ String MediaPlayer::referrer() const
     return m_mediaPlayerClient->mediaPlayerReferrer();
 }
 
+String MediaPlayer::userAgent() const
+{
+    if (!m_mediaPlayerClient)
+        return String();
+    
+    return m_mediaPlayerClient->mediaPlayerUserAgent();
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/platform/graphics/MediaPlayer.h b/Source/WebCore/platform/graphics/MediaPlayer.h
index 2ccfb72ac..bc10fc306 100644
--- a/Source/WebCore/platform/graphics/MediaPlayer.h
+++ b/Source/WebCore/platform/graphics/MediaPlayer.h
@@ -169,6 +169,7 @@ public:
 #endif
 
     virtual String mediaPlayerReferrer() const { return String(); }
+    virtual String mediaPlayerUserAgent() const { return String(); }
 };
 
 class MediaPlayer {
@@ -336,6 +337,7 @@ public:
 #endif
 
     String referrer() const;
+    String userAgent() const;
 
 private:
     MediaPlayer(MediaPlayerClient*);
diff --git a/Source/WebCore/platform/graphics/Pattern.cpp b/Source/WebCore/platform/graphics/Pattern.cpp
index c2c3de08b..43f1507d2 100644
--- a/Source/WebCore/platform/graphics/Pattern.cpp
+++ b/Source/WebCore/platform/graphics/Pattern.cpp
@@ -37,6 +37,7 @@ Pattern::Pattern(PassRefPtr<Image> image, bool repeatX, bool repeatY)
     , m_repeatY(repeatY)
 #if USE(SKIA)
     , m_pattern(0)
+    , m_externalMemoryAllocated(0)
 #endif
 {
     ASSERT(m_tileImage);
diff --git a/Source/WebCore/platform/graphics/Pattern.h b/Source/WebCore/platform/graphics/Pattern.h
index db3661231..0909584a0 100644
--- a/Source/WebCore/platform/graphics/Pattern.h
+++ b/Source/WebCore/platform/graphics/Pattern.h
@@ -95,6 +95,9 @@ private:
     bool m_repeatY;
     AffineTransform m_patternSpaceTransformation;
     PlatformPatternPtr m_pattern;
+#if USE(SKIA)
+    size_t m_externalMemoryAllocated;
+#endif
 };
 
 } //namespace
diff --git a/Source/WebCore/platform/graphics/Region.cpp b/Source/WebCore/platform/graphics/Region.cpp
index 789556496..3f093ebdc 100644
--- a/Source/WebCore/platform/graphics/Region.cpp
+++ b/Source/WebCore/platform/graphics/Region.cpp
@@ -77,6 +77,31 @@ bool Region::contains(const IntPoint& point) const
     return contains(IntRect(point, IntSize(1, 1)));
 }
 
+bool Region::intersects(const Region& region) const
+{
+    if (!m_bounds.intersects(region.m_bounds))
+        return false;
+
+    // FIXME: this could be optimized.
+    Region tempRegion(*this);
+    tempRegion.intersect(region);
+    return !tempRegion.isEmpty();
+}
+
+unsigned Region::totalArea() const
+{
+    Vector<IntRect> rects = this->rects();
+    size_t size = rects.size();
+    unsigned totalArea = 0;
+
+    for (size_t i = 0; i < size; ++i) {
+        IntRect rect = rects[i];
+        totalArea += (rect.width() * rect.height());
+    }
+
+    return totalArea;
+}
+
 Region::Shape::Shape()
 {
 }
diff --git a/Source/WebCore/platform/graphics/Region.h b/Source/WebCore/platform/graphics/Region.h
index 8bc839578..a87269567 100644
--- a/Source/WebCore/platform/graphics/Region.h
+++ b/Source/WebCore/platform/graphics/Region.h
@@ -52,6 +52,11 @@ public:
 
     bool contains(const IntPoint&) const;
 
+    // Returns true if the query region intersects any part of this region.
+    bool intersects(const Region&) const;
+
+    unsigned totalArea() const;
+
 #ifndef NDEBUG
     void dump() const;
 #endif
diff --git a/Source/WebCore/platform/graphics/ShadowBlur.cpp b/Source/WebCore/platform/graphics/ShadowBlur.cpp
index 0f207f83d..3b8a956b0 100644
--- a/Source/WebCore/platform/graphics/ShadowBlur.cpp
+++ b/Source/WebCore/platform/graphics/ShadowBlur.cpp
@@ -73,14 +73,14 @@ public:
         m_bufferInUse = true;
 #endif
         // We do not need to recreate the buffer if the current buffer is large enough.
-        if (m_imageBuffer && m_imageBuffer->width() >= size.width() && m_imageBuffer->height() >= size.height())
+        if (m_imageBuffer && m_imageBuffer->logicalSize().width() >= size.width() && m_imageBuffer->logicalSize().height() >= size.height())
             return m_imageBuffer.get();
 
         // Round to the nearest 32 pixels so we do not grow the buffer for similar sized requests.
         IntSize roundedSize(roundUpToMultipleOf32(size.width()), roundUpToMultipleOf32(size.height()));
 
         clearScratchBuffer();
-        m_imageBuffer = ImageBuffer::create(roundedSize);
+        m_imageBuffer = ImageBuffer::create(roundedSize, 1);
         return m_imageBuffer.get();
     }
 
@@ -440,7 +440,7 @@ void ShadowBlur::drawShadowBuffer(GraphicsContext* graphicsContext)
 
     GraphicsContextStateSaver stateSaver(*graphicsContext);
 
-    IntSize bufferSize = m_layerImage->size();
+    IntSize bufferSize = m_layerImage->internalSize();
     if (bufferSize != m_layerSize) {
         // The rect passed to clipToImageBuffer() has to be the size of the entire buffer,
         // but we may not have cleared it all, so clip to the filled part first.
diff --git a/Source/WebCore/platform/graphics/TiledBackingStore.cpp b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
index acf4c8957..9bd424c94 100644
--- a/Source/WebCore/platform/graphics/TiledBackingStore.cpp
+++ b/Source/WebCore/platform/graphics/TiledBackingStore.cpp
@@ -1,5 +1,5 @@
 /*
- Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ Copyright (C) 2010-2012 Nokia Corporation and/or its subsidiary(-ies)
  
  This library is free software; you can redistribute it and/or
  modify it under the terms of the GNU Library General Public
@@ -26,7 +26,7 @@
 #include "TiledBackingStoreClient.h"
 
 namespace WebCore {
-    
+
 static const int defaultTileDimension = 512;
 
 static IntPoint innerBottomRight(const IntRect& rect)
@@ -38,8 +38,8 @@ static IntPoint innerBottomRight(const IntRect& rect)
 TiledBackingStore::TiledBackingStore(TiledBackingStoreClient* client, PassOwnPtr<TiledBackingStoreBackend> backend)
     : m_client(client)
     , m_backend(backend)
-    , m_tileBufferUpdateTimer(new TileTimer(this, &TiledBackingStore::tileBufferUpdateTimerFired))
-    , m_tileCreationTimer(new TileTimer(this, &TiledBackingStore::tileCreationTimerFired))
+    , m_tileBufferUpdateTimer(this, &TiledBackingStore::tileBufferUpdateTimerFired)
+    , m_backingStoreUpdateTimer(this, &TiledBackingStore::backingStoreUpdateTimerFired)
     , m_tileSize(defaultTileDimension, defaultTileDimension)
     , m_tileCreationDelay(0.01)
     , m_coverAreaMultiplier(2.0f)
@@ -52,15 +52,13 @@ TiledBackingStore::TiledBackingStore(TiledBackingStoreClient* client, PassOwnPtr
 
 TiledBackingStore::~TiledBackingStore()
 {
-    delete m_tileBufferUpdateTimer;
-    delete m_tileCreationTimer;
 }
 
 void TiledBackingStore::setTileSize(const IntSize& size)
 {
     m_tileSize = size;
     m_tiles.clear();
-    startTileCreationTimer();
+    startBackingStoreUpdateTimer();
 }
 
 void TiledBackingStore::setTileCreationDelay(double delay)
@@ -68,25 +66,25 @@ void TiledBackingStore::setTileCreationDelay(double delay)
     m_tileCreationDelay = delay;
 }
 
-void TiledBackingStore::coverWithTilesIfNeeded(const FloatPoint& panningTrajectoryVector)
+void TiledBackingStore::coverWithTilesIfNeeded(const FloatPoint& trajectoryVector)
 {
-    IntRect visibleRect = visibleContentsRect();
-    if (m_visibleRectTrajectoryVector == panningTrajectoryVector && m_previousVisibleRect == visibleRect)
+    IntRect visibleRect = this->visibleRect();
+    if (m_trajectoryVector == trajectoryVector && m_visibleRect == visibleRect)
         return;
 
-    m_visibleRectTrajectoryVector = panningTrajectoryVector;
-    m_previousVisibleRect = visibleRect;
+    m_trajectoryVector = trajectoryVector;
+    m_visibleRect = visibleRect;
 
-    startTileCreationTimer();
+    startBackingStoreUpdateTimer();
 }
 
 void TiledBackingStore::invalidate(const IntRect& contentsDirtyRect)
 {
-    IntRect dirtyRect(mapFromContents(contentsDirtyRect));
-    
+    IntRect dirtyRect(intersection(mapFromContents(contentsDirtyRect), m_keepRect));
+
     Tile::Coordinate topLeft = tileCoordinateForPoint(dirtyRect.location());
     Tile::Coordinate bottomRight = tileCoordinateForPoint(innerBottomRight(dirtyRect));
-    
+
     for (unsigned yCoordinate = topLeft.y(); yCoordinate <= bottomRight.y(); ++yCoordinate) {
         for (unsigned xCoordinate = topLeft.x(); xCoordinate <= bottomRight.x(); ++xCoordinate) {
             RefPtr<Tile> currentTile = tileAt(Tile::Coordinate(xCoordinate, yCoordinate));
@@ -103,7 +101,7 @@ void TiledBackingStore::updateTileBuffers()
 {
     if (!m_client->tiledBackingStoreUpdatesAllowed() || m_contentsFrozen)
         return;
-    
+
     m_client->tiledBackingStorePaintBegin();
 
     Vector<IntRect> paintedArea;
@@ -114,7 +112,7 @@ void TiledBackingStore::updateTileBuffers()
             continue;
         dirtyTiles.append(it->second);
     }
-    
+
     if (dirtyTiles.isEmpty()) {
         m_client->tiledBackingStorePaintEnd(paintedArea);
         return;
@@ -136,13 +134,13 @@ void TiledBackingStore::updateTileBuffers()
 void TiledBackingStore::paint(GraphicsContext* context, const IntRect& rect)
 {
     context->save();
-    
+
     // Assumes the backing store is painted with the scale transform applied.
     // Since tile content is already scaled, first revert the scaling from the painter.
     context->scale(FloatSize(1.f / m_contentsScale, 1.f / m_contentsScale));
-    
+
     IntRect dirtyRect = mapFromContents(rect);
-    
+
     Tile::Coordinate topLeft = tileCoordinateForPoint(dirtyRect.location());
     Tile::Coordinate bottomRight = tileCoordinateForPoint(innerBottomRight(dirtyRect));
 
@@ -164,7 +162,7 @@ void TiledBackingStore::paint(GraphicsContext* context, const IntRect& rect)
     context->restore();
 }
 
-IntRect TiledBackingStore::visibleContentsRect() const
+IntRect TiledBackingStore::visibleRect() const
 {
     return mapFromContents(intersection(m_client->tiledBackingStoreVisibleRect(), m_client->tiledBackingStoreContentsRect()));
 }
@@ -180,26 +178,24 @@ void TiledBackingStore::setContentsScale(float scale)
         return;
     commitScaleChange();
 }
-    
+
 void TiledBackingStore::commitScaleChange()
 {
     m_contentsScale = m_pendingScale;
     m_pendingScale = 0;
     m_tiles.clear();
-    createTiles();
+    coverWithTilesIfNeeded();
 }
 
 double TiledBackingStore::tileDistance(const IntRect& viewport, const Tile::Coordinate& tileCoordinate) const
 {
     if (viewport.intersects(tileRectForCoordinate(tileCoordinate)))
         return 0;
-    
+
     IntPoint viewCenter = viewport.location() + IntSize(viewport.width() / 2, viewport.height() / 2);
     Tile::Coordinate centerCoordinate = tileCoordinateForPoint(viewCenter);
-    
-    // Manhattan distance, biased so that vertical distances are shorter.
-    const double horizontalBias = 1.3;
-    return abs(centerCoordinate.y() - tileCoordinate.y()) + horizontalBias * abs(centerCoordinate.x() - tileCoordinate.x());
+
+    return std::max(abs(centerCoordinate.y() - tileCoordinate.y()), abs(centerCoordinate.x() - tileCoordinate.x()));
 }
 
 // Returns a ratio between 0.0f and 1.0f of the surface of contentsRect covered by rendered tiles.
@@ -215,7 +211,7 @@ float TiledBackingStore::coverageRatio(const WebCore::IntRect& contentsRect) con
     for (unsigned yCoordinate = topLeft.y(); yCoordinate <= bottomRight.y(); ++yCoordinate) {
         for (unsigned xCoordinate = topLeft.x(); xCoordinate <= bottomRight.x(); ++xCoordinate) {
             Tile::Coordinate currentCoordinate(xCoordinate, yCoordinate);
-            RefPtr<Tile> currentTile = tileAt(Tile::Coordinate(xCoordinate, yCoordinate));
+            RefPtr<Tile> currentTile = tileAt(currentCoordinate);
             if (currentTile && currentTile->isReadyToPaint()) {
                 IntRect coverRect = intersection(dirtyRect, currentTile->rect());
                 coverArea += coverRect.width() * coverRect.height();
@@ -227,35 +223,46 @@ float TiledBackingStore::coverageRatio(const WebCore::IntRect& contentsRect) con
 
 bool TiledBackingStore::visibleAreaIsCovered() const
 {
-    return coverageRatio(visibleContentsRect()) == 1.0f;
+    return coverageRatio(visibleRect()) == 1.0f;
 }
 
 void TiledBackingStore::createTiles()
 {
-    if (m_contentsFrozen)
+    // Guard here as as these can change before the timer fires.
+    if (isBackingStoreUpdatesSuspended())
         return;
-    
-    IntRect visibleRect = visibleContentsRect();
-    m_previousVisibleRect = visibleRect;
+
+    // Update our backing store geometry.
+    const IntRect previousRect = m_rect;
+    m_rect = mapFromContents(m_client->tiledBackingStoreContentsRect());
+
+    const IntRect visibleRect = this->visibleRect();
+    m_visibleRect = visibleRect;
 
     if (visibleRect.isEmpty())
         return;
 
-    // Resize tiles on edges in case the contents size has changed.
-    bool didResizeTiles = resizeEdgeTiles();
-
     IntRect keepRect;
     IntRect coverRect;
     computeCoverAndKeepRect(visibleRect, coverRect, keepRect);
 
-    dropTilesOutsideRect(keepRect);
-    
-    // Search for the tile position closest to the viewport center that does not yet contain a tile. 
+    setKeepRect(keepRect);
+
+    // Resize tiles at the edge in case the contents size has changed, but only do so
+    // after having dropped tiles outside the keep rect.
+    bool didResizeTiles = false;
+    if (previousRect != m_rect)
+        didResizeTiles = resizeEdgeTiles();
+
+    // Search for the tile position closest to the viewport center that does not yet contain a tile.
     // Which position is considered the closest depends on the tileDistance function.
     double shortestDistance = std::numeric_limits<double>::infinity();
     Vector<Tile::Coordinate> tilesToCreate;
     unsigned requiredTileCount = 0;
 
+    // Cover areas (in tiles) with minimum distance from the visible rect. If the visible rect is
+    // not covered already it will be covered first in one go, due to the distance being 0 for tiles
+    // inside the visible rect.
     Tile::Coordinate topLeft = tileCoordinateForPoint(coverRect.location());
     Tile::Coordinate bottomRight = tileCoordinateForPoint(innerBottomRight(coverRect));
     for (unsigned yCoordinate = topLeft.y(); yCoordinate <= bottomRight.y(); ++yCoordinate) {
@@ -264,7 +271,6 @@ void TiledBackingStore::createTiles()
             if (tileAt(currentCoordinate))
                 continue;
             ++requiredTileCount;
-            // Distance is 0 for all tiles inside the visibleRect.
             double distance = tileDistance(visibleRect, currentCoordinate);
             if (distance > shortestDistance)
                 continue;
@@ -284,18 +290,18 @@ void TiledBackingStore::createTiles()
     }
     requiredTileCount -= tilesToCreateCount;
 
-    // Paint the content of the newly created tiles.
+    // Paint the content of the newly created tiles or resized tiles.
     if (tilesToCreateCount || didResizeTiles)
         updateTileBuffers();
 
     // Re-call createTiles on a timer to cover the visible area with the newest shortest distance.
     if (requiredTileCount)
-        m_tileCreationTimer->startOneShot(m_tileCreationDelay);
+        m_backingStoreUpdateTimer.startOneShot(m_tileCreationDelay);
 }
 
 void TiledBackingStore::adjustForContentsRect(IntRect& rect) const
 {
-    IntRect bounds = contentsRect();
+    IntRect bounds = m_rect;
     IntSize candidateSize = rect.size();
 
     // We will try to keep the cover and keep rect the same size at all time, which
@@ -334,7 +340,7 @@ void TiledBackingStore::computeCoverAndKeepRect(const IntRect& visibleRect, IntR
         coverRect.inflateY(visibleRect.height() * (m_coverAreaMultiplier - 1) / 2);
         keepRect = coverRect;
 
-        float trajectoryVectorNorm = sqrt(pow(m_visibleRectTrajectoryVector.x(), 2) + pow(m_visibleRectTrajectoryVector.y(), 2));
+        float trajectoryVectorNorm = sqrt(pow(m_trajectoryVector.x(), 2) + pow(m_trajectoryVector.y(), 2));
         if (trajectoryVectorNorm) {
             // A null trajectory vector (no motion) means that tiles for the coverArea will be created.
             // A non-null trajectory vector will shrink the covered rect to visibleRect plus its expansion from its
@@ -350,8 +356,8 @@ void TiledBackingStore::computeCoverAndKeepRect(const IntRect& visibleRect, IntR
 
             // Unite the visible rect with a "ghost" of the visible rect moved in the direction of the trajectory vector.
             coverRect = visibleRect;
-            coverRect.move(coverRect.width() * m_visibleRectTrajectoryVector.x() / trajectoryVectorNorm * trajectoryVectorMultiplier,
-                           coverRect.height() * m_visibleRectTrajectoryVector.y() / trajectoryVectorNorm * trajectoryVectorMultiplier);
+            coverRect.move(coverRect.width() * m_trajectoryVector.x() / trajectoryVectorNorm * trajectoryVectorMultiplier,
+                           coverRect.height() * m_trajectoryVector.y() / trajectoryVectorNorm * trajectoryVectorMultiplier);
 
             coverRect.unite(visibleRect);
         }
@@ -367,10 +373,19 @@ void TiledBackingStore::computeCoverAndKeepRect(const IntRect& visibleRect, IntR
     adjustForContentsRect(keepRect);
 }
 
+bool TiledBackingStore::isBackingStoreUpdatesSuspended() const
+{
+    return m_contentsFrozen;
+}
+
+bool TiledBackingStore::isTileBufferUpdatesSuspended() const
+{
+    return m_contentsFrozen || !m_client->tiledBackingStoreUpdatesAllowed();
+}
+
 bool TiledBackingStore::resizeEdgeTiles()
 {
     bool wasResized = false;
-
     Vector<Tile::Coordinate> tilesToRemove;
     TileMap::iterator end = m_tiles.end();
     for (TileMap::iterator it = m_tiles.begin(); it != end; ++it) {
@@ -390,8 +405,10 @@ bool TiledBackingStore::resizeEdgeTiles()
     return wasResized;
 }
 
-void TiledBackingStore::dropTilesOutsideRect(const IntRect& keepRect)
+void TiledBackingStore::setKeepRect(const IntRect& keepRect)
 {
+    // Drop tiles outside the new keepRect.
+
     FloatRect keepRectF = keepRect;
 
     Vector<Tile::Coordinate> toRemove;
@@ -405,11 +422,13 @@ void TiledBackingStore::dropTilesOutsideRect(const IntRect& keepRect)
     unsigned removeCount = toRemove.size();
     for (unsigned n = 0; n < removeCount; ++n)
         removeTile(toRemove[n]);
+
+    m_keepRect = keepRect;
 }
 
 void TiledBackingStore::removeAllNonVisibleTiles()
 {
-    dropTilesOutsideRect(visibleContentsRect());
+    setKeepRect(visibleRect());
 }
 
 PassRefPtr<Tile> TiledBackingStore::tileAt(const Tile::Coordinate& coordinate) const
@@ -443,11 +462,6 @@ IntRect TiledBackingStore::mapFromContents(const IntRect& rect) const
         rect.height() * m_contentsScale));
 }
 
-IntRect TiledBackingStore::contentsRect() const
-{
-    return mapFromContents(m_client->tiledBackingStoreContentsRect());
-}
-
 IntRect TiledBackingStore::tileRectForCoordinate(const Tile::Coordinate& coordinate) const
 {
     IntRect rect(coordinate.x() * m_tileSize.width(),
@@ -455,10 +469,10 @@ IntRect TiledBackingStore::tileRectForCoordinate(const Tile::Coordinate& coordin
                  m_tileSize.width(),
                  m_tileSize.height());
 
-    rect.intersect(contentsRect());
+    rect.intersect(m_rect);
     return rect;
 }
-    
+
 Tile::Coordinate TiledBackingStore::tileCoordinateForPoint(const IntPoint& point) const
 {
     int x = point.x() / m_tileSize.width();
@@ -466,27 +480,26 @@ Tile::Coordinate TiledBackingStore::tileCoordinateForPoint(const IntPoint& point
     return Tile::Coordinate(std::max(x, 0), std::max(y, 0));
 }
 
-
 void TiledBackingStore::startTileBufferUpdateTimer()
 {
-    if (m_tileBufferUpdateTimer->isActive() || !m_client->tiledBackingStoreUpdatesAllowed() || m_contentsFrozen)
+    if (m_tileBufferUpdateTimer.isActive() || isTileBufferUpdatesSuspended())
         return;
-    m_tileBufferUpdateTimer->startOneShot(0);
+    m_tileBufferUpdateTimer.startOneShot(0);
 }
 
-void TiledBackingStore::tileBufferUpdateTimerFired(TileTimer*)
+void TiledBackingStore::tileBufferUpdateTimerFired(Timer<TiledBackingStore>*)
 {
     updateTileBuffers();
 }
 
-void TiledBackingStore::startTileCreationTimer()
+void TiledBackingStore::startBackingStoreUpdateTimer()
 {
-    if (m_tileCreationTimer->isActive() || m_contentsFrozen)
+    if (m_backingStoreUpdateTimer.isActive() || isBackingStoreUpdatesSuspended())
         return;
-    m_tileCreationTimer->startOneShot(0);
+    m_backingStoreUpdateTimer.startOneShot(0);
 }
 
-void TiledBackingStore::tileCreationTimerFired(TileTimer*)
+void TiledBackingStore::backingStoreUpdateTimerFired(Timer<TiledBackingStore>*)
 {
     createTiles();
 }
@@ -506,7 +519,7 @@ void TiledBackingStore::setContentsFrozen(bool freeze)
     if (m_pendingScale)
         commitScaleChange();
     else {
-        startTileCreationTimer();
+        startBackingStoreUpdateTimer();
         startTileBufferUpdateTimer();
     }
 }
@@ -516,7 +529,7 @@ void TiledBackingStore::setSupportsAlpha(bool a)
     if (a == supportsAlpha())
         return;
     m_supportsAlpha = a;
-    invalidate(contentsRect());
+    invalidate(m_rect);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/TiledBackingStore.h b/Source/WebCore/platform/graphics/TiledBackingStore.h
index ea5607b16..3c6ac9350 100644
--- a/Source/WebCore/platform/graphics/TiledBackingStore.h
+++ b/Source/WebCore/platform/graphics/TiledBackingStore.h
@@ -1,5 +1,5 @@
 /*
- Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ Copyright (C) 2010-2012 Nokia Corporation and/or its subsidiary(-ies)
  
  This library is free software; you can redistribute it and/or
  modify it under the terms of the GNU Library General Public
@@ -80,27 +80,27 @@ public:
 
 private:
     void startTileBufferUpdateTimer();
-    void startTileCreationTimer();
+    void startBackingStoreUpdateTimer();
 
-    typedef Timer<TiledBackingStore> TileTimer;
-
-    void tileBufferUpdateTimerFired(TileTimer*);
-    void tileCreationTimerFired(TileTimer*);
+    void tileBufferUpdateTimerFired(Timer<TiledBackingStore>*);
+    void backingStoreUpdateTimerFired(Timer<TiledBackingStore>*);
 
     void createTiles();
     void computeCoverAndKeepRect(const IntRect& visibleRect, IntRect& coverRect, IntRect& keepRect) const;
 
+    bool isBackingStoreUpdatesSuspended() const;
+    bool isTileBufferUpdatesSuspended() const;
+
     void commitScaleChange();
 
     bool resizeEdgeTiles();
-    void dropTilesOutsideRect(const IntRect&);
+    void setKeepRect(const IntRect&);
 
     PassRefPtr<Tile> tileAt(const Tile::Coordinate&) const;
     void setTile(const Tile::Coordinate& coordinate, PassRefPtr<Tile> tile);
     void removeTile(const Tile::Coordinate& coordinate);
 
-    IntRect contentsRect() const;
-    IntRect visibleContentsRect() const;
+    IntRect visibleRect() const;
 
     float coverageRatio(const IntRect&) const;
     void adjustForContentsRect(IntRect&) const;
@@ -114,15 +114,19 @@ private:
     typedef HashMap<Tile::Coordinate, RefPtr<Tile> > TileMap;
     TileMap m_tiles;
 
-    TileTimer* m_tileBufferUpdateTimer;
-    TileTimer* m_tileCreationTimer;
+    Timer<TiledBackingStore> m_tileBufferUpdateTimer;
+    Timer<TiledBackingStore> m_backingStoreUpdateTimer;
 
     IntSize m_tileSize;
     double m_tileCreationDelay;
     float m_coverAreaMultiplier;
-    FloatPoint m_visibleRectTrajectoryVector;
-    
-    IntRect m_previousVisibleRect;
+
+    FloatPoint m_trajectoryVector;
+    IntRect m_visibleRect;
+
+    IntRect m_keepRect;
+    IntRect m_rect;
+
     float m_contentsScale;
     float m_pendingScale;
 
diff --git a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
index 0b30b2ec9..d8f1fe8dc 100644
--- a/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
+++ b/Source/WebCore/platform/graphics/avfoundation/objc/MediaPlayerPrivateAVFoundationObjC.mm
@@ -261,12 +261,18 @@ void MediaPlayerPrivateAVFoundationObjC::createAVAssetForURL(const String& url)
     [options.get() setObject:[NSNumber numberWithInt:AVAssetReferenceRestrictionForbidRemoteReferenceToLocal | AVAssetReferenceRestrictionForbidLocalReferenceToRemote] forKey:AVURLAssetReferenceRestrictionsKey];
 
 #if !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
+    RetainPtr<NSMutableDictionary> headerFields(AdoptNS, [[NSMutableDictionary alloc] init]);
+
     String referrer = player()->referrer();
-    if (!referrer.isEmpty()) {
-        RetainPtr<NSMutableDictionary> headerFields(AdoptNS, [[NSMutableDictionary alloc] init]);
+    if (!referrer.isEmpty())
         [headerFields.get() setObject:referrer forKey:@"Referer"];
+
+    String userAgent = player()->userAgent();
+    if (!userAgent.isEmpty())
+        [headerFields.get() setObject:userAgent forKey:@"User-Agent"];
+
+    if ([headerFields.get() count])
         [options.get() setObject:headerFields.get() forKey:@"AVURLAssetHTTPHeaderFieldsKey"];
-    }
 #endif
 
     NSURL *cocoaURL = KURL(ParsedURLString, url);
diff --git a/Source/WebCore/platform/graphics/blackberry/CanvasLayerWebKitThread.cpp b/Source/WebCore/platform/graphics/blackberry/CanvasLayerWebKitThread.cpp
new file mode 100644
index 000000000..4d2032679
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/CanvasLayerWebKitThread.cpp
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "CanvasLayerWebKitThread.h"
+
+#if USE(ACCELERATED_COMPOSITING) && ENABLE(SKIA_GPU_CANVAS)
+
+#include "HTMLCanvasElement.h"
+#include "PlatformContextSkia.h"
+
+#include <BlackBerryPlatformGraphics.h>
+#include <GLES2/gl2.h>
+#include <GrGLTexture.h>
+#include <SkGpuDevice.h>
+
+namespace WebCore {
+
+CanvasLayerWebKitThread::CanvasLayerWebKitThread(HTMLCanvasElement* canvas)
+    : LayerWebKitThread(Layer, 0)
+{
+    setCanvas(canvas);
+}
+
+CanvasLayerWebKitThread::~CanvasLayerWebKitThread()
+{
+    if (m_texID) {
+        BlackBerry::Platform::Graphics::makeSharedResourceContextCurrent(BlackBerry::Platform::Graphics::GLES2);
+        glDeleteTextures(1, &m_texID);
+    }
+}
+
+void CanvasLayerWebKitThread::setCanvas(HTMLCanvasElement* canvas)
+{
+    m_canvas = canvas;
+    setNeedsTexture(isDrawable() && canvas);
+    setLayerProgramShader(LayerProgramShaderRGBA);
+    setNeedsDisplay();
+}
+
+void CanvasLayerWebKitThread::setNeedsDisplay()
+{
+    m_needsDisplay = true;
+    setNeedsCommit();
+}
+
+void CanvasLayerWebKitThread::updateTextureContentsIfNeeded()
+{
+    if (!m_needsDisplay)
+        return;
+
+    m_needsDisplay = false;
+
+    if (!m_canvas || !m_canvas->drawingContext())
+        return;
+
+    SkGpuDevice* gpuDevice = static_cast<SkGpuDevice*>(m_canvas->drawingContext()->platformContext()->canvas()->getDevice());
+    gpuDevice->makeRenderTargetCurrent();
+    // We know this is a GrGLTexture
+    if (GrGLTexture* deviceTexture = (GrGLTexture*)gpuDevice->accessTexture()) {
+        m_texWidth = deviceTexture->allocWidth();
+        m_texHeight = deviceTexture->allocHeight();
+    }
+
+    GLint previousTexture;
+    glGetIntegerv(GL_TEXTURE_BINDING_2D, &previousTexture);
+
+    if (!m_texID) {
+        glGenTextures(1, &m_texID);
+        glBindTexture(GL_TEXTURE_2D, m_texID);
+        glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+        glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+        glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+        glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+        glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, m_canvas->width(), m_canvas->height(), 0, GL_RGBA, GL_UNSIGNED_BYTE, 0);
+
+        createFrontBufferLock();
+    }
+
+    pthread_mutex_lock(m_frontBufferLock);
+    glBindTexture(GL_TEXTURE_2D, m_texID);
+    glCopyTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, 0, 0, m_texWidth, m_texHeight, 0);
+    glBindTexture(GL_TEXTURE_2D, previousTexture);
+    pthread_mutex_unlock(m_frontBufferLock);
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING) && ENABLE(SKIA_GPU_CANVAS)
diff --git a/Source/WebCore/platform/graphics/blackberry/CanvasLayerWebKitThread.h b/Source/WebCore/platform/graphics/blackberry/CanvasLayerWebKitThread.h
new file mode 100644
index 000000000..9a731ce82
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/CanvasLayerWebKitThread.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef CanvasLayerWebKitThread_h
+#define CanvasLayerWebKitThread_h
+
+#if USE(ACCELERATED_COMPOSITING) && ENABLE(SKIA_GPU_CANVAS)
+
+#include "LayerWebKitThread.h"
+
+namespace WebCore {
+
+class HTMLCanvasElement;
+
+class CanvasLayerWebKitThread : public LayerWebKitThread {
+public:
+    static PassRefPtr<CanvasLayerWebKitThread> create(HTMLCanvasElement* canvas)
+    {
+        return adoptRef(new CanvasLayerWebKitThread(canvas));
+    }
+
+    virtual ~CanvasLayerWebKitThread();
+
+    void setCanvas(HTMLCanvasElement*);
+
+    virtual void setNeedsDisplay();
+
+protected:
+    virtual void updateTextureContentsIfNeeded();
+
+private:
+    CanvasLayerWebKitThread(HTMLCanvasElement*);
+    bool m_needsDisplay;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING) && ENABLE(SKIA_GPU_CANVAS)
+
+#endif // CanvasLayerWebKitThread_h
diff --git a/Source/WebCore/platform/graphics/blackberry/DrawingBufferBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/DrawingBufferBlackBerry.cpp
new file mode 100644
index 000000000..c53108c00
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/DrawingBufferBlackBerry.cpp
@@ -0,0 +1,130 @@
+/*
+ * Copyright (c) 2010, Google Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DrawingBuffer.h"
+
+#include "GraphicsContext3D.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "LayerWebKitThread.h"
+#endif
+
+namespace WebCore {
+
+struct DrawingBufferInternal {
+    unsigned offscreenColorTexture;
+#if USE(ACCELERATED_COMPOSITING)
+    RefPtr<LayerWebKitThread> platformLayer;
+#endif
+};
+
+static unsigned generateColorTexture(GraphicsContext3D* context, const IntSize& size)
+{
+    unsigned offscreenColorTexture = context->createTexture();
+    if (!offscreenColorTexture)
+        return 0;
+
+    context->bindTexture(GraphicsContext3D::TEXTURE_2D, offscreenColorTexture);
+    context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::NEAREST);
+    context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::NEAREST);
+    context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE);
+    context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
+    context->texImage2D(GraphicsContext3D::TEXTURE_2D, 0, GraphicsContext3D::RGBA, size.width(), size.height(), 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, 0);
+    context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, offscreenColorTexture, 0);
+    return offscreenColorTexture;
+}
+
+DrawingBuffer::DrawingBuffer(GraphicsContext3D* context, const IntSize& size)
+    : m_context(context)
+    , m_size(size)
+    , m_fbo(context->createFramebuffer())
+{
+    m_internal = adoptPtr(new DrawingBufferInternal);
+
+    context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_fbo);
+    m_internal->offscreenColorTexture = generateColorTexture(context, size);
+}
+
+DrawingBuffer::~DrawingBuffer()
+{
+    if (!m_context)
+        return;
+
+    m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_fbo);
+    m_context->deleteTexture(m_internal->offscreenColorTexture);
+
+    clear();
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+void DrawingBuffer::publishToPlatformLayer()
+{
+    if (!m_context)
+        return;
+
+    if (m_callback)
+        m_callback->willPublish();
+
+    // FIXME: We do the copy in the canvas' (child) context so that it executes in the correct order relative to
+    // other commands in the child context. This ensures that the parent texture always contains a complete
+    // frame and not some intermediate result. However, there is no synchronization to ensure that this copy
+    // happens before the compositor draws. This means we might draw stale frames sometimes. Ideally this
+    // would insert a fence into the child command stream that the compositor could wait for.
+    m_context->makeContextCurrent();
+    m_context->flush();
+}
+#endif
+
+bool DrawingBuffer::reset(const IntSize& newSize)
+{
+    if (!m_context)
+        return false;
+
+    if (m_size == newSize)
+        return false;
+
+    m_size = newSize;
+
+    m_context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_internal->offscreenColorTexture);
+    m_context->texImage2D(GraphicsContext3D::TEXTURE_2D, 0, GraphicsContext3D::RGBA, m_size.width(), m_size.height(), 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, 0);
+
+    return true;
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+PlatformLayer* DrawingBuffer::platformLayer()
+{
+    return m_internal->platformLayer.get();
+}
+#endif
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp
new file mode 100644
index 000000000..56a585e04
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/GraphicsContext3DBlackBerry.cpp
@@ -0,0 +1,208 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEBGL)
+
+#include "GraphicsContext3D.h"
+
+#include "BitmapImageSingleFrameSkia.h"
+#include "Extensions3DOpenGL.h"
+#include "GraphicsContext.h"
+#include "WebGLLayerWebKitThread.h"
+
+#include <BlackBerryPlatformGraphics.h>
+
+namespace WebCore {
+
+PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(Attributes attribs, HostWindow* hostWindow, RenderStyle renderStyle)
+{
+    // This implementation doesn't currently support rendering directly to a window.
+    if (renderStyle == RenderDirectlyToHostWindow)
+        return 0;
+
+    return adoptRef(new GraphicsContext3D(attribs, hostWindow, false));
+}
+
+GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, bool renderDirectlyToHostWindow)
+    : m_currentWidth(0)
+    , m_currentHeight(0)
+    , m_hostWindow(hostWindow)
+    , m_context(BlackBerry::Platform::Graphics::createWebGLContext())
+    , m_extensions(adoptPtr(new Extensions3DOpenGL(this)))
+    , m_attrs(attrs)
+    , m_texture(0)
+    , m_fbo(0)
+    , m_depthStencilBuffer(0)
+    , m_boundFBO(0)
+    , m_activeTexture(GL_TEXTURE0)
+    , m_boundTexture0(0)
+    , m_multisampleFBO(0)
+    , m_multisampleDepthStencilBuffer(0)
+    , m_multisampleColorBuffer(0)
+{
+    if (!renderDirectlyToHostWindow) {
+#if USE(ACCELERATED_COMPOSITING)
+        m_compositingLayer = WebGLLayerWebKitThread::create();
+#endif
+        makeContextCurrent();
+
+        Extensions3D* extensions = getExtensions();
+        if (!extensions->supports("GL_IMG_multisampled_render_to_texture"))
+            m_attrs.antialias = false;
+
+        // Create a texture to render into.
+        ::glGenTextures(1, &m_texture);
+        ::glBindTexture(GL_TEXTURE_2D, m_texture);
+        ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+        ::glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+        ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+        ::glTexParameteri(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+        ::glBindTexture(GL_TEXTURE_2D, 0);
+
+        // Create an FBO.
+        ::glGenFramebuffers(1, &m_fbo);
+        ::glBindFramebuffer(GL_FRAMEBUFFER, m_fbo);
+        if (m_attrs.stencil || m_attrs.depth)
+            ::glGenRenderbuffers(1, &m_depthStencilBuffer);
+        m_boundFBO = m_fbo;
+
+#if USE(ACCELERATED_COMPOSITING)
+        static_cast<WebGLLayerWebKitThread*>(m_compositingLayer.get())->setWebGLContext(this);
+#endif
+    }
+
+    // FIXME: If GraphicsContext3D is created with renderDirectlyToHostWindow == true,
+    // makeContextCurrent() will make the shared context current.
+    makeContextCurrent();
+
+    // FIXME: Do we need to enable GL_VERTEX_PROGRAM_POINT_SIZE with GL ES2? See PR #120141.
+
+    ::glClearColor(0, 0, 0, 0);
+}
+
+GraphicsContext3D::~GraphicsContext3D()
+{
+    if (m_texture) {
+        makeContextCurrent();
+        ::glDeleteTextures(1, &m_texture);
+        if (m_attrs.stencil || m_attrs.depth)
+            ::glDeleteRenderbuffers(1, &m_depthStencilBuffer);
+        ::glDeleteFramebuffers(1, &m_fbo);
+    }
+
+    BlackBerry::Platform::Graphics::destroyWebGLContext(m_context);
+}
+
+bool GraphicsContext3D::paintsIntoCanvasBuffer() const
+{
+    // See PR #120141.
+    return true;
+}
+
+bool GraphicsContext3D::makeContextCurrent()
+{
+    BlackBerry::Platform::Graphics::useWebGLContext(m_context);
+    return true;
+}
+
+bool GraphicsContext3D::isGLES2Compliant() const
+{
+    return true;
+}
+
+bool GraphicsContext3D::isGLES2NPOTStrict() const
+{
+    return true;
+}
+
+bool GraphicsContext3D::isErrorGeneratedOnOutOfBoundsAccesses() const
+{
+    return false;
+}
+
+Platform3DObject GraphicsContext3D::platformTexture() const
+{
+    return m_texture;
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+PlatformLayer* GraphicsContext3D::platformLayer() const
+{
+    return m_compositingLayer.get();
+}
+#endif
+
+void GraphicsContext3D::paintToCanvas(const unsigned char* imagePixels, int imageWidth, int imageHeight, int canvasWidth, int canvasHeight,
+       GraphicsContext* context, bool flipY)
+{
+    // Reorder pixels into BGRA format.
+    unsigned char* tempPixels = new unsigned char[imageWidth * imageHeight * 4];
+
+    if (flipY) {
+        for (int y = 0; y < imageHeight; y++) {
+            const unsigned char *srcRow = imagePixels + (imageWidth * 4 * y);
+            unsigned char *destRow = tempPixels + (imageWidth * 4 * (imageHeight - y - 1));
+            for (int i = 0; i < imageWidth * 4; i += 4) {
+                destRow[i + 0] = srcRow[i + 2];
+                destRow[i + 1] = srcRow[i + 1];
+                destRow[i + 2] = srcRow[i + 0];
+                destRow[i + 3] = srcRow[i + 3];
+            }
+        }
+    } else {
+        for (int i = 0; i < imageWidth * imageHeight * 4; i += 4) {
+            tempPixels[i + 0] = imagePixels[i + 2];
+            tempPixels[i + 1] = imagePixels[i + 1];
+            tempPixels[i + 2] = imagePixels[i + 0];
+            tempPixels[i + 3] = imagePixels[i + 3];
+        }
+    }
+
+    SkBitmap canvasBitmap;
+
+    canvasBitmap.setConfig(SkBitmap::kARGB_8888_Config, canvasWidth, canvasHeight);
+    canvasBitmap.allocPixels(0, 0);
+    bool rc = canvasBitmap.copyPixelsFrom(static_cast<void*>(const_cast<unsigned char*>(tempPixels)), imageWidth * imageHeight * 4);
+    delete [] tempPixels;
+
+    FloatRect src(0, 0, canvasWidth, canvasHeight);
+    FloatRect dst(0, 0, imageWidth, imageHeight);
+
+    RefPtr<BitmapImageSingleFrameSkia> bitmapImage = BitmapImageSingleFrameSkia::create(canvasBitmap, false);
+    if (rc)
+        context->drawImage(bitmapImage.get(), ColorSpaceDeviceRGB, dst, src, CompositeCopy, false);
+}
+
+void GraphicsContext3D::setContextLostCallback(PassOwnPtr<ContextLostCallback>)
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEBGL)
+
diff --git a/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp
new file mode 100644
index 000000000..135257a03
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.cpp
@@ -0,0 +1,886 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+/** FIXME
+ * This file borrows code heavily from platform/graphics/win/GraphicsLayerCACF.cpp
+ * (and hence it includes both copyrights)
+ * Ideally the common code (mostly the code that keeps track of the layer hierarchy)
+ * should be kept separate and shared between platforms. It would be a well worthwhile
+ * effort once the Windows implementation (binaries and headers) of CoreAnimation is
+ * checked in to the WebKit repository. Until then only Apple can make this happen.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsLayerBlackBerry.h"
+
+#include "FloatConversion.h"
+#include "FloatRect.h"
+#include "Image.h"
+#include "LayerAnimation.h"
+#include "LayerWebKitThread.h"
+
+namespace WebCore {
+
+static void setLayerBorderColor(LayerWebKitThread& layer, const Color& color)
+{
+    layer.setBorderColor(color);
+}
+
+static void clearBorderColor(LayerWebKitThread& layer)
+{
+    layer.setBorderColor(Color::transparent);
+}
+
+static void setLayerBackgroundColor(LayerWebKitThread& layer, const Color& color)
+{
+    layer.setBackgroundColor(color);
+}
+
+static void clearLayerBackgroundColor(LayerWebKitThread& layer)
+{
+    layer.setBackgroundColor(Color::transparent);
+}
+
+PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
+{
+    return adoptPtr(new GraphicsLayerBlackBerry(client));
+}
+
+GraphicsLayerBlackBerry::GraphicsLayerBlackBerry(GraphicsLayerClient* client)
+    : GraphicsLayer(client)
+    , m_suspendTime(0)
+    , m_contentsLayerPurpose(NoContentsLayer)
+    , m_contentsLayerHasBackgroundColor(false)
+{
+    m_layer = LayerWebKitThread::create(LayerData::Layer, this);
+
+    updateDebugIndicators();
+}
+
+GraphicsLayerBlackBerry::~GraphicsLayerBlackBerry()
+{
+    if (m_layer)
+        m_layer->setOwner(0);
+    if (m_contentsLayer)
+        m_contentsLayer->setOwner(0);
+    if (m_transformLayer)
+        m_transformLayer->setOwner(0);
+}
+
+void GraphicsLayerBlackBerry::setName(const String& inName)
+{
+    String name = String::format("GraphicsLayerBlackBerry(%p) GraphicsLayer(%p) ", m_layer.get(), this) + inName;
+    GraphicsLayer::setName(name);
+}
+
+bool GraphicsLayerBlackBerry::setChildren(const Vector<GraphicsLayer*>& children)
+{
+    bool childrenChanged = GraphicsLayer::setChildren(children);
+    // FIXME: GraphicsLayer::setChildren calls addChild() for each sublayer, which
+    // will end up calling updateSublayerList() N times.
+    if (childrenChanged)
+        updateSublayerList();
+
+    return childrenChanged;
+}
+
+void GraphicsLayerBlackBerry::addChild(GraphicsLayer* childLayer)
+{
+    GraphicsLayer::addChild(childLayer);
+    updateSublayerList();
+}
+
+void GraphicsLayerBlackBerry::addChildAtIndex(GraphicsLayer* childLayer, int index)
+{
+    GraphicsLayer::addChildAtIndex(childLayer, index);
+    updateSublayerList();
+}
+
+void GraphicsLayerBlackBerry::addChildBelow(GraphicsLayer* childLayer, GraphicsLayer* sibling)
+{
+    GraphicsLayer::addChildBelow(childLayer, sibling);
+    updateSublayerList();
+}
+
+void GraphicsLayerBlackBerry::addChildAbove(GraphicsLayer* childLayer, GraphicsLayer *sibling)
+{
+    GraphicsLayer::addChildAbove(childLayer, sibling);
+    updateSublayerList();
+}
+
+bool GraphicsLayerBlackBerry::replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild)
+{
+    if (!GraphicsLayer::replaceChild(oldChild, newChild))
+        return false;
+
+    updateSublayerList();
+    return true;
+}
+
+void GraphicsLayerBlackBerry::removeFromParent()
+{
+    GraphicsLayer::removeFromParent();
+    layerForSuperlayer()->removeFromSuperlayer();
+}
+
+void GraphicsLayerBlackBerry::setPosition(const FloatPoint& point)
+{
+    GraphicsLayer::setPosition(point);
+    updateLayerPosition();
+}
+
+void GraphicsLayerBlackBerry::setAnchorPoint(const FloatPoint3D& point)
+{
+    if (point == m_anchorPoint)
+        return;
+
+    GraphicsLayer::setAnchorPoint(point);
+    updateAnchorPoint();
+}
+
+void GraphicsLayerBlackBerry::setSize(const FloatSize& size)
+{
+    if (size == m_size)
+        return;
+
+    GraphicsLayer::setSize(size);
+    updateLayerSize();
+}
+
+void GraphicsLayerBlackBerry::setTransform(const TransformationMatrix& transform)
+{
+    if (transform == m_transform)
+        return;
+
+    GraphicsLayer::setTransform(transform);
+    updateTransform();
+}
+
+void GraphicsLayerBlackBerry::setChildrenTransform(const TransformationMatrix& transform)
+{
+    if (transform == m_childrenTransform)
+        return;
+
+    GraphicsLayer::setChildrenTransform(transform);
+    updateChildrenTransform();
+}
+
+void GraphicsLayerBlackBerry::setPreserves3D(bool preserves3D)
+{
+    if (preserves3D == m_preserves3D)
+        return;
+
+    GraphicsLayer::setPreserves3D(preserves3D);
+    updateLayerPreserves3D();
+}
+
+void GraphicsLayerBlackBerry::setMasksToBounds(bool masksToBounds)
+{
+    if (masksToBounds == m_masksToBounds)
+        return;
+
+    GraphicsLayer::setMasksToBounds(masksToBounds);
+    updateMasksToBounds();
+}
+
+void GraphicsLayerBlackBerry::setDrawsContent(bool drawsContent)
+{
+    // Note carefully this early-exit is only correct because we also properly initialize
+    // LayerWebKitThread::isDrawable() whenever m_contentsLayer is set to a new layer in setupContentsLayer().
+    if (drawsContent == m_drawsContent)
+        return;
+
+    GraphicsLayer::setDrawsContent(drawsContent);
+    updateLayerIsDrawable();
+}
+
+void GraphicsLayerBlackBerry::setContentsVisible(bool contentsVisible)
+{
+    // Note carefully this early-exit is only correct because we also properly initialize
+    // LayerWebKitThread::isDrawable() whenever m_contentsLayer is set to a new layer in setupContentsLayer().
+    if (contentsVisible == m_contentsVisible)
+        return;
+
+    GraphicsLayer::setContentsVisible(contentsVisible);
+    updateLayerIsDrawable();
+}
+
+void GraphicsLayerBlackBerry::setMaskLayer(GraphicsLayer* maskLayer)
+{
+    if (maskLayer == m_maskLayer)
+        return;
+
+    GraphicsLayer::setMaskLayer(maskLayer);
+
+    LayerWebKitThread* maskLayerWebKit = m_maskLayer ? m_maskLayer->platformLayer() : 0;
+    if (maskLayerWebKit)
+        maskLayerWebKit->setIsMask(true);
+    m_layer->setMaskLayer(maskLayerWebKit);
+}
+
+void GraphicsLayerBlackBerry::setReplicatedByLayer(GraphicsLayer* layer)
+{
+    GraphicsLayerBlackBerry* layerWebKit = static_cast<GraphicsLayerBlackBerry*>(layer);
+    GraphicsLayer::setReplicatedByLayer(layer);
+    LayerWebKitThread* replicaLayer = layerWebKit ? layerWebKit->primaryLayer() : 0;
+    primaryLayer()->setReplicaLayer(replicaLayer);
+}
+
+void GraphicsLayerBlackBerry::setFixedPosition(bool fixed)
+{
+    if (fixed == m_fixedPosition)
+        return;
+
+    GraphicsLayer::setFixedPosition(fixed);
+    updateFixedPosition();
+}
+
+void GraphicsLayerBlackBerry::setHasFixedContainer(bool hasFixedContainer)
+{
+    if (hasFixedContainer == m_hasFixedContainer)
+        return;
+
+    GraphicsLayer::setHasFixedContainer(hasFixedContainer);
+    updateHasFixedContainer();
+}
+
+void GraphicsLayerBlackBerry::setHasFixedAncestorInDOMTree(bool hasFixedAncestorInDOMTree)
+{
+    if (hasFixedAncestorInDOMTree == m_hasFixedAncestorInDOMTree)
+        return;
+
+    GraphicsLayer::setHasFixedAncestorInDOMTree(hasFixedAncestorInDOMTree);
+    updateHasFixedAncestorInDOMTree();
+}
+
+void GraphicsLayerBlackBerry::setBackgroundColor(const Color& color)
+{
+    if (m_backgroundColorSet && m_backgroundColor == color)
+        return;
+
+    GraphicsLayer::setBackgroundColor(color);
+
+    m_contentsLayerHasBackgroundColor = true;
+    updateLayerBackgroundColor();
+}
+
+void GraphicsLayerBlackBerry::clearBackgroundColor()
+{
+    if (!m_backgroundColorSet)
+        return;
+
+    GraphicsLayer::clearBackgroundColor();
+    clearLayerBackgroundColor(*m_contentsLayer);
+}
+
+void GraphicsLayerBlackBerry::setContentsOpaque(bool opaque)
+{
+    if (m_contentsOpaque == opaque)
+        return;
+
+    GraphicsLayer::setContentsOpaque(opaque);
+    updateContentsOpaque();
+}
+
+void GraphicsLayerBlackBerry::setBackfaceVisibility(bool visible)
+{
+    if (m_backfaceVisibility == visible)
+        return;
+
+    GraphicsLayer::setBackfaceVisibility(visible);
+    updateBackfaceVisibility();
+}
+
+void GraphicsLayerBlackBerry::setOpacity(float opacity)
+{
+    float clampedOpacity = clampTo(opacity, 0.0f, 1.0f);
+
+    if (m_opacity == clampedOpacity)
+        return;
+
+    GraphicsLayer::setOpacity(clampedOpacity);
+    primaryLayer()->setOpacity(opacity);
+}
+
+void GraphicsLayerBlackBerry::setContentsNeedsDisplay()
+{
+    if (m_contentsLayer)
+        m_contentsLayer->setNeedsDisplay();
+}
+
+void GraphicsLayerBlackBerry::setNeedsDisplay()
+{
+    if (drawsContent())
+        m_layer->setNeedsDisplay();
+}
+
+void GraphicsLayerBlackBerry::setNeedsDisplayInRect(const FloatRect& rect)
+{
+    if (drawsContent())
+        m_layer->setNeedsDisplayInRect(rect);
+}
+
+void GraphicsLayerBlackBerry::setContentsRect(const IntRect& rect)
+{
+    if (rect == m_contentsRect)
+        return;
+
+    GraphicsLayer::setContentsRect(rect);
+    updateContentsRect();
+}
+
+static PassRefPtr<LayerAnimation> removeAnimationByIdAndProperty(int id, AnimatedPropertyID property, Vector<RefPtr<LayerAnimation> >& list)
+{
+    for (size_t i = 0; i < list.size(); ++i) {
+        if (list[i]->id() == id && list[i]->property() == property) {
+            RefPtr<LayerAnimation> layerAnimation = list[i];
+            list.remove(i);
+            return layerAnimation;
+        }
+    }
+
+    return PassRefPtr<LayerAnimation>();
+}
+
+static PassRefPtr<LayerAnimation> removeAnimationByName(const String& animationName, Vector<RefPtr<LayerAnimation> >& list)
+{
+    for (size_t i = 0; i < list.size(); ++i) {
+        if (list[i]->name() == animationName) {
+            RefPtr<LayerAnimation> layerAnimation = list[i];
+            list.remove(i);
+            return layerAnimation;
+        }
+    }
+
+    return PassRefPtr<LayerAnimation>();
+}
+
+bool GraphicsLayerBlackBerry::addAnimation(const KeyframeValueList& values, const IntSize& boxSize, const Animation* animation, const String& animationName, double timeOffset)
+{
+    // This is what GraphicsLayerCA checks for.
+    if (!animation || animation->isEmptyOrZeroDuration() || values.size() < 2)
+        return false;
+
+    // We only support these two kinds of properties at the moment.
+    if (values.property() != AnimatedPropertyWebkitTransform && values.property() != AnimatedPropertyOpacity)
+        return false;
+
+    // Remove any running animation for the same property.
+    // FIXME: Maybe this is superstition, I got the idea from GraphicsLayerQt
+    // WebCore might be adding an animation with the same name, but for a different property
+    removeAnimationByIdAndProperty(LayerAnimation::idFromAnimation(animation), values.property(), m_runningAnimations);
+    removeAnimationByIdAndProperty(LayerAnimation::idFromAnimation(animation), values.property(), m_suspendedAnimations);
+
+    RefPtr<LayerAnimation> layerAnimation = LayerAnimation::create(values, boxSize, animation, animationName, timeOffset);
+
+#if DEBUG_LAYER_ANIMATION
+    fprintf(stderr, "LayerAnimation 0x%08x: Adding animation %s for property %d\n", layerAnimation.get(), animationName.latin1().data(), values.property());
+#endif
+
+    m_runningAnimations.append(layerAnimation);
+
+    updateAnimations();
+
+    return true;
+}
+
+void GraphicsLayerBlackBerry::pauseAnimation(const String& animationName, double timeOffset)
+{
+    // WebCore might have added several animations with the same name, but for different properties
+
+    while (RefPtr<LayerAnimation> animation = removeAnimationByName(animationName, m_runningAnimations)) {
+#if DEBUG_LAYER_ANIMATION
+        fprintf(stderr, "LayerAnimation 0x%08x: Pausing animation %s\n", animation.get(), animation->name().latin1().data());
+#endif
+
+        // LayerAnimation is readonly. Create a new animation with the same data except for timeOffset.
+        // WebCore will adjust the timeOffset for paused animations so it can be used to calculate the
+        // progress for the paused animation without knowing the exact timestamp when the animation was
+        // paused.
+        // If an animation was started with a timeOffset dt_orig and paused dt_pause seconds later, the
+        // cloned animation will have a timeOffset of dt_pause + dt_orig.
+        animation = animation->clone(timeOffset);
+        m_suspendedAnimations.append(animation);
+
+#if DEBUG_LAYER_ANIMATION
+        fprintf(stderr, "LayerAnimation 0x%08x: Paused animation %s\n", animation.get(), animation->name().latin1().data());
+#endif
+    };
+
+    updateAnimations();
+}
+
+void GraphicsLayerBlackBerry::removeAnimation(const String& animationName)
+{
+    // WebCore might have added several animations with the same name, but for different properties
+
+#if DEBUG_LAYER_ANIMATION
+    fprintf(stderr, "LayerAnimation: Removing animation %s\n", animationName.latin1().data());
+#endif
+
+    while (removeAnimationByName(animationName, m_runningAnimations)) { }
+    while (removeAnimationByName(animationName, m_suspendedAnimations)) { }
+
+    updateAnimations();
+}
+
+void GraphicsLayerBlackBerry::suspendAnimations(double time)
+{
+#if DEBUG_LAYER_ANIMATION
+    fprintf(stderr, "LayerAnimation: Suspending animations\n");
+#endif
+    m_suspendTime = time;
+}
+
+void GraphicsLayerBlackBerry::resumeAnimations()
+{
+#if DEBUG_LAYER_ANIMATION
+    fprintf(stderr, "LayerAnimation: Resuming animations\n");
+#endif
+    m_suspendTime = 0;
+}
+
+void GraphicsLayerBlackBerry::setContentsToImage(Image* image)
+{
+    bool childrenChanged = false;
+    if (image) {
+        m_contentsLayerPurpose = ContentsLayerForImage;
+        if (!m_contentsLayer)
+            childrenChanged = true;
+    } else {
+        m_contentsLayerPurpose = NoContentsLayer;
+        if (m_contentsLayer)
+            childrenChanged = true;
+    }
+
+    updateContentsImage(image);
+
+    if (childrenChanged)
+        updateSublayerList();
+}
+
+void GraphicsLayerBlackBerry::updateContentsImage(Image* image)
+{
+    if (image) {
+        if (!m_contentsLayer.get()) {
+            RefPtr<LayerWebKitThread> imageLayer = LayerWebKitThread::create(LayerData::Layer, this);
+
+            setupContentsLayer(imageLayer.get());
+            m_contentsLayer = imageLayer;
+            // m_contentsLayer will be parented by updateSublayerList.
+        }
+        m_contentsLayer->setContents(image);
+
+        updateContentsRect();
+    } else {
+        // No image. m_contentsLayer will be removed via updateSublayerList.
+        m_contentsLayer = 0;
+    }
+}
+
+void GraphicsLayerBlackBerry::setContentsToCanvas(PlatformLayer* platformLayer)
+{
+    bool childrenChanged = false;
+    if (platformLayer) {
+        platformLayer->setOwner(this);
+        if (m_contentsLayer.get() != platformLayer) {
+            setupContentsLayer(platformLayer);
+            m_contentsLayer = platformLayer;
+            m_contentsLayerPurpose = ContentsLayerForCanvas;
+            childrenChanged = true;
+        }
+        m_contentsLayer->setNeedsDisplay();
+        updateContentsRect();
+    } else {
+        if (m_contentsLayer) {
+            childrenChanged = true;
+
+            // The old contents layer will be removed via updateSublayerList.
+            m_contentsLayer = 0;
+        }
+    }
+
+    if (childrenChanged)
+        updateSublayerList();
+}
+
+void GraphicsLayerBlackBerry::setContentsToMedia(PlatformLayer* layer)
+{
+    bool childrenChanged = false;
+    if (layer) {
+        if (!m_contentsLayer.get() || m_contentsLayerPurpose != ContentsLayerForVideo) {
+            setupContentsLayer(layer);
+            m_contentsLayer = layer;
+            m_contentsLayerPurpose = ContentsLayerForVideo;
+            childrenChanged = true;
+        }
+        layer->setOwner(this);
+        layer->setNeedsDisplay();
+        updateContentsRect();
+    } else {
+        if (m_contentsLayer) {
+            childrenChanged = true;
+
+            // The old contents layer will be removed via updateSublayerList.
+            m_contentsLayer = 0;
+        }
+    }
+
+    if (childrenChanged)
+        updateSublayerList();
+}
+
+PlatformLayer* GraphicsLayerBlackBerry::hostLayerForSublayers() const
+{
+    return m_transformLayer ? m_transformLayer.get() : m_layer.get();
+}
+
+PlatformLayer* GraphicsLayerBlackBerry::layerForSuperlayer() const
+{
+    return m_transformLayer ? m_transformLayer.get() : m_layer.get();
+}
+
+PlatformLayer* GraphicsLayerBlackBerry::platformLayer() const
+{
+    return primaryLayer();
+}
+
+void GraphicsLayerBlackBerry::setDebugBackgroundColor(const Color& color)
+{
+    if (color.isValid())
+        setLayerBackgroundColor(*m_layer, color);
+    else
+        clearLayerBackgroundColor(*m_layer);
+}
+
+void GraphicsLayerBlackBerry::setDebugBorder(const Color& color, float borderWidth)
+{
+    if (color.isValid()) {
+        setLayerBorderColor(*m_layer, color);
+        m_layer->setBorderWidth(borderWidth);
+    } else {
+        clearBorderColor(*m_layer);
+        m_layer->setBorderWidth(0);
+    }
+}
+
+void GraphicsLayerBlackBerry::updateSublayerList()
+{
+    Vector<RefPtr<LayerWebKitThread> > newSublayers;
+
+    if (m_transformLayer) {
+        // Add the primary layer first. Even if we have negative z-order children, the primary layer always comes behind.
+        newSublayers.append(m_layer.get());
+    } else if (m_contentsLayer) {
+        // FIXME: add the contents layer in the correct order with negative z-order children.
+        // This does not cause visible rendering issues because currently contents layers are only used
+        // for replaced elements that don't have children.
+        newSublayers.append(m_contentsLayer.get());
+    }
+
+    const Vector<GraphicsLayer*>& childLayers = children();
+    size_t numChildren = childLayers.size();
+    for (size_t i = 0; i < numChildren; ++i) {
+        GraphicsLayerBlackBerry* curChild = static_cast<GraphicsLayerBlackBerry*>(childLayers[i]);
+
+        LayerWebKitThread* childLayer = curChild->layerForSuperlayer();
+        newSublayers.append(childLayer);
+    }
+
+    for (size_t i = 0; i < newSublayers.size(); ++i)
+        newSublayers[i]->removeFromSuperlayer();
+
+    if (m_transformLayer) {
+        m_transformLayer->setSublayers(newSublayers);
+
+        if (m_contentsLayer) {
+            // If we have a transform layer, then the contents layer is parented in the
+            // primary layer (which is itself a child of the transform layer).
+            m_layer->removeAllSublayers();
+            m_layer->addSublayer(m_contentsLayer);
+        }
+    } else
+        m_layer->setSublayers(newSublayers);
+}
+
+void GraphicsLayerBlackBerry::updateLayerPosition()
+{
+    // Position is offset on the layer by the layer anchor point.
+    FloatPoint layerPosition(m_position.x() + m_anchorPoint.x() * m_size.width(),
+                             m_position.y() + m_anchorPoint.y() * m_size.height());
+
+    primaryLayer()->setPosition(layerPosition);
+}
+
+void GraphicsLayerBlackBerry::updateLayerSize()
+{
+    IntSize layerSize(m_size.width(), m_size.height());
+    if (m_transformLayer) {
+        m_transformLayer->setBounds(layerSize);
+        // The anchor of the contents layer is always at 0.5, 0.5, so the position is center-relative.
+        FloatPoint centerPoint(m_size.width() / 2, m_size.height() / 2);
+        m_layer->setPosition(centerPoint);
+    }
+
+    m_layer->setBounds(layerSize);
+
+    // Note that we don't resize m_contentsLayer. It's up the caller to do that.
+
+    // If we've changed the bounds, we need to recalculate the position
+    // of the layer, taking anchor point into account.
+    updateLayerPosition();
+}
+
+void GraphicsLayerBlackBerry::updateAnchorPoint()
+{
+    primaryLayer()->setAnchorPoint(FloatPoint(m_anchorPoint.x(), m_anchorPoint.y()));
+    primaryLayer()->setAnchorPointZ(m_anchorPoint.z());
+    updateLayerPosition();
+}
+
+void GraphicsLayerBlackBerry::updateTransform()
+{
+    primaryLayer()->setTransform(m_transform);
+}
+
+void GraphicsLayerBlackBerry::updateChildrenTransform()
+{
+    primaryLayer()->setSublayerTransform(m_childrenTransform);
+}
+
+void GraphicsLayerBlackBerry::updateMasksToBounds()
+{
+    m_layer->setMasksToBounds(m_masksToBounds);
+    updateDebugIndicators();
+}
+
+void GraphicsLayerBlackBerry::updateContentsOpaque()
+{
+    m_layer->setOpaque(m_contentsOpaque);
+}
+
+void GraphicsLayerBlackBerry::updateBackfaceVisibility()
+{
+    m_layer->setDoubleSided(m_backfaceVisibility);
+}
+
+void GraphicsLayerBlackBerry::updateLayerPreserves3D()
+{
+    if (m_preserves3D && !m_transformLayer) {
+        // Create the transform layer.
+        m_transformLayer = LayerWebKitThread::create(LayerData::TransformLayer, this);
+
+        // Copy the position from this layer.
+        updateLayerPosition();
+        updateLayerSize();
+        updateAnchorPoint();
+        updateTransform();
+        updateChildrenTransform();
+        updateAnimations();
+
+        m_layer->setPosition(FloatPoint(m_size.width() / 2.0f, m_size.height() / 2.0f));
+
+        m_layer->setAnchorPoint(FloatPoint(0.5f, 0.5f));
+        TransformationMatrix identity;
+        m_layer->setTransform(identity);
+
+        // Set the old layer to opacity of 1. Further down we will set the opacity on the transform layer.
+        m_layer->setOpacity(1);
+
+        // Move this layer to be a child of the transform layer.
+        if (m_layer->superlayer())
+            m_layer->superlayer()->replaceSublayer(m_layer.get(), m_transformLayer.get());
+        m_transformLayer->addSublayer(m_layer.get());
+
+        m_transformLayer->setPreserves3D(true);
+        m_layer->setPreserves3D(true);
+
+        updateSublayerList();
+    } else if (!m_preserves3D && m_transformLayer) {
+        // Relace the transformLayer in the parent with this layer.
+        m_layer->removeFromSuperlayer();
+        if (m_transformLayer->superlayer())
+            m_transformLayer->superlayer()->replaceSublayer(m_transformLayer.get(), m_layer.get());
+
+        // Release the transform layer.
+        m_transformLayer = 0;
+
+        updateLayerPosition();
+        updateLayerSize();
+        updateAnchorPoint();
+        updateTransform();
+        updateChildrenTransform();
+        updateAnimations();
+
+        m_layer->setPreserves3D(false);
+
+        updateSublayerList();
+    }
+
+    updateOpacityOnLayer();
+}
+
+void GraphicsLayerBlackBerry::updateLayerIsDrawable()
+{
+    // For the rest of the accelerated compositor code, there is no reason to make a
+    // distinction between drawsContent and contentsVisible. So, for m_layer, these two
+    // flags are combined here. m_contentsLayer shouldn't receive the drawsContent flag
+    // so it is only given contentsVisible.
+    m_layer->setDrawable(m_drawsContent && m_contentsVisible);
+
+    if (m_contentsLayer)
+        m_contentsLayer->setDrawable(m_contentsVisible);
+
+    if (m_drawsContent)
+        m_layer->setNeedsDisplay();
+
+    updateDebugIndicators();
+}
+
+void GraphicsLayerBlackBerry::updateFixedPosition()
+{
+    m_layer->setFixedPosition(m_fixedPosition);
+}
+
+void GraphicsLayerBlackBerry::updateHasFixedContainer()
+{
+    m_layer->setHasFixedContainer(m_hasFixedContainer);
+}
+
+void GraphicsLayerBlackBerry::updateHasFixedAncestorInDOMTree()
+{
+    m_layer->setHasFixedAncestorInDOMTree(m_hasFixedAncestorInDOMTree);
+}
+
+void GraphicsLayerBlackBerry::updateLayerBackgroundColor()
+{
+    if (!m_contentsLayer)
+        return;
+
+    // We never create the contents layer just for background color yet.
+    if (m_backgroundColorSet)
+        setLayerBackgroundColor(*m_contentsLayer, m_backgroundColor);
+    else
+        clearLayerBackgroundColor(*m_contentsLayer);
+}
+
+void GraphicsLayerBlackBerry::updateAnimations()
+{
+    // When there is a transform layer, the transform must be set on that layer
+    // instead of the content layer. Opacity can be set on the transform layer or the
+    // layer with equal outcome, but currently it is also set on the transform
+    // layer. Since we only accelerate animations of these two properties, it
+    // is safe to move all accelerated animations to the transform layer, and
+    // remove them from the layer proper.
+    // So the following code, while it looks strange, is correct:
+    // we transfer all animations to the transform layer if it exists.
+    // FIXME: If other properties become animated, it may not be equivalent to
+    // move them to the transform layer. Then this code needs to be revisited
+    // to only move the transform animations to the transform layer.
+    primaryLayer()->setRunningAnimations(m_runningAnimations);
+    primaryLayer()->setSuspendedAnimations(m_suspendedAnimations);
+
+    // We need to move the animations to the transform layer if there is one.
+    if (m_transformLayer) {
+        m_layer->setRunningAnimations(Vector<RefPtr<LayerAnimation> >());
+        m_layer->setSuspendedAnimations(Vector<RefPtr<LayerAnimation> >());
+    }
+}
+
+void GraphicsLayerBlackBerry::updateContentsVideo()
+{
+    // FIXME: Implement
+}
+
+void GraphicsLayerBlackBerry::updateContentsRect()
+{
+    if (!m_contentsLayer)
+        return;
+
+    m_contentsLayer->setPosition(m_contentsRect.location());
+    m_contentsLayer->setBounds(m_contentsRect.size());
+}
+
+void GraphicsLayerBlackBerry::setupContentsLayer(LayerWebKitThread* contentsLayer)
+{
+    if (contentsLayer == m_contentsLayer)
+        return;
+
+    if (m_contentsLayer) {
+        m_contentsLayer->removeFromSuperlayer();
+        m_contentsLayer = 0;
+    }
+
+    if (contentsLayer) {
+        m_contentsLayer = contentsLayer;
+
+        m_contentsLayer->setAnchorPoint(FloatPoint::zero());
+
+        // It is necessary to update setDrawable as soon as we receive the new contentsLayer, for
+        // the correctness of early exit conditions in setDrawsContent() and setContentsVisible().
+        m_contentsLayer->setDrawable(m_contentsVisible);
+
+        // Insert the content layer first. Video elements require this, because they have
+        // shadow content that must display in front of the video.
+        m_layer->insertSublayer(m_contentsLayer.get(), 0);
+
+        updateContentsRect();
+
+        if (showDebugBorders()) {
+            setLayerBorderColor(*m_contentsLayer, Color(0, 0, 128, 180));
+            m_contentsLayer->setBorderWidth(1);
+        }
+    }
+    updateDebugIndicators();
+}
+
+// This function simply mimics the operation of GraphicsLayerCA
+void GraphicsLayerBlackBerry::updateOpacityOnLayer()
+{
+    primaryLayer()->setOpacity(m_opacity);
+}
+
+bool GraphicsLayerBlackBerry::contentsVisible(const IntRect& contentRect) const
+{
+    if (!m_client)
+        return false;
+
+    return m_client->contentsVisible(this, contentRect);
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.h b/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.h
new file mode 100644
index 000000000..ef7cddaeb
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/GraphicsLayerBlackBerry.h
@@ -0,0 +1,179 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GraphicsLayerBlackBerry_h
+#define GraphicsLayerBlackBerry_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsLayer.h"
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class LayerAnimation;
+class LayerWebKitThread;
+
+class GraphicsLayerBlackBerry : public GraphicsLayer {
+public:
+    GraphicsLayerBlackBerry(GraphicsLayerClient*);
+    virtual ~GraphicsLayerBlackBerry();
+
+    virtual void setName(const String&);
+
+    virtual bool setChildren(const Vector<GraphicsLayer*>&);
+    virtual void addChild(GraphicsLayer*);
+    virtual void addChildAtIndex(GraphicsLayer*, int index);
+    virtual void addChildAbove(GraphicsLayer*, GraphicsLayer* sibling);
+    virtual void addChildBelow(GraphicsLayer*, GraphicsLayer* sibling);
+    virtual bool replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild);
+
+    virtual void removeFromParent();
+
+    virtual void setPosition(const FloatPoint&);
+    virtual void setAnchorPoint(const FloatPoint3D&);
+    virtual void setSize(const FloatSize&);
+
+    virtual void setTransform(const TransformationMatrix&);
+
+    virtual void setChildrenTransform(const TransformationMatrix&);
+
+    virtual void setPreserves3D(bool);
+    virtual void setMasksToBounds(bool);
+    virtual void setDrawsContent(bool);
+    virtual void setContentsVisible(bool);
+    virtual void setMaskLayer(GraphicsLayer*);
+    virtual void setReplicatedByLayer(GraphicsLayer*);
+    virtual void setFixedPosition(bool);
+    virtual void setHasFixedContainer(bool);
+    virtual void setHasFixedAncestorInDOMTree(bool);
+
+    virtual void setBackgroundColor(const Color&);
+    virtual void clearBackgroundColor();
+
+    virtual void setContentsOpaque(bool);
+    virtual void setBackfaceVisibility(bool);
+
+    virtual void setOpacity(float);
+
+    virtual void setNeedsDisplay();
+    virtual void setNeedsDisplayInRect(const FloatRect&);
+
+    virtual void setContentsNeedsDisplay();
+
+    virtual void setContentsRect(const IntRect&);
+
+    virtual bool addAnimation(const KeyframeValueList&, const IntSize& boxSize, const Animation*, const String& animationName, double timeOffset);
+    virtual void pauseAnimation(const String& animationName, double timeOffset);
+    virtual void removeAnimation(const String& animationName);
+
+    virtual void suspendAnimations(double time);
+    virtual void resumeAnimations();
+
+    virtual void setContentsToImage(Image*);
+    virtual void setContentsToMedia(PlatformLayer*);
+    virtual void setContentsToCanvas(PlatformLayer*);
+
+    virtual PlatformLayer* platformLayer() const;
+
+    virtual void setDebugBackgroundColor(const Color&);
+    virtual void setDebugBorder(const Color&, float borderWidth);
+
+    void notifySyncRequired()
+    {
+        if (m_client)
+            m_client->notifySyncRequired(this);
+    }
+
+    void notifyAnimationStarted(double time)
+    {
+        if (m_client)
+            m_client->notifyAnimationStarted(this, time);
+    }
+
+    bool contentsVisible(const IntRect& contentRect) const;
+
+private:
+    void updateOpacityOnLayer();
+
+    LayerWebKitThread* primaryLayer() const  { return m_transformLayer.get() ? m_transformLayer.get() : m_layer.get(); }
+    LayerWebKitThread* hostLayerForSublayers() const;
+    LayerWebKitThread* layerForSuperlayer() const;
+
+    void updateSublayerList();
+    void updateLayerPosition();
+    void updateLayerSize();
+    void updateAnchorPoint();
+    void updateTransform();
+    void updateChildrenTransform();
+    void updateMasksToBounds();
+    void updateContentsOpaque();
+    void updateBackfaceVisibility();
+    void updateLayerPreserves3D();
+    void updateLayerIsDrawable();
+    void updateFixedPosition();
+    void updateHasFixedContainer();
+    void updateHasFixedAncestorInDOMTree();
+    void updateLayerBackgroundColor();
+    void updateAnimations();
+
+    void updateContentsImage(Image*);
+    void updateContentsVideo();
+    void updateContentsRect();
+
+    void setupContentsLayer(LayerWebKitThread*);
+    LayerWebKitThread* contentsLayer() const { return m_contentsLayer.get(); }
+
+    RefPtr<LayerWebKitThread> m_layer;
+    RefPtr<LayerWebKitThread> m_transformLayer;
+    RefPtr<LayerWebKitThread> m_contentsLayer;
+
+    Vector<RefPtr<LayerAnimation> > m_runningAnimations;
+    Vector<RefPtr<LayerAnimation> > m_suspendedAnimations;
+    double m_suspendTime;
+
+    enum ContentsLayerPurpose {
+        NoContentsLayer = 0,
+        ContentsLayerForImage,
+        ContentsLayerForVideo,
+        ContentsLayerForCanvas,
+    };
+
+    ContentsLayerPurpose m_contentsLayerPurpose;
+    bool m_contentsLayerHasBackgroundColor : 1;
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif
diff --git a/Source/WebCore/platform/graphics/blackberry/InstrumentedPlatformCanvas.h b/Source/WebCore/platform/graphics/blackberry/InstrumentedPlatformCanvas.h
new file mode 100644
index 000000000..1629ff107
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/InstrumentedPlatformCanvas.h
@@ -0,0 +1,292 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef InstrumentedPlatformCanvas_h
+#define InstrumentedPlatformCanvas_h
+
+#include <skia/ext/platform_canvas.h>
+
+#define DEBUG_SKIA_DRAWING 0
+#if DEBUG_SKIA_DRAWING
+#define WRAPCANVAS_LOG_ENTRY(...) do { \
+    fprintf(stderr, "%s ", __FUNCTION__); \
+    fprintf(stderr, __VA_ARGS__); \
+    fprintf(stderr, "\n"); \
+} while (0)
+#else
+#define WRAPCANVAS_LOG_ENTRY(...) ((void)0)
+#endif
+
+namespace WebCore {
+
+class InstrumentedPlatformCanvas : public skia::PlatformCanvas {
+public:
+    InstrumentedPlatformCanvas(int width, int height, bool is_opaque, SkDeviceFactory* factory)
+        : skia::PlatformCanvas(width, height, is_opaque, factory)
+        , m_size(width, height)
+        , m_isSolidColor(true)
+        , m_solidColor(0, 0, 0, 0)
+    {
+    }
+
+    virtual ~InstrumentedPlatformCanvas() { }
+
+    bool isSolidColor() const { return m_isSolidColor; }
+    Color solidColor() const { return m_solidColor; }
+
+    // overrides from SkCanvas
+    virtual int save(SaveFlags flags)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        return skia::PlatformCanvas::save(flags);
+    }
+
+    virtual int saveLayer(const SkRect* bounds, const SkPaint* paint, SaveFlags flags)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        return skia::PlatformCanvas::saveLayer(bounds, paint, flags);
+    }
+
+    virtual void restore()
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        skia::PlatformCanvas::restore();
+    }
+
+    virtual bool translate(SkScalar dx, SkScalar dy)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        return skia::PlatformCanvas::translate(dx, dy);
+    }
+
+    virtual bool scale(SkScalar sx, SkScalar sy)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        return skia::PlatformCanvas::scale(sx, sy);
+    }
+
+    virtual bool rotate(SkScalar degrees)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        return skia::PlatformCanvas::rotate(degrees);
+    }
+
+    virtual bool skew(SkScalar sx, SkScalar sy)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        return skia::PlatformCanvas::skew(sx, sy);
+    }
+
+    virtual bool concat(const SkMatrix& matrix)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        return skia::PlatformCanvas::concat(matrix);
+    }
+
+    virtual void setMatrix(const SkMatrix& matrix)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        skia::PlatformCanvas::setMatrix(matrix);
+    }
+
+    virtual bool clipRect(const SkRect& rect, SkRegion::Op op)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        return skia::PlatformCanvas::clipRect(rect, op);
+    }
+
+    virtual bool clipPath(const SkPath& path, SkRegion::Op op) 
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        return skia::PlatformCanvas::clipPath(path, op);
+    }
+
+    virtual bool clipRegion(const SkRegion& region, SkRegion::Op op)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        return skia::PlatformCanvas::clipRegion(region, op);
+    }
+
+    virtual void clear(SkColor color)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = true;
+        m_solidColor = Color(color);
+        skia::PlatformCanvas::clear(color);
+    }
+
+    virtual void drawPaint(const SkPaint& paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawPaint(paint);
+    }
+
+    virtual void drawPoints(PointMode mode, size_t count, const SkPoint pts[],
+            const SkPaint& paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawPoints(mode, count, pts, paint);
+    }
+
+    virtual void drawRect(const SkRect& rect, const SkPaint& paint)
+    {
+        IntRect rectToDraw(rect);
+        WRAPCANVAS_LOG_ENTRY("rect = (x=%d,y=%d,width=%d,height=%d)", rectToDraw.x(), rectToDraw.y(), rectToDraw.width(), rectToDraw.height());
+        IntRect canvasRect(IntPoint(), m_size);
+        if (m_isSolidColor && getTotalMatrix().rectStaysRect() && getTotalClip().contains(canvasRect)) {
+            const SkMatrix& matrix = getTotalMatrix();
+            SkRect mapped;
+            matrix.mapRect(&mapped, rect);
+            if (mapped.contains(canvasRect)) {
+                Color color = solidColor(paint);
+                m_isSolidColor = color.isValid();
+                m_solidColor = color;
+             } else
+                 m_isSolidColor = false;
+        } else
+            m_isSolidColor = false;
+        skia::PlatformCanvas::drawRect(rect, paint);
+    }
+
+    virtual void drawPath(const SkPath& path, const SkPaint& paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawPath(path, paint);
+    }
+
+    virtual void drawBitmap(const SkBitmap& bitmap, SkScalar left,
+            SkScalar top, const SkPaint* paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawBitmap(bitmap, left, top, paint);
+    }
+
+    virtual void drawBitmapRect(const SkBitmap& bitmap, const SkIRect* src,
+            const SkRect& dst, const SkPaint* paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawBitmapRect(bitmap, src, dst, paint);
+    }
+
+    virtual void drawBitmapMatrix(const SkBitmap& bitmap,
+            const SkMatrix& matrix, const SkPaint* paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawBitmapMatrix(bitmap, matrix, paint);
+    }
+
+    virtual void drawSprite(const SkBitmap& bitmap, int left, int top,
+            const SkPaint* paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawSprite(bitmap, left, top, paint);
+    }
+
+    virtual void drawText(const void* text, size_t byteLength, SkScalar x,
+            SkScalar y, const SkPaint& paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawText(text, byteLength, x, y, paint);
+    }
+
+    virtual void drawPosText(const void* text, size_t byteLength,
+            const SkPoint pos[], const SkPaint& paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawPosText(text, byteLength, pos, paint);
+    }
+
+    virtual void drawPosTextH(const void* text, size_t byteLength,
+            const SkScalar xpos[], SkScalar constY, const SkPaint& paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawPosTextH(text, byteLength, xpos, constY, paint);
+    }
+
+    virtual void drawTextOnPath(const void* text, size_t byteLength,
+            const SkPath& path, const SkMatrix* matrix, const SkPaint& paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawTextOnPath(text, byteLength, path, matrix, paint);
+    }
+
+    virtual void drawPicture(SkPicture& picture)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawPicture(picture);
+    }
+
+    virtual void drawVertices(VertexMode mode, int vertexCount,
+            const SkPoint vertices[], const SkPoint texs[],
+            const SkColor colors[], SkXfermode* xfermode,
+            const uint16_t indices[], int indexCount, const SkPaint& paint)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawVertices(mode, vertexCount, vertices, texs, colors, xfermode, indices, indexCount, paint);
+    }
+
+    virtual void drawData(const void* data, size_t size)
+    {
+        WRAPCANVAS_LOG_ENTRY("");
+        m_isSolidColor = false;
+        skia::PlatformCanvas::drawData(data, size);
+    }
+
+private:
+    Color solidColor(const SkPaint& paint)
+    {
+        if (paint.getStyle() != SkPaint::kFill_Style)
+            return Color();
+        if (paint.getLooper() || paint.getShader())
+            return Color();
+
+        SkXfermode::Mode mode;
+        SkXfermode::AsMode(paint.getXfermode(), &mode);
+        if (mode == SkXfermode::kClear_Mode)
+            return Color(0, 0, 0, 0);
+
+        if ((mode == SkXfermode::kSrcOver_Mode && paint.getAlpha() == 255) || mode == SkXfermode::kSrc_Mode)
+            return Color(paint.getColor());
+        return Color();
+    }
+
+    IntSize m_size;
+    bool m_isSolidColor;
+    Color m_solidColor;
+    SkPaint m_solidPaint;
+};
+
+} // namespace WebCore
+
+#endif // InstrumentedPlatformCanvas_h
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerData.h b/Source/WebCore/platform/graphics/blackberry/LayerData.h
new file mode 100644
index 000000000..57746fa64
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerData.h
@@ -0,0 +1,232 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef LayerData_h
+#define LayerData_h
+
+#include "Color.h"
+#include "FloatPoint.h"
+#include "FloatRect.h"
+#include "IntRect.h"
+#include "LayerAnimation.h"
+#include "PlatformString.h"
+#include "TransformationMatrix.h"
+#include <wtf/HashMap.h>
+
+#if USE(ACCELERATED_COMPOSITING)
+
+namespace WebCore {
+
+class HTMLCanvasElement;
+class PluginView;
+#if ENABLE(VIDEO)
+class MediaPlayer;
+#endif
+
+class LayerData {
+public:
+    enum LayerType { Layer, TransformLayer, WebGLLayer };
+    enum FilterType { Linear, Nearest, Trilinear, Lanczos };
+    enum LayerProgramShader { LayerProgramShaderRGBA = 0,
+                              LayerProgramShaderBGRA,
+                              NumberOfLayerProgramShaders };
+
+    LayerData(LayerType type)
+        : m_layerType(type)
+        , m_anchorPoint(0.5, 0.5)
+        , m_backgroundColor(0, 0, 0, 0)
+        , m_borderColor(0, 0, 0, 0)
+        , m_opacity(1.0)
+        , m_anchorPointZ(0.0)
+        , m_borderWidth(0.0)
+        , m_layerProgramShader(LayerProgramShaderBGRA)
+        , m_pluginView(0)
+#if ENABLE(VIDEO)
+        , m_mediaPlayer(0)
+#endif
+        , m_texID(0)
+        , m_texWidth(0)
+        , m_texHeight(0)
+        , m_canvas(0)
+        , m_frontBufferLock(0)
+        , m_suspendTime(0)
+        , m_doubleSided(true)
+        , m_masksToBounds(false)
+        , m_opaque(true)
+        , m_preserves3D(false)
+        , m_needsDisplayOnBoundsChange(false)
+        , m_needsTexture(false)
+        , m_isFixedPosition(false)
+        , m_hasFixedContainer(false)
+        , m_hasFixedAncestorInDOMTree(false)
+        , m_isVisible(true)
+    {
+    }
+
+    virtual ~LayerData()
+    {
+    }
+
+    FloatPoint anchorPoint() const { return m_anchorPoint; }
+
+    float anchorPointZ() const { return m_anchorPointZ; }
+
+    Color backgroundColor() const { return m_backgroundColor; }
+
+    Color borderColor() const { return m_borderColor; }
+
+    float borderWidth() const { return m_borderWidth; }
+
+    IntSize bounds() const { return m_bounds; }
+
+    bool doubleSided() const { return m_doubleSided; }
+
+    FloatRect frame() const { return m_frame; }
+
+    bool masksToBounds() const { return m_masksToBounds; }
+
+    float opacity() const { return m_opacity; }
+
+    bool opaque() const { return m_opaque; }
+
+    FloatPoint position() const { return m_position; }
+
+    // This is currently only used for perspective transform, see GraphicsLayer::setChildrenTransform()
+    const TransformationMatrix& sublayerTransform() const { return m_sublayerTransform; }
+
+    const TransformationMatrix& transform() const { return m_transform; }
+
+    bool preserves3D() const { return m_preserves3D; }
+
+    unsigned getTextureID() const { return m_texID; }
+    void setTextureID(unsigned int value) { m_texID = value; }
+
+    bool needsTexture() const { return m_layerType == WebGLLayer ? true : m_needsTexture; }
+
+    LayerProgramShader layerProgramShader() const { return m_layerProgramShader; }
+
+    bool isFixedPosition() const { return m_isFixedPosition; }
+    bool hasFixedContainer() const { return m_hasFixedContainer; }
+    bool hasFixedAncestorInDOMTree() const { return m_hasFixedAncestorInDOMTree; }
+
+    PluginView* pluginView() const { return m_pluginView; }
+
+    IntRect holePunchRect() const { return m_holePunchRect; }
+    bool hasHolePunchRect() const { return !m_holePunchRect.isEmpty(); }
+
+#if ENABLE(VIDEO)
+    MediaPlayer* mediaPlayer() const { return m_mediaPlayer; }
+#endif
+
+    HTMLCanvasElement* canvas() const { return m_canvas; }
+
+    void replicate(LayerData *to) const { *to = *this; }
+
+    LayerType layerType() const { return m_layerType; }
+
+    bool includeVisibility() const
+    {
+        if (pluginView())
+            return true;
+
+#if ENABLE(VIDEO)
+        if (mediaPlayer())
+            return true;
+#endif
+
+        return false;
+    }
+
+protected:
+    LayerType m_layerType;
+
+    IntSize m_bounds;
+    FloatPoint m_position;
+    FloatPoint m_anchorPoint;
+    Color m_backgroundColor;
+    Color m_borderColor;
+
+    FloatRect m_frame;
+    TransformationMatrix m_transform;
+    TransformationMatrix m_sublayerTransform;
+
+    float m_opacity;
+    float m_anchorPointZ;
+    float m_borderWidth;
+
+    LayerProgramShader m_layerProgramShader;
+
+    PluginView* m_pluginView;
+#if ENABLE(VIDEO)
+    MediaPlayer* m_mediaPlayer;
+    IntRect m_holePunchClipRect;
+#endif
+    IntRect m_holePunchRect;
+
+    unsigned m_texID;
+    unsigned m_texWidth;
+    unsigned m_texHeight;
+
+    HTMLCanvasElement* m_canvas;
+
+    pthread_mutex_t* m_frontBufferLock;
+
+    Vector<RefPtr<LayerAnimation> > m_runningAnimations;
+    Vector<RefPtr<LayerAnimation> > m_suspendedAnimations;
+    double m_suspendTime;
+
+    unsigned m_doubleSided : 1;
+    unsigned m_masksToBounds : 1;
+    unsigned m_opaque : 1;
+    unsigned m_preserves3D : 1;
+    unsigned m_needsDisplayOnBoundsChange : 1;
+
+    unsigned m_needsTexture : 1;
+    unsigned m_isFixedPosition : 1;
+    unsigned m_hasFixedContainer : 1;
+    unsigned m_hasFixedAncestorInDOMTree : 1;
+
+    // The following is only available for media (video) and plugin layers.
+    unsigned m_isVisible : 1;
+
+    // CAUTION: all the data members are copied from one instance to another
+    // i.e. from one thread to another in the replicate method.
+    // Beware of adding any member data e.g. of type String whose default
+    // assignment operator doesn't behave properly if the two String instances
+    // are owned by different threads.
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // LayerData_h
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerMessage.h b/Source/WebCore/platform/graphics/blackberry/LayerMessage.h
new file mode 100644
index 000000000..1687a1f02
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerMessage.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef LayerMessage_h
+#define LayerMessage_h
+
+#include <BlackBerryPlatformExecutableMessage.h>
+#include <BlackBerryPlatformMessage.h>
+#include <BlackBerryPlatformMessageClient.h>
+
+typedef BlackBerry::Platform::Message PlatformMessage;
+
+namespace WebCore {
+
+inline bool isCompositingThread()
+{
+    return BlackBerry::Platform::userInterfaceThreadMessageClient()->isCurrentThread();
+}
+
+inline pthread_t compositingThread()
+{
+    return BlackBerry::Platform::userInterfaceThreadMessageClient()->threadIdentifier();
+}
+
+inline bool isWebKitThread()
+{
+    return BlackBerry::Platform::webKitThreadMessageClient()->isCurrentThread();
+}
+
+inline pthread_t webKitThread()
+{
+    return BlackBerry::Platform::webKitThreadMessageClient()->threadIdentifier();
+}
+
+inline void dispatchCompositingMessage(PlatformMessage* msg)
+{
+    BlackBerry::Platform::userInterfaceThreadMessageClient()->dispatchMessage(msg);
+}
+
+inline void dispatchSyncCompositingMessage(PlatformMessage* msg)
+{
+    BlackBerry::Platform::userInterfaceThreadMessageClient()->dispatchSyncMessage(msg);
+}
+
+enum PlatformMessagePriority { PlatformMessagePriorityLow = -1, PlatformMessagePriorityNormal = 0, PlatformMessagePriorityHigh = 1 };
+
+inline void dispatchWebKitMessage(PlatformMessage* msg, PlatformMessagePriority priority = PlatformMessagePriorityNormal)
+{
+    if (priority != PlatformMessagePriorityNormal)
+        msg->setPriority(BlackBerry::Platform::webKitThreadMessageClient()->threadPriority() + priority);
+    BlackBerry::Platform::webKitThreadMessageClient()->dispatchMessage(msg);
+}
+
+} // namespace WebCore
+
+#endif // LayerMessage_h
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerRenderer.cpp b/Source/WebCore/platform/graphics/blackberry/LayerRenderer.cpp
new file mode 100644
index 000000000..4012e46f7
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerRenderer.cpp
@@ -0,0 +1,1108 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerRenderer.h"
+
+#include "LayerCompositingThread.h"
+#include "PlatformString.h"
+#include "TextureCacheCompositingThread.h"
+
+#include <BlackBerryPlatformLog.h>
+#include <wtf/CurrentTime.h>
+#include <wtf/text/CString.h>
+
+#define ENABLE_SCISSOR 1
+
+#define DEBUG_SHADER_COMPILATION 0
+#define DEBUG_DIRTY_LAYERS 0 // Show dirty layers as red.
+#define DEBUG_LAYER_ANIMATIONS 0 // Show running animations as green.
+#define DEBUG_VIDEO_CLIPPING 0
+
+using BlackBerry::Platform::Graphics::GLES2Context;
+using namespace std;
+
+namespace WebCore {
+
+static void checkGLError()
+{
+#ifndef NDEBUG
+    if (GLenum error = glGetError())
+        LOG_ERROR("GL Error: 0x%x " , error);
+#endif
+}
+
+static GLuint loadShader(GLenum type, const char* shaderSource)
+{
+    GLuint shader = glCreateShader(type);
+    if (!shader)
+        return 0;
+    glShaderSource(shader, 1, &shaderSource, 0);
+    glCompileShader(shader);
+    GLint compiled;
+    glGetShaderiv(shader, GL_COMPILE_STATUS, &compiled);
+    if (!compiled) {
+#if DEBUG_SHADER_COMPILATION
+        char infoLog[2048];
+        GLsizei length;
+        glGetShaderInfoLog(shader, 2048, &length, infoLog);
+        fprintf(stderr, "Failed to compile shader: %s", infoLog);
+#endif
+        glDeleteShader(shader);
+        return 0;
+    }
+    return shader;
+}
+
+static GLuint loadShaderProgram(const char* vertexShaderSource, const char* fragmentShaderSource)
+{
+    GLuint vertexShader;
+    GLuint fragmentShader;
+    GLuint programObject;
+    GLint linked;
+    vertexShader = loadShader(GL_VERTEX_SHADER, vertexShaderSource);
+    if (!vertexShader)
+        return 0;
+    fragmentShader = loadShader(GL_FRAGMENT_SHADER, fragmentShaderSource);
+    if (!fragmentShader) {
+        glDeleteShader(vertexShader);
+        return 0;
+    }
+    programObject = glCreateProgram();
+    if (programObject) {
+        glAttachShader(programObject, vertexShader);
+        glAttachShader(programObject, fragmentShader);
+        glLinkProgram(programObject);
+        glGetProgramiv(programObject, GL_LINK_STATUS, &linked);
+        if (!linked) {
+            glDeleteProgram(programObject);
+            programObject = 0;
+        }
+    }
+    glDeleteShader(vertexShader);
+    glDeleteShader(fragmentShader);
+    return programObject;
+}
+
+static TransformationMatrix orthoMatrix(float left, float right, float bottom, float top, float nearZ, float farZ)
+{
+    float deltaX = right - left;
+    float deltaY = top - bottom;
+    float deltaZ = farZ - nearZ;
+    TransformationMatrix ortho;
+    if (!deltaX || !deltaY || !deltaZ)
+        return ortho;
+    ortho.setM11(2.0f / deltaX);
+    ortho.setM41(-(right + left) / deltaX);
+    ortho.setM22(2.0f / deltaY);
+    ortho.setM42(-(top + bottom) / deltaY);
+    ortho.setM33(-2.0f / deltaZ);
+    ortho.setM43(-(nearZ + farZ) / deltaZ);
+    return ortho;
+}
+
+static Vector<LayerCompositingThread*> rawPtrVectorFromRefPtrVector(const Vector<RefPtr<LayerCompositingThread> >& sublayers)
+{
+    Vector<LayerCompositingThread*> sublayerList;
+    for (size_t i = 0; i < sublayers.size(); i++)
+        sublayerList.append(sublayers[i].get());
+
+    return sublayerList;
+}
+
+PassOwnPtr<LayerRenderer> LayerRenderer::create(GLES2Context* context)
+{
+    return adoptPtr(new LayerRenderer(context));
+}
+
+LayerRenderer::LayerRenderer(GLES2Context* context)
+    : m_colorProgramObject(0)
+    , m_checkerProgramObject(0)
+    , m_positionLocation(0)
+    , m_texCoordLocation(1)
+    , m_fbo(0)
+    , m_currentLayerRendererSurface(0)
+    , m_clearSurfaceOnDrawLayers(true)
+    , m_context(context)
+    , m_needsCommit(false)
+{
+    for (int i = 0; i < LayerData::NumberOfLayerProgramShaders; ++i)
+        m_layerProgramObject[i] = 0;
+
+    m_hardwareCompositing = initializeSharedGLObjects();
+}
+
+LayerRenderer::~LayerRenderer()
+{
+    makeContextCurrent();
+    if (m_fbo)
+        glDeleteFramebuffers(1, &m_fbo);
+    glDeleteProgram(m_colorProgramObject);
+    glDeleteProgram(m_checkerProgramObject);
+    for (int i = 0; i < LayerData::NumberOfLayerProgramShaders; ++i)
+        glDeleteProgram(m_layerProgramObject[i]);
+    if (m_hardwareCompositing) {
+        // Free up all GL textures.
+        while (m_layers.begin() != m_layers.end()) {
+            LayerSet::iterator iter = m_layers.begin();
+            (*iter)->deleteTextures();
+            (*iter)->setLayerRenderer(0);
+            removeLayer(*iter);
+        }
+
+        textureCacheCompositingThread()->clear();
+    }
+}
+
+void LayerRenderer::releaseLayerResources()
+{
+    if (m_hardwareCompositing) {
+        makeContextCurrent();
+        // Free up all GL textures.
+        for (LayerSet::iterator iter = m_layers.begin(); iter != m_layers.end(); ++iter)
+            (*iter)->deleteTextures();
+
+        textureCacheCompositingThread()->clear();
+    }
+}
+
+static inline bool compareLayerZ(const LayerCompositingThread* a, const LayerCompositingThread* b)
+{
+    const TransformationMatrix& transformA = a->drawTransform();
+    const TransformationMatrix& transformB = b->drawTransform();
+
+    return transformA.m43() < transformB.m43();
+}
+
+// Re-composites all sublayers.
+void LayerRenderer::drawLayers(const FloatRect& visibleRect, const IntRect& layoutRect, const IntSize& contentsSize, const IntRect& dstRect)
+{
+    ASSERT(m_hardwareCompositing);
+
+    bool wasEmpty = m_lastRenderingResults.isEmpty();
+    m_lastRenderingResults = LayerRenderingResults();
+    m_lastRenderingResults.wasEmpty = wasEmpty;
+
+    if (!m_rootLayer)
+        return;
+
+    // These parameters are used to calculate position of fixed position elements
+    m_visibleRect = visibleRect;
+    m_layoutRect = layoutRect;
+    m_contentsSize = contentsSize;
+
+    // WebKit uses row vectors which are multiplied by the matrix on the left (i.e. v*M)
+    // Transformations are composed on the left so that M1.xform(M2) means M2*M1
+    // We therefore start with our (othogonal) projection matrix, which will be applied
+    // as the last transformation.
+    TransformationMatrix matrix = orthoMatrix(0, visibleRect.width(), visibleRect.height(), 0, -1000, 1000);
+    matrix.translate3d(-visibleRect.x(), -visibleRect.y(), 0);
+
+    // OpenGL window coordinates origin is at the lower left corner of the surface while
+    // WebKit uses upper left as the origin of the window coordinate system. The passed in 'dstRect'
+    // is in WebKit window coordinate system. Here we setup the viewport to the corresponding value
+    // in OpenGL window coordinates.
+    int viewportY = std::max(0, m_context->surfaceSize().height() - dstRect.maxY());
+    m_viewport = IntRect(dstRect.x(), viewportY, dstRect.width(), dstRect.height());
+
+    double animationTime = currentTime();
+
+#if DEBUG_VIDEO_CLIPPING
+    // Invoking updateLayersRecursive() which will call LayerCompositingThread::setDrawTransform().
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelInfo, "LayerRenderer::drawLayers() visible=(x=%.2f,y=%.2f,width=%.2f,height=%.2f), layout=(x=%d,y=%d,width=%d,height=%d), contents=(%dx%d), dst=(x=%d,y=%d,width=%d,height=%d).",
+        visibleRect.x(), visibleRect.y(), visibleRect.width(), visibleRect.height(),
+        layoutRect.x(), layoutRect.y(), layoutRect.width(), layoutRect.height(),
+        contentsSize.width(), contentsSize.height(),
+        dstRect.x(), dstRect.y(), dstRect.width(), dstRect.height());
+#endif
+
+    Vector<RefPtr<LayerCompositingThread> > surfaceLayers;
+    const Vector<RefPtr<LayerCompositingThread> >& sublayers = m_rootLayer->getSublayers();
+    for (size_t i = 0; i < sublayers.size(); i++) {
+        float opacity = 1;
+        FloatRect clipRect(-1, -1, 2, 2);
+        updateLayersRecursive(sublayers[i].get(), matrix, surfaceLayers, opacity, clipRect, animationTime);
+    }
+
+    // Decompose the dirty rect into a set of non-overlaping rectangles
+    // (they need to not overlap so that the blending code doesn't draw any region twice).
+    for (int i = 0; i < LayerRenderingResults::NumberOfDirtyRects; ++i) {
+        BlackBerry::Platform::IntRectRegion region(BlackBerry::Platform::IntRect(m_lastRenderingResults.dirtyRect(i)));
+        m_lastRenderingResults.dirtyRegion = BlackBerry::Platform::IntRectRegion::unionRegions(m_lastRenderingResults.dirtyRegion, region);
+    }
+
+    // If we won't draw anything, don't touch the OpenGL APIs.
+    if (m_lastRenderingResults.isEmpty() && wasEmpty)
+        return;
+
+    // Okay, we're going to do some drawing.
+    makeContextCurrent();
+
+    glEnableVertexAttribArray(m_positionLocation);
+    glEnableVertexAttribArray(m_texCoordLocation);
+    glActiveTexture(GL_TEXTURE0);
+    glDisable(GL_DEPTH_TEST);
+    glDisable(GL_CULL_FACE);
+    glEnable(GL_STENCIL_TEST);
+
+    // If culling is enabled then we will cull the backface.
+    glCullFace(GL_BACK);
+    // The orthographic projection is setup such that Y starts at zero and
+    // increases going down the page which flips the winding order of triangles.
+    // The layer quads are drawn in clock-wise order so the front face is CCW.
+    glFrontFace(GL_CCW);
+
+    // The shader used to render layers returns pre-multiplied alpha colors
+    // so we need to send the blending mode appropriately.
+    glEnable(GL_BLEND);
+    glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA);
+
+    // Update the parameters for the checkerboard drawing.
+    glUseProgram(m_checkerProgramObject);
+    float bitmapScale = static_cast<float>(m_layoutRect.width()) / static_cast<float>(m_visibleRect.width());
+    glUniform1f(m_checkerScaleLocation, bitmapScale);
+    float scale = static_cast<float>(dstRect.width()) / static_cast<float>(m_visibleRect.width());
+    glUniform2f(m_checkerOriginLocation, m_visibleRect.x()*scale, m_visibleRect.y()*scale);
+    glUniform1f(m_checkerSurfaceHeightLocation, m_context->surfaceSize().height());
+
+    checkGLError();
+
+    // If some layers should be drawed on temporary surfaces, we should do it first.
+    drawLayersOnSurfaces(surfaceLayers);
+
+#if ENABLE_SCISSOR
+    m_scissorRect = m_viewport;
+    glEnable(GL_SCISSOR_TEST);
+    glScissor(m_scissorRect.x(), m_scissorRect.y(), m_scissorRect.width(), m_scissorRect.height());
+#endif
+
+    glClearStencil(0);
+    if (m_clearSurfaceOnDrawLayers) {
+        glClearColor(0, 0, 0, 0);
+        glClear(GL_COLOR_BUFFER_BIT | GL_DEPTH_BUFFER_BIT | GL_STENCIL_BUFFER_BIT);
+    }
+
+    // Don't render the root layer, the BlackBerry port uses the BackingStore to draw the
+    // root layer.
+    for (size_t i = 0; i < sublayers.size(); i++) {
+        int currentStencilValue = 0;
+        FloatRect clipRect(-1, -1, 2, 2);
+        compositeLayersRecursive(sublayers[i].get(), currentStencilValue, clipRect);
+    }
+
+    m_context->swapBuffers();
+
+#if ENABLE_SCISSOR
+    glDisable(GL_SCISSOR_TEST);
+#endif
+    glDisable(GL_STENCIL_TEST);
+
+    LayerSet::iterator iter = m_layersLockingTextureResources.begin();
+    for (; iter != m_layersLockingTextureResources.end(); ++iter)
+        (*iter)->releaseTextureResources();
+
+    m_layersLockingTextureResources.clear();
+
+    if (m_needsCommit) {
+        m_needsCommit = false;
+        m_rootLayer->scheduleCommit();
+    }
+
+    textureCacheCompositingThread()->collectGarbage();
+}
+
+bool LayerRenderer::useSurface(LayerRendererSurface* surface)
+{
+    if (m_currentLayerRendererSurface == surface)
+        return true;
+
+    m_currentLayerRendererSurface = surface;
+    if (!surface) {
+        glBindFramebuffer(GL_FRAMEBUFFER, 0);
+        glViewport(m_viewport.x(), m_viewport.y(), m_viewport.width(), m_viewport.height());
+        return true;
+    }
+
+    surface->ensureTexture();
+
+    if (!m_fbo)
+        glGenFramebuffers(1, &m_fbo);
+    glBindFramebuffer(GL_FRAMEBUFFER, m_fbo);
+    glFramebufferTexture2D(GL_FRAMEBUFFER, GL_COLOR_ATTACHMENT0, GL_TEXTURE_2D, surface->texture()->textureId(), 0);
+
+#ifndef NDEBUG
+    GLenum status = glCheckFramebufferStatus(GL_FRAMEBUFFER);
+    if (status != GL_FRAMEBUFFER_COMPLETE) {
+        fprintf(stderr, "glCheckFramebufferStatus error %x\n", status);
+        return false;
+    }
+#endif
+
+    glViewport(0, 0, surface->size().width(), surface->size().height());
+    return true;
+}
+
+void LayerRenderer::drawLayersOnSurfaces(const Vector<RefPtr<LayerCompositingThread> >& surfaceLayers)
+{
+    for (int i = surfaceLayers.size() - 1; i >= 0; i--) {
+        LayerCompositingThread* layer = surfaceLayers[i].get();
+        LayerRendererSurface* surface = layer->layerRendererSurface();
+        if (!surface || !useSurface(surface))
+            continue;
+
+        glDisable(GL_SCISSOR_TEST);
+        glClearColor(0, 0, 0, 0);
+        glClear(GL_COLOR_BUFFER_BIT);
+
+        int currentStencilValue = 0;
+        FloatRect clipRect(-1, -1, 2, 2);
+        compositeLayersRecursive(surfaceLayers[i].get(), currentStencilValue, clipRect);
+    }
+
+    // If there are layers drawed on surfaces, we need to switch to default framebuffer.
+    // Otherwise, we just need to set viewport.
+    if (surfaceLayers.size())
+        useSurface(0);
+    else
+        glViewport(m_viewport.x(), m_viewport.y(), m_viewport.width(), m_viewport.height());
+}
+
+void LayerRenderer::setRootLayer(LayerCompositingThread* layer)
+{
+    m_rootLayer = layer;
+}
+
+void LayerRenderer::addLayer(LayerCompositingThread* layer)
+{
+    m_layers.add(layer);
+}
+
+bool LayerRenderer::removeLayer(LayerCompositingThread* layer)
+{
+    LayerSet::iterator iter = m_layers.find(layer);
+    if (iter == m_layers.end())
+        return false;
+    m_layers.remove(layer);
+    return true;
+}
+
+void LayerRenderer::addLayerToReleaseTextureResourcesList(LayerCompositingThread* layer)
+{
+    m_layersLockingTextureResources.add(layer);
+}
+
+// Transform normalized device coordinates to window coordinates
+// as specified in the OpenGL ES 2.0 spec section 2.12.1.
+IntRect LayerRenderer::toOpenGLWindowCoordinates(const FloatRect& r) const
+{
+    float vw2 = m_viewport.width() / 2.0;
+    float vh2 = m_viewport.height() / 2.0;
+    float ox = m_viewport.x() + vw2;
+    float oy = m_viewport.y() + vh2;
+    return enclosingIntRect(FloatRect(r.x() * vw2 + ox, r.y() * vh2 + oy, r.width() * vw2, r.height() * vh2));
+}
+
+// Transform normalized device coordinates to window coordinates as WebKit understands them.
+//
+// The OpenGL surface may be larger than the WebKit window, and OpenGL window coordinates
+// have origin in bottom left while WebKit window coordinates origin is in top left.
+// The viewport is setup to cover the upper portion of the larger OpenGL surface.
+IntRect LayerRenderer::toWebKitWindowCoordinates(const FloatRect& r) const
+{
+    float vw2 = m_viewport.width() / 2.0;
+    float vh2 = m_viewport.height() / 2.0;
+    float ox = m_viewport.x() + vw2;
+    float oy = m_context->surfaceSize().height() - (m_viewport.y() + vh2);
+    return enclosingIntRect(FloatRect(r.x() * vw2 + ox, -(r.y()+r.height()) * vh2 + oy, r.width() * vw2, r.height() * vh2));
+}
+
+// Similar to toWebKitWindowCoordinates except that this also takes any zoom into account.
+IntRect LayerRenderer::toWebKitDocumentCoordinates(const FloatRect& r) const
+{
+    // The zoom is the ratio between visibleRect (or layoutRect) and dstRect parameters which are passed to drawLayers
+    float zoom = m_visibleRect.width() / m_viewport.width();
+    // Could assert here that it doesn't matter whether we choose width or height in the above statement:
+    // because both rectangles should have very similar shapes (subject only to pixel rounding error).
+
+    IntRect result = toWebKitWindowCoordinates(r);
+    result.scale(zoom);
+    return result;
+}
+
+// Draws a debug border around the layer's bounds.
+void LayerRenderer::drawDebugBorder(LayerCompositingThread* layer)
+{
+    Color borderColor = layer->borderColor();
+
+#if DEBUG_DIRTY_LAYERS
+    if (layer->isDirty())
+        borderColor = Color(0xFF, 0x00, 0x00, 0xFF);
+#endif
+
+#if DEBUG_LAYER_ANIMATIONS
+    if (layer->hasRunningAnimations())
+        borderColor =  Color(0x00, 0xFF, 0x00, 0xFF);
+#endif
+
+    if (!borderColor.alpha())
+        return;
+
+    glUseProgram(m_colorProgramObject);
+    glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 0, &layer->getTransformedBounds());
+    glUniform4f(m_colorColorLocation, borderColor.red() / 255.0, borderColor.green() / 255.0, borderColor.blue() / 255.0, 1);
+
+    glLineWidth(layer->borderWidth());
+    glDrawArrays(GL_LINE_LOOP, 0, 4);
+}
+
+// Clears a rectangle inside the layer's bounds.
+void LayerRenderer::drawHolePunchRect(LayerCompositingThread* layer)
+{
+    glUseProgram(m_colorProgramObject);
+    glUniform4f(m_colorColorLocation, 0, 0, 0, 0);
+
+    glBlendFunc(GL_ONE, GL_ZERO);
+    FloatQuad hole = layer->getTransformedHolePunchRect();
+    glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 0, &hole);
+    glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
+    checkGLError();
+    glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA);
+
+    IntRect holeWC = toWebKitWindowCoordinates(hole.boundingBox());
+    m_lastRenderingResults.addHolePunchRect(holeWC);
+}
+
+void LayerRenderer::updateLayersRecursive(LayerCompositingThread* layer, const TransformationMatrix& matrix, Vector<RefPtr<LayerCompositingThread> >& surfaceLayers, float opacity, FloatRect clipRect, double currentTime)
+{
+
+    // The contract for LayerCompositingThread::setLayerRenderer is it must be set if the layer has been rendered.
+    // So do it now, before we render it in compositeLayersRecursive.
+    layer->setLayerRenderer(this);
+    if (layer->maskLayer())
+        layer->maskLayer()->setLayerRenderer(this);
+    if (layer->replicaLayer()) {
+        LayerCompositingThread* replica = layer->replicaLayer();
+        replica->setLayerRenderer(this);
+        if (replica->maskLayer())
+            replica->maskLayer()->setLayerRenderer(this);
+    }
+
+    // This might cause the layer to recompute some attributes.
+    m_lastRenderingResults.needsAnimationFrame |= layer->updateAnimations(currentTime);
+
+    // Compute the new matrix transformation that will be applied to this layer and
+    // all its sublayers. It's important to remember that the layer's position
+    // is the position of the layer's anchor point. Also, the coordinate system used
+    // assumes that the origin is at the lower left even though the coordinates the browser
+    // gives us for the layers are for the upper left corner. The Y flip happens via
+    // the orthographic projection applied at render time.
+    // The transformation chain for the layer is (using the Matrix x Vector order):
+    // M = M[p] * Tr[l] * M[l] * Tr[c]
+    // Where M[p] is the parent matrix passed down to the function
+    //       Tr[l] is the translation matrix locating the layer's anchor point
+    //       Tr[c] is the translation offset between the anchor point and the center of the layer
+    //       M[l] is the layer's matrix (applied at the anchor point)
+    // This transform creates a coordinate system whose origin is the center of the layer.
+    // Note that the final matrix used by the shader for the layer is P * M * S . This final product
+    // is computed in drawTexturedQuad().
+    // Where: P is the projection matrix
+    //        M is the layer's matrix computed above
+    //        S is the scale adjustment (to scale up to the layer size)
+    IntSize bounds = layer->bounds();
+    FloatPoint anchorPoint = layer->anchorPoint();
+    FloatPoint position = layer->position();
+
+    // Layer whose hasFixedContainer is true will get scrolled relative to
+    // the fixed positioned parent.
+    if (!layer->hasFixedContainer() && (layer->isFixedPosition() || layer->hasFixedAncestorInDOMTree())) {
+        // The basic idea here is to set visible y to the value we want, and
+        // layout y to the value WebCore layouted the fixed element to.
+        float maximumScrollY = m_contentsSize.height() - m_visibleRect.height();
+        float visibleY = max(0.0f, m_visibleRect.y());
+        float layoutY = max(0.0f, min(maximumScrollY, (float)m_layoutRect.y()));
+
+        // For stuff located on the lower half of the screen, we zoom relative to bottom.
+        // This trick allows us to display fixed positioned elements aligned to top or
+        // bottom correctly when panning and zooming, without actually knowing the
+        // numeric values of the top and bottom CSS attributes.
+        // In fact, the position is the location of the anchor, so to find the top left
+        // we have to subtract the anchor times the bounds. The anchor defaults to
+        // (0.5, 0.5) for most layers.
+        if (position.y() - anchorPoint.y() * bounds.height() > layoutY + m_layoutRect.height() / 2) {
+            visibleY = min<float>(m_contentsSize.height(), m_visibleRect.y() + m_visibleRect.height());
+            layoutY = min(m_contentsSize.height(), max(0, m_layoutRect.y()) + m_layoutRect.height());
+        }
+
+        position.setY(position.y() + (visibleY - layoutY));
+    }
+
+    // Offset between anchor point and the center of the quad.
+    float centerOffsetX = (0.5 - anchorPoint.x()) * bounds.width();
+    float centerOffsetY = (0.5 - anchorPoint.y()) * bounds.height();
+
+    // M = M[p]
+    TransformationMatrix localMatrix = matrix;
+    // M = M[p] * Tr[l]
+    localMatrix.translate3d(position.x(), position.y(), layer->anchorPointZ());
+    // M = M[p] * Tr[l] * M[l]
+    localMatrix.multiply(layer->transform());
+    // M = M[p] * Tr[l] * M[l] * Tr[c]
+    localMatrix.translate3d(centerOffsetX, centerOffsetY, -layer->anchorPointZ());
+
+    // Calculate the layer's opacity.
+    opacity *= layer->opacity();
+
+    bool useLayerRendererSurface = layer->maskLayer() || layer->replicaLayer();
+    if (!useLayerRendererSurface) {
+        layer->setDrawOpacity(opacity);
+        layer->clearLayerRendererSurface();
+    } else {
+        if (!layer->layerRendererSurface())
+            layer->createLayerRendererSurface();
+
+        LayerRendererSurface* surface = layer->layerRendererSurface();
+
+        layer->setDrawOpacity(1.0);
+        surface->setDrawOpacity(opacity);
+
+        surface->setDrawTransform(localMatrix);
+        if (layer->replicaLayer()) {
+            TransformationMatrix replicaMatrix = localMatrix;
+            replicaMatrix.translate3d(-0.5 * bounds.width(), -0.5 * bounds.height(), 0);
+            replicaMatrix.translate3d(layer->replicaLayer()->position().x(), layer->replicaLayer()->position().y(), 0);
+            replicaMatrix.multiply(layer->replicaLayer()->transform());
+            replicaMatrix.translate3d(centerOffsetX, centerOffsetY, 0);
+            surface->setReplicaDrawTransform(replicaMatrix);
+        }
+
+        IntRect drawRect = IntRect(IntPoint(), bounds);
+        surface->setContentRect(drawRect);
+
+        TransformationMatrix projectionMatrix = orthoMatrix(drawRect.x(), drawRect.maxX(), drawRect.y(), drawRect.maxY(), -1000, 1000);
+        // The origin of the new surface is the upper left corner of the layer.
+        TransformationMatrix drawTransform;
+        drawTransform.translate3d(0.5 * bounds.width(), 0.5 * bounds.height(), 0);
+        // This layer will start using new transformation.
+        localMatrix = projectionMatrix * drawTransform;
+
+        surfaceLayers.append(layer);
+    }
+
+    layer->setDrawTransform(localMatrix);
+
+#if ENABLE(VIDEO)
+    bool layerVisible = clipRect.intersects(layer->getDrawRect()) || layer->mediaPlayer();
+#else
+    bool layerVisible = clipRect.intersects(layer->getDrawRect());
+#endif
+
+    if (layer->needsTexture() && layerVisible) {
+        IntRect dirtyRect = toWebKitWindowCoordinates(intersection(layer->getDrawRect(), clipRect));
+        m_lastRenderingResults.addDirtyRect(dirtyRect);
+    }
+
+    if (layer->masksToBounds())
+        clipRect.intersect(layer->getDrawRect());
+
+    // Flatten to 2D if the layer doesn't preserve 3D.
+    if (!layer->preserves3D()) {
+        localMatrix.setM13(0);
+        localMatrix.setM23(0);
+        localMatrix.setM31(0);
+        localMatrix.setM32(0);
+        // This corresponds to the depth range specified in the original orthographic projection matrix
+        localMatrix.setM33(0.001);
+        localMatrix.setM34(0);
+        localMatrix.setM43(0);
+    }
+
+    // Apply the sublayer transform.
+    localMatrix.multiply(layer->sublayerTransform());
+
+    // The origin of the sublayers is actually the bottom left corner of the layer
+    // (or top left when looking it it from the browser's pespective) instead of the center.
+    // The matrix passed down to the sublayers is therefore:
+    // M[s] = M * Tr[-center]
+    localMatrix.translate3d(-bounds.width() * 0.5, -bounds.height() * 0.5, 0);
+
+    const Vector<RefPtr<LayerCompositingThread> >& sublayers = layer->getSublayers();
+    for (size_t i = 0; i < sublayers.size(); i++)
+        updateLayersRecursive(sublayers[i].get(), localMatrix, surfaceLayers, opacity, clipRect, currentTime);
+}
+
+static bool hasRotationalComponent(const TransformationMatrix& m)
+{
+    return m.m12() || m.m13() || m.m23() || m.m21() || m.m31() || m.m32();
+}
+
+bool LayerRenderer::layerAlreadyOnSurface(LayerCompositingThread* layer) const
+{
+    return layer->layerRendererSurface() && layer->layerRendererSurface() != m_currentLayerRendererSurface;
+}
+
+static void collect3DPreservingLayers(Vector<LayerCompositingThread*>& layers)
+{
+    for (size_t i = 0; i < layers.size(); ++i) {
+        LayerCompositingThread* layer = layers[i];
+        if (!layer->preserves3D() || !layer->getSublayers().size())
+            continue;
+
+        Vector<LayerCompositingThread*> sublayers = rawPtrVectorFromRefPtrVector(layer->getSublayers());
+        collect3DPreservingLayers(sublayers);
+        layers.insert(i+1, sublayers);
+        i += sublayers.size();
+    }
+}
+
+void LayerRenderer::compositeLayersRecursive(LayerCompositingThread* layer, int stencilValue, FloatRect clipRect)
+{
+    FloatRect rect;
+    if (layerAlreadyOnSurface(layer))
+        rect = layer->layerRendererSurface()->drawRect();
+    else
+        rect = layer->getDrawRect();
+
+#if ENABLE(VIDEO)
+    bool layerVisible = clipRect.intersects(rect) || layer->mediaPlayer();
+#else
+    bool layerVisible = clipRect.intersects(rect);
+#endif
+
+    layer->setVisible(layerVisible);
+
+    glStencilFunc(GL_EQUAL, stencilValue, 0xff);
+    glStencilOp(GL_KEEP, GL_KEEP, GL_KEEP);
+
+    // Note that there are two types of layers:
+    // 1. Layers that have their own GraphicsContext and can draw their contents on demand (layer->drawsContent() == true).
+    // 2. Layers that are just containers of images/video/etc that don't own a GraphicsContext (layer->contents() == true).
+
+    // Even non-visible layers need to perform their texture jobs, or they will
+    // pile up and waste memory.
+    if (layer->needsTexture())
+        layer->updateTextureContentsIfNeeded();
+    if (layer->maskLayer() && layer->maskLayer()->needsTexture())
+        layer->maskLayer()->updateTextureContentsIfNeeded();
+    if (layer->replicaLayer()) {
+        LayerCompositingThread* replica = layer->replicaLayer();
+        if (replica->needsTexture())
+            replica->updateTextureContentsIfNeeded();
+        if (replica->maskLayer() && replica->maskLayer()->needsTexture())
+            replica->maskLayer()->updateTextureContentsIfNeeded();
+    }
+
+    if ((layer->needsTexture() || layer->layerRendererSurface()) && layerVisible) {
+        updateScissorIfNeeded(clipRect);
+
+        if (layer->doubleSided())
+            glDisable(GL_CULL_FACE);
+        else
+            glEnable(GL_CULL_FACE);
+
+        if (layer->hasVisibleHolePunchRect())
+            drawHolePunchRect(layer);
+
+        // Draw the surface onto another surface or screen.
+        bool drawSurface = layerAlreadyOnSurface(layer);
+        // The texture format for the surface is RGBA.
+        LayerData::LayerProgramShader shader = drawSurface ? LayerData::LayerProgramShaderRGBA : layer->layerProgramShader();
+
+        if (!drawSurface) {
+            glUseProgram(m_layerProgramObject[shader]);
+            glUniform1f(m_alphaLocation[shader], layer->drawOpacity());
+            layer->drawTextures(m_positionLocation, m_texCoordLocation, m_visibleRect);
+        } else {
+            // Draw the reflection if it exists.
+            if (layer->replicaLayer()) {
+                // If this layer and its reflection both have mask, we need another temporary surface.
+                // Since this use case should be rare, currently it's not handled and the mask for
+                // the reflection is applied only when this layer has no mask.
+                LayerCompositingThread* mask = layer->maskLayer();
+                if (!mask && layer->replicaLayer())
+                    mask = layer->replicaLayer()->maskLayer();
+
+                glUseProgram(mask ? m_layerMaskProgramObject[shader] : m_layerProgramObject[shader]);
+                glUniform1f(mask ? m_maskAlphaLocation[shader] : m_alphaLocation[shader], layer->layerRendererSurface()->drawOpacity());
+                layer->drawSurface(layer->layerRendererSurface()->replicaDrawTransform(), mask, m_positionLocation, m_texCoordLocation);
+            }
+
+            glUseProgram(layer->maskLayer() ? m_layerMaskProgramObject[shader] : m_layerProgramObject[shader]);
+            glUniform1f(layer->maskLayer() ? m_maskAlphaLocation[shader] : m_alphaLocation[shader], layer->layerRendererSurface()->drawOpacity());
+            layer->drawSurface(layer->layerRendererSurface()->drawTransform(), layer->maskLayer(), m_positionLocation, m_texCoordLocation);
+        }
+
+        if (layer->hasMissingTextures()) {
+            glDisable(GL_BLEND);
+            glUseProgram(m_checkerProgramObject);
+            layer->drawMissingTextures(m_positionLocation, m_texCoordLocation, m_visibleRect);
+            glEnable(GL_BLEND);
+            glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA);
+        }
+    }
+
+    // Draw the debug border if there is one.
+    drawDebugBorder(layer);
+
+    // The texture for the LayerRendererSurface can be released after the surface was drawed on another surface.
+    if (layerAlreadyOnSurface(layer)) {
+        layer->layerRendererSurface()->releaseTexture();
+        return;
+    }
+
+    // If we need to mask to bounds but the transformation has a rotational component
+    // to it, scissoring is not enough and we need to use the stencil buffer for clipping.
+#if ENABLE_SCISSOR
+    bool stencilClip = layer->masksToBounds() && hasRotationalComponent(layer->drawTransform());
+#else
+    bool stencilClip = layer->masksToBounds();
+#endif
+
+    if (stencilClip) {
+        glStencilFunc(GL_EQUAL, stencilValue, 0xff);
+        glStencilOp(GL_KEEP, GL_INCR, GL_INCR);
+
+        updateScissorIfNeeded(clipRect);
+        glUseProgram(m_colorProgramObject);
+        glColorMask(GL_FALSE, GL_FALSE, GL_FALSE, GL_FALSE);
+        glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 0, &layer->getTransformedBounds());
+        glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
+        glColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
+    }
+
+    if (layer->masksToBounds())
+        clipRect.intersect(layer->getDrawRect());
+
+    // Here, we need to sort the whole subtree of layers with preserve-3d. It
+    // affects all children, and the children of any children with preserve-3d,
+    // and so on.
+    Vector<LayerCompositingThread*> sublayers = rawPtrVectorFromRefPtrVector(layer->getSublayers());
+
+    bool preserves3D = layer->preserves3D();
+    bool superlayerPreserves3D = layer->superlayer() && layer->superlayer()->preserves3D();
+
+    // Collect and render all sublayers with preserves-3D.
+    // If the superlayer preserves 3D, we've already collected and rendered its
+    // children, so bail.
+    if (preserves3D && !superlayerPreserves3D) {
+        collect3DPreservingLayers(sublayers);
+        std::stable_sort(sublayers.begin(), sublayers.end(), compareLayerZ);
+    }
+
+    int newStencilValue = stencilClip ? stencilValue+1 : stencilValue;
+    for (size_t i = 0; i < sublayers.size(); i++) {
+        LayerCompositingThread* sublayer = sublayers[i];
+        // The root of the 3d-preserving subtree has collected all
+        // 3d-preserving layers and their children and will render them all in
+        // the right order.
+        if (preserves3D && superlayerPreserves3D)
+            continue;
+
+         compositeLayersRecursive(sublayer, newStencilValue, clipRect);
+    }
+
+    if (stencilClip) {
+        glStencilFunc(GL_LEQUAL, stencilValue, 0xff);
+        glStencilOp(GL_KEEP, GL_REPLACE, GL_REPLACE);
+
+        updateScissorIfNeeded(clipRect);
+        glUseProgram(m_colorProgramObject);
+        glColorMask(GL_FALSE, GL_FALSE, GL_FALSE, GL_FALSE);
+        glVertexAttribPointer(0, 2, GL_FLOAT, GL_FALSE, 0, &layer->getTransformedBounds());
+        glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
+        glColorMask(GL_TRUE, GL_TRUE, GL_TRUE, GL_TRUE);
+    }
+}
+
+void LayerRenderer::updateScissorIfNeeded(const FloatRect& clipRect)
+{
+#if ENABLE_SCISSOR
+    IntRect clipRectWC = toOpenGLWindowCoordinates(clipRect);
+    if (m_scissorRect == clipRectWC)
+        return;
+
+    m_scissorRect = clipRectWC;
+    glScissor(m_scissorRect.x(), m_scissorRect.y(), m_scissorRect.width(), m_scissorRect.height());
+#endif
+}
+
+bool LayerRenderer::makeContextCurrent()
+{
+    return m_context->makeCurrent();
+}
+
+// Binds the given attribute name to a common location across all three programs
+// used by the compositor. This allows the code to bind the attributes only once
+// even when switching between programs.
+void LayerRenderer::bindCommonAttribLocation(int location, const char* attribName)
+{
+    for (int i = 0; i < LayerData::NumberOfLayerProgramShaders; ++i) {
+        glBindAttribLocation(m_layerProgramObject[i], location, attribName);
+        glBindAttribLocation(m_layerMaskProgramObject[i], location, attribName);
+    }
+
+    glBindAttribLocation(m_colorProgramObject, location, attribName);
+    glBindAttribLocation(m_checkerProgramObject, location, attribName);
+}
+
+bool LayerRenderer::initializeSharedGLObjects()
+{
+    // Shaders for drawing the layer contents.
+    char vertexShaderString[] =
+        "attribute vec4 a_position;   \n"
+        "attribute vec2 a_texCoord;   \n"
+        "varying vec2 v_texCoord;     \n"
+        "void main()                  \n"
+        "{                            \n"
+        "  gl_Position = a_position;  \n"
+        "  v_texCoord = a_texCoord;   \n"
+        "}                            \n";
+
+    char fragmentShaderStringRGBA[] =
+        "varying mediump vec2 v_texCoord;                           \n"
+        "uniform lowp sampler2D s_texture;                          \n"
+        "uniform lowp float alpha;                                  \n"
+        "void main()                                                \n"
+        "{                                                          \n"
+        "  gl_FragColor = texture2D(s_texture, v_texCoord) * alpha; \n"
+        "}                                                          \n";
+
+    char fragmentShaderStringBGRA[] =
+        "varying mediump vec2 v_texCoord;                                \n"
+        "uniform lowp sampler2D s_texture;                               \n"
+        "uniform lowp float alpha;                                       \n"
+        "void main()                                                     \n"
+        "{                                                               \n"
+        "  gl_FragColor = texture2D(s_texture, v_texCoord).bgra * alpha; \n"
+        "}                                                               \n";
+
+    char fragmentShaderStringMaskRGBA[] =
+        "varying mediump vec2 v_texCoord;                           \n"
+        "uniform lowp sampler2D s_texture;                          \n"
+        "uniform lowp sampler2D s_mask;                             \n"
+        "uniform lowp float alpha;                                  \n"
+        "void main()                                                \n"
+        "{                                                          \n"
+        "  lowp vec4 texColor = texture2D(s_texture, v_texCoord);   \n"
+        "  lowp vec4 maskColor = texture2D(s_mask, v_texCoord);     \n"
+        "  gl_FragColor = vec4(texColor.x, texColor.y, texColor.z, texColor.w) * alpha * maskColor.w;           \n"
+        "}                                                          \n";
+
+    char fragmentShaderStringMaskBGRA[] =
+        "varying mediump vec2 v_texCoord;                                \n"
+        "uniform lowp sampler2D s_texture;                               \n"
+        "uniform lowp sampler2D s_mask;                                  \n"
+        "uniform lowp float alpha;                                       \n"
+        "void main()                                                     \n"
+        "{                                                               \n"
+        "  lowp vec4 texColor = texture2D(s_texture, v_texCoord).bgra;             \n"
+        "  lowp vec4 maskColor = texture2D(s_mask, v_texCoord).bgra;          \n"
+        "  gl_FragColor = vec4(texColor.x, texColor.y, texColor.z, texColor.w) * alpha * maskColor.w;         \n"
+        "}                                                               \n";
+
+
+    // Shaders for drawing the debug borders around the layers.
+    char colorVertexShaderString[] =
+        "attribute vec4 a_position;   \n"
+        "void main()                  \n"
+        "{                            \n"
+        "   gl_Position = a_position; \n"
+        "}                            \n";
+
+    char colorFragmentShaderString[] =
+        "uniform lowp vec4 color;     \n"
+        "void main()                  \n"
+        "{                            \n"
+        "  gl_FragColor = color;      \n"
+        "}                            \n";
+
+    // FIXME: get screen size, get light/dark color, use
+    // string manipulation methods to insert those constants into
+    // the shader source.
+    static Color lightColor(0xfb, 0xfd, 0xff);
+    // checkerboardColorDark()
+    static Color darkColor(0xe8, 0xee, 0xf7);
+    int checkerSize = 20;
+    String tmp(
+        "uniform mediump float scale;                  \n"
+        "uniform mediump vec2 origin;                  \n"
+        "uniform mediump float surfaceHeight;          \n"
+        "void main()                                   \n"
+        "{                                             \n"
+        "  const mediump float grid = GRID;            \n"
+        "  const lowp vec4 lightColor = LIGHT_COLOR;   \n"
+        "  const lowp vec4 darkColor = DARK_COLOR;     \n"
+        "  mediump float tmp = grid * scale;           \n"
+        "  gl_FragColor = mod(floor((gl_FragCoord.x + origin.x) / tmp) + floor((surfaceHeight - gl_FragCoord.y + origin.y) / tmp), 2.0) > 0.99 \n"
+        "    ? lightColor : darkColor;                 \n"
+        "}                                             \n");
+
+    // Let WTF::String be our preprocessor
+    tmp.replace("LIGHT_COLOR", String::format("vec4(%.4f, %.4f, %.4f, 1.0)", lightColor.red() / 255.0, lightColor.green() / 255.0, lightColor.blue() / 255.0));
+    tmp.replace("DARK_COLOR", String::format("vec4(%.4f, %.4f, %.4f, 1.0)", darkColor.red() / 255.0, darkColor.green() / 255.0, darkColor.blue() / 255.0));
+    tmp.replace("GRID", String::format("%.3f", (float)checkerSize));
+    CString checkerFragmentShaderString = tmp.latin1();
+
+    makeContextCurrent();
+
+    m_layerProgramObject[LayerData::LayerProgramShaderRGBA] =
+        loadShaderProgram(vertexShaderString, fragmentShaderStringRGBA);
+    if (!m_layerProgramObject[LayerData::LayerProgramShaderRGBA]) {
+        LOG_ERROR("Failed to create shader program for RGBA layers");
+        return false;
+    }
+
+    m_layerProgramObject[LayerData::LayerProgramShaderBGRA] =
+        loadShaderProgram(vertexShaderString, fragmentShaderStringBGRA);
+    if (!m_layerProgramObject[LayerData::LayerProgramShaderBGRA]) {
+        LOG_ERROR("Failed to create shader program for BGRA layers");
+        return false;
+    }
+
+    m_layerMaskProgramObject[LayerData::LayerProgramShaderRGBA] =
+        loadShaderProgram(vertexShaderString, fragmentShaderStringMaskRGBA);
+    if (!m_layerMaskProgramObject[LayerData::LayerProgramShaderRGBA]) {
+        LOG_ERROR("Failed to create shader mask program for RGBA layers");
+        return false;
+    }
+
+    m_layerMaskProgramObject[LayerData::LayerProgramShaderBGRA] =
+        loadShaderProgram(vertexShaderString, fragmentShaderStringMaskBGRA);
+    if (!m_layerMaskProgramObject[LayerData::LayerProgramShaderBGRA]) {
+        LOG_ERROR("Failed to create shader mask program for BGRA layers");
+        return false;
+    }
+
+    m_colorProgramObject = loadShaderProgram(colorVertexShaderString, colorFragmentShaderString);
+    if (!m_colorProgramObject) {
+        LOG_ERROR("Failed to create shader program for debug borders");
+        return false;
+    }
+
+    m_checkerProgramObject = loadShaderProgram(colorVertexShaderString, checkerFragmentShaderString.data());
+    if (!m_checkerProgramObject) {
+        LOG_ERROR("Failed to create shader program for checkerboard pattern");
+        return false;
+    }
+
+    // Specify the attrib location for the position and make it the same for all three programs to
+    // avoid binding re-binding the vertex attributes.
+    bindCommonAttribLocation(m_positionLocation, "a_position");
+    bindCommonAttribLocation(m_texCoordLocation, "a_texCoord");
+
+    checkGLError();
+
+    // Re-link the shaders to get the new attrib location to take effect.
+    for (int i = 0; i < LayerData::NumberOfLayerProgramShaders; ++i) {
+        glLinkProgram(m_layerProgramObject[i]);
+        glLinkProgram(m_layerMaskProgramObject[i]);
+    }
+
+    glLinkProgram(m_colorProgramObject);
+    glLinkProgram(m_checkerProgramObject);
+
+    checkGLError();
+
+    // Get locations of uniforms for the layer content shader program.
+    for (int i = 0; i < LayerData::NumberOfLayerProgramShaders; ++i) {
+        m_samplerLocation[i] = glGetUniformLocation(m_layerProgramObject[i], "s_texture");
+        m_alphaLocation[i] = glGetUniformLocation(m_layerProgramObject[i], "alpha");
+        glUseProgram(m_layerProgramObject[i]);
+        glUniform1i(m_samplerLocation[i], 0);
+        m_maskSamplerLocation[i] = glGetUniformLocation(m_layerMaskProgramObject[i], "s_texture");
+        m_maskSamplerLocationMask[i] = glGetUniformLocation(m_layerMaskProgramObject[i], "s_mask");
+        m_maskAlphaLocation[i] = glGetUniformLocation(m_layerMaskProgramObject[i], "alpha");
+        glUseProgram(m_layerMaskProgramObject[i]);
+        glUniform1i(m_maskSamplerLocation[i], 0);
+        glUniform1i(m_maskSamplerLocationMask[i], 1);
+    }
+
+    // Get locations of uniforms for the debug border shader program.
+    m_colorColorLocation = glGetUniformLocation(m_colorProgramObject, "color");
+
+    // Get locations of uniforms for the checkerboard shader program.
+    m_checkerScaleLocation = glGetUniformLocation(m_checkerProgramObject, "scale");
+    m_checkerOriginLocation = glGetUniformLocation(m_checkerProgramObject, "origin");
+    m_checkerSurfaceHeightLocation = glGetUniformLocation(m_checkerProgramObject, "surfaceHeight");
+
+    return true;
+}
+
+IntRect LayerRenderingResults::holePunchRect(unsigned index) const
+{
+    if (index >= m_holePunchRects.size())
+        return IntRect();
+
+    return m_holePunchRects.at(index);
+}
+
+void LayerRenderingResults::addHolePunchRect(const IntRect& rect)
+{
+#if DEBUG_VIDEO_CLIPPING
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelInfo, "LayerRenderingResults::addHolePunchRect (x=%d,y=%d,width=%d,height=%d).", rect.x(), rect.y(), rect.width(), rect.height());
+#endif
+    if (!rect.isEmpty())
+        m_holePunchRects.append(rect);
+}
+
+void LayerRenderingResults::addDirtyRect(const IntRect& rect)
+{
+    IntRect dirtyUnion[NumberOfDirtyRects];
+    int smallestIncrease = INT_MAX;
+    int modifiedRect = 0;
+    for (int i = 0; i < NumberOfDirtyRects; ++i) {
+        dirtyUnion[i] = m_dirtyRects[i];
+        dirtyUnion[i].unite(rect);
+        int increase = dirtyUnion[i].width()*dirtyUnion[i].height() - m_dirtyRects[i].width()*m_dirtyRects[i].height();
+        if (increase < smallestIncrease) {
+            smallestIncrease = increase;
+            modifiedRect = i;
+        }
+    }
+
+    m_dirtyRects[modifiedRect] = dirtyUnion[modifiedRect];
+}
+
+bool LayerRenderingResults::isEmpty() const
+{
+    for (int i = 0; i < NumberOfDirtyRects; ++i) {
+        if (!m_dirtyRects[i].isEmpty())
+            return false;
+    }
+    return true;
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerRenderer.h b/Source/WebCore/platform/graphics/blackberry/LayerRenderer.h
new file mode 100644
index 000000000..fe5ea0011
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerRenderer.h
@@ -0,0 +1,191 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef LayerRenderer_h
+#define LayerRenderer_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "IntRect.h"
+#include "LayerData.h"
+#include "TransformationMatrix.h"
+
+#include <BlackBerryPlatformGLES2Context.h>
+#include <BlackBerryPlatformIntRectRegion.h>
+#include <wtf/HashSet.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class LayerCompositingThread;
+class LayerRendererSurface;
+
+class LayerRenderingResults {
+public:
+    LayerRenderingResults() : wasEmpty(true), needsAnimationFrame(false) { }
+
+    void addHolePunchRect(const IntRect&);
+    IntRect holePunchRect(size_t index) const;
+    size_t holePunchRectSize() { return m_holePunchRects.size(); }
+
+    static const int NumberOfDirtyRects = 3;
+    const IntRect& dirtyRect(int i) const { return m_dirtyRects[i]; }
+    void addDirtyRect(const IntRect& dirtyRect);
+    bool isEmpty() const;
+
+    bool wasEmpty;
+
+    BlackBerry::Platform::IntRectRegion dirtyRegion;
+
+    bool needsAnimationFrame;
+
+private:
+    Vector<IntRect> m_holePunchRects; // Rects are in compositing surface coordinates.
+    IntRect m_dirtyRects[NumberOfDirtyRects];
+};
+
+// Class that handles drawing of composited render layers using GL.
+class LayerRenderer {
+    WTF_MAKE_NONCOPYABLE(LayerRenderer);
+public:
+    static PassOwnPtr<LayerRenderer> create(BlackBerry::Platform::Graphics::GLES2Context*);
+
+    LayerRenderer(BlackBerry::Platform::Graphics::GLES2Context*);
+    ~LayerRenderer();
+
+    void releaseLayerResources();
+
+    // Recomposites all the layers. Returns true if it needs more draw.
+    void drawLayers(const FloatRect& visibleRect, const IntRect& layoutRect, const IntSize& contentsSize, const IntRect& dstRect);
+
+    void setRootLayer(LayerCompositingThread*);
+    LayerCompositingThread* rootLayer() { return m_rootLayer.get(); }
+
+    // Keep track of layers that need cleanup when the LayerRenderer is destroyed
+    void addLayer(LayerCompositingThread*);
+    bool removeLayer(LayerCompositingThread*);
+
+    // Keep track of layers that need to release their textures when we swap buffers
+    void addLayerToReleaseTextureResourcesList(LayerCompositingThread*);
+
+    bool hardwareCompositing() const { return m_hardwareCompositing; }
+
+    void setClearSurfaceOnDrawLayers(bool clear) { m_clearSurfaceOnDrawLayers = clear; }
+    bool clearSurfaceOnDrawLayers() const { return m_clearSurfaceOnDrawLayers; }
+
+    BlackBerry::Platform::Graphics::GLES2Context* context() const { return m_context; }
+
+    const LayerRenderingResults& lastRenderingResults() const { return m_lastRenderingResults; }
+
+    // Schedule a commit on the WebKit thread at the end of rendering
+    // Used when a layer discovers during rendering that it needs a commit.
+    void setNeedsCommit() { m_needsCommit = true; }
+
+    IntRect toWebKitDocumentCoordinates(const FloatRect&) const;
+
+    // If the layer has already been drawed on a surface.
+    bool layerAlreadyOnSurface(LayerCompositingThread*) const;
+
+private:
+    void updateLayersRecursive(LayerCompositingThread*, const TransformationMatrix& parentMatrix, Vector<RefPtr<LayerCompositingThread> >& surfaceLayers, float opacity, FloatRect clipRect, double currentTime);
+    void compositeLayersRecursive(LayerCompositingThread*, int stencilValue, FloatRect clipRect);
+    void updateScissorIfNeeded(const FloatRect& clipRect);
+
+    bool useSurface(LayerRendererSurface*);
+    void drawLayersOnSurfaces(const Vector<RefPtr<LayerCompositingThread> >& surfaceLayers);
+
+    void drawDebugBorder(LayerCompositingThread*);
+    void drawHolePunchRect(LayerCompositingThread*);
+
+    IntRect toOpenGLWindowCoordinates(const FloatRect&) const;
+    IntRect toWebKitWindowCoordinates(const FloatRect&) const;
+
+    void bindCommonAttribLocation(int location, const char* attribName);
+
+    bool makeContextCurrent();
+
+    bool initializeSharedGLObjects();
+
+    // GL shader program object IDs.
+    unsigned m_layerProgramObject[LayerData::NumberOfLayerProgramShaders];
+    unsigned m_layerMaskProgramObject[LayerData::NumberOfLayerProgramShaders];
+    unsigned m_colorProgramObject;
+    unsigned m_checkerProgramObject;
+
+    // Shader uniform and attribute locations.
+    const int m_positionLocation;
+    const int m_texCoordLocation;
+    int m_samplerLocation[LayerData::NumberOfLayerProgramShaders];
+    int m_alphaLocation[LayerData::NumberOfLayerProgramShaders];
+    int m_maskSamplerLocation[LayerData::NumberOfLayerProgramShaders];
+    int m_maskSamplerLocationMask[LayerData::NumberOfLayerProgramShaders];
+    int m_maskAlphaLocation[LayerData::NumberOfLayerProgramShaders];
+
+    int m_colorColorLocation;
+    int m_checkerScaleLocation;
+    int m_checkerOriginLocation;
+    int m_checkerSurfaceHeightLocation;
+
+    // Current draw configuration.
+    FloatRect m_visibleRect;
+    IntRect m_layoutRect;
+    IntSize m_contentsSize;
+
+    IntRect m_viewport;
+    IntRect m_scissorRect;
+
+    RefPtr<LayerCompositingThread> m_rootLayer;
+
+    unsigned m_fbo;
+    LayerRendererSurface* m_currentLayerRendererSurface;
+
+    bool m_hardwareCompositing;
+    bool m_clearSurfaceOnDrawLayers;
+
+    // Map associating layers with textures ids used by the GL compositor.
+    typedef HashSet<LayerCompositingThread*> LayerSet;
+    LayerSet m_layers;
+    LayerSet m_layersLockingTextureResources;
+
+    BlackBerry::Platform::Graphics::GLES2Context* m_context;
+
+    LayerRenderingResults m_lastRenderingResults;
+    bool m_needsCommit;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerRendererSurface.cpp b/Source/WebCore/platform/graphics/blackberry/LayerRendererSurface.cpp
new file mode 100644
index 000000000..dea1dd002
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerRendererSurface.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerRendererSurface.h"
+
+#include "LayerCompositingThread.h"
+#include "LayerRenderer.h"
+#include "TextureCacheCompositingThread.h"
+
+namespace WebCore {
+
+LayerRendererSurface::LayerRendererSurface(LayerRenderer* renderer, LayerCompositingThread* owner)
+    : m_ownerLayer(owner)
+    , m_layerRenderer(renderer)
+    , m_opacity(1.0)
+{
+}
+
+LayerRendererSurface::~LayerRendererSurface()
+{
+}
+
+void LayerRendererSurface::setContentRect(const IntRect& contentRect)
+{
+    m_contentRect = contentRect;
+    m_size = contentRect.size();
+}
+
+FloatRect LayerRendererSurface::drawRect() const
+{
+    float bx = m_size.width() / 2.0;
+    float by = m_size.height() / 2.0;
+
+    FloatQuad transformedBounds;
+    transformedBounds.setP1(m_drawTransform.mapPoint(FloatPoint(-bx, -by)));
+    transformedBounds.setP2(m_drawTransform.mapPoint(FloatPoint(-bx, by)));
+    transformedBounds.setP3(m_drawTransform.mapPoint(FloatPoint(bx, by)));
+    transformedBounds.setP4(m_drawTransform.mapPoint(FloatPoint(bx, -by)));
+
+    FloatRect rect = transformedBounds.boundingBox();
+
+    if (m_ownerLayer->replicaLayer()) {
+        FloatQuad bounds;
+        bounds.setP1(m_replicaDrawTransform.mapPoint(FloatPoint(-bx, -by)));
+        bounds.setP2(m_replicaDrawTransform.mapPoint(FloatPoint(-bx, by)));
+        bounds.setP3(m_replicaDrawTransform.mapPoint(FloatPoint(bx, by)));
+        bounds.setP4(m_replicaDrawTransform.mapPoint(FloatPoint(bx, -by)));
+        rect.unite(bounds.boundingBox());
+    }
+
+    return rect;
+}
+
+bool LayerRendererSurface::ensureTexture()
+{
+    if (!m_texture)
+        m_texture = textureCacheCompositingThread()->createTexture();
+
+    return m_texture->protect(m_size);
+}
+
+void LayerRendererSurface::releaseTexture()
+{
+    m_texture->unprotect();
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerRendererSurface.h b/Source/WebCore/platform/graphics/blackberry/LayerRendererSurface.h
new file mode 100644
index 000000000..20bcfad6c
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerRendererSurface.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef LayerRendererSurface_h
+#define LayerRendererSurface_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "FloatRect.h"
+#include "IntRect.h"
+#include "IntSize.h"
+#include "Texture.h"
+#include "TransformationMatrix.h"
+
+namespace WebCore {
+
+class LayerCompositingThread;
+class LayerRenderer;
+
+class LayerRendererSurface {
+    WTF_MAKE_NONCOPYABLE(LayerRendererSurface);
+public:
+    LayerRendererSurface(LayerRenderer*, LayerCompositingThread* owner);
+    ~LayerRendererSurface();
+
+    IntSize size() const { return m_size; }
+
+    FloatRect contentRect() const { return m_contentRect; }
+    void setContentRect(const IntRect&);
+    FloatRect clipRect() const { return m_clipRect; }
+    void setClipRect(const FloatRect& rect) { m_clipRect = rect; }
+
+    void setDrawTransform(const TransformationMatrix& matrix) { m_drawTransform = matrix; }
+    const TransformationMatrix& drawTransform() const { return m_drawTransform; }
+    void setReplicaDrawTransform(const TransformationMatrix& matrix) { m_replicaDrawTransform = matrix; }
+    const TransformationMatrix& replicaDrawTransform() const { return m_replicaDrawTransform; }
+
+    FloatRect drawRect() const;
+
+    bool ensureTexture();
+    void releaseTexture();
+    Texture* texture() const { return m_texture.get(); }
+
+    float drawOpacity() { return m_opacity; }
+    void setDrawOpacity(float opacity) { m_opacity = opacity; }
+
+private:
+    RefPtr<Texture> m_texture;
+
+    FloatRect m_contentRect;
+    FloatRect m_clipRect;
+
+    TransformationMatrix m_surfaceMatrix;
+    TransformationMatrix m_drawTransform;
+    TransformationMatrix m_replicaDrawTransform;
+
+    LayerCompositingThread* m_ownerLayer;
+    LayerRenderer* m_layerRenderer;
+
+    float m_opacity;
+
+    IntSize m_size;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // LayerRendererSurface_h
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerTile.cpp b/Source/WebCore/platform/graphics/blackberry/LayerTile.cpp
new file mode 100644
index 000000000..f21ea948e
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerTile.cpp
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerTile.h"
+
+#include "TextureCacheCompositingThread.h"
+
+namespace WebCore {
+
+LayerTile::LayerTile()
+    : m_contentsDirty(false)
+{
+}
+
+LayerTile::~LayerTile()
+{
+    // Make sure to unprotect the texture if needed.
+    setVisible(false);
+}
+
+void LayerTile::setContents(const SkBitmap& contents, const IntRect& tileRect, const TileIndex& index, bool isOpaque)
+{
+    setTexture(textureCacheCompositingThread()->textureForTiledContents(contents, tileRect, index, isOpaque));
+}
+
+void LayerTile::setContentsToColor(const Color& color)
+{
+    setTexture(textureCacheCompositingThread()->textureForColor(color));
+}
+
+void LayerTile::updateContents(const SkBitmap& contents, const IntRect& dirtyRect, const IntRect& tileRect)
+{
+    setTexture(textureCacheCompositingThread()->updateContents(m_texture, contents, dirtyRect, tileRect));
+}
+
+void LayerTile::discardContents()
+{
+    setTexture(0);
+}
+
+void LayerTile::setVisible(bool visible)
+{
+    if (visible == m_visible)
+        return;
+
+    m_visible = visible;
+
+    if (!m_texture)
+        return;
+
+    // Protect the texture from being evicted from cache
+    // if we are visible.
+    if (visible)
+        m_texture->protect();
+    else
+        m_texture->unprotect();
+}
+
+void LayerTile::setTexture(PassRefPtr<Texture> texture)
+{
+    // Clear this flag regardless of the value of the texture parameter.
+    // If it's 0, isDirty() will return true anyway.
+    // If it's the same texture, perhaps there was no more detailed texture
+    // available than the one we already had, and keeping the dirty flag will
+    // result in an endless loop of updating to the same texture.
+    m_contentsDirty = false;
+
+    if (texture == m_texture)
+        return;
+
+    // Move protection over to the new texture.
+    if (m_visible) {
+        if (m_texture)
+            m_texture->unprotect();
+        if (texture)
+            texture->protect();
+    }
+
+    m_texture = texture;
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerTile.h b/Source/WebCore/platform/graphics/blackberry/LayerTile.h
new file mode 100644
index 000000000..0eddcdaae
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerTile.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef LayerTile_h
+#define LayerTile_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "Texture.h"
+
+#include <wtf/RefPtr.h>
+
+class SkBitmap;
+
+namespace WebCore {
+
+class Color;
+class IntRect;
+class TileIndex;
+
+class LayerTileData {
+public:
+    LayerTileData()
+        : m_visible(false)
+    {
+    }
+
+    bool isVisible() const { return m_visible; }
+
+protected:
+    bool m_visible;
+};
+
+class LayerTile : public LayerTileData {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    LayerTile();
+    ~LayerTile();
+
+    Texture* texture() const { return m_texture.get(); }
+
+    bool isVisible() const { return m_visible; }
+    void setVisible(bool);
+
+    bool isDirty() const { return m_contentsDirty || !m_texture || m_texture->isDirty(); }
+
+    bool hasTexture() const { return m_texture && m_texture->hasTexture(); }
+
+    void setContents(const SkBitmap& contents, const IntRect& tileRect, const TileIndex&, bool isOpaque);
+    void setContentsToColor(const Color&);
+    void updateContents(const SkBitmap& contents, const IntRect& dirtyRect, const IntRect& tileRect);
+    void discardContents();
+
+    // The current texture is an accurate preview of this layer, but a more
+    // detailed texture could be obtained by repainting the layer. Used when
+    // zoom level changes.
+    void setContentsDirty() { m_contentsDirty = true; }
+
+private:
+    void setTexture(PassRefPtr<Texture>);
+
+    // Never assign to m_texture directly, use setTexture() above.
+    RefPtr<Texture> m_texture;
+    bool m_contentsDirty;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // Texture_h
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerTileIndex.h b/Source/WebCore/platform/graphics/blackberry/LayerTileIndex.h
new file mode 100644
index 000000000..4df008728
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerTileIndex.h
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef LayerTileIndex_h
+#define LayerTileIndex_h
+
+#include <limits>
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+
+class TileIndex {
+public:
+    TileIndex()
+        : m_i(std::numeric_limits<unsigned>::max())
+        , m_j(std::numeric_limits<unsigned>::max())
+    {
+    }
+    TileIndex(unsigned i, unsigned j)
+        : m_i(i)
+        , m_j(j)
+    {
+    }
+    ~TileIndex() { }
+
+    unsigned i() const { return m_i; }
+    unsigned j() const { return m_j; }
+    void setIndex(unsigned i, unsigned j)
+    {
+        m_i = i;
+        m_j = j;
+    }
+
+private:
+    unsigned m_i;
+    unsigned m_j;
+};
+
+inline bool operator==(const TileIndex& a, const TileIndex& b)
+{
+    return a.i() == b.i() && a.j() == b.j();
+}
+
+inline bool operator!=(const TileIndex& a, const TileIndex& b)
+{
+    return a.i() != b.i() || a.j() != b.j();
+}
+
+}
+
+namespace WTF {
+
+template<> struct IntHash<WebCore::TileIndex> {
+    static unsigned hash(const WebCore::TileIndex& key) { return intHash((static_cast<uint64_t>(key.i()) << 32 | key.j())); }
+    static bool equal(const WebCore::TileIndex& a, const WebCore::TileIndex& b) { return a == b; }
+    static const bool safeToCompareToEmptyOrDeleted = true;
+};
+template<> struct DefaultHash<WebCore::TileIndex> {
+    typedef IntHash<WebCore::TileIndex> Hash;
+};
+
+template<> struct HashTraits<WebCore::TileIndex> : GenericHashTraits<WebCore::TileIndex> {
+    static const bool emptyValueIsZero = false;
+    static const bool needsDestruction = false;
+    static WebCore::TileIndex emptyValue() { return WebCore::TileIndex(); }
+    static void constructDeletedValue(WebCore::TileIndex& slot)
+    {
+        new (&slot) WebCore::TileIndex(std::numeric_limits<unsigned>::max() - 1, std::numeric_limits<unsigned>::max() - 1);
+    }
+    static bool isDeletedValue(const WebCore::TileIndex& value)
+    {
+        return value.i() == std::numeric_limits<unsigned>::max() - 1 && value.j() == std::numeric_limits<unsigned>::max() - 1;
+    }
+};
+
+} // namespace WTF
+
+#endif // LayerTileIndex_h
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerTiler.cpp b/Source/WebCore/platform/graphics/blackberry/LayerTiler.cpp
new file mode 100644
index 000000000..3dad399d6
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerTiler.cpp
@@ -0,0 +1,747 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerTiler.h"
+
+#include "BitmapImage.h"
+#include "LayerCompositingThread.h"
+#include "LayerMessage.h"
+#include "LayerWebKitThread.h"
+#include "NativeImageSkia.h"
+#include "TextureCacheCompositingThread.h"
+
+#include <BlackBerryPlatformScreen.h>
+#include <GLES2/gl2.h>
+
+using namespace std;
+
+namespace WebCore {
+
+// This is used to make the viewport as used in texture visibility calculations
+// slightly larger so textures are uploaded before becoming really visible.
+const float viewportInflationFactor = 1.1f;
+
+// The tileMultiplier indicates how many tiles will fit in the largest dimension
+// of the screen, if drawn using identity transform.
+// We use half the screen size as tile size, to reduce the texture upload time
+// for small repaint rects. Compared to using screen size directly, this should
+// make most small invalidations 16x faster, unless they're unfortunate enough
+// to intersect two or more tiles, where it would be 8x-1x faster.
+const int tileMultiplier = 4;
+
+static void transformPoint(float x, float y, const TransformationMatrix& m, float* result)
+{
+    // Squash the Z coordinate so that layers aren't clipped against the near and
+    // far plane. Note that the perspective is maintained as we're still passing
+    // down the W coordinate.
+    result[0] = x * m.m11() + y * m.m21() + m.m41();
+    result[1] = x * m.m12() + y * m.m22() + m.m42();
+    result[2] = 0;
+    result[3] = x * m.m14() + y * m.m24() + m.m44();
+}
+
+static IntSize defaultTileSize()
+{
+    static IntSize screenSize = BlackBerry::Platform::Graphics::Screen::primaryScreen()->nativeSize();
+    static int dim = max(screenSize.width(), screenSize.height()) / tileMultiplier;
+    return IntSize(dim, dim);
+}
+
+LayerTiler::LayerTiler(LayerWebKitThread* layer)
+    : m_layer(layer)
+    , m_tilingDisabled(false)
+    , m_contentsDirty(false)
+    , m_tileSize(defaultTileSize())
+    , m_clearTextureJobs(false)
+    , m_hasMissingTextures(false)
+    , m_contentsScale(0.0)
+{
+}
+
+LayerTiler::~LayerTiler()
+{
+    // Someone should have called LayerTiler::deleteTextures()
+    // before now. We can't call it here because we have no
+    // OpenGL context.
+    ASSERT(m_tilesCompositingThread.isEmpty());
+}
+
+void LayerTiler::layerWebKitThreadDestroyed()
+{
+    m_layer = 0;
+}
+
+void LayerTiler::layerCompositingThreadDestroyed()
+{
+    ASSERT(isCompositingThread());
+}
+
+void LayerTiler::setNeedsDisplay(const FloatRect& dirtyRect)
+{
+    m_dirtyRect.unite(dirtyRect);
+    m_contentsDirty = true;
+}
+
+void LayerTiler::setNeedsDisplay()
+{
+    m_dirtyRect.setLocation(FloatPoint::zero());
+    m_dirtyRect.setSize(m_layer->bounds());
+    m_contentsDirty = true;
+}
+
+void LayerTiler::updateTextureContentsIfNeeded(double scale)
+{
+    updateTileSize();
+
+    HashSet<TileIndex> renderJobs;
+    {
+        MutexLocker locker(m_renderJobsMutex);
+        if (!m_contentsDirty && m_renderJobs.isEmpty())
+            return;
+        renderJobs = m_renderJobs;
+    }
+
+    bool isZoomJob = false;
+    if (scale != m_contentsScale) {
+        // The first time around, it does not count as a zoom job.
+        if (m_contentsScale)
+            isZoomJob = true;
+        m_contentsScale = scale;
+    }
+
+    IntRect dirtyRect = enclosingIntRect(m_dirtyRect);
+    IntSize requiredTextureSize;
+
+    if (m_layer->drawsContent()) {
+        // Layer contents must be drawn into a canvas.
+        IntRect untransformedDirtyRect(dirtyRect);
+        IntRect boundsRect(IntPoint::zero(), m_layer->bounds());
+        IntRect untransformedBoundsRect(boundsRect);
+        requiredTextureSize = boundsRect.size();
+
+        if (scale != 1.0) {
+            TransformationMatrix matrix;
+            matrix.scale(scale);
+
+            dirtyRect = matrix.mapRect(untransformedDirtyRect);
+            requiredTextureSize = matrix.mapRect(IntRect(IntPoint::zero(), requiredTextureSize)).size();
+            boundsRect = matrix.mapRect(untransformedBoundsRect);
+        }
+
+        if (requiredTextureSize != m_pendingTextureSize)
+            dirtyRect = boundsRect;
+        else {
+            // Clip the dirtyRect to the size of the layer to avoid drawing
+            // outside the bounds of the backing texture.
+            dirtyRect.intersect(boundsRect);
+        }
+    } else if (m_layer->contents()) {
+        // Layer is a container, and it contains an Image.
+        requiredTextureSize = m_layer->contents()->size();
+        dirtyRect = IntRect(IntPoint::zero(), requiredTextureSize);
+    }
+
+    // If we need display because we no longer need to be displayed, due to texture size becoming 0 x 0,
+    // or if we're re-rendering the whole thing anyway, clear old texture jobs.
+    HashSet<TileIndex> finishedJobs;
+    if (requiredTextureSize.isEmpty() || dirtyRect == IntRect(IntPoint::zero(), requiredTextureSize)) {
+        {
+            MutexLocker locker(m_renderJobsMutex);
+            m_renderJobs.clear();
+        }
+        clearTextureJobs();
+    } else if (!renderJobs.isEmpty()) {
+        if (Image* image = m_layer->contents()) {
+            bool isOpaque = false;
+            if (image->isBitmapImage())
+                isOpaque = !static_cast<BitmapImage*>(image)->currentFrameHasAlpha();
+            if (NativeImagePtr nativeImage = image->nativeImageForCurrentFrame()) {
+                SkBitmap bitmap = SkBitmap(*nativeImage);
+                addTextureJob(TextureJob::setContents(bitmap, isOpaque));
+            }
+        } else {
+            // There might still be some pending render jobs due to visibility changes.
+            for (HashSet<TileIndex>::iterator it = renderJobs.begin(); it != renderJobs.end(); ++it) {
+                {
+                    // Check if the job has been cancelled.
+                    MutexLocker locker(m_renderJobsMutex);
+                    if (!m_renderJobs.contains(*it))
+                        continue;
+                    m_renderJobs.remove(*it);
+                }
+
+                IntRect tileRect = rectForTile(*it, requiredTextureSize);
+                if (tileRect.isEmpty())
+                    continue;
+
+                bool isSolidColor = false;
+                Color color;
+                SkBitmap bitmap = m_layer->paintContents(tileRect, scale, &isSolidColor, &color);
+                // bitmap can be null here. Make requiredTextureSize empty so that we
+                // will not try to update and draw the layer.
+                if (!bitmap.isNull()) {
+                    if (isSolidColor)
+                        addTextureJob(TextureJob::setContentsToColor(color, *it));
+                    else
+                        addTextureJob(TextureJob::updateContents(bitmap, tileRect));
+                }
+
+                finishedJobs.add(*it);
+            }
+        }
+    }
+
+    bool didResize = false;
+    if (m_pendingTextureSize != requiredTextureSize) {
+        didResize = true;
+        m_pendingTextureSize = requiredTextureSize;
+        addTextureJob(TextureJob::resizeContents(m_pendingTextureSize));
+    }
+    m_contentsDirty = false;
+    m_dirtyRect = FloatRect();
+
+    if (dirtyRect.isEmpty() || requiredTextureSize.isEmpty())
+        return;
+
+    if (Image* image = m_layer->contents()) {
+        bool isOpaque = false;
+        if (image->isBitmapImage())
+            isOpaque = !static_cast<BitmapImage*>(image)->currentFrameHasAlpha();
+        // No point in tiling an image layer, the image is already stored as an SkBitmap
+        NativeImagePtr nativeImage = m_layer->contents()->nativeImageForCurrentFrame();
+        if (nativeImage) {
+            SkBitmap bitmap = SkBitmap(*nativeImage);
+            addTextureJob(TextureJob::setContents(bitmap, isOpaque));
+        }
+        return;
+    }
+
+    IntPoint topLeft = dirtyRect.minXMinYCorner();
+    IntPoint bottomRight = dirtyRect.maxXMaxYCorner(); // This is actually a pixel below and to the right of the dirtyRect.
+
+    IntSize tileMaximumSize = tileSize();
+    bool wasOneTile = m_tilesWebKitThread.size() == 1;
+    bool isOneTile = m_pendingTextureSize.width() <= tileMaximumSize.width() && m_pendingTextureSize.height() <= tileMaximumSize.height();
+    IntPoint origin = originOfTile(indexOfTile(topLeft));
+    IntRect tileRect;
+    for (tileRect.setX(origin.x()); tileRect.x() < bottomRight.x(); tileRect.setX(tileRect.x() + tileMaximumSize.width())) {
+        for (tileRect.setY(origin.y()); tileRect.y() < bottomRight.y(); tileRect.setY(tileRect.y() + tileMaximumSize.height())) {
+            tileRect.setWidth(min(requiredTextureSize.width() - tileRect.x(), tileMaximumSize.width()));
+            tileRect.setHeight(min(requiredTextureSize.height() - tileRect.y(), tileMaximumSize.height()));
+
+            IntRect localDirtyRect(dirtyRect);
+            localDirtyRect.intersect(tileRect);
+            if (localDirtyRect.isEmpty())
+                continue;
+
+            TileIndex index = indexOfTile(tileRect.location());
+
+            // If we already did this as part of one of the render jobs due to
+            // visibility changes, don't render that tile again.
+            if (finishedJobs.contains(index))
+                continue;
+
+            if (!shouldPerformRenderJob(index, !isZoomJob)) {
+                // Avoid checkerboarding unless the layer is resized. When
+                // resized, the contents are likely to change appearance, for
+                // example due to aspect ratio change. However, if it is a
+                // resize due to zooming, the aspect ratio and content will
+                // stay the same, and we can keep the old texture content as a
+                // preview.
+                // FIXME: the zoom preview only works if we don't re-tile the
+                // layer. We need to store texture coordinates in
+                // WebCore::Texture to be able to fix that.
+                if (didResize && !(isZoomJob && wasOneTile && isOneTile))
+                    addTextureJob(TextureJob::discardContents(tileRect));
+                else
+                    addTextureJob(TextureJob::dirtyContents(tileRect));
+                continue;
+            }
+
+            // Just in case a new job for this tile has just been inserted by compositing thread.
+            removeRenderJob(index);
+
+            // FIXME: We are always drawing whole tiles at the moment, because
+            // we currently can't keep track of which part of a tile is
+            // rendered and which is not. Sending only a subrectangle of a tile
+            // to the compositing thread might cause it to be uploaded using
+            // glTexImage, if the texture was previously evicted from the cache.
+            // The result would be that a subrectangle of the tile was stretched
+            // to fit the tile geometry, appearing as a glaring misrendering of
+            // the web page.
+            bool isSolidColor = false;
+            Color color;
+            SkBitmap bitmap = m_layer->paintContents(tileRect, scale, &isSolidColor, &color);
+            // bitmap can be null here. Make requiredTextureSize empty so that we
+            // will not try to update and draw the layer.
+            if (!bitmap.isNull()) {
+                if (isSolidColor)
+                    addTextureJob(TextureJob::setContentsToColor(color, index));
+                else
+                    addTextureJob(TextureJob::updateContents(bitmap, tileRect));
+            }
+        }
+    }
+}
+
+bool LayerTiler::shouldPerformRenderJob(const TileIndex& index, bool allowPrefill)
+{
+    // If the visibility information was propagated from the compositing
+    // thread, use that information.
+    // However, we are about to commit new layer properties that may make
+    // currently hidden layers visible. To avoid false negatives, we only allow
+    // the current state to be used to accept render jobs, not to reject them.
+    if (m_tilesWebKitThread.get(index).isVisible())
+        return true;
+
+    // Tiles that are not currently visible on the compositing thread may still
+    // deserve to be rendered if they should be prefilled...
+    if (allowPrefill && !m_tilesWebKitThread.contains(index) && shouldPrefillTile(index))
+        return true;
+
+    // Or if they are visible according to the state that's about to be
+    // committed. We do a visibility test using the current transform state.
+    IntRect contentRect = rectForTile(index, m_pendingTextureSize);
+    return m_layer->contentsVisible(contentRect);
+}
+
+void LayerTiler::addTextureJob(const TextureJob& job)
+{
+    m_pendingTextureJobs.append(job);
+}
+
+void LayerTiler::clearTextureJobs()
+{
+    // Clear any committed texture jobs on next invocation of LayerTiler::commitPendingTextureUploads().
+    m_clearTextureJobs = true;
+
+    removeUpdateContentsJobs(m_pendingTextureJobs);
+}
+
+void LayerTiler::commitPendingTextureUploads()
+{
+    if (m_clearTextureJobs) {
+        removeUpdateContentsJobs(m_textureJobs);
+        m_clearTextureJobs = false;
+    }
+
+    for (Vector<TextureJob>::iterator it = m_pendingTextureJobs.begin(); it != m_pendingTextureJobs.end(); ++it)
+        m_textureJobs.append(*it);
+    m_pendingTextureJobs.clear();
+}
+
+void LayerTiler::layerVisibilityChanged(bool visible)
+{
+    // For visible layers, we handle the tile-level visibility
+    // in the draw loop, see LayerTiler::drawTextures().
+    if (visible)
+        return;
+
+    {
+        // All tiles are invisible now.
+        MutexLocker locker(m_renderJobsMutex);
+        m_renderJobs.clear();
+    }
+
+    for (TileMap::iterator it = m_tilesCompositingThread.begin(); it != m_tilesCompositingThread.end(); ++it) {
+        TileIndex index = (*it).first;
+        LayerTile* tile = (*it).second;
+        tile->setVisible(false);
+    }
+}
+
+void LayerTiler::uploadTexturesIfNeeded()
+{
+    TileJobsMap tileJobsMap;
+    Deque<TextureJob>::const_iterator textureJobIterEnd = m_textureJobs.end();
+    for (Deque<TextureJob>::const_iterator textureJobIter = m_textureJobs.begin(); textureJobIter != textureJobIterEnd; ++textureJobIter)
+        processTextureJob(*textureJobIter, tileJobsMap);
+
+    TileJobsMap::const_iterator tileJobsIterEnd = tileJobsMap.end();
+    for (TileJobsMap::const_iterator tileJobsIter = tileJobsMap.begin(); tileJobsIter != tileJobsIterEnd; ++tileJobsIter) {
+        IntPoint origin = originOfTile(tileJobsIter->first);
+
+        LayerTile* tile = m_tilesCompositingThread.get(tileJobsIter->first);
+        if (!tile) {
+            if (origin.x() >= m_requiredTextureSize.width() || origin.y() >= m_requiredTextureSize.height())
+                continue;
+            tile = new LayerTile();
+            m_tilesCompositingThread.add(tileJobsIter->first, tile);
+        }
+
+        IntRect tileRect(origin, tileSize());
+        tileRect.setWidth(min(m_requiredTextureSize.width() - tileRect.x(), tileRect.width()));
+        tileRect.setHeight(min(m_requiredTextureSize.height() - tileRect.y(), tileRect.height()));
+
+        performTileJob(tile, *tileJobsIter->second, tileRect);
+    }
+
+    m_textureJobs.clear();
+}
+
+void LayerTiler::processTextureJob(const TextureJob& job, TileJobsMap& tileJobsMap)
+{
+    if (job.m_type == TextureJob::ResizeContents) {
+        IntSize pendingTextureSize = job.m_dirtyRect.size();
+        if (pendingTextureSize.width() < m_requiredTextureSize.width() || pendingTextureSize.height() < m_requiredTextureSize.height())
+            pruneTextures();
+
+        m_requiredTextureSize = pendingTextureSize;
+        return;
+    }
+
+    if (job.m_type == TextureJob::SetContentsToColor) {
+        addTileJob(job.m_index, job, tileJobsMap);
+        return;
+     }
+
+    IntSize tileMaximumSize = tileSize();
+    IntPoint topLeft = job.m_dirtyRect.minXMinYCorner();
+    IntPoint bottomRight = job.m_dirtyRect.maxXMaxYCorner(); // This is actually a pixel below and to the right of the dirtyRect.
+    IntPoint origin = originOfTile(indexOfTile(topLeft));
+    IntRect tileRect;
+    for (tileRect.setX(origin.x()); tileRect.x() < bottomRight.x(); tileRect.setX(tileRect.x() + tileMaximumSize.width())) {
+        for (tileRect.setY(origin.y()); tileRect.y() < bottomRight.y(); tileRect.setY(tileRect.y() + tileMaximumSize.height()))
+            addTileJob(indexOfTile(tileRect.location()), job, tileJobsMap);
+    }
+}
+
+void LayerTiler::addTileJob(const TileIndex& index, const TextureJob& job, TileJobsMap& tileJobsMap)
+{
+    // HashMap::add always returns a valid iterator even the key already exists.
+    pair<TileJobsMap::iterator, bool> result = tileJobsMap.add(index, &job);
+
+    // Successfully added the new job.
+    if (result.second)
+        return;
+
+    // In this case we leave the previous job.
+    if (job.m_type == TextureJob::DirtyContents && result.first->second->m_type == TextureJob::DiscardContents)
+        return;
+
+    // Override the previous job.
+    result.first->second = &job;
+}
+
+void LayerTiler::performTileJob(LayerTile* tile, const TextureJob& job, const IntRect& tileRect)
+{
+    switch (job.m_type) {
+    case TextureJob::SetContentsToColor:
+        tile->setContentsToColor(job.m_color);
+        return;
+    case TextureJob::SetContents:
+        tile->setContents(job.m_contents, tileRect, indexOfTile(tileRect.location()), job.m_isOpaque);
+        return;
+    case TextureJob::UpdateContents:
+        tile->updateContents(job.m_contents, job.m_dirtyRect, tileRect);
+        return;
+    case TextureJob::DiscardContents:
+        tile->discardContents();
+        return;
+    case TextureJob::DirtyContents:
+        tile->setContentsDirty();
+        return;
+    case TextureJob::Unknown:
+    case TextureJob::ResizeContents:
+        ASSERT_NOT_REACHED();
+        return;
+    }
+    ASSERT_NOT_REACHED();
+}
+
+void LayerTiler::drawTextures(LayerCompositingThread* layer, int pos, int texCoord)
+{
+    drawTexturesInternal(layer, pos, texCoord, false /* drawMissing */);
+}
+
+void LayerTiler::drawMissingTextures(LayerCompositingThread* layer, int pos, int texCoord)
+{
+    drawTexturesInternal(layer, pos, texCoord, true /* drawMissing */);
+}
+
+void LayerTiler::drawTexturesInternal(LayerCompositingThread* layer, int positionLocation, int texCoordLocation, bool drawMissing)
+{
+    const TransformationMatrix& drawTransform = layer->drawTransform();
+    IntSize bounds = layer->bounds();
+
+    float texcoords[4 * 2] = { 0, 0,  0, 1,  1, 1,  1, 0 };
+    float vertices[4 * 4];
+
+    glVertexAttribPointer(positionLocation, 4, GL_FLOAT, GL_FALSE, 0, vertices);
+    glVertexAttribPointer(texCoordLocation, 2, GL_FLOAT, GL_FALSE, 0, texcoords);
+
+    m_hasMissingTextures = false;
+
+    int maxw = tileSize().width();
+    int maxh = tileSize().height();
+    float sx = static_cast<float>(bounds.width()) / m_requiredTextureSize.width();
+    float sy = static_cast<float>(bounds.height()) / m_requiredTextureSize.height();
+
+    bool needsDisplay = false;
+
+    bool blending = !drawMissing;
+
+    IntRect tileRect;
+    for (tileRect.setX(0); tileRect.x() < m_requiredTextureSize.width(); tileRect.setX(tileRect.x() + maxw)) {
+        for (tileRect.setY(0); tileRect.y() < m_requiredTextureSize.height(); tileRect.setY(tileRect.y() + maxh)) {
+            TileIndex index = indexOfTile(tileRect.location());
+            LayerTile* tile = m_tilesCompositingThread.get(index);
+            if (!tile) {
+                tile = new LayerTile();
+                m_tilesCompositingThread.add(index, tile);
+            }
+
+            float x = index.i() * maxw * sx;
+            float y = index.j() * maxh * sy;
+            float w = min(bounds.width() - x, maxw * sx);
+            float h = min(bounds.height() - y, maxh * sy);
+            float ox = x - bounds.width() / 2.0;
+            float oy = y - bounds.height() / 2.0;
+
+            // We apply the transformation by hand, since we need the z coordinate
+            // as well (to do perspective correct texturing) and we don't need
+            // to divide by w by hand, the GPU will do that for us
+            transformPoint(ox, oy, drawTransform, &vertices[0]);
+            transformPoint(ox, oy + h, drawTransform, &vertices[4]);
+            transformPoint(ox + w, oy + h, drawTransform, &vertices[8]);
+            transformPoint(ox + w, oy, drawTransform, &vertices[12]);
+
+            // Inflate the rect somewhat to attempt to make textures render before they show
+            // up on screen.
+            float d = viewportInflationFactor;
+            FloatRect rect(-d, -d, 2 * d, 2 * d);
+            FloatQuad quad(FloatPoint(vertices[0] / vertices[3], vertices[1] / vertices[3]),
+                           FloatPoint(vertices[4] / vertices[7], vertices[5] / vertices[7]),
+                           FloatPoint(vertices[8] / vertices[11], vertices[9] / vertices[11]),
+                           FloatPoint(vertices[12] / vertices[15], vertices[13] / vertices[15]));
+            bool visible = quad.boundingBox().intersects(rect);
+
+            bool wasVisible = tile->isVisible();
+            tile->setVisible(visible);
+
+            // This method is called in two passes. The first pass draws all
+            // visible tiles with textures.
+            // If a visible tile has no texture, set the m_hasMissingTextures
+            // flag, to indicate that we need a second pass.
+            // The second "drawMissing" pass draws all visible tiles without
+            // textures as checkerboard.
+            // However, don't draw brand new tiles as checkerboard. The checker-
+            // board indicates that a tile has dirty contents, but that's not
+            // the case if it's brand new.
+            if (visible) {
+                bool hasTexture = tile->hasTexture();
+                if (!hasTexture)
+                    m_hasMissingTextures = true;
+
+                if (hasTexture && !drawMissing) {
+                    Texture* texture = tile->texture();
+                    if (texture->isOpaque() && layer->drawOpacity() == 1.0f && !layer->maskLayer()) {
+                        if (blending) {
+                            blending = false;
+                            glDisable(GL_BLEND);
+                        }
+                    } else if (!blending) {
+                        blending = true;
+                        glEnable(GL_BLEND);
+                        glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA);
+                    }
+
+                    textureCacheCompositingThread()->textureAccessed(texture);
+                    glBindTexture(GL_TEXTURE_2D, texture->textureId());
+                }
+
+                if (hasTexture != drawMissing)
+                    glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
+
+                if (tile->isDirty()) {
+                    addRenderJob(index);
+                    needsDisplay = true;
+                }
+            } else if (wasVisible)
+                removeRenderJob(index);
+        }
+    }
+
+    // Return early for the drawMissing case, don't flag us as needing commit.
+    if (drawMissing)
+        return;
+
+    // Switch on blending again (we know that drawMissing == false).
+    if (!blending) {
+        glEnable(GL_BLEND);
+        glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA);
+    }
+
+    // If we schedule a commit, visibility will be updated, and display will
+    // happen if there are any visible and dirty textures.
+    if (needsDisplay)
+        layer->setNeedsCommit();
+}
+
+void LayerTiler::addRenderJob(const TileIndex& index)
+{
+    ASSERT(isCompositingThread());
+
+    MutexLocker locker(m_renderJobsMutex);
+    m_renderJobs.add(index);
+}
+
+void LayerTiler::removeRenderJob(const TileIndex& index)
+{
+    MutexLocker locker(m_renderJobsMutex);
+    m_renderJobs.remove(index);
+}
+
+void LayerTiler::deleteTextures()
+{
+    // Since textures are deleted by a synchronous message
+    // from WebKit thread to compositing thread, we don't need
+    // any synchronization mechanism here, even though we are
+    // touching some WebKit thread state.
+    m_tilesWebKitThread.clear();
+
+    if (m_tilesCompositingThread.size()) {
+        for (TileMap::iterator it = m_tilesCompositingThread.begin(); it != m_tilesCompositingThread.end(); ++it)
+            (*it).second->discardContents();
+        m_tilesCompositingThread.clear();
+
+        m_contentsDirty = true;
+    }
+
+    // For various reasons, e.g. page cache, someone may try
+    // to render us after the textures were deleted.
+    m_pendingTextureSize = IntSize();
+    m_requiredTextureSize = IntSize();
+}
+
+void LayerTiler::pruneTextures()
+{
+    // Prune tiles that are no longer needed.
+    Vector<TileIndex> tilesToDelete;
+    for (TileMap::iterator it = m_tilesCompositingThread.begin(); it != m_tilesCompositingThread.end(); ++it) {
+        TileIndex index = (*it).first;
+
+        IntPoint origin = originOfTile(index);
+        if (origin.x() >= m_requiredTextureSize.width() || origin.y() >= m_requiredTextureSize.height())
+            tilesToDelete.append(index);
+    }
+
+    for (Vector<TileIndex>::iterator it = tilesToDelete.begin(); it != tilesToDelete.end(); ++it) {
+        LayerTile* tile = m_tilesCompositingThread.take(*it);
+        tile->discardContents();
+        delete tile;
+    }
+}
+
+void LayerTiler::updateTileSize()
+{
+    IntSize size = m_tilingDisabled ? m_layer->bounds() : defaultTileSize();
+    const IntSize maxTextureSize(2048, 2048);
+    size = size.shrunkTo(maxTextureSize);
+
+    if (m_tileSize == size || size.isEmpty())
+        return;
+
+    // Invalidate the whole layer if tile size changes.
+    setNeedsDisplay();
+    m_tileSize = size;
+}
+
+void LayerTiler::disableTiling(bool disable)
+{
+    if (m_tilingDisabled == disable)
+        return;
+
+    m_tilingDisabled = disable;
+    updateTileSize();
+}
+
+bool LayerTiler::shouldPrefillTile(const TileIndex& index)
+{
+    // For now, we use the heuristic of prefilling the first screenful of tiles.
+    // This gives the correct result only for layers with identity transform,
+    // which is why it's called a heuristic here. This is needed for the case
+    // where the developer actually designed their web page around the use of
+    // accelerated compositing, and expects even offscreen layers to have content.
+    // We oblige them to some degree by prefilling a screenful of tiles.
+    // This is redundant in some other scenarios, i.e. when an offscreen layer
+    // is composited only because of overlapping a flash ad or something like
+    // that, but we're willing to make this tradeoff.
+
+    // Since the tileMultiplier indicates how many tiles fit on the screen,
+    // the following formula can be used:
+    return index.i() < static_cast<unsigned>(tileMultiplier) && index.j() < static_cast<unsigned>(tileMultiplier);
+}
+
+TileIndex LayerTiler::indexOfTile(const WebCore::IntPoint& origin)
+{
+    int offsetX = origin.x();
+    int offsetY = origin.y();
+    if (offsetX)
+        offsetX = offsetX / tileSize().width();
+    if (offsetY)
+        offsetY = offsetY / tileSize().height();
+    return TileIndex(offsetX, offsetY);
+}
+
+IntPoint LayerTiler::originOfTile(const TileIndex& index)
+{
+    return IntPoint(index.i() * tileSize().width(), index.j() * tileSize().height());
+}
+
+IntRect LayerTiler::rectForTile(const TileIndex& index, const IntSize& bounds)
+{
+    IntPoint origin = originOfTile(index);
+    IntSize offset(origin.x(), origin.y());
+    IntSize size = tileSize().shrunkTo(bounds - offset);
+    return IntRect(origin, size);
+}
+
+bool LayerTiler::hasDirtyTiles() const
+{
+    for (TileMap::const_iterator it = m_tilesCompositingThread.begin(); it != m_tilesCompositingThread.end(); ++it) {
+        const LayerTile* tile = (*it).second;
+        if (tile->isDirty())
+            return true;
+    }
+
+    return false;
+}
+
+void LayerTiler::bindContentsTexture()
+{
+    ASSERT(m_tilesCompositingThread.size() == 1);
+    if (m_tilesCompositingThread.size() != 1)
+        return;
+
+    const LayerTile* tile = m_tilesCompositingThread.begin()->second;
+
+    ASSERT(tile->hasTexture());
+    if (!tile->hasTexture())
+        return;
+
+    glBindTexture(GL_TEXTURE_2D, tile->texture()->textureId());
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerTiler.h b/Source/WebCore/platform/graphics/blackberry/LayerTiler.h
new file mode 100644
index 000000000..eda9e61d3
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerTiler.h
@@ -0,0 +1,205 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef LayerTiler_h
+#define LayerTiler_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "Color.h"
+#include "FloatRect.h"
+#include "IntRect.h"
+#include "LayerTile.h"
+#include "LayerTileIndex.h"
+
+#include <SkBitmap.h>
+#include <wtf/Deque.h>
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/ThreadSafeRefCounted.h>
+
+namespace WebCore {
+
+class LayerCompositingThread;
+class LayerWebKitThread;
+
+class LayerTiler : public ThreadSafeRefCounted<LayerTiler> {
+public:
+    TileIndex indexOfTile(const IntPoint& origin);
+    IntPoint originOfTile(const TileIndex&);
+    IntRect rectForTile(const TileIndex&, const IntSize& bounds);
+
+    static PassRefPtr<LayerTiler> create(LayerWebKitThread* layer)
+    {
+        return adoptRef(new LayerTiler(layer));
+    }
+
+    virtual ~LayerTiler();
+
+    // WebKit thread
+    LayerWebKitThread* layer() const { return m_layer; }
+    void layerWebKitThreadDestroyed();
+    void setNeedsDisplay(const FloatRect& dirtyRect);
+    void setNeedsDisplay();
+    void updateTextureContentsIfNeeded(double scale);
+    void disableTiling(bool);
+
+    // Compositing thread
+    void layerCompositingThreadDestroyed();
+    void uploadTexturesIfNeeded();
+    void drawTextures(LayerCompositingThread*, int positionLocation, int texCoordLocation);
+    bool hasMissingTextures() const { return m_hasMissingTextures; }
+    void drawMissingTextures(LayerCompositingThread*, int positionLocation, int texCoordLocation);
+    void deleteTextures();
+    void commitPendingTextureUploads();
+    void layerVisibilityChanged(bool visible);
+    bool hasDirtyTiles() const;
+    void bindContentsTexture();
+
+    // Thread safe
+    void addRenderJob(const TileIndex&);
+    void removeRenderJob(const TileIndex&);
+
+private:
+    struct TextureJob {
+        enum Type { Unknown, SetContents, SetContentsToColor, UpdateContents, DiscardContents, ResizeContents, DirtyContents };
+
+        TextureJob()
+            : m_type(Unknown)
+        {
+        }
+
+        TextureJob(Type type, const IntSize& newSize)
+            : m_type(type)
+            , m_isOpaque(false)
+            , m_dirtyRect(IntPoint::zero(), newSize)
+        {
+            ASSERT(type == ResizeContents);
+        }
+
+        TextureJob(Type type, const IntRect& dirtyRect)
+            : m_type(type)
+            , m_isOpaque(false)
+            , m_dirtyRect(dirtyRect)
+        {
+            ASSERT(type == DiscardContents || type == DirtyContents);
+        }
+
+        TextureJob(Type type, const SkBitmap& contents, const IntRect& dirtyRect, bool isOpaque = false)
+            : m_type(type)
+            , m_contents(contents)
+            , m_isOpaque(isOpaque)
+            , m_dirtyRect(dirtyRect)
+        {
+            ASSERT(type == UpdateContents || type == SetContents);
+            ASSERT(!contents.isNull());
+        }
+
+        TextureJob(Type type, const Color& color, const TileIndex& index)
+            : m_type(type)
+            , m_isOpaque(false)
+            , m_color(color)
+            , m_index(index)
+        {
+            ASSERT(type == SetContentsToColor);
+        }
+
+        static TextureJob setContents(const SkBitmap& contents, bool isOpaque) { return TextureJob(SetContents, contents, IntRect(IntPoint::zero(), IntSize(contents.width(), contents.height())), isOpaque); }
+        static TextureJob setContentsToColor(const Color& color, const TileIndex& index) { return TextureJob(SetContentsToColor, color, index); }
+        static TextureJob updateContents(const SkBitmap& contents, const IntRect& dirtyRect) { return TextureJob(UpdateContents, contents, dirtyRect); }
+        static TextureJob discardContents(const IntRect& dirtyRect) { return TextureJob(DiscardContents, dirtyRect); }
+        static TextureJob resizeContents(const IntSize& newSize) { return TextureJob(ResizeContents, newSize); }
+        static TextureJob dirtyContents(const IntRect& dirtyRect) { return TextureJob(DirtyContents, dirtyRect); }
+
+        bool isNull() { return m_type == Unknown; }
+
+        Type m_type;
+        SkBitmap m_contents;
+        bool m_isOpaque;
+        IntRect m_dirtyRect;
+        Color m_color;
+        TileIndex m_index;
+    };
+
+    typedef HashMap<TileIndex, LayerTile*> TileMap;
+    typedef HashMap<TileIndex, LayerTileData> VisibilityMap;
+    typedef HashMap<TileIndex, const TextureJob*> TileJobsMap;
+
+    IntSize tileSize() const { return m_tileSize; }
+    void updateTileSize();
+
+    LayerTiler(LayerWebKitThread*);
+
+    // WebKit thread
+    void addTextureJob(const TextureJob&);
+    void clearTextureJobs();
+    bool shouldPerformRenderJob(const TileIndex&, bool allowPrefill);
+    bool shouldPrefillTile(const TileIndex&);
+
+    // Compositing thread
+    void updateTileContents(const TextureJob&, const IntRect&);
+    void addTileJob(const TileIndex&, const TextureJob&, TileJobsMap&);
+    void performTileJob(LayerTile*, const TextureJob&, const IntRect&);
+    void processTextureJob(const TextureJob&, TileJobsMap&);
+    void drawTexturesInternal(LayerCompositingThread*, int positionLocation, int texCoordLocation, bool missing);
+    void pruneTextures();
+    void visibilityChanged(bool needsDisplay);
+
+    // Clear all pending update content texture jobs
+    template<typename T>
+    static void removeUpdateContentsJobs(T& jobs)
+    {
+        // Clear all pending update content jobs
+        T list;
+        for (typename T::iterator it = jobs.begin(); it != jobs.end(); ++it) {
+            if ((*it).m_type != TextureJob::UpdateContents)
+                list.append(*it);
+        }
+        jobs = list;
+    }
+
+    LayerWebKitThread* m_layer;
+
+    TileMap m_tilesCompositingThread;
+
+    VisibilityMap m_tilesWebKitThread;
+
+    bool m_tilingDisabled;
+
+    bool m_contentsDirty;
+    FloatRect m_dirtyRect;
+
+    IntSize m_pendingTextureSize; // Resized, but not committed yet.
+    IntSize m_requiredTextureSize;
+    IntSize m_tileSize;
+
+    bool m_clearTextureJobs;
+    Vector<TextureJob> m_pendingTextureJobs; // Added, but not committed yet.
+    Deque<TextureJob> m_textureJobs;
+    bool m_hasMissingTextures;
+
+    HashSet<TileIndex> m_renderJobs;
+    Mutex m_renderJobsMutex;
+    double m_contentsScale;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // LayerTiler_h
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.cpp b/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.cpp
new file mode 100644
index 000000000..6cadf359d
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.cpp
@@ -0,0 +1,457 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerWebKitThread.h"
+
+#include "GraphicsContext.h"
+#include "InstrumentedPlatformCanvas.h"
+#include "LayerCompositingThread.h"
+#include "LayerMessage.h"
+#include "PlatformContextSkia.h"
+#include "RenderLayerBacking.h"
+#include "TransformationMatrix.h"
+
+#include <BlackBerryPlatformGraphics.h>
+#include <wtf/CurrentTime.h>
+
+namespace WebCore {
+
+using namespace std;
+
+PassRefPtr<LayerWebKitThread> LayerWebKitThread::create(LayerType type, GraphicsLayerBlackBerry* owner)
+{
+    return adoptRef(new LayerWebKitThread(type, owner));
+}
+
+LayerWebKitThread::LayerWebKitThread(LayerType type, GraphicsLayerBlackBerry* owner)
+    : LayerData(type)
+    , m_owner(owner)
+    , m_superlayer(0)
+    , m_contents(0)
+    , m_scale(1.0)
+    , m_isDrawable(false)
+    , m_isMask(false)
+{
+    m_tiler = LayerTiler::create(this);
+    m_layerCompositingThread = LayerCompositingThread::create(type, m_tiler);
+}
+
+LayerWebKitThread::~LayerWebKitThread()
+{
+    m_layerCompositingThread->clearAnimations();
+
+    if (m_frontBufferLock)
+        pthread_mutex_destroy(m_frontBufferLock);
+
+    m_tiler->layerWebKitThreadDestroyed();
+
+    // Our superlayer should be holding a reference to us so there should be no
+    // way for us to be destroyed while we still have a superlayer.
+    ASSERT(!superlayer());
+
+    // Remove the superlayer reference from all sublayers.
+    removeAllSublayers();
+}
+
+SkBitmap LayerWebKitThread::paintContents(const IntRect& contentsRect, double scale, bool* isSolidColor, Color* color)
+{
+    // Don't try to allocate image data bigger than this. This should be big
+    // enough to accomodate a huge iScroll use case.
+    // FIXME: This is a hack to work around a crash bug on maps.bing.com where
+    // a (visually empty) layer becomes too big.
+    static const int maximumBitmapSizeInBytes = 40 * 1024 * 1024;
+    static const int bytesPerPixel = 4;
+
+    if (isSolidColor)
+        *isSolidColor = false;
+
+    if (contentsRect.width() * contentsRect.height() * bytesPerPixel > maximumBitmapSizeInBytes)
+        return SkBitmap();
+
+    SkBitmap bitmap;
+
+    // Keep the canvas alive until we're done extracting its pixels
+    OwnPtr<InstrumentedPlatformCanvas> canvas;
+
+    if (drawsContent()) { // Layer contents must be drawn into a canvas.
+        IntRect untransformedContentsRect = contentsRect;
+
+        canvas = adoptPtr(new InstrumentedPlatformCanvas(contentsRect.width(), contentsRect.height(), false, 0));
+        PlatformContextSkia skiaContext(canvas.get());
+
+        GraphicsContext graphicsContext(&skiaContext);
+        graphicsContext.translate(-contentsRect.x(), -contentsRect.y());
+
+        if (scale != 1.0) {
+            TransformationMatrix matrix;
+            matrix.scale(1.0 / scale);
+            untransformedContentsRect = matrix.mapRect(contentsRect);
+
+            // We extract from the contentsRect but draw a slightly larger region than
+            // we were told to, in order to avoid pixels being rendered only partially.
+            const int atLeastOneDevicePixel = static_cast<int>(ceilf(1.0 / scale));
+            untransformedContentsRect.inflate(atLeastOneDevicePixel);
+
+            graphicsContext.scale(FloatSize(scale, scale));
+        }
+
+        // RenderLayerBacking doesn't always clip, so we need to do this by ourselves.
+        graphicsContext.clip(untransformedContentsRect);
+        m_owner->paintGraphicsLayerContents(graphicsContext, untransformedContentsRect);
+
+        bitmap = canvas->getDevice()->accessBitmap(false);
+        if (isSolidColor) {
+            *isSolidColor = canvas->isSolidColor();
+            if (color)
+                *color = canvas->solidColor();
+        }
+    }
+
+    ASSERT(!bitmap.isNull());
+
+    // FIXME: do we need to support more image configurations?
+    ASSERT(bitmap.config() == SkBitmap::kARGB_8888_Config);
+    if (bitmap.config() != SkBitmap::kARGB_8888_Config)
+        return SkBitmap();
+
+    return bitmap;
+}
+
+bool LayerWebKitThread::contentsVisible(const IntRect& contentsRect) const
+{
+    if (!m_owner)
+        return false;
+
+    return m_owner->contentsVisible(contentsRect);
+}
+
+void LayerWebKitThread::createFrontBufferLock()
+{
+    pthread_mutexattr_t mutexAttributes;
+    pthread_mutexattr_init(&mutexAttributes);
+    m_frontBufferLock = new pthread_mutex_t;
+    pthread_mutex_init(m_frontBufferLock, &mutexAttributes);
+}
+
+void LayerWebKitThread::updateTextureContentsIfNeeded()
+{
+    m_tiler->updateTextureContentsIfNeeded(m_isMask ? 1.0 : contentsScale());
+}
+
+void LayerWebKitThread::setContents(Image* contents)
+{
+    // Check if the image has changed.
+    if (m_contents == contents)
+        return;
+    m_contents = contents;
+    setNeedsTexture(m_isDrawable && (this->contents() || drawsContent() || pluginView()));
+
+    if (m_contents)
+        setNeedsDisplay();
+    else
+        setNeedsCommit();
+}
+
+void LayerWebKitThread::setDrawable(bool isDrawable)
+{
+    if (m_isDrawable == isDrawable)
+        return;
+
+    m_isDrawable = isDrawable;
+
+    setNeedsTexture(m_isDrawable && (drawsContent() || contents() || pluginView() || mediaPlayer() || canvas()));
+    setNeedsCommit();
+}
+
+void LayerWebKitThread::setNeedsCommit()
+{
+    // Call notifySyncRequired(), which in this implementation plumbs through to
+    // call scheduleRootLayerCommit() on the WebView, which will cause us to commit
+    // changes done on the WebKit thread for display on the Compositing thread.
+    if (m_owner)
+        m_owner->notifySyncRequired();
+}
+
+void LayerWebKitThread::notifyAnimationStarted(double time)
+{
+    if (m_owner)
+        m_owner->notifyAnimationStarted(time);
+}
+
+void LayerWebKitThread::commitOnWebKitThread(double scale)
+{
+    // Updating texture contents require the latest visibility info.
+    updateTextureContents(scale);
+
+    // Make sure all animations are started at the same time
+    // to avoid showing animations out-of-sync.
+    // Do this after updating texture contents, because that can be a slow
+    // operation.
+    startAnimations(currentTime());
+}
+
+void LayerWebKitThread::startAnimations(double time)
+{
+    for (size_t i = 0; i < m_runningAnimations.size(); ++i) {
+        if (!m_runningAnimations[i]->startTime()) {
+            m_runningAnimations[i]->setStartTime(time);
+            notifyAnimationStarted(time);
+        }
+    }
+
+    size_t listSize = m_sublayers.size();
+    for (size_t i = 0; i < listSize; i++)
+        m_sublayers[i]->startAnimations(time);
+}
+
+void LayerWebKitThread::updateTextureContents(double scale)
+{
+    if (m_scale != scale) {
+        m_scale = scale;
+
+        // Only web content can redraw at the new scale.
+        // Canvas, images, video etc can't.
+        if (drawsContent())
+            setNeedsDisplay();
+    }
+
+    updateTextureContentsIfNeeded();
+
+    if (includeVisibility()) {
+        // The RenderLayerBacking cast looks unsafe given that there are two classes
+        // derived from GraphicsLayerClient but this code is only reachable for
+        // things that produce RenderLayerBacking derivatives; i.e., plugins and media.
+        RenderLayer* renderLayer(static_cast<RenderLayerBacking*>(m_owner->client())->owningLayer());
+        bool isVisible(renderLayer->hasVisibleContent() || renderLayer->hasVisibleDescendant());
+        if (m_isVisible != isVisible) {
+            m_isVisible = isVisible;
+            setNeedsCommit();
+        }
+    }
+
+    size_t listSize = m_sublayers.size();
+    for (size_t i = 0; i < listSize; i++)
+        m_sublayers[i]->updateTextureContents(scale);
+
+    if (maskLayer())
+        maskLayer()->updateTextureContents(scale);
+
+    if (replicaLayer())
+        replicaLayer()->updateTextureContents(scale);
+}
+
+void LayerWebKitThread::commitOnCompositingThread()
+{
+    FloatPoint oldPosition = m_position;
+    m_position += m_absoluteOffset;
+    // Copy the base variables from this object into m_layerCompositingThread
+    replicate(m_layerCompositingThread.get());
+    m_position = oldPosition;
+    updateLayerHierarchy();
+    m_tiler->commitPendingTextureUploads();
+
+    size_t listSize = m_sublayers.size();
+    for (size_t i = 0; i < listSize; i++)
+        m_sublayers[i]->commitOnCompositingThread();
+
+    if (maskLayer()) {
+        maskLayer()->commitOnCompositingThread();
+        layerCompositingThread()->setMaskLayer(maskLayer()->layerCompositingThread());
+    } else
+        layerCompositingThread()->setMaskLayer(0);
+
+    if (replicaLayer()) {
+        replicaLayer()->commitOnCompositingThread();
+        layerCompositingThread()->setReplicaLayer(replicaLayer()->layerCompositingThread());
+    } else
+        layerCompositingThread()->setReplicaLayer(0);
+}
+
+void LayerWebKitThread::addSublayer(PassRefPtr<LayerWebKitThread> sublayer)
+{
+    insertSublayer(sublayer, numSublayers());
+}
+
+void LayerWebKitThread::insertSublayer(PassRefPtr<LayerWebKitThread> sublayer, size_t index)
+{
+    index = min(index, m_sublayers.size());
+    sublayer->removeFromSuperlayer();
+    sublayer->setSuperlayer(this);
+    m_sublayers.insert(index, sublayer);
+
+    setNeedsCommit();
+}
+
+void LayerWebKitThread::removeFromSuperlayer()
+{
+    if (m_superlayer)
+        m_superlayer->removeSublayer(this);
+}
+
+void LayerWebKitThread::removeSublayer(LayerWebKitThread* sublayer)
+{
+    int foundIndex = indexOfSublayer(sublayer);
+    if (foundIndex == -1)
+        return;
+
+    sublayer->setSuperlayer(0);
+    m_sublayers.remove(foundIndex);
+
+    setNeedsCommit();
+}
+
+void LayerWebKitThread::replaceSublayer(LayerWebKitThread* reference, PassRefPtr<LayerWebKitThread> newLayer)
+{
+    ASSERT_ARG(reference, reference);
+    ASSERT_ARG(reference, reference->superlayer() == this);
+
+    if (reference == newLayer)
+        return;
+
+    int referenceIndex = indexOfSublayer(reference);
+    if (referenceIndex == -1) {
+        ASSERT_NOT_REACHED();
+        return;
+    }
+
+    reference->removeFromSuperlayer();
+
+    if (newLayer) {
+        newLayer->removeFromSuperlayer();
+        insertSublayer(newLayer, referenceIndex);
+    }
+}
+
+int LayerWebKitThread::indexOfSublayer(const LayerWebKitThread* reference)
+{
+    for (size_t i = 0; i < m_sublayers.size(); i++) {
+        if (m_sublayers[i] == reference)
+            return i;
+    }
+    return -1;
+}
+
+void LayerWebKitThread::setBounds(const IntSize& size)
+{
+    if (m_bounds == size)
+        return;
+
+    bool firstResize = !m_bounds.width() && !m_bounds.height() && size.width() && size.height();
+
+    m_bounds = size;
+
+    boundsChanged();
+
+    if (firstResize)
+        setNeedsDisplay();
+    else
+        setNeedsCommit();
+}
+
+void LayerWebKitThread::setFrame(const FloatRect& rect)
+{
+    if (rect == m_frame)
+      return;
+
+    m_frame = rect;
+    setNeedsDisplay();
+}
+
+const LayerWebKitThread* LayerWebKitThread::rootLayer() const
+{
+    const LayerWebKitThread* layer = this;
+    LayerWebKitThread* superlayer = layer->superlayer();
+
+    while (superlayer) {
+        layer = superlayer;
+        superlayer = superlayer->superlayer();
+    }
+    return layer;
+}
+
+void LayerWebKitThread::removeAllSublayers()
+{
+    while (m_sublayers.size()) {
+        RefPtr<LayerWebKitThread> layer = m_sublayers[0].get();
+        ASSERT(layer->superlayer());
+        layer->removeFromSuperlayer();
+    }
+    setNeedsCommit();
+}
+
+void LayerWebKitThread::setSublayers(const Vector<RefPtr<LayerWebKitThread> >& sublayers)
+{
+    if (sublayers == m_sublayers)
+        return;
+
+    removeAllSublayers();
+    size_t listSize = sublayers.size();
+    for (size_t i = 0; i < listSize; i++)
+        addSublayer(sublayers[i]);
+}
+
+void LayerWebKitThread::setNeedsDisplayInRect(const FloatRect& dirtyRect)
+{
+    m_tiler->setNeedsDisplay(dirtyRect);
+    setNeedsCommit(); // FIXME: Replace this with a more targeted message for dirty rect handling with plugin content?
+}
+
+void LayerWebKitThread::setNeedsDisplay()
+{
+    m_tiler->setNeedsDisplay();
+    setNeedsCommit(); // FIXME: Replace this with a more targeted message for dirty rect handling with plugin content?
+}
+
+void LayerWebKitThread::updateLayerHierarchy()
+{
+    m_layerCompositingThread->setSuperlayer(superlayer() ? superlayer()->m_layerCompositingThread.get() : 0);
+
+    Vector<RefPtr<LayerCompositingThread> > sublayers;
+    size_t listSize = m_sublayers.size();
+    for (size_t i = 0; i < listSize; i++)
+        sublayers.append(m_sublayers[i]->m_layerCompositingThread.get());
+    m_layerCompositingThread->setSublayers(sublayers);
+}
+
+void LayerWebKitThread::setIsMask(bool isMask)
+{
+    m_isMask = isMask;
+    if (isMask)
+        m_tiler->disableTiling(true);
+}
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.h b/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.h
new file mode 100644
index 000000000..f4c7441cd
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/LayerWebKitThread.h
@@ -0,0 +1,200 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef LayerWebKitThread_h
+#define LayerWebKitThread_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsLayerBlackBerry.h"
+#include "LayerData.h"
+#include "LayerTiler.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+class SkBitmap;
+
+namespace WebCore {
+
+class LayerCompositingThread;
+
+class LayerWebKitThread : public RefCounted<LayerWebKitThread>, public LayerData {
+public:
+    static PassRefPtr<LayerWebKitThread> create(LayerType, GraphicsLayerBlackBerry* owner = 0);
+
+    virtual ~LayerWebKitThread();
+
+    void addSublayer(PassRefPtr<LayerWebKitThread>);
+    void insertSublayer(PassRefPtr<LayerWebKitThread>, size_t index);
+    void replaceSublayer(LayerWebKitThread* reference, PassRefPtr<LayerWebKitThread> newLayer);
+    void removeFromSuperlayer();
+
+    void setAnchorPoint(const FloatPoint& anchorPoint) { m_anchorPoint = anchorPoint; setNeedsCommit(); }
+
+    void setAnchorPointZ(float anchorPointZ) { m_anchorPointZ = anchorPointZ; setNeedsCommit(); }
+
+    void setBackgroundColor(const Color& color) { m_backgroundColor = color; setNeedsCommit(); }
+
+    void setBorderColor(const Color& color) { m_borderColor = color; setNeedsCommit(); }
+
+    void setBorderWidth(float width) { m_borderWidth = width; setNeedsCommit(); }
+
+    void setBounds(const IntSize&);
+
+    void setDoubleSided(bool doubleSided) { m_doubleSided = doubleSided; setNeedsCommit(); }
+
+    void setFrame(const FloatRect&);
+
+    void setMasksToBounds(bool masksToBounds) { m_masksToBounds = masksToBounds; }
+
+    void setMaskLayer(LayerWebKitThread* maskLayer) { m_maskLayer = maskLayer; }
+    LayerWebKitThread* maskLayer() const { return m_maskLayer.get(); }
+    void setIsMask(bool);
+
+    void setReplicaLayer(LayerWebKitThread* layer) { m_replicaLayer = layer; }
+    LayerWebKitThread* replicaLayer() { return m_replicaLayer.get(); }
+
+    // FIXME: Move to a new subclass, ContentLayerWebKitThread. This is only used for layers that draw content
+    void setNeedsDisplayInRect(const FloatRect& dirtyRect);
+
+    virtual void setNeedsDisplay();
+
+    void setNeedsDisplayOnBoundsChange(bool needsDisplay) { m_needsDisplayOnBoundsChange = needsDisplay; }
+
+    void setOpacity(float opacity) { m_opacity = opacity; setNeedsCommit(); }
+
+    void setOpaque(bool opaque) { m_opaque = opaque; setNeedsCommit(); }
+
+    void setPosition(const FloatPoint& position) { m_position = position; setNeedsCommit(); }
+
+    const LayerWebKitThread* rootLayer() const;
+
+    void removeAllSublayers();
+
+    void setSublayers(const Vector<RefPtr<LayerWebKitThread> >&);
+
+    const Vector<RefPtr<LayerWebKitThread> >& getSublayers() const { return m_sublayers; }
+
+    void setSublayerTransform(const TransformationMatrix& transform) { m_sublayerTransform = transform; setNeedsCommit(); }
+
+    LayerWebKitThread* superlayer() const { return m_superlayer; }
+
+    void setTransform(const TransformationMatrix& transform) { m_transform = transform; setNeedsCommit(); }
+
+    void setPreserves3D(bool preserves3D) { m_preserves3D = preserves3D; setNeedsCommit(); }
+
+    void setFixedPosition(bool fixed) { m_isFixedPosition = fixed; setNeedsCommit(); }
+    void setHasFixedContainer(bool fixed) { m_hasFixedContainer = fixed; setNeedsCommit(); }
+    void setHasFixedAncestorInDOMTree(bool fixed) { m_hasFixedAncestorInDOMTree = fixed; setNeedsCommit(); }
+
+    void setContents(Image*);
+    Image* contents() const { return m_contents.get(); }
+
+    void setOwner(GraphicsLayerBlackBerry* owner) { m_owner = owner; }
+
+    bool drawsContent() const { return m_owner && m_owner->drawsContent(); }
+    void setDrawable(bool);
+
+    void commitOnWebKitThread(double scale);
+    void commitOnCompositingThread();
+    LayerCompositingThread* layerCompositingThread() const { return m_layerCompositingThread.get(); }
+
+    // Only used when this layer is the root layer of a frame.
+    void setAbsoluteOffset(const FloatSize& offset) { m_absoluteOffset = offset; }
+
+    double contentsScale() const { return m_scale; }
+
+    SkBitmap paintContents(const IntRect& transformedContentsRect, double scale, bool* isSolidColor = 0, Color* = 0);
+    bool contentsVisible(const IntRect& contentsRect) const;
+
+    void setNeedsCommit();
+    void notifyAnimationStarted(double time);
+
+    void setRunningAnimations(const Vector<RefPtr<LayerAnimation> >& animations) { m_runningAnimations = animations; setNeedsCommit(); }
+    void setSuspendedAnimations(const Vector<RefPtr<LayerAnimation> >& animations) { m_suspendedAnimations = animations; setNeedsCommit(); }
+
+protected:
+    LayerWebKitThread(LayerType, GraphicsLayerBlackBerry* owner);
+
+    void setNeedsTexture(bool needsTexture) { m_needsTexture = needsTexture; }
+    void setLayerProgramShader(LayerData::LayerProgramShader shader) { m_layerProgramShader = shader; }
+    void createFrontBufferLock();
+    bool isDrawable() const { return m_isDrawable; }
+
+    void startAnimations(double time);
+    void updateVisibility();
+    void updateTextureContents(double scale);
+
+    virtual void boundsChanged() { }
+    virtual void updateTextureContentsIfNeeded();
+
+private:
+    void updateLayerHierarchy();
+
+    void setSuperlayer(LayerWebKitThread* superlayer) { m_superlayer = superlayer; }
+
+    size_t numSublayers() const
+    {
+        return m_sublayers.size();
+    }
+
+    // Returns the index of the sublayer or -1 if not found.
+    int indexOfSublayer(const LayerWebKitThread*);
+
+    // This should only be called from removeFromSuperlayer.
+    void removeSublayer(LayerWebKitThread*);
+
+    GraphicsLayerBlackBerry* m_owner;
+
+    Vector<RefPtr<LayerWebKitThread> > m_sublayers;
+    LayerWebKitThread* m_superlayer;
+    RefPtr<LayerWebKitThread> m_maskLayer;
+    RefPtr<LayerWebKitThread> m_replicaLayer;
+
+    RefPtr<Image> m_contents;
+
+    RefPtr<LayerCompositingThread> m_layerCompositingThread;
+    RefPtr<LayerTiler> m_tiler;
+    FloatSize m_absoluteOffset;
+    double m_scale; // Scale applies only to content layers
+    bool m_isDrawable;
+    bool m_isMask;
+};
+
+}
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif
diff --git a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
new file mode 100644
index 000000000..1d8bd3af5
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.cpp
@@ -0,0 +1,803 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+
+#if ENABLE(VIDEO)
+#include "MediaPlayerPrivateBlackBerry.h"
+
+#include "CookieManager.h"
+#include "Frame.h"
+#include "FrameView.h"
+#include "GraphicsContext.h"
+#include "HTMLMediaElement.h"
+#include "HTMLNames.h"
+#include "HostWindow.h"
+#include "NotImplemented.h"
+#include "PlatformContextSkia.h"
+#include "RenderBox.h"
+#include "TimeRanges.h"
+#include "WebPageClient.h"
+
+#include <BlackBerryPlatformClient.h>
+#include <set>
+#include <string>
+#include <wtf/text/CString.h>
+
+#if USE(ACCELERATED_COMPOSITING)
+#include "NativeImageSkia.h"
+#include "VideoLayerWebKitThread.h"
+#include <GLES2/gl2.h>
+#endif
+
+using namespace std;
+using namespace BlackBerry::Platform;
+
+namespace WebCore {
+
+// Static callback functions for factory
+PassOwnPtr<MediaPlayerPrivateInterface> MediaPlayerPrivate::create(MediaPlayer* player)
+{
+    return adoptPtr(new MediaPlayerPrivate(player));
+}
+
+void MediaPlayerPrivate::registerMediaEngine(MediaEngineRegistrar registrar)
+{
+    registrar(create, getSupportedTypes, supportsType, 0, 0, 0);
+}
+
+void MediaPlayerPrivate::getSupportedTypes(HashSet<String>& types)
+{
+    set<string> supported = MMRPlayer::allSupportedMimeTypes();
+    set<string>::iterator i = supported.begin();
+    for (; i != supported.end(); i++)
+        types.add(i->c_str());
+}
+
+MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String& type, const String& codecs)
+{
+    if (type.isNull() || type.isEmpty()) {
+        LOG(Media, "MediaPlayer does not support type; type is null or empty.");
+        return MediaPlayer::IsNotSupported;
+    }
+
+    // spec says we should not return "probably" if the codecs string is empty
+    if (MMRPlayer::mimeTypeSupported(type.ascii().data())) {
+        LOG(Media, "MediaPlayer supports type; cache contains type '%s'.", type.ascii().data());
+        return codecs.isEmpty() ? MediaPlayer::MayBeSupported : MediaPlayer::IsSupported;
+    }
+    LOG(Media, "MediaPlayer does not support type; cache doesn't contain type '%s'.", type.ascii().data());
+    return MediaPlayer::IsNotSupported;
+}
+
+void MediaPlayerPrivate::notifyAppActivatedEvent(bool activated)
+{
+    MMRPlayer::notifyAppActivatedEvent(activated);
+}
+
+void MediaPlayerPrivate::setCertificatePath(const String& caPath)
+{
+    MMRPlayer::setCertificatePath(string(caPath.utf8().data()));
+}
+
+MediaPlayerPrivate::MediaPlayerPrivate(MediaPlayer* player)
+    : m_webCorePlayer(player)
+#if USE(ACCELERATED_COMPOSITING)
+    , m_platformPlayer(new MMRPlayer(this, true))
+#else
+    , m_platformPlayer(new MMRPlayer(this, false))
+#endif
+    , m_networkState(MediaPlayer::Empty)
+    , m_readyState(MediaPlayer::HaveNothing)
+    , m_fullscreenWebPageClient(0)
+#if USE(ACCELERATED_COMPOSITING)
+    , m_bufferingTimer(this, &MediaPlayerPrivate::bufferingTimerFired)
+    , m_showBufferingImage(false)
+    , m_mediaIsBuffering(false)
+#endif
+    , m_userDrivenSeekTimer(this, &MediaPlayerPrivate::userDrivenSeekTimerFired)
+    , m_lastSeekTime(0)
+{
+}
+
+MediaPlayerPrivate::~MediaPlayerPrivate()
+{
+    if (isFullscreen()) {
+        HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
+        element->exitFullscreen();
+    }
+#if USE(ACCELERATED_COMPOSITING)
+    // Remove media player from platform layer.
+    if (m_platformLayer)
+        static_cast<VideoLayerWebKitThread*>(m_platformLayer.get())->setMediaPlayer(0);
+#endif
+
+    delete m_platformPlayer;
+}
+
+void MediaPlayerPrivate::load(const String& url)
+{
+    String modifiedUrl(url);
+
+    if (modifiedUrl.startsWith("local://")) {
+        KURL kurl = KURL(KURL(), modifiedUrl);
+        kurl.setProtocol("file");
+        String tempPath(BlackBerry::Platform::Client::get()->getApplicationLocalDirectory().c_str());
+        tempPath.append(kurl.path());
+        kurl.setPath(tempPath);
+        modifiedUrl = kurl.string();
+    }
+    if (modifiedUrl.startsWith("file://")) {
+        // The QNX Multimedia Framework cannot handle filenames containing URL escape sequences.
+        modifiedUrl = decodeURLEscapeSequences(modifiedUrl);
+    }
+
+    String cookiePairs;
+    if (!url.isEmpty())
+        cookiePairs = cookieManager().getCookie(KURL(ParsedURLString, url.utf8().data()), WithHttpOnlyCookies);
+    if (!cookiePairs.isEmpty() && cookiePairs.utf8().data())
+        m_platformPlayer->load(modifiedUrl.utf8().data(), userAgent(modifiedUrl).utf8().data(), cookiePairs.utf8().data());
+    else
+        m_platformPlayer->load(modifiedUrl.utf8().data(), userAgent(modifiedUrl).utf8().data(), 0);
+}
+
+void MediaPlayerPrivate::cancelLoad()
+{
+    m_platformPlayer->cancelLoad();
+}
+
+void MediaPlayerPrivate::prepareToPlay()
+{
+    m_platformPlayer->prepareToPlay();
+}
+
+void MediaPlayerPrivate::play()
+{
+    m_platformPlayer->play();
+}
+
+void MediaPlayerPrivate::pause()
+{
+    m_platformPlayer->pause();
+}
+
+bool MediaPlayerPrivate::supportsFullscreen() const
+{
+    return true;
+}
+
+IntSize MediaPlayerPrivate::naturalSize() const
+{
+    // Cannot return empty size, otherwise paint() will never get called.
+    // Also, the values here will affect the aspect ratio of the output rectangle that will
+    // be used for renderering the video, so we must take PAR into account.
+    // Now, hope that metadata has been provided before this gets called if this is a video.
+    double pixelWidth = static_cast<double>(m_platformPlayer->pixelWidth());
+    double pixelHeight = static_cast<double>(m_platformPlayer->pixelHeight());
+    if (!m_platformPlayer->pixelWidth() || !m_platformPlayer->pixelHeight())
+        pixelWidth = pixelHeight = 1.0;
+
+    // Use floating point arithmetic to eliminate the chance of integer
+    // overflow. PAR numbers can be 5 digits or more.
+    double adjustedSourceWidth = static_cast<double>(m_platformPlayer->sourceWidth()) * pixelWidth / pixelHeight;
+    return IntSize(static_cast<int>(adjustedSourceWidth + 0.5), m_platformPlayer->sourceHeight());
+}
+
+bool MediaPlayerPrivate::hasVideo() const
+{
+    return m_platformPlayer->hasVideo();
+}
+
+bool MediaPlayerPrivate::hasAudio() const
+{
+    return m_platformPlayer->hasAudio();
+}
+
+void MediaPlayerPrivate::setVisible(bool)
+{
+    notImplemented();
+}
+
+float MediaPlayerPrivate::duration() const
+{
+    return m_platformPlayer->duration();
+}
+
+float MediaPlayerPrivate::currentTime() const
+{
+    return m_userDrivenSeekTimer.isActive() ? m_lastSeekTime: m_platformPlayer->currentTime();
+}
+
+static const double SeekSubmissionDelay = 0.1; // Reasonable throttling value.
+
+void MediaPlayerPrivate::seek(float time)
+{
+    m_lastSeekTime = time;
+    if (!m_userDrivenSeekTimer.isActive())
+        m_userDrivenSeekTimer.startOneShot(SeekSubmissionDelay);
+}
+
+void MediaPlayerPrivate::userDrivenSeekTimerFired(Timer<MediaPlayerPrivate>*)
+{
+    m_platformPlayer->seek(m_lastSeekTime);
+}
+
+bool MediaPlayerPrivate::seeking() const
+{
+    return false;
+}
+
+void MediaPlayerPrivate::setRate(float rate)
+{
+    m_platformPlayer->setRate(rate);
+}
+
+bool MediaPlayerPrivate::paused() const
+{
+    return m_platformPlayer->paused();
+}
+
+void MediaPlayerPrivate::setVolume(float volume)
+{
+    m_platformPlayer->setVolume(volume);
+}
+
+MediaPlayer::NetworkState MediaPlayerPrivate::networkState() const
+{
+    return m_networkState;
+}
+
+MediaPlayer::ReadyState MediaPlayerPrivate::readyState() const
+{
+    return m_readyState;
+}
+
+float MediaPlayerPrivate::maxTimeSeekable() const
+{
+    return m_platformPlayer->maxTimeSeekable();
+}
+
+PassRefPtr<TimeRanges> MediaPlayerPrivate::buffered() const
+{
+    RefPtr<TimeRanges> timeRanges = TimeRanges::create();
+    if (float bufferLoaded = m_platformPlayer->bufferLoaded())
+        timeRanges->add(0, bufferLoaded);
+    return timeRanges.release();
+}
+
+unsigned MediaPlayerPrivate::bytesLoaded() const
+{
+    notImplemented();
+    return 0;
+}
+
+void MediaPlayerPrivate::setSize(const IntSize&)
+{
+    notImplemented();
+}
+
+void MediaPlayerPrivate::paint(GraphicsContext* context, const IntRect& rect)
+{
+#if USE(ACCELERATED_COMPOSITING)
+    // Only process paint calls coming via the accelerated compositing code
+    // path, where we get called with a null graphics context. See
+    // LayerCompositingThread::drawTextures(). Ignore calls from the regular
+    // rendering path.
+    if (!context)
+        m_platformPlayer->notifyOutputUpdate(BlackBerry::Platform::IntRect(rect.x(), rect.y(), rect.width(), rect.height()));
+    return;
+#endif
+
+    if (!hasVideo() || context->paintingDisabled() || !m_webCorePlayer->visible())
+        return;
+
+    PlatformGraphicsContext* graphics = context->platformContext();
+    ASSERT(graphics);
+
+    BlackBerry::Platform::IntRect platformRect(rect.x(), rect.y(), rect.width(), rect.height());
+    IntRect clippedRect = frameView()->windowClipRect();
+    BlackBerry::Platform::IntRect platformWindowClipRect(clippedRect.x(), clippedRect.y(), clippedRect.width(), clippedRect.height());
+    m_platformPlayer->paint(graphics->canvas(), platformRect, platformWindowClipRect);
+}
+
+bool MediaPlayerPrivate::hasAvailableVideoFrame() const
+{
+    return m_platformPlayer->hasAvailableVideoFrame();
+}
+
+bool MediaPlayerPrivate::hasSingleSecurityOrigin() const
+{
+    return false;
+}
+
+MediaPlayer::MovieLoadType MediaPlayerPrivate::movieLoadType() const
+{
+    return static_cast<MediaPlayer::MovieLoadType>(m_platformPlayer->movieLoadType());
+}
+
+// This function returns the user agent string associated with the
+// frame loader client of our HTMLMediaElement. The call below will
+// end up in FrameLoaderClientBlackBerry::userAgent().
+String MediaPlayerPrivate::userAgent(const String& url) const
+{
+    HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
+    Document* topdoc = element->document()->topDocument();
+    ASSERT(topdoc->frame());
+    ASSERT(topdoc->frame()->loader());
+    if (topdoc->frame())
+        return topdoc->frame()->loader()->userAgent(KURL(KURL(), url));
+    return String();
+}
+
+void MediaPlayerPrivate::resizeSourceDimensions()
+{
+    if (!m_webCorePlayer)
+        return;
+
+    HTMLMediaElement* client = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
+
+    if (!client || !client->isVideo())
+        return;
+
+    RenderObject* o = client->renderer();
+    if (!o)
+        return;
+
+    // If we have an HTMLVideoElement but the source has no video, then we need to resize the media element.
+    if (!hasVideo()) {
+        IntRect rect = o->enclosingBox()->contentBoxRect();
+
+        static const int playbookMinAudioElementWidth = 300;
+        static const int playbookMinAudioElementHeight = 32;
+        // If the rect dimensions are less than the allowed minimum, use the minimum instead.
+        int newWidth = max(rect.width(), playbookMinAudioElementWidth);
+        int newHeight = max(rect.height(), playbookMinAudioElementHeight);
+
+        char attrString[12];
+
+        sprintf(attrString, "%d", newWidth);
+        client->setAttribute(HTMLNames::widthAttr, attrString);
+
+        sprintf(attrString, "%d", newHeight);
+        client->setAttribute(HTMLNames::heightAttr, attrString);
+    }
+
+    // If we don't know what the width and height of the video source is, then we need to set it to something sane.
+    if (m_platformPlayer->sourceWidth() && m_platformPlayer->sourceHeight())
+        return;
+    IntRect rect = o->enclosingBox()->contentBoxRect();
+    m_platformPlayer->setSourceDimension(rect.width(), rect.height());
+}
+
+void MediaPlayerPrivate::setFullscreenWebPageClient(BlackBerry::WebKit::WebPageClient* client)
+{
+    if (m_fullscreenWebPageClient == client)
+        return;
+
+    m_fullscreenWebPageClient = client;
+    m_platformPlayer->toggleFullscreen(client);
+
+    // The following repaint is needed especially if video is paused and
+    // fullscreen is exiting, so that a MediaPlayerPrivate::paint() is
+    // triggered and the code in outputUpdate() sets the correct window
+    // rectangle.
+    if (!client)
+        m_webCorePlayer->repaint();
+}
+
+BlackBerry::Platform::Graphics::Window* MediaPlayerPrivate::getWindow()
+{
+    return m_platformPlayer->getWindow();
+}
+
+BlackBerry::Platform::Graphics::Window* MediaPlayerPrivate::getPeerWindow(const char* uniqueID) const
+{
+    return m_platformPlayer->getPeerWindow(uniqueID);
+}
+
+int MediaPlayerPrivate::getWindowPosition(unsigned& x, unsigned& y, unsigned& width, unsigned& height) const
+{
+    return m_platformPlayer->getWindowPosition(x, y, width, height);
+}
+
+const char* MediaPlayerPrivate::mmrContextName()
+{
+    return m_platformPlayer->mmrContextName();
+}
+
+float MediaPlayerPrivate::percentLoaded()
+{
+    if (!m_platformPlayer->duration())
+        return 0;
+
+    float buffered = 0;
+    RefPtr<TimeRanges> timeRanges = this->buffered();
+    for (unsigned i = 0; i < timeRanges->length(); ++i) {
+        ExceptionCode ignoredException;
+        float start = timeRanges->start(i, ignoredException);
+        float end = timeRanges->end(i, ignoredException);
+        buffered += end - start;
+    }
+
+    float loaded = buffered / m_platformPlayer->duration();
+    return loaded;
+}
+
+unsigned MediaPlayerPrivate::sourceWidth()
+{
+    return m_platformPlayer->sourceWidth();
+}
+
+unsigned MediaPlayerPrivate::sourceHeight()
+{
+    return m_platformPlayer->sourceHeight();
+}
+
+void MediaPlayerPrivate::setAllowPPSVolumeUpdates(bool allow)
+{
+    return m_platformPlayer->setAllowPPSVolumeUpdates(allow);
+}
+
+void MediaPlayerPrivate::updateStates()
+{
+    MediaPlayer::NetworkState oldNetworkState = m_networkState;
+    MediaPlayer::ReadyState oldReadyState = m_readyState;
+
+    MMRPlayer::Error currentError = m_platformPlayer->error();
+
+    HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
+
+    if (currentError != MMRPlayer::MediaOK) {
+        m_readyState = MediaPlayer::HaveNothing;
+        if (currentError == MMRPlayer::MediaDecodeError)
+            m_networkState = MediaPlayer::DecodeError;
+        else if (currentError == MMRPlayer::MediaMetaDataError
+            || currentError == MMRPlayer::MediaAudioReceiveError
+            || currentError == MMRPlayer::MediaVideoReceiveError)
+            m_networkState = MediaPlayer::NetworkError;
+    } else {
+        switch (m_platformPlayer->mediaState()) {
+        case MMRPlayer::MMRPlayStateIdle:
+            m_networkState = MediaPlayer::Idle;
+            break;
+        case MMRPlayer::MMRPlayStatePlaying:
+            m_networkState = MediaPlayer::Loading;
+            break;
+        case MMRPlayer::MMRPlayStateStopped:
+            m_networkState = MediaPlayer::Idle;
+            break;
+        case MMRPlayer::MMRPlayStateUnknown:
+        default:
+            break;
+        }
+
+        switch (m_platformPlayer->state()) {
+        case MMRPlayer::MP_STATE_IDLE:
+#if USE(ACCELERATED_COMPOSITING)
+            setBuffering(false);
+            m_mediaIsBuffering = false;
+#endif
+            if (isFullscreen())
+                element->exitFullscreen();
+            break;
+        case MMRPlayer::MP_STATE_ACTIVE:
+#if USE(ACCELERATED_COMPOSITING)
+            m_showBufferingImage = false;
+            m_mediaIsBuffering = false;
+#endif
+            break;
+        case MMRPlayer::MP_STATE_UNSUPPORTED:
+            break;
+        default:
+            break;
+        }
+        if ((duration() || movieLoadType() == MediaPlayer::LiveStream)
+            && m_readyState != MediaPlayer::HaveEnoughData)
+            m_readyState = MediaPlayer::HaveEnoughData;
+    }
+
+    if (m_readyState != oldReadyState) {
+        m_webCorePlayer->readyStateChanged();
+#if USE(ACCELERATED_COMPOSITING)
+        // Create platform layer for video.
+        if (!m_platformLayer)
+            m_platformLayer = VideoLayerWebKitThread::create(m_webCorePlayer);
+#endif
+    }
+    if (m_networkState != oldNetworkState)
+        m_webCorePlayer->networkStateChanged();
+}
+
+// IMMRPlayerListener callbacks implementation
+void MediaPlayerPrivate::onStateChanged(MMRPlayer::MpState)
+{
+    updateStates();
+}
+
+void MediaPlayerPrivate::onMediaStatusChanged(MMRPlayer::MMRPlayState)
+{
+    updateStates();
+}
+
+void MediaPlayerPrivate::onError(MMRPlayer::Error type)
+{
+    updateStates();
+}
+
+void MediaPlayerPrivate::onDurationChanged(float duration)
+{
+    updateStates();
+    m_webCorePlayer->durationChanged();
+}
+
+void MediaPlayerPrivate::onTimeChanged(float)
+{
+    m_webCorePlayer->timeChanged();
+}
+
+void MediaPlayerPrivate::onPauseStateChanged()
+{
+    if (!isFullscreen())
+        return;
+
+    HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
+    // Paused state change not due to local controller.
+    if (m_platformPlayer->isPaused())
+        element->pause();
+    else {
+        // The HMI fullscreen widget has resumed play. Check if the
+        // pause timeout occurred.
+        m_platformPlayer->processPauseTimeoutIfNecessary();
+        element->play();
+    }
+}
+
+void MediaPlayerPrivate::onRateChanged(float)
+{
+    m_webCorePlayer->rateChanged();
+}
+
+void MediaPlayerPrivate::onVolumeChanged(float volume)
+{
+    m_webCorePlayer->volumeChanged(volume);
+}
+
+void MediaPlayerPrivate::onRepaint()
+{
+    m_webCorePlayer->repaint();
+}
+
+void MediaPlayerPrivate::onSizeChanged()
+{
+    resizeSourceDimensions();
+    if (hasVideo())
+        m_webCorePlayer->sizeChanged();
+}
+
+void MediaPlayerPrivate::onPlayNotified()
+{
+    if (HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient()))
+        element->play();
+}
+
+void MediaPlayerPrivate::onPauseNotified()
+{
+    if (HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient()))
+        element->pause();
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+void MediaPlayerPrivate::onBuffering(bool flag)
+{
+    setBuffering(flag);
+}
+#endif
+
+int MediaPlayerPrivate::showErrorDialog(MMRPlayer::Error type)
+{
+    using namespace BlackBerry::WebKit;
+
+    WebPageClient::AlertType atype;
+    switch (type) {
+    case MMRPlayer::MediaOK:
+        atype = WebPageClient::MediaOK;
+        break;
+    case MMRPlayer::MediaDecodeError:
+        atype = WebPageClient::MediaDecodeError;
+        break;
+    case MMRPlayer::MediaMetaDataError:
+        atype = WebPageClient::MediaMetaDataError;
+        break;
+    case MMRPlayer::MediaMetaDataTimeoutError:
+        atype = WebPageClient::MediaMetaDataTimeoutError;
+        break;
+    case MMRPlayer::MediaNoMetaDataError:
+        atype = WebPageClient::MediaNoMetaDataError;
+        break;
+    case MMRPlayer::MediaVideoReceiveError:
+        atype = WebPageClient::MediaVideoReceiveError;
+        break;
+    case MMRPlayer::MediaAudioReceiveError:
+        atype = WebPageClient::MediaAudioReceiveError;
+        break;
+    case MMRPlayer::MediaInvalidError:
+        atype = WebPageClient::MediaInvalidError;
+        break;
+    default:
+        LOG(Media, "Alert type does not exist.");
+        return -1;
+    }
+
+    int rc = 0;
+    HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
+    Document* topdoc = element->document()->topDocument();
+    if (topdoc->view() && topdoc->view()->hostWindow())
+        rc = topdoc->view()->hostWindow()->platformPageClient()->showAlertDialog(atype);
+    return rc;
+}
+
+FrameView* MediaPlayerPrivate::frameView() const
+{
+    // We previously used m_webCorePlayer->frameView(), but this method returns
+    // a null frameView until quite late in the media player initialization,
+    // and starting quite early in the media player destruction (because
+    // it may be set to zero by the destructor in RenderVideo.cpp before
+    // our destructor is called, leaving us unable to clean up child windows
+    // in mmrDisconnect).
+    HTMLMediaElement* element = static_cast<HTMLMediaElement*>(m_webCorePlayer->mediaPlayerClient());
+    return element->document()->view();
+}
+
+BlackBerry::Platform::Graphics::Window* MediaPlayerPrivate::platformWindow()
+{
+    if (frameView() && frameView()->hostWindow())
+        return frameView()->hostWindow()->platformPageClient()->platformWindow();
+    return 0;
+}
+
+bool MediaPlayerPrivate::isFullscreen() const
+{
+    return m_fullscreenWebPageClient;
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+static const double BufferingAnimationDelay = 1.0 / 24;
+static char* s_bufferingImageData = 0;
+static int s_bufferingImageWidth = 0;
+static int s_bufferingImageHeight = 0;
+
+PlatformMedia MediaPlayerPrivate::platformMedia() const
+{
+    PlatformMedia pm;
+    pm.type = PlatformMedia::QNXMediaPlayerType;
+    pm.media.qnxMediaPlayer = const_cast<MediaPlayerPrivate*>(this);
+    return pm;
+}
+
+PlatformLayer* MediaPlayerPrivate::platformLayer() const
+{
+    if (m_platformLayer)
+        return m_platformLayer.get();
+    return 0;
+}
+
+static void loadBufferingImageData()
+{
+    static bool loaded = false;
+    if (!loaded) {
+        static Image* bufferingIcon = Image::loadPlatformResource("vidbuffer").leakRef();
+        NativeImageSkia* nativeImage = bufferingIcon->nativeImageForCurrentFrame();
+        if (!nativeImage)
+            return;
+
+        if (!nativeImage->isDataComplete())
+            return;
+
+        loaded = true;
+        nativeImage->lockPixels();
+
+        int bufSize = nativeImage->width() * nativeImage->height() * 4;
+        s_bufferingImageWidth = nativeImage->width();
+        s_bufferingImageHeight = nativeImage->height();
+        s_bufferingImageData = static_cast<char*>(malloc(bufSize));
+        memcpy(s_bufferingImageData, nativeImage->getPixels(), bufSize);
+
+        nativeImage->unlockPixels();
+        bufferingIcon->deref();
+    }
+}
+
+void MediaPlayerPrivate::bufferingTimerFired(Timer<MediaPlayerPrivate>*)
+{
+    if (m_showBufferingImage) {
+        if (!isFullscreen() && m_platformLayer)
+            m_platformLayer->setNeedsDisplay();
+        m_bufferingTimer.startOneShot(BufferingAnimationDelay);
+    }
+}
+
+void MediaPlayerPrivate::setBuffering(bool buffering)
+{
+    if (!hasVideo())
+        buffering = false; // Buffering animation not visible for audio.
+    if (buffering != m_showBufferingImage) {
+        m_showBufferingImage = buffering;
+        if (buffering) {
+            loadBufferingImageData();
+            m_bufferingTimer.startOneShot(BufferingAnimationDelay);
+        } else
+            m_bufferingTimer.stop();
+
+        if (m_platformLayer)
+            m_platformLayer->setNeedsDisplay();
+    }
+}
+
+static unsigned int allocateTextureId()
+{
+    unsigned int texid;
+    glGenTextures(1, &texid);
+    glBindTexture(GL_TEXTURE_2D, texid);
+    // Do basic linear filtering on resize.
+    glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+    glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+    // NPOT textures in GL ES only work when the wrap mode is set to GL_CLAMP_TO_EDGE.
+    glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+    glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+    return texid;
+}
+
+void MediaPlayerPrivate::drawBufferingAnimation(const TransformationMatrix& matrix, int positionLocation, int texCoordLocation)
+{
+    if (m_showBufferingImage && s_bufferingImageData && !isFullscreen()) {
+        TransformationMatrix renderMatrix = matrix;
+
+        // Rotate the buffering indicator so that it takes 1 second to do 1 revolution.
+        timespec time;
+        clock_gettime(CLOCK_REALTIME, &time);
+        renderMatrix.rotate(time.tv_nsec / 1000000000.0 * 360.0);
+
+        static bool initialized = false;
+        static unsigned int texId = allocateTextureId();
+        glBindTexture(GL_TEXTURE_2D, texId);
+        if (!initialized) {
+            initialized = true;
+            glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, s_bufferingImageWidth, s_bufferingImageHeight,
+                0, GL_RGBA, GL_UNSIGNED_BYTE, s_bufferingImageData);
+            free(s_bufferingImageData);
+        }
+
+        float texcoords[] = { 0, 0,  0, 1,  1, 1,  1, 0 };
+        FloatPoint vertices[4];
+        float bx = s_bufferingImageWidth / 2.0;
+        float by = s_bufferingImageHeight / 2.0;
+        vertices[0] = renderMatrix.mapPoint(FloatPoint(-bx, -by));
+        vertices[1] = renderMatrix.mapPoint(FloatPoint(-bx, by));
+        vertices[2] = renderMatrix.mapPoint(FloatPoint(bx, by));
+        vertices[3] = renderMatrix.mapPoint(FloatPoint(bx, -by));
+
+        glVertexAttribPointer(positionLocation, 2, GL_FLOAT, GL_FALSE, 0, vertices);
+        glVertexAttribPointer(texCoordLocation, 2, GL_FLOAT, GL_FALSE, 0, texcoords);
+        glDrawArrays(GL_TRIANGLE_FAN, 0, 4);
+    }
+}
+#endif
+
+} // namespace WebCore
+
+#endif // ENABLE(VIDEO)
diff --git a/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h
new file mode 100644
index 000000000..5b7f43299
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/MediaPlayerPrivateBlackBerry.h
@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef MediaPlayerPrivateBlackBerry_h
+#define MediaPlayerPrivateBlackBerry_h
+
+#if ENABLE(VIDEO)
+#include "MediaPlayerPrivate.h"
+
+#include <BlackBerryPlatformMMRPlayer.h>
+
+namespace BlackBerry {
+namespace WebKit {
+class WebPageClient;
+}
+}
+
+namespace WebCore {
+
+class MediaPlayerPrivate : public MediaPlayerPrivateInterface, public BlackBerry::Platform::IMMRPlayerListener {
+public:
+    virtual ~MediaPlayerPrivate();
+
+    static PassOwnPtr<MediaPlayerPrivateInterface> create(MediaPlayer*);
+    static void registerMediaEngine(MediaEngineRegistrar);
+    static void getSupportedTypes(HashSet<String>&);
+    static MediaPlayer::SupportsType supportsType(const String&, const String&);
+    static void notifyAppActivatedEvent(bool);
+    static void setCertificatePath(const String&);
+
+    virtual void load(const String& url);
+    virtual void cancelLoad();
+
+    virtual void prepareToPlay();
+#if USE(ACCELERATED_COMPOSITING)
+    virtual PlatformMedia platformMedia() const;
+    virtual PlatformLayer* platformLayer() const;
+    void drawBufferingAnimation(const TransformationMatrix&, int positionLocation, int texCoordLocation);
+#endif
+
+    virtual void play();
+    virtual void pause();
+
+    virtual bool supportsFullscreen() const;
+
+    virtual IntSize naturalSize() const;
+
+    virtual bool hasVideo() const;
+    virtual bool hasAudio() const;
+
+    virtual void setVisible(bool);
+
+    virtual float duration() const;
+
+    virtual float currentTime() const;
+    virtual void seek(float time);
+    virtual bool seeking() const;
+
+    virtual void setRate(float);
+
+    virtual bool paused() const;
+
+    virtual void setVolume(float);
+
+    virtual MediaPlayer::NetworkState networkState() const;
+    virtual MediaPlayer::ReadyState readyState() const;
+
+    virtual float maxTimeSeekable() const;
+    virtual PassRefPtr<TimeRanges> buffered() const;
+
+    virtual unsigned bytesLoaded() const;
+
+    virtual void setSize(const IntSize&);
+
+    virtual void paint(GraphicsContext*, const IntRect&);
+
+    virtual bool hasAvailableVideoFrame() const;
+
+#if USE(ACCELERATED_COMPOSITING)
+    // Whether accelerated rendering is supported by the media engine for the current media.
+    virtual bool supportsAcceleratedRendering() const { return true; }
+    // Called when the rendering system flips the into or out of accelerated rendering mode.
+    virtual void acceleratedRenderingStateChanged() { }
+#endif
+
+    virtual bool hasSingleSecurityOrigin() const;
+
+    virtual MediaPlayer::MovieLoadType movieLoadType() const;
+
+    void resizeSourceDimensions();
+    void setFullscreenWebPageClient(BlackBerry::WebKit::WebPageClient*);
+    BlackBerry::Platform::Graphics::Window* getWindow();
+    BlackBerry::Platform::Graphics::Window* getPeerWindow(const char*) const;
+    int getWindowPosition(unsigned& x, unsigned& y, unsigned& width, unsigned& height) const;
+    const char* mmrContextName();
+    float percentLoaded();
+    unsigned sourceWidth();
+    unsigned sourceHeight();
+    void setAllowPPSVolumeUpdates(bool);
+
+    // IMMRPlayerListener implementation.
+    virtual void onStateChanged(BlackBerry::Platform::MMRPlayer::MpState);
+    virtual void onMediaStatusChanged(BlackBerry::Platform::MMRPlayer::MMRPlayState);
+    virtual void onError(BlackBerry::Platform::MMRPlayer::Error);
+    virtual void onDurationChanged(float);
+    virtual void onTimeChanged(float);
+    virtual void onRateChanged(float);
+    virtual void onVolumeChanged(float);
+    virtual void onPauseStateChanged();
+    virtual void onRepaint();
+    virtual void onSizeChanged();
+    virtual void onPlayNotified();
+    virtual void onPauseNotified();
+#if USE(ACCELERATED_COMPOSITING)
+    virtual void onBuffering(bool);
+#endif
+
+    virtual bool isFullscreen() const;
+    virtual int showErrorDialog(BlackBerry::Platform::MMRPlayer::Error);
+    virtual BlackBerry::Platform::Graphics::Window* platformWindow();
+
+private:
+    MediaPlayerPrivate(MediaPlayer*);
+
+    FrameView* frameView() const;
+    void updateStates();
+    String userAgent(const String&) const;
+
+    MediaPlayer* m_webCorePlayer;
+    BlackBerry::Platform::MMRPlayer* m_platformPlayer;
+
+    mutable MediaPlayer::NetworkState m_networkState;
+    MediaPlayer::ReadyState m_readyState;
+
+    BlackBerry::WebKit::WebPageClient* m_fullscreenWebPageClient;
+#if USE(ACCELERATED_COMPOSITING)
+    void bufferingTimerFired(Timer<MediaPlayerPrivate>*);
+    void setBuffering(bool);
+
+    Timer<MediaPlayerPrivate> m_bufferingTimer;
+    RefPtr<PlatformLayer> m_platformLayer;
+    bool m_showBufferingImage;
+    bool m_mediaIsBuffering;
+#endif
+
+    void userDrivenSeekTimerFired(Timer<MediaPlayerPrivate>*);
+    Timer<MediaPlayerPrivate> m_userDrivenSeekTimer;
+    float m_lastSeekTime;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(VIDEO)
+#endif // MediaPlayerPrivateBlackBerry_h
diff --git a/Source/WebCore/platform/graphics/blackberry/PluginLayerWebKitThread.cpp b/Source/WebCore/platform/graphics/blackberry/PluginLayerWebKitThread.cpp
new file mode 100644
index 000000000..c22254cb7
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/PluginLayerWebKitThread.cpp
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "PluginLayerWebKitThread.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerCompositingThread.h"
+#include "PluginView.h"
+
+namespace WebCore {
+
+PluginLayerWebKitThread::PluginLayerWebKitThread(PluginView* pluginView)
+    : LayerWebKitThread(Layer, 0)
+    , m_needsDisplay(false)
+{
+    setPluginView(pluginView);
+}
+
+PluginLayerWebKitThread::~PluginLayerWebKitThread()
+{
+}
+
+void PluginLayerWebKitThread::setPluginView(PluginView* pluginView)
+{
+    m_pluginView = pluginView;
+    setNeedsTexture(isDrawable() && pluginView);
+    setLayerProgramShader(LayerProgramShaderRGBA);
+
+    if (m_pluginView)
+        setNeedsDisplay();
+    else {
+        // We can't afford to wait until the next commit
+        // to set the m_pluginView to 0 in the impl, because it is
+        // about to be destroyed.
+        layerCompositingThread()->setPluginView(0);
+        setNeedsCommit();
+    }
+}
+
+void PluginLayerWebKitThread::setHolePunchRect(const IntRect& rect)
+{
+    m_holePunchRect = rect;
+    setNeedsCommit();
+}
+
+void PluginLayerWebKitThread::setNeedsDisplay()
+{
+    m_needsDisplay = true;
+    setNeedsCommit();
+}
+
+void PluginLayerWebKitThread::updateTextureContentsIfNeeded()
+{
+    if (!m_needsDisplay)
+        return;
+
+    m_needsDisplay = false;
+
+    if (!m_pluginView)
+        return;
+
+    m_pluginView->updateBuffer(IntRect(IntPoint::zero(), m_pluginView->size()));
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/blackberry/PluginLayerWebKitThread.h b/Source/WebCore/platform/graphics/blackberry/PluginLayerWebKitThread.h
new file mode 100644
index 000000000..87b9c831f
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/PluginLayerWebKitThread.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef PluginLayerWebKitThread_h
+#define PluginLayerWebKitThread_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerWebKitThread.h"
+
+namespace WebCore {
+
+class PluginView;
+
+class PluginLayerWebKitThread : public LayerWebKitThread {
+public:
+    static PassRefPtr<PluginLayerWebKitThread> create(PluginView* pluginView)
+    {
+        return adoptRef(new PluginLayerWebKitThread(pluginView));
+    }
+
+    virtual ~PluginLayerWebKitThread();
+
+    void setPluginView(PluginView*);
+    void setHolePunchRect(const IntRect&);
+
+    virtual void setNeedsDisplay();
+
+protected:
+    virtual void updateTextureContentsIfNeeded();
+
+private:
+    PluginLayerWebKitThread(PluginView*);
+    bool m_needsDisplay;
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // PluginLayerWebKitThread_h
diff --git a/Source/WebCore/platform/graphics/blackberry/Texture.cpp b/Source/WebCore/platform/graphics/blackberry/Texture.cpp
new file mode 100644
index 000000000..1324d1536
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/Texture.cpp
@@ -0,0 +1,202 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "Texture.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "Color.h"
+#include "IntRect.h"
+#include "TextureCacheCompositingThread.h"
+
+#include <GLES2/gl2.h>
+#include <SkBitmap.h>
+#include <wtf/CurrentTime.h>
+#include <wtf/OwnArrayPtr.h>
+
+#define DEBUG_TEXTURE_UPLOADS 0
+
+namespace WebCore {
+
+static void copyImageData(unsigned char* dst, int dstStride, int dstX, int dstY,
+                    const unsigned char* src, int srcStride, int srcX, int srcY, int width, int height)
+{
+    dst += (dstY * dstStride) + (Texture::bytesPerPixel() * dstX);
+    src += (srcY * srcStride) + (Texture::bytesPerPixel() * srcX);
+    int length = Texture::bytesPerPixel() * width;
+
+    for (int y = 0; y < height; ++y) {
+        memcpy(dst, src, length);
+        dst += dstStride;
+        src += srcStride;
+    }
+}
+
+Texture::Texture(bool isColor)
+    : m_protectionCount(0)
+    , m_textureId(0)
+    , m_isColor(isColor)
+    , m_isOpaque(false)
+{
+    textureCacheCompositingThread()->install(this);
+}
+
+Texture::~Texture()
+{
+    textureCacheCompositingThread()->textureDestroyed(this);
+}
+
+void Texture::updateContents(const SkBitmap& contents, const IntRect& dirtyRect, const IntRect& tile, bool isOpaque)
+{
+    IntRect tileDirtyRect(dirtyRect);
+
+    tileDirtyRect.intersect(tile);
+    if (tileDirtyRect.isEmpty())
+        return;
+
+    m_isOpaque = isOpaque;
+
+    int stride = bytesPerPixel() * contents.width();
+    int x = tileDirtyRect.x() - dirtyRect.x();
+    int y = tileDirtyRect.y() - dirtyRect.y();
+    SkAutoLockPixels lock(contents);
+    unsigned char* pixels = static_cast<unsigned char*>(contents.getPixels());
+    pixels += (y * stride) + (bytesPerPixel() * x);
+    if (!pixels)
+        return;
+
+    bool subImage = tile.size() == m_size;
+    IntSize size = subImage ? tileDirtyRect.size() : tile.size();
+    IntSize contentsSize(IntSize(contents.width(), contents.height()));
+
+#if DEBUG_TEXTURE_UPLOADS
+    fprintf(stderr, "%s\n", subImage ? "SUBIMAGE" : "IMAGE");
+    fprintf(stderr, "  tile = (x=%d,y=%d,width=%d,height=%d), m_size = (%dx%d)\n", tile.x(), tile.y(), tile.width(), tile.height(), m_size.width(), m_size.height());
+    fprintf(stderr, "  tileDirtyRect = (x=%d,y=%d,width=%d,height=%d), contents.size() = (%dx%d)\n", tileDirtyRect.x(), tileDirtyRect.y(), tileDirtyRect.width(), tileDirtyRect.height(), contentsSize.width(), contentsSize.height());
+    IntSize sizeBeforeShunk = size;
+#endif
+
+    size = size.shrunkTo(contentsSize);
+
+#if DEBUG_TEXTURE_UPLOADS
+    if (size != sizeBeforeShunk)
+        fprintf(stderr, "  SHRUNK!!!!\n");
+#endif
+
+    if (!hasTexture()) {
+        // We may have been evicted by the TextureCacheCompositingThread,
+        // attempt to install us again.
+        if (!textureCacheCompositingThread()->install(this))
+            return;
+    }
+
+    glBindTexture(GL_TEXTURE_2D, m_textureId);
+
+    ASSERT(size.width() >= 0);
+    bool doesTileStrideEqualTextureStride = contents.width() == size.width();
+
+    OwnArrayPtr<unsigned char> tmp;
+    if (!doesTileStrideEqualTextureStride) {
+#if defined(GL_UNPACK_ROW_LENGTH)
+        glPixelStorei(GL_UNPACK_ROW_LENGTH, contents.width());
+#else
+        tmp = adoptArrayPtr(new unsigned char[size.width() * size.height() * bytesPerPixel()]);
+        copyImageData(tmp.get(), bytesPerPixel() * size.width(), 0, 0,
+                      pixels, stride, 0, 0,
+                      size.width(), size.height());
+        pixels = tmp.get();
+#endif
+    }
+
+    if (subImage) {
+#if DEBUG_TEXTURE_UPLOADS
+        fprintf(stderr, "glTexSubImage2D(%d, %d, %d, %d)\n", tileDirtyRect.x() - tile.x(), tileDirtyRect.y() - tile.y(),
+                        size.width(), size.height());
+        double t = currentTime();
+#endif
+        glTexSubImage2D(GL_TEXTURE_2D, 0,
+                        tileDirtyRect.x() - tile.x(), tileDirtyRect.y() - tile.y(),
+                        size.width(), size.height(),
+                        GL_RGBA, GL_UNSIGNED_BYTE, pixels);
+#if DEBUG_TEXTURE_UPLOADS
+        t = currentTime() - t;
+        fprintf(stderr, "    time = %f s (%d bytes)\n", t, size.width()*size.height()*4);
+#endif
+    } else {
+#if DEBUG_TEXTURE_UPLOADS
+        fprintf(stderr, "glTexImage2D(%d, %d)\n", size.width(), size.height());
+        double t = currentTime();
+#endif
+        glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, size.width(), size.height(), 0, GL_RGBA, GL_UNSIGNED_BYTE, pixels);
+#if DEBUG_TEXTURE_UPLOADS
+        t = currentTime() - t;
+        fprintf(stderr, "    time = %f s (%d bytes)\n", t, size.width()*size.height()*4);
+#endif
+    }
+
+#if defined(GL_UNPACK_ROW_LENGTH)
+    if (!doesTileStrideEqualTextureStride)
+        glPixelStorei(GL_UNPACK_ROW_LENGTH, 0);
+#endif
+
+    IntSize oldSize = m_size;
+    m_size = tile.size();
+    if (m_size != oldSize)
+        textureCacheCompositingThread()->textureResized(this, oldSize);
+}
+
+void Texture::setContentsToColor(const Color& color)
+{
+    m_isOpaque = !color.hasAlpha();
+    RGBA32 rgba = color.rgb();
+    glBindTexture(GL_TEXTURE_2D, m_textureId);
+    glTexImage2D(GL_TEXTURE_2D, 0, GL_RGBA, 1, 1, 0, GL_RGBA, GL_UNSIGNED_BYTE, &rgba);
+
+    IntSize oldSize = m_size;
+    m_size = IntSize(1, 1);
+    if (m_size != oldSize)
+        textureCacheCompositingThread()->textureResized(this, oldSize);
+}
+
+bool Texture::protect(const IntSize& size)
+{
+    if (!hasTexture()) {
+        // We may have been evicted by the TextureCacheCompositingThread,
+        // attempt to install us again.
+        if (!textureCacheCompositingThread()->install(this))
+            return false;
+    }
+
+    ++m_protectionCount;
+
+    if (m_size == size)
+        return true;
+
+    IntSize oldSize = m_size;
+    m_size = size;
+    textureCacheCompositingThread()->textureResized(this, oldSize);
+
+    glBindTexture(GL_TEXTURE_2D, m_textureId);
+    glTexImage2D(GL_TEXTURE_2D, 0 , GL_RGBA, size.width(), size.height(), 0, GL_RGBA, GL_UNSIGNED_BYTE, 0);
+    return true;
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/blackberry/Texture.h b/Source/WebCore/platform/graphics/blackberry/Texture.h
new file mode 100644
index 000000000..4e996d0d3
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/Texture.h
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef Texture_h
+#define Texture_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "IntSize.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+class SkBitmap;
+
+namespace WebCore {
+
+class Color;
+class IntRect;
+class TextureCacheCompositingThread;
+
+// Texture encapsulates a volatile texture - at any time, the underlying OpenGL
+// texture may be deleted by the TextureCacheCompositingThread. The user must
+// check using Texture::isDirty() immediately before using it, every time.
+// The only way to prevent eviction this is to call Texture::protect().
+// If the texture isDirty(), you must updateContents() before you can use it.
+class Texture : public RefCounted<Texture> {
+public:
+    static PassRefPtr<Texture> create(bool isColor = false)
+    {
+        return adoptRef(new Texture(isColor));
+    }
+
+    ~Texture();
+
+    unsigned textureId() const { return m_textureId; }
+
+    bool isDirty() const { return !m_textureId; }
+    bool hasTexture() const { return m_textureId; }
+
+    bool isColor() const { return m_isColor; }
+    bool isOpaque() const { return m_isOpaque; }
+
+    bool isProtected() const { return m_protectionCount > 0; }
+    void protect() { ++m_protectionCount; }
+    void unprotect() { --m_protectionCount; }
+    bool protect(const IntSize&);
+
+    void updateContents(const SkBitmap& contents, const IntRect& dirtyRect, const IntRect& tile, bool isOpaque = false);
+    void setContentsToColor(const Color&);
+
+    IntSize size() const { return m_size; }
+    int width() const { return m_size.width(); }
+    int height() const { return m_size.height(); }
+    static int bytesPerPixel() { return 4; }
+
+private:
+    friend class TextureCacheCompositingThread;
+
+    Texture(bool isColor = false);
+
+    void setTextureId(unsigned id)
+    {
+        m_textureId = id;
+
+        // We assume it is a newly allocated texture,
+        // and thus empty, or 0, which would of course
+        // be empty.
+        m_size = IntSize();
+    }
+
+    int m_protectionCount;
+    unsigned m_textureId;
+    IntSize m_size;
+    bool m_isColor;
+    bool m_isOpaque;
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // Texture_h
diff --git a/Source/WebCore/platform/graphics/blackberry/TextureCacheCompositingThread.cpp b/Source/WebCore/platform/graphics/blackberry/TextureCacheCompositingThread.cpp
new file mode 100644
index 000000000..fe0c3da49
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/TextureCacheCompositingThread.cpp
@@ -0,0 +1,301 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "TextureCacheCompositingThread.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "IntRect.h"
+
+#include <GLES2/gl2.h>
+#include <SkBitmap.h>
+
+#define DEBUG_TEXTURE_MEMORY_USAGE 0
+
+namespace WebCore {
+
+static const int defaultMemoryLimit = 64 * 1024 * 1024; // Measured in bytes.
+
+// Used to protect a newly created texture from being immediately evicted
+// before someone has a chance to protect it for legitimate reasons.
+class TextureProtector {
+public:
+    TextureProtector(Texture* texture)
+        : m_texture(texture)
+    {
+        m_texture->protect();
+    }
+
+    ~TextureProtector()
+    {
+        m_texture->unprotect();
+    }
+
+private:
+    Texture* m_texture;
+};
+
+TextureCacheCompositingThread::TextureCacheCompositingThread()
+    : m_memoryUsage(0)
+    , m_memoryLimit(defaultMemoryLimit)
+{
+}
+
+unsigned TextureCacheCompositingThread::allocateTextureId()
+{
+    unsigned texid;
+    glGenTextures(1, &texid);
+    glBindTexture(GL_TEXTURE_2D, texid);
+    if (!glIsTexture(texid))
+        return 0;
+
+    // Do basic linear filtering on resize.
+    glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+    glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+    // NPOT textures in GL ES only work when the wrap mode is set to GL_CLAMP_TO_EDGE.
+    glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+    glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+    return texid;
+}
+
+void TextureCacheCompositingThread::freeTextureId(unsigned id)
+{
+    if (id)
+        glDeleteTextures(1, &id);
+}
+
+void TextureCacheCompositingThread::collectGarbage()
+{
+    int delta = 0;
+
+    for (Garbage::iterator it = m_garbage.begin(); it != m_garbage.end(); ++it) {
+        ZombieTexture& zombie = *it;
+        freeTextureId(zombie.id);
+        delta += zombie.size.width() * zombie.size.height() * Texture::bytesPerPixel();
+    }
+    m_garbage.clear();
+
+    if (delta)
+        decMemoryUsage(delta);
+}
+
+void TextureCacheCompositingThread::textureResized(Texture* texture, const IntSize& oldSize)
+{
+    int delta = (texture->width() * texture->height() - oldSize.width() * oldSize.height()) * Texture::bytesPerPixel();
+    incMemoryUsage(delta);
+    if (delta > 0)
+        prune();
+}
+
+void TextureCacheCompositingThread::textureDestroyed(Texture* texture)
+{
+    if (texture->isColor()) {
+        m_garbage.append(ZombieTexture(texture));
+        return;
+    }
+
+    evict(m_textures.find(texture));
+}
+
+bool TextureCacheCompositingThread::install(Texture* texture)
+{
+    if (!texture)
+        return true;
+
+    if (!texture->hasTexture()) {
+        unsigned textureId = allocateTextureId();
+        if (!textureId)
+            return false;
+
+        texture->setTextureId(textureId);
+    }
+
+    if (!texture->isColor()) {
+        if (!m_textures.contains(texture))
+            m_textures.add(texture);
+    }
+
+    return true;
+}
+
+void TextureCacheCompositingThread::evict(const TextureSet::iterator& it)
+{
+    if (it == m_textures.end())
+        return;
+
+    Texture* texture = *it;
+    if (texture->hasTexture())
+        m_garbage.append(ZombieTexture(texture));
+
+    texture->setTextureId(0);
+
+    m_textures.remove(it);
+}
+
+void TextureCacheCompositingThread::textureAccessed(Texture* texture)
+{
+    if (texture->isColor())
+        return;
+
+    TextureSet::iterator it = m_textures.find(texture);
+    if (it == m_textures.end())
+        return;
+
+    m_textures.remove(it);
+    m_textures.add(texture);
+}
+
+TextureCacheCompositingThread* textureCacheCompositingThread()
+{
+    static TextureCacheCompositingThread* staticCache = new TextureCacheCompositingThread;
+    return staticCache;
+}
+
+void TextureCacheCompositingThread::prune(size_t limit)
+{
+    while (m_memoryUsage > limit) {
+        bool found = false;
+        for (TextureSet::iterator it = m_textures.begin(); it != m_textures.end(); ++it) {
+            Texture* texture = *it;
+            if (texture->isProtected())
+                continue;
+            evict(it);
+            found = true;
+            break;
+        }
+        if (!found)
+            break;
+    }
+}
+
+void TextureCacheCompositingThread::clear()
+{
+    m_cache.clear();
+    m_colors.clear();
+    collectGarbage();
+}
+
+void TextureCacheCompositingThread::setMemoryUsage(size_t memoryUsage)
+{
+    m_memoryUsage = memoryUsage;
+#if DEBUG_TEXTURE_MEMORY_USAGE
+    fprintf(stderr, "Texture memory usage %u kB\n", m_memoryUsage / 1024);
+#endif
+}
+
+PassRefPtr<Texture> TextureCacheCompositingThread::textureForTiledContents(const SkBitmap& contents, const IntRect& tileRect, const TileIndex& index, bool isOpaque)
+{
+    HashMap<ContentsKey, TextureMap>::iterator it = m_cache.add(key(contents), TextureMap()).first;
+    TextureMap& map = (*it).second;
+
+    TextureMap::iterator jt = map.add(index, RefPtr<Texture>()).first;
+    RefPtr<Texture> texture = (*jt).second;
+    if (!texture) {
+        texture = createTexture();
+#if DEBUG_TEXTURE_MEMORY_USAGE
+        fprintf(stderr, "Creating texture 0x%x for 0x%x+%d @ (%d, %d)\n", texture.get(), contents.pixelRef(), contents.pixelRefOffset(), index.i(), index.j());
+#endif
+        map.set(index, texture);
+    }
+
+    // Protect newly created texture from being evicted.
+    TextureProtector protector(texture.get());
+
+    IntSize contentsSize(contents.width(), contents.height());
+    IntRect dirtyRect(IntPoint(), contentsSize);
+    if (tileRect.size() != texture->size()) {
+#if DEBUG_TEXTURE_MEMORY_USAGE
+        fprintf(stderr, "Updating texture 0x%x for 0x%x+%d @ (%d, %d)\n", texture.get(), contents.pixelRef(), contents.pixelRefOffset(), index.i(), index.j());
+#endif
+        texture->updateContents(contents, dirtyRect, tileRect, isOpaque);
+    }
+    return texture.release();
+}
+
+PassRefPtr<Texture> TextureCacheCompositingThread::textureForColor(const Color& color)
+{
+    // Just to make sure we don't get fooled by some malicious web page
+    // into caching millions of color textures.
+    if (m_colors.size() > 100)
+        m_colors.clear();
+
+    ColorTextureMap::iterator it = m_colors.find(color);
+    RefPtr<Texture> texture;
+    if (it == m_colors.end()) {
+        texture = Texture::create(true /* isColor */);
+#if DEBUG_TEXTURE_MEMORY_USAGE
+        fprintf(stderr, "Creating texture 0x%x for color 0x%x\n", texture.get(), color.rgb());
+#endif
+        m_colors.set(color, texture);
+    } else
+        texture = (*it).second;
+
+    // Color textures can't be evicted, so no need for TextureProtector.
+
+    if (texture->size() != IntSize(1, 1))
+        texture->setContentsToColor(color);
+
+    return texture.release();
+}
+
+PassRefPtr<Texture> TextureCacheCompositingThread::updateContents(const RefPtr<Texture>& textureIn, const SkBitmap& contents, const IntRect& dirtyRect, const IntRect& tileRect)
+{
+    RefPtr<Texture> texture(textureIn);
+
+    // If the texture was 0, or needs to transition from a solid color texture to a contents texture,
+    // create a new texture.
+    if (!texture || texture->isColor())
+        texture = createTexture();
+
+    // Protect newly created texture from being evicted.
+    TextureProtector protector(texture.get());
+
+    texture->updateContents(contents, dirtyRect, tileRect);
+
+    return texture.release();
+}
+
+TextureCacheCompositingThread::ContentsKey TextureCacheCompositingThread::key(const SkBitmap& contents)
+{
+    // The pixelRef is an address, and addresses can be reused by the allocator
+    // so it's unsuitable to use as a key. Instead, grab the generation, which
+    // is globally unique according to the current implementation in
+    // SkPixelRef.cpp.
+    uint32_t generation = contents.getGenerationID();
+
+    // If the generation is equal to the deleted value, use something else that
+    // is unlikely to correspond to a generation currently in use or soon to be
+    // in use.
+    uint32_t deletedValue = 0;
+    HashTraits<uint32_t>::constructDeletedValue(deletedValue);
+    if (generation == deletedValue) {
+        // This strategy works as long as the deleted value is -1.
+        ASSERT(deletedValue == static_cast<uint32_t>(-1));
+        generation = deletedValue / 2;
+    }
+
+    // Now the generation alone does not uniquely identify the texture contents.
+    // The same pixelref can be reused in another bitmap but with a different
+    // offset (somewhat contrived, but possible).
+    return std::make_pair(generation, contents.pixelRefOffset());
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/graphics/blackberry/TextureCacheCompositingThread.h b/Source/WebCore/platform/graphics/blackberry/TextureCacheCompositingThread.h
new file mode 100644
index 000000000..82905b991
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/TextureCacheCompositingThread.h
@@ -0,0 +1,145 @@
+/*
+ * Copyright (C) 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef TextureCacheCompositingThread_h
+#define TextureCacheCompositingThread_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "Color.h"
+#include "LayerTileIndex.h"
+#include "Texture.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/ListHashSet.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class IntRect;
+
+// A LRU cache for OpenGL textures.
+class TextureCacheCompositingThread {
+    WTF_MAKE_NONCOPYABLE(TextureCacheCompositingThread);
+    WTF_MAKE_FAST_ALLOCATED;
+public:
+    friend TextureCacheCompositingThread* textureCacheCompositingThread();
+
+    // Creates a new texture managed by this cache.
+    PassRefPtr<Texture> createTexture()
+    {
+        return Texture::create();
+    }
+
+    // Retrieve a texture from the cache.
+    PassRefPtr<Texture> textureForTiledContents(const SkBitmap& contents, const IntRect& tileRect, const TileIndex&, bool isOpaque);
+    PassRefPtr<Texture> textureForColor(const Color&);
+
+    // Update contents of an existing texture, or create a new one if texture is 0.
+    PassRefPtr<Texture> updateContents(const RefPtr<Texture>&, const SkBitmap& contents, const IntRect& dirtyRect, const IntRect& tileRect);
+
+    size_t memoryUsage() const { return m_memoryUsage; }
+    size_t memoryLimit() const { return m_memoryLimit; }
+    void setMemoryLimit(size_t limit) { m_memoryLimit = limit; }
+
+    // Evict unprotected textures until we reach the limit provided.
+    void prune(size_t limit);
+    void prune() { prune(memoryLimit()); }
+
+    // Evict all textures from the cache.
+    void clear();
+
+    // Update the LRU list.
+    void textureAccessed(Texture*);
+
+    // Deleting destroyed textures is provided as a separate method, because
+    // there might not be an OpenGL context current when the texture destructor
+    // was called. Calling this makes sure to free any such textures.
+    void collectGarbage();
+
+    void textureDestroyed(Texture*);
+    void textureResized(Texture*, const IntSize& oldSize);
+
+    // Undo the effects of eviction, if possible.
+    bool install(Texture*);
+
+private:
+    struct ZombieTexture {
+        explicit ZombieTexture(Texture* texture)
+            : id(texture->textureId())
+            , size(texture->size())
+        {
+        }
+
+        unsigned id;
+        IntSize size;
+    };
+    typedef ListHashSet<Texture* > TextureSet;
+    typedef std::pair<uint32_t, size_t> ContentsKey;
+    typedef HashMap<TileIndex, RefPtr<Texture> > TextureMap;
+    typedef Vector<ZombieTexture> Garbage;
+
+    TextureCacheCompositingThread();
+    ~TextureCacheCompositingThread();
+
+    unsigned allocateTextureId();
+    void freeTextureId(unsigned id);
+
+    void incMemoryUsage(int delta) { setMemoryUsage(memoryUsage() + delta); }
+    void decMemoryUsage(int delta) { setMemoryUsage(memoryUsage() - delta); }
+    void setMemoryUsage(size_t);
+
+    ContentsKey key(const SkBitmap& contents);
+
+    void evict(const TextureSet::iterator&);
+
+    // LRU set of weak pointers to textures.
+    TextureSet m_textures;
+    size_t m_memoryUsage;
+    size_t m_memoryLimit;
+
+    // Map of refCounted pointers to textures.
+    HashMap<ContentsKey, TextureMap> m_cache;
+    struct ColorHash {
+        static unsigned hash(const Color& key) { return WTF::intHash(key.rgb()); }
+        static bool equal(const Color& a, const Color& b) { return a == b; }
+        static const bool safeToCompareToEmptyOrDeleted = true;
+    };
+    struct ColorHashTraits : WTF::GenericHashTraits<Color> {
+        static const bool emptyValueIsZero = true;
+        // The deleted value is an invalid color with an RGB value of 0xFFFFFFFF.
+        // Such values do not naturally occur as colors.
+        // And empty value is an invalid color with an RGB value of 0x0.
+        static void constructDeletedValue(Color& slot) { new (&slot) Color(); *reinterpret_cast<RGBA32*>(&slot) = Color::white; }
+        static bool isDeletedValue(const Color& value) { return !value.isValid() && value.rgb() == Color::white; }
+    };
+    typedef HashMap<Color, RefPtr<Texture>, ColorHash, ColorHashTraits> ColorTextureMap;
+    ColorTextureMap m_colors;
+    Garbage m_garbage;
+};
+
+TextureCacheCompositingThread* textureCacheCompositingThread();
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif // TextureCacheCompositingThread_h
diff --git a/Source/WebCore/platform/graphics/blackberry/VideoLayerWebKitThread.cpp b/Source/WebCore/platform/graphics/blackberry/VideoLayerWebKitThread.cpp
new file mode 100644
index 000000000..7492871d2
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/VideoLayerWebKitThread.cpp
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING) && ENABLE(VIDEO)
+#include "VideoLayerWebKitThread.h"
+
+#include "FrameView.h"
+#include "LayerCompositingThread.h"
+#include "MediaPlayer.h"
+
+#include <BlackBerryPlatformLog.h>
+
+#define DEBUG_VIDEO_CLIPPING 0
+
+namespace WebCore {
+
+VideoLayerWebKitThread::VideoLayerWebKitThread(MediaPlayer* mediaPlayer)
+    : LayerWebKitThread(Layer, 0)
+{
+    setMediaPlayer(mediaPlayer);
+}
+
+VideoLayerWebKitThread::~VideoLayerWebKitThread()
+{
+}
+
+void VideoLayerWebKitThread::setMediaPlayer(MediaPlayer* mediaPlayer)
+{
+    m_mediaPlayer = mediaPlayer;
+
+    // This is a bit of a misnomer, since we don't need an actual GL texture.
+    // However, the LayerRenderer will only process layers that "need textures"
+    setNeedsTexture(isDrawable() && (contents() || drawsContent() || this->mediaPlayer()));
+
+    if (!m_mediaPlayer) {
+        // We can't afford to wait until the next commit to set the m_mediaPlayer
+        // to 0 in the impl, because it is about to be destroyed.
+        layerCompositingThread()->setMediaPlayer(0);
+
+        // Clear hole punch rect.
+        setHolePunchRect(IntRect());
+    }
+
+    setNeedsCommit();
+}
+
+void VideoLayerWebKitThread::setHolePunchRect(const IntRect& rect)
+{
+    m_holePunchRect = rect;
+#if DEBUG_VIDEO_CLIPPING
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelInfo, "VideoLayerWebKitThread m_holePunchRect=(x=%d,y=%d,width=%d,height=%d).", m_holePunchRect.x(), m_holePunchRect.y(), m_holePunchRect.width(), m_holePunchRect.height());
+#endif
+    setNeedsCommit();
+}
+
+void VideoLayerWebKitThread::setNeedsDisplay()
+{
+    // We don't really need display per se, but some code may depend on
+    // setNeedsDisplay() to call setNeedsCommit()
+    setNeedsCommit();
+}
+
+void VideoLayerWebKitThread::boundsChanged()
+{
+    if (!mediaPlayer())
+        return;
+
+    // For video layers, the entire layer should be hole punched
+    // Hole punch rectangle size is equal to the size of this layer.
+    // Note that although we know the *size* of this layer, we won't know the position of this layer
+    // until the LayerCompositingThread::setDrawTransform method is called from the LayerRenderer.
+    setHolePunchRect(IntRect(IntPoint::zero(), m_bounds));
+
+    // Also set a clipping rectangle for this hole punch rectangle.
+    if (FrameView* frameView = mediaPlayer()->frameView())
+        m_holePunchClipRect = frameView->windowClipRect();
+    else
+        m_holePunchClipRect = holePunchRect();
+
+#if DEBUG_VIDEO_CLIPPING
+    BlackBerry::Platform::log(BlackBerry::Platform::LogLevelInfo, "VideoLayerWebKitThread m_holePunchClipRect=(x=%d,y=%d,width=%d,height=%d).", m_holePunchClipRect.x(), m_holePunchClipRect.y(), m_holePunchClipRect.width(), m_holePunchClipRect.height());
+#endif
+}
+
+void VideoLayerWebKitThread::updateTextureContentsIfNeeded()
+{
+    // There are no texture contents, video is shown in a special screen window
+    // behind the web page.
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING) && ENABLE(VIDEO)
diff --git a/Source/WebCore/platform/graphics/blackberry/VideoLayerWebKitThread.h b/Source/WebCore/platform/graphics/blackberry/VideoLayerWebKitThread.h
new file mode 100644
index 000000000..e64732a9b
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/VideoLayerWebKitThread.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef VideoLayerWebKitThread_h
+#define VideoLayerWebKitThread_h
+
+#if USE(ACCELERATED_COMPOSITING) && ENABLE(VIDEO)
+
+#include "LayerWebKitThread.h"
+
+namespace WebCore {
+
+class MediaPlayer;
+
+class VideoLayerWebKitThread : public LayerWebKitThread {
+public:
+    static PassRefPtr<VideoLayerWebKitThread> create(MediaPlayer* mediaPlayer)
+    {
+        return adoptRef(new VideoLayerWebKitThread(mediaPlayer));
+    }
+
+    virtual ~VideoLayerWebKitThread();
+
+    void setMediaPlayer(MediaPlayer*);
+
+    virtual void setNeedsDisplay();
+
+protected:
+    void setHolePunchRect(const IntRect&);
+
+    virtual void boundsChanged();
+    virtual void updateTextureContentsIfNeeded();
+
+private:
+    VideoLayerWebKitThread(MediaPlayer*);
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING) && ENABLE(VIDEO)
+
+#endif // VideoLayerWebKitThread_h
diff --git a/Source/WebCore/platform/graphics/blackberry/WebGLLayerWebKitThread.cpp b/Source/WebCore/platform/graphics/blackberry/WebGLLayerWebKitThread.cpp
new file mode 100644
index 000000000..a26f5ffee
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/WebGLLayerWebKitThread.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "WebGLLayerWebKitThread.h"
+
+#if USE(ACCELERATED_COMPOSITING) && ENABLE(WEBGL)
+
+#include "GraphicsContext3D.h"
+#include <pthread.h>
+
+namespace WebCore {
+
+WebGLLayerWebKitThread::WebGLLayerWebKitThread()
+    : LayerWebKitThread(WebGLLayer, 0)
+    , m_webGLContext(0)
+    , m_needsDisplay(false)
+{
+    setLayerProgramShader(LayerProgramShaderRGBA);
+}
+
+WebGLLayerWebKitThread::~WebGLLayerWebKitThread()
+{
+    if (m_frontBufferLock)
+        pthread_mutex_destroy(m_frontBufferLock);
+}
+
+void WebGLLayerWebKitThread::setNeedsDisplay()
+{
+    m_needsDisplay = true;
+    setNeedsCommit();
+}
+
+void WebGLLayerWebKitThread::updateTextureContentsIfNeeded()
+{
+    // FIXME: Does WebGLLayer always need display? Or can we just return immediately if (!m_needsDisplay)?
+    m_needsDisplay = false;
+
+    if (!m_frontBufferLock)
+        createFrontBufferLock();
+
+    // Lock copied GL texture so that the UI thread won't access it while we are drawing into it.
+    pthread_mutex_lock(m_frontBufferLock);
+    m_webGLContext->prepareTexture();
+    pthread_mutex_unlock(m_frontBufferLock);
+}
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING) && ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/blackberry/WebGLLayerWebKitThread.h b/Source/WebCore/platform/graphics/blackberry/WebGLLayerWebKitThread.h
new file mode 100644
index 000000000..6bcb48658
--- /dev/null
+++ b/Source/WebCore/platform/graphics/blackberry/WebGLLayerWebKitThread.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2010, 2011, 2012 Research In Motion Limited. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef WebGLLayerWebKitThread_h
+#define WebGLLayerWebKitThread_h
+
+#if USE(ACCELERATED_COMPOSITING) && ENABLE(WEBGL)
+
+#include "LayerWebKitThread.h"
+
+namespace WebCore {
+
+class GraphicsContext3D;
+
+class WebGLLayerWebKitThread : public LayerWebKitThread {
+public:
+    static PassRefPtr<WebGLLayerWebKitThread> create()
+    {
+        return adoptRef(new WebGLLayerWebKitThread());
+    }
+
+    virtual ~WebGLLayerWebKitThread();
+
+    void setWebGLContext(GraphicsContext3D* context) { m_webGLContext = context; }
+
+    virtual void setNeedsDisplay();
+
+protected:
+    virtual void updateTextureContentsIfNeeded();
+
+private:
+    WebGLLayerWebKitThread();
+
+    GraphicsContext3D* m_webGLContext;
+    bool m_needsDisplay;
+};
+
+} // namespace WebCore
+
+#endif // USE(ACCELERATED_COMPOSITING) && ENABLE(WEBGL)
+
+#endif // WebGLLayerWebKitThread_h
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
index f6e714b2a..47235367c 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.cpp
@@ -243,6 +243,18 @@ static bool animationHasStepsTimingFunction(const KeyframeValueList& valueList,
     return false;
 }
 
+#if ENABLE(CSS_FILTERS)
+static inline bool supportsAcceleratedFilterAnimations()
+{
+// <rdar://problem/10907251> - WebKit2 doesn't support CA animations of CI filters on Lion and below
+#if !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
+    return true;
+#else
+    return false;
+#endif
+}
+#endif
+
 PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
 {
     return adoptPtr(new GraphicsLayerCA(client));
@@ -661,8 +673,10 @@ bool GraphicsLayerCA::addAnimation(const KeyframeValueList& valueList, const Int
     if (valueList.property() == AnimatedPropertyWebkitTransform)
         createdAnimations = createTransformAnimationsFromKeyframes(valueList, anim, animationName, timeOffset, boxSize);
 #if ENABLE(CSS_FILTERS)
-    else if (valueList.property() == AnimatedPropertyWebkitFilter)
-        createdAnimations = createFilterAnimationsFromKeyframes(valueList, anim, animationName, timeOffset);
+    else if (valueList.property() == AnimatedPropertyWebkitFilter) {
+        if (supportsAcceleratedFilterAnimations())
+            createdAnimations = createFilterAnimationsFromKeyframes(valueList, anim, animationName, timeOffset);
+    }
 #endif
     else
         createdAnimations = createAnimationFromKeyframes(valueList, anim, animationName, timeOffset);
@@ -859,9 +873,9 @@ void GraphicsLayerCA::syncCompositingStateForThisLayerOnly()
     commitLayerChangesAfterSublayers();
 }
 
-void GraphicsLayerCA::visibleRectChanged()
+void GraphicsLayerCA::visibleRectChanged(const IntRect& visibleRect)
 {
-    m_layer->visibleRectChanged();
+    m_layer->visibleRectChanged(visibleRect);
 }
 
 void GraphicsLayerCA::recursiveCommitChanges(const TransformState& state, float pageScaleFactor, const FloatPoint& positionRelativeToBase, bool affectedByPageScale)
@@ -1763,7 +1777,7 @@ void GraphicsLayerCA::updateContentsNeedsDisplay()
 
 bool GraphicsLayerCA::createAnimationFromKeyframes(const KeyframeValueList& valueList, const Animation* animation, const String& animationName, double timeOffset)
 {
-    ASSERT(valueList.property() != AnimatedPropertyWebkitTransform && valueList.property() != AnimatedPropertyWebkitFilter);
+    ASSERT(valueList.property() != AnimatedPropertyWebkitTransform && (!supportsAcceleratedFilterAnimations() || valueList.property() != AnimatedPropertyWebkitFilter));
     
     bool isKeyframe = valueList.size() > 2;
     bool valuesOK;
diff --git a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
index 77dafc523..cce1ffd06 100644
--- a/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
+++ b/Source/WebCore/platform/graphics/ca/GraphicsLayerCA.h
@@ -103,6 +103,7 @@ public:
 
     virtual void setNeedsDisplay();
     virtual void setNeedsDisplayInRect(const FloatRect&);
+    virtual bool needsDisplay() const OVERRIDE { return !m_dirtyRects.isEmpty(); }
     virtual void setContentsNeedsDisplay();
     
     virtual void setContentsRect(const IntRect&);
@@ -134,7 +135,7 @@ public:
     virtual void syncCompositingState(const FloatRect&);
     virtual void syncCompositingStateForThisLayerOnly();
 
-    virtual void visibleRectChanged() OVERRIDE;
+    virtual void visibleRectChanged(const IntRect&) OVERRIDE;
 
     bool allowTiledLayer() const { return m_allowTiledLayer; }
     virtual void setAllowTiledLayer(bool b);
diff --git a/Source/WebCore/platform/graphics/ca/PlatformCALayer.h b/Source/WebCore/platform/graphics/ca/PlatformCALayer.h
index 582a0f74a..3aff7c261 100644
--- a/Source/WebCore/platform/graphics/ca/PlatformCALayer.h
+++ b/Source/WebCore/platform/graphics/ca/PlatformCALayer.h
@@ -203,7 +203,7 @@ public:
     float contentsScale() const;
     void setContentsScale(float);
 
-    void visibleRectChanged();
+    void visibleRectChanged(const IntRect&);
 
 #if PLATFORM(WIN)
     HashMap<String, RefPtr<PlatformCAAnimation> >& animations() { return m_animations; }
diff --git a/Source/WebCore/platform/graphics/ca/mac/PlatformCALayerMac.mm b/Source/WebCore/platform/graphics/ca/mac/PlatformCALayerMac.mm
index c52f20dd9..e124a1647 100644
--- a/Source/WebCore/platform/graphics/ca/mac/PlatformCALayerMac.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/PlatformCALayerMac.mm
@@ -956,13 +956,13 @@ void PlatformCALayer::setContentsScale(float value)
 #endif
 }
 
-void PlatformCALayer::visibleRectChanged()
+void PlatformCALayer::visibleRectChanged(const IntRect& visibleRect)
 {
     if (m_layerType != LayerTypeTileCacheLayer)
         return;
 
     WebTileCacheLayer *tileCacheLayer = static_cast<WebTileCacheLayer *>(m_layer.get());
-    [tileCacheLayer visibleRectChanged];
+    [tileCacheLayer visibleRectChanged:visibleRect];
 }
 
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
diff --git a/Source/WebCore/platform/graphics/ca/mac/TileCache.h b/Source/WebCore/platform/graphics/ca/mac/TileCache.h
index 675b85af6..714d3c90b 100644
--- a/Source/WebCore/platform/graphics/ca/mac/TileCache.h
+++ b/Source/WebCore/platform/graphics/ca/mac/TileCache.h
@@ -56,13 +56,14 @@ public:
     void setNeedsDisplay();
     void setNeedsDisplayInRect(const IntRect&);
     void drawLayer(WebTileLayer*, CGContextRef);
-    void setContentsScale(CGFloat);
+
+    void setScale(CGFloat);
 
     bool acceleratesDrawing() const { return m_acceleratesDrawing; }
     void setAcceleratesDrawing(bool);
 
     CALayer *tileContainerLayer() const { return m_tileContainerLayer.get(); }
-    void visibleRectChanged();
+    void visibleRectChanged(const IntRect&);
 
     float tileDebugBorderWidth() const { return m_tileDebugBorderWidth; }
     void setTileDebugBorderWidth(float);
@@ -75,7 +76,6 @@ private:
 
     TileCache(WebTileCacheLayer*, const IntSize& tileSize);
 
-    FloatRect visibleRect() const;
     IntRect bounds() const;
 
     IntRect rectForTileIndex(const TileIndex&) const;
@@ -93,12 +93,15 @@ private:
     WebTileCacheLayer* m_tileCacheLayer;
     RetainPtr<CALayer> m_tileContainerLayer;
     const IntSize m_tileSize;
+    IntRect m_visibleRect;
 
     typedef HashMap<TileIndex, RetainPtr<WebTileLayer> > TileMap;
     TileMap m_tiles;
     Timer<TileCache> m_tileRevalidationTimer;
     IntRect m_tileCoverageRect;
 
+    CGFloat m_scale;
+
     bool m_acceleratesDrawing;
 
     RetainPtr<CGColorRef> m_tileDebugBorderColor;
diff --git a/Source/WebCore/platform/graphics/ca/mac/TileCache.mm b/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
index a74ff7215..fbb5ddc71 100644
--- a/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/TileCache.mm
@@ -54,6 +54,7 @@ TileCache::TileCache(WebTileCacheLayer* tileCacheLayer, const IntSize& tileSize)
     , m_tileContainerLayer(adoptCF([[CALayer alloc] init]))
     , m_tileSize(tileSize)
     , m_tileRevalidationTimer(this, &TileCache::tileRevalidationTimerFired)
+    , m_scale(1)
     , m_acceleratesDrawing(false)
     , m_tileDebugBorderWidth(0)
 {
@@ -90,10 +91,13 @@ void TileCache::setNeedsDisplayInRect(const IntRect& rect)
     if (m_tiles.isEmpty())
         return;
 
+    FloatRect scaledRect(rect);
+    scaledRect.scale(m_scale);
+
     // Find the tiles that need to be invalidated.
     TileIndex topLeft;
     TileIndex bottomRight;
-    getTileIndexRangeForRect(intersection(rect, m_tileCoverageRect), topLeft, bottomRight);
+    getTileIndexRangeForRect(intersection(enclosingIntRect(scaledRect), m_tileCoverageRect), topLeft, bottomRight);
 
     for (int y = topLeft.y(); y <= bottomRight.y(); ++y) {
         for (int x = topLeft.x(); x <= bottomRight.x(); ++x) {
@@ -126,6 +130,7 @@ void TileCache::drawLayer(WebTileLayer* layer, CGContextRef context)
 
     CGPoint layerOrigin = [layer frame].origin;
     CGContextTranslateCTM(context, -layerOrigin.x, -layerOrigin.y);
+    CGContextScaleCTM(context, m_scale, m_scale);
     drawLayerContents(context, layer, platformLayer);
 
     CGContextRestoreGState(context);
@@ -162,19 +167,22 @@ void TileCache::drawLayer(WebTileLayer* layer, CGContextRef context)
     CGContextRestoreGState(context);
 }
 
-void TileCache::setContentsScale(CGFloat contentsScale)
+void TileCache::setScale(CGFloat scale)
 {
+    if (m_scale == scale)
+        return;
+
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-    for (TileMap::const_iterator it = m_tiles.begin(), end = m_tiles.end(); it != end; ++it) {
-        [it->second.get() setContentsScale:contentsScale];
+    m_scale = scale;
+    [m_tileContainerLayer.get() setTransform:CATransform3DMakeScale(1 / m_scale, 1 / m_scale, 1)];
+
+    revalidateTiles();
+
+    for (TileMap::const_iterator it = m_tiles.begin(), end = m_tiles.end(); it != end; ++it)
         [it->second.get() setNeedsDisplay];
-    }
 
     PlatformCALayer* platformLayer = PlatformCALayer::platformCALayer(m_tileCacheLayer);
     platformLayer->owner()->platformCALayerDidCreateTiles();
-    revalidateTiles();
-#else
-    UNUSED_PARAM(contentsScale);
 #endif
 }
 
@@ -193,9 +201,13 @@ void TileCache::setAcceleratesDrawing(bool acceleratesDrawing)
 #endif
 }
 
-void TileCache::visibleRectChanged()
+void TileCache::visibleRectChanged(const IntRect& visibleRect)
 {
-    scheduleTileRevalidation();
+    if (m_visibleRect == visibleRect)
+        return;
+
+    m_visibleRect = visibleRect;
+    revalidateTiles();
 }
 
 void TileCache::setTileDebugBorderWidth(float borderWidth)
@@ -218,28 +230,6 @@ void TileCache::setTileDebugBorderColor(CGColorRef borderColor)
         [it->second.get() setBorderColor:m_tileDebugBorderColor.get()];
 }
 
-FloatRect TileCache::visibleRect() const
-{
-    CGRect rect = [m_tileCacheLayer bounds];
-
-    CALayer *layer = m_tileCacheLayer;
-    CALayer *superlayer = [layer superlayer];
-
-    while (superlayer) {
-        CGRect rectInSuperlayerCoordinates = [superlayer convertRect:rect fromLayer:layer];
-
-        if ([superlayer masksToBounds])
-            rect = CGRectIntersection([superlayer bounds], rectInSuperlayerCoordinates);
-        else
-            rect = rectInSuperlayerCoordinates;
-
-        layer = superlayer;
-        superlayer = [layer superlayer];
-    }
-
-    return [m_tileCacheLayer convertRect:rect fromLayer:layer];
-}
-
 IntRect TileCache::bounds() const
 {
     return IntRect(IntPoint(), IntSize([m_tileCacheLayer bounds].size));
@@ -252,7 +242,9 @@ IntRect TileCache::rectForTileIndex(const TileIndex& tileIndex) const
 
 void TileCache::getTileIndexRangeForRect(const IntRect& rect, TileIndex& topLeft, TileIndex& bottomRight)
 {
-    IntRect clampedRect = intersection(rect, bounds());
+    IntRect clampedRect = bounds();
+    clampedRect.scale(m_scale);
+    clampedRect.intersect(rect);
 
     topLeft.setX(max(clampedRect.x() / m_tileSize.width(), 0));
     topLeft.setY(max(clampedRect.y() / m_tileSize.height(), 0));
@@ -275,10 +267,17 @@ void TileCache::tileRevalidationTimerFired(Timer<TileCache>*)
 
 void TileCache::revalidateTiles()
 {
-    IntRect tileCoverageRect = enclosingIntRect(visibleRect());
-    if (tileCoverageRect.isEmpty())
+    // If the underlying PlatformLayer has been destroyed, but the WebTileCacheLayer hasn't
+    // platformLayer will be null here.
+    PlatformCALayer* platformLayer = PlatformCALayer::platformCALayer(m_tileCacheLayer);
+    if (!platformLayer)
         return;
 
+    if (m_visibleRect.isEmpty() || bounds().isEmpty())
+        return;
+
+    IntRect tileCoverageRect = m_visibleRect;
+
     // Inflate the coverage rect so that it covers 2x of the visible width and 3x of the visible height.
     // These values were chosen because it's more common to have tall pages and to scroll vertically,
     // so we keep more tiles above and below the current area.
@@ -343,7 +342,6 @@ void TileCache::revalidateTiles()
     if (!didCreateNewTiles)
         return;
 
-    PlatformCALayer* platformLayer = PlatformCALayer::platformCALayer(m_tileCacheLayer);
     platformLayer->owner()->platformCALayerDidCreateTiles();
 }
 
@@ -363,7 +361,6 @@ RetainPtr<WebTileLayer> TileCache::createTileLayer()
     [layer.get() setEdgeAntialiasingMask:0];
 
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-    [layer.get() setContentsScale:[m_tileCacheLayer contentsScale]];
     [layer.get() setAcceleratesDrawing:m_acceleratesDrawing];
 #endif
 
diff --git a/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.h b/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.h
index 5dc64983e..208884bf7 100644
--- a/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.h
+++ b/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.h
@@ -27,6 +27,7 @@
 #import <wtf/OwnPtr.h>
 
 namespace WebCore {
+    class IntRect;
     class TileCache;
 }
 
@@ -35,6 +36,6 @@ namespace WebCore {
 }
 
 - (CALayer *)tileContainerLayer;
-- (void)visibleRectChanged;
+- (void)visibleRectChanged:(const WebCore::IntRect&)visibleRect;
 
 @end
diff --git a/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm b/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
index f992c270c..83abb72a8 100644
--- a/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
+++ b/Source/WebCore/platform/graphics/ca/mac/WebTileCacheLayer.mm
@@ -58,6 +58,22 @@ using namespace WebCore;
     [super dealloc];
 }
 
+- (id)initWithLayer:(id)layer
+{
+    UNUSED_PARAM(layer);
+
+    ASSERT_NOT_REACHED();
+    return nil;
+}
+
+- (id<CAAction>)actionForKey:(NSString *)key
+{
+    UNUSED_PARAM(key);
+    
+    // Disable all animations.
+    return nil;
+}
+
 - (void)setBounds:(CGRect)bounds
 {
     [super setBounds:bounds];
@@ -87,16 +103,7 @@ using namespace WebCore;
 
 - (void)setContentsScale:(CGFloat)contentsScale
 {
-#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-    CGFloat oldContentsScale = [self contentsScale];
-
-    [super setContentsScale:contentsScale];
-
-    if (contentsScale != oldContentsScale)
-        _tileCache->setContentsScale(contentsScale);
-#else
-    UNUSED_PARAM(contentsScale);
-#endif
+    _tileCache->setScale(contentsScale);
 }
 
 - (CALayer *)tileContainerLayer
@@ -104,9 +111,9 @@ using namespace WebCore;
     return _tileCache->tileContainerLayer();
 }
 
-- (void)visibleRectChanged
+- (void)visibleRectChanged:(const IntRect&)visibleRect
 {
-    _tileCache->visibleRectChanged();
+    _tileCache->visibleRectChanged(visibleRect);
 }
 
 - (CGColorRef)borderColor
diff --git a/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp b/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
index 633d4e321..ca73001d5 100644
--- a/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
+++ b/Source/WebCore/platform/graphics/ca/win/PlatformCALayerWin.cpp
@@ -633,7 +633,7 @@ void PlatformCALayer::setContentsScale(float)
 {
 }
 
-void PlatformCALayer::visibleRectChanged()
+void PlatformCALayer::visibleRectChanged(const IntRect&)
 {
 }
 
diff --git a/Source/WebCore/platform/graphics/cairo/GLContext.h b/Source/WebCore/platform/graphics/cairo/GLContext.h
new file mode 100644
index 000000000..0a39cec58
--- /dev/null
+++ b/Source/WebCore/platform/graphics/cairo/GLContext.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2012 Igalia S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free
+ *  Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301 USA
+ */
+
+#ifndef GLContext_h
+#define GLContext_h
+
+#include "GraphicsContext3D.h"
+#include "Widget.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/PassOwnPtr.h>
+
+#if defined(XP_UNIX)
+typedef struct __GLXcontextRec* GLXContext;
+typedef struct _XDisplay Display;
+typedef struct __GLXcontextRec *GLXContext;
+typedef unsigned long GLXPbuffer;
+typedef unsigned long GLXPixmap;
+typedef unsigned char GLubyte;
+typedef unsigned long Pixmap;
+typedef unsigned long XID;
+typedef void* ContextKeyType;
+#endif
+
+namespace WebCore {
+
+class GLContext {
+    WTF_MAKE_NONCOPYABLE(GLContext);
+public:
+    static GLContext* createSharingContext(GLContext* shareContext);
+    static GLContext* getContextForWidget(PlatformWidget);
+    static GLContext* getCurrent();
+    static void removeActiveContext(GLContext*);
+    static void removeActiveContextForWidget(PlatformWidget);
+
+    virtual ~GLContext();
+    bool makeContextCurrent();
+    void swapBuffers();
+    bool canRenderToDefaultFramebuffer();
+
+#if ENABLE(WEBGL)
+    PlatformGraphicsContext3D platformContext();
+#endif
+
+private:
+    static void addActiveContext(GLContext*);
+    static void cleanupActiveContextsAtExit();
+
+#if defined(XP_UNIX)
+    GLContext(GLXContext);
+    GLContext(GLXContext, Pixmap, GLXPixmap);
+    static GLContext* createContext(XID, GLXContext sharingContext = 0);
+    static GLContext* createWindowContext(XID window, GLXContext sharingContext);
+    static GLContext* createPbufferContext(GLXContext sharingContext);
+    static GLContext* createPixmapContext(GLXContext sharingContext);
+
+    GLXContext m_context;
+    Display* m_display;
+
+    XID m_window;
+    GLXPbuffer m_pbuffer;
+    Pixmap m_pixmap;
+    GLXPixmap m_glxPixmap;
+#endif
+};
+
+}
+
+#endif // GLContext_h
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
index f542fb9ed..ad7db41d3 100644
--- a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DCairo.cpp
@@ -27,7 +27,6 @@
 
 #include "config.h"
 #include "GraphicsContext3D.h"
-#include "PlatformContextCairo.h"
 
 #if ENABLE(WEBGL)
 
@@ -35,9 +34,12 @@
 #include "GraphicsContext3DPrivate.h"
 #include "Image.h"
 #include "OpenGLShims.h"
+#include "PlatformContextCairo.h"
 #include "RefPtrCairo.h"
 #include "ShaderLang.h"
 #include <cairo.h>
+#include <wtf/NotFound.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
@@ -48,16 +50,20 @@ PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attri
     if (renderStyle == RenderDirectlyToHostWindow)
         return 0;
 
-    OwnPtr<GraphicsContext3DPrivate> priv = GraphicsContext3DPrivate::create();
-    if (!priv)
+    static bool initialized = false;
+    static bool success = true;
+    if (!initialized) {
+        success = initializeOpenGLShims();
+        initialized = true;
+    }
+    if (!success)
         return 0;
 
     RefPtr<GraphicsContext3D> context = adoptRef(new GraphicsContext3D(attributes, hostWindow, false));
-    context->m_private = priv.release();
     return context.release();
 }
 
-GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attributes, HostWindow*, bool)
+GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attributes, HostWindow* hostWindow, bool)
     : m_currentWidth(0)
     , m_currentHeight(0)
     , m_attrs(attributes)
@@ -68,8 +74,9 @@ GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attributes, H
     , m_multisampleFBO(0)
     , m_multisampleDepthStencilBuffer(0)
     , m_multisampleColorBuffer(0)
+    , m_private(GraphicsContext3DPrivate::create(this, hostWindow))
 {
-    GraphicsContext3DPrivate::addActiveGraphicsContext(this);
+    makeContextCurrent();
 
     validateAttributes();
 
@@ -123,10 +130,6 @@ GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attributes, H
 
 GraphicsContext3D::~GraphicsContext3D()
 {
-    GraphicsContext3DPrivate::removeActiveGraphicsContext(this);
-    if (!m_private->m_context)
-        return;
-
     makeContextCurrent();
     ::glDeleteTextures(1, &m_texture);
     if (m_attrs.antialias) {
@@ -228,10 +231,9 @@ bool GraphicsContext3D::makeContextCurrent()
         return false;
     return m_private->makeContextCurrent();
 }
-
 PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D()
 {
-    return m_private->m_context;
+    return m_private->platformContext();
 }
 
 bool GraphicsContext3D::isGLES2Compliant() const
@@ -242,7 +244,7 @@ bool GraphicsContext3D::isGLES2Compliant() const
 #if USE(ACCELERATED_COMPOSITING)
 PlatformLayer* GraphicsContext3D::platformLayer() const
 {
-    return 0;
+    return m_private.get();
 }
 #endif
 
diff --git a/Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.cpp b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.cpp
new file mode 100644
index 000000000..69eef6efc
--- /dev/null
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2011, 2012 Igalia S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free
+ *  Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301 USA
+ */
+
+#include "config.h"
+#include "GraphicsContext3DPrivate.h"
+
+#if ENABLE(WEBGL)
+
+#include "HostWindow.h"
+#include "NotImplemented.h"
+
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER) && USE(TEXTURE_MAPPER_GL)
+#include <texmap/TextureMapperGL.h>
+#endif
+
+namespace WebCore {
+
+PassOwnPtr<GraphicsContext3DPrivate> GraphicsContext3DPrivate::create(GraphicsContext3D* context, HostWindow* window)
+{
+    return adoptPtr(new GraphicsContext3DPrivate(context, window));
+}
+
+GraphicsContext3DPrivate::GraphicsContext3DPrivate(GraphicsContext3D* context, HostWindow* window)
+    : m_context(context)
+    , m_window(window)
+#if PLATFORM(GTK)
+    , m_glContext(GLContext::createSharingContext(GLContext::getContextForWidget(m_window->platformPageClient())))
+#else
+    , m_glContext(GLContext::createContext(0, 0))
+#endif
+{
+}
+
+GraphicsContext3DPrivate::~GraphicsContext3DPrivate()
+{
+    GLContext::removeActiveContext(m_glContext);
+}
+
+bool GraphicsContext3DPrivate::makeContextCurrent()
+{
+    return m_glContext ? m_glContext->makeContextCurrent() : false;
+}
+
+PlatformGraphicsContext3D GraphicsContext3DPrivate::platformContext()
+{
+    return m_glContext ? m_glContext->platformContext() : 0;
+}
+
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+void GraphicsContext3DPrivate::paintToTextureMapper(TextureMapper* textureMapper, const FloatRect& targetRect, const TransformationMatrix& matrix, float opacity, BitmapTexture* mask)
+{
+    if (!m_glContext)
+        return;
+
+    if (textureMapper->accelerationMode() != TextureMapper::OpenGLMode) {
+        notImplemented();
+        return;
+    }
+
+    if (m_context->m_attrs.antialias && m_context->m_boundFBO == m_context->m_multisampleFBO) {
+        GLContext* previousActiveContext = GLContext::getCurrent();
+
+        if (previousActiveContext != m_glContext)
+            m_context->makeContextCurrent();
+
+        m_context->resolveMultisamplingIfNecessary();
+
+        if (previousActiveContext && previousActiveContext != m_glContext)
+            previousActiveContext->makeContextCurrent();
+    }
+
+    TextureMapperGL* texmapGL = static_cast<TextureMapperGL*>(textureMapper);
+    TextureMapperGL::Flags flags = TextureMapperGL::ShouldFlipTexture | (m_context->m_attrs.alpha ? TextureMapperGL::SupportsBlending : 0);
+    texmapGL->drawTexture(m_context->m_texture, flags, FloatSize(1, 1), targetRect, matrix, opacity, mask);
+}
+#endif // USE(ACCELERATED_COMPOSITING)
+
+} // namespace WebCore
+
+#endif // ENABLE_WEBGL
diff --git a/Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.h b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.h
index 33a500d0a..717fd1d8d 100644
--- a/Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.h
+++ b/Source/WebCore/platform/graphics/cairo/GraphicsContext3DPrivate.h
@@ -20,39 +20,37 @@
 #ifndef GraphicsContext3DPrivate_h
 #define GraphicsContext3DPrivate_h
 
+#include "GLContext.h"
+#include "GraphicsContext3D.h"
 #include <wtf/PassOwnPtr.h>
 
-typedef struct __GLXcontextRec *GLXContext;
-typedef unsigned long GLXPbuffer;
-typedef unsigned long GLXPixmap;
-typedef unsigned char GLubyte;
-typedef unsigned long Pixmap;
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+#include "TextureMapper.h"
+#endif
 
 namespace WebCore {
 
-class GraphicsContext3D;
-
-class GraphicsContext3DPrivate {
+class GraphicsContext3DPrivate
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+    : public TextureMapperPlatformLayer
+#endif
+{
 public:
-    static PassOwnPtr<GraphicsContext3DPrivate> create();
+    static PassOwnPtr<GraphicsContext3DPrivate> create(GraphicsContext3D*, HostWindow*);
     ~GraphicsContext3DPrivate();
     bool makeContextCurrent();
+    PlatformGraphicsContext3D platformContext();
+
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+    virtual void paintToTextureMapper(TextureMapper*, const FloatRect& target, const TransformationMatrix&, float opacity, BitmapTexture* mask);
+#endif
 
 private:
-    friend class GraphicsContext3D;
-    static GraphicsContext3DPrivate* createPbufferContext();
-    static GraphicsContext3DPrivate* createPixmapContext();
-    GraphicsContext3DPrivate(GLXContext, GLXPbuffer);
-    GraphicsContext3DPrivate(GLXContext, Pixmap, GLXPixmap);
-
-    static void addActiveGraphicsContext(GraphicsContext3D*);
-    static void removeActiveGraphicsContext(GraphicsContext3D*);
-    static void cleanupActiveContextsAtExit();
-
-    GLXContext m_context;
-    GLXPbuffer m_pbuffer;
-    Pixmap m_pixmap;
-    GLXPixmap m_glxPixmap;
+    GraphicsContext3DPrivate(GraphicsContext3D*, HostWindow*);
+
+    GraphicsContext3D* m_context;
+    HostWindow* m_window;
+    GLContext* m_glContext;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp b/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
index 7ae5024a6..96df0938f 100644
--- a/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
+++ b/Source/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
@@ -76,11 +76,6 @@ ImageBuffer::~ImageBuffer()
     cairo_surface_destroy(m_data.m_surface);
 }
 
-size_t ImageBuffer::dataSize() const
-{
-    return m_size.width() * m_size.height() * 4;
-}
-
 GraphicsContext* ImageBuffer::context() const
 {
     return m_context.get();
diff --git a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index 4b6192f16..09caf5dae 100644
--- a/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -73,6 +73,24 @@ extern "C" {
 using namespace std;
 
 namespace WebCore {
+    
+static CGColorSpaceRef createLinearSRGBColorSpace()
+{
+    // If we fail to load the linearized sRGB ICC profile, fall back to DeviceRGB.
+    CGColorSpaceRef linearSRGBSpace = deviceRGBColorSpaceRef();
+    
+    CFBundleRef webCoreBundle = CFBundleGetBundleWithIdentifier(CFSTR("com.apple.WebCore"));
+    RetainPtr<CFURLRef> iccProfileURL(CFBundleCopyResourceURL(webCoreBundle, CFSTR("linearSRGB"), CFSTR("icc"), 0));
+    CFDataRef iccProfileData;
+    
+    if (iccProfileURL && CFURLCreateDataAndPropertiesFromResource(0, iccProfileURL.get(), &iccProfileData, 0, 0, 0))
+        linearSRGBSpace = CGColorSpaceCreateWithICCProfile(iccProfileData);
+    
+    if (iccProfileData)
+        CFRelease(iccProfileData);
+    
+    return linearSRGBSpace;
+}
 
 static void setCGFillColor(CGContextRef context, const Color& color, ColorSpace colorSpace)
 {
@@ -103,12 +121,12 @@ CGColorSpaceRef sRGBColorSpaceRef()
 
 CGColorSpaceRef linearRGBColorSpaceRef()
 {
-    // FIXME: Windows should be able to use kCGColorSpaceGenericRGBLinear, this is tracked by http://webkit.org/b/31363.
+    // FIXME: Windows should be able to use linear sRGB, this is tracked by http://webkit.org/b/80000.
 #if PLATFORM(WIN)
     return deviceRGBColorSpaceRef();
 #else
-    static CGColorSpaceRef linearRGBSpace = CGColorSpaceCreateWithName(kCGColorSpaceGenericRGBLinear);
-    return linearRGBSpace;
+    static CGColorSpaceRef linearSRGBSpace = createLinearSRGBColorSpace();
+    return linearSRGBSpace;
 #endif
 }
 
diff --git a/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp b/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
index e9f77f301..646bd365d 100644
--- a/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
+++ b/Source/WebCore/platform/graphics/cg/ImageBufferCG.cpp
@@ -108,7 +108,7 @@ static void releaseImageData(void*, const void* data, size_t)
 }
 
 ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace imageColorSpace, RenderingMode renderingMode, DeferralMode, bool& success)
-    : m_data(size)
+    : m_data(size) // NOTE: The input here isn't important as ImageBufferDataCG's constructor just ignores it.
     , m_size(size)
 {
     success = false;  // Make early return mean failure.
@@ -121,8 +121,8 @@ ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace imageColorSpace, Render
 
     // Prevent integer overflows
     m_data.m_bytesPerRow = 4 * width;
-    Checked<size_t, RecordOverflow> dataSize = height * m_data.m_bytesPerRow;
-    if (dataSize.hasOverflowed())
+    Checked<size_t, RecordOverflow> numBytes = height * m_data.m_bytesPerRow;
+    if (numBytes.hasOverflowed())
         return;
 
 #if USE(IOSURFACE_CANVAS_BACKING_STORE)
@@ -162,7 +162,7 @@ ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace imageColorSpace, Render
         m_data.m_bitmapInfo = kCGImageAlphaPremultipliedLast;
         cgContext.adoptCF(CGBitmapContextCreate(m_data.m_data, width.unsafeGet(), height.unsafeGet(), 8, m_data.m_bytesPerRow.unsafeGet(), m_data.m_colorSpace, m_data.m_bitmapInfo));
         // Create a live image that wraps the data.
-        m_data.m_dataProvider.adoptCF(CGDataProviderCreateWithData(0, m_data.m_data, dataSize.unsafeGet(), releaseImageData));
+        m_data.m_dataProvider.adoptCF(CGDataProviderCreateWithData(0, m_data.m_data, numBytes.unsafeGet(), releaseImageData));
     }
 
     if (!cgContext)
@@ -182,11 +182,6 @@ ImageBuffer::~ImageBuffer()
 {
 }
 
-size_t ImageBuffer::dataSize() const
-{
-    return m_size.height() * m_data.m_bytesPerRow.unsafeGet();
-}
-
 GraphicsContext* ImageBuffer::context() const
 {
 #if defined(BUILDING_ON_LION)
@@ -222,7 +217,7 @@ NativeImagePtr ImageBuffer::copyNativeImage(BackingStoreCopy copyBehavior) const
     if (!m_context->isAcceleratedContext()) {
         switch (copyBehavior) {
         case DontCopyBackingStore:
-            image = CGImageCreate(m_size.width(), m_size.height(), 8, 32, m_data.m_bytesPerRow.unsafeGet(), m_data.m_colorSpace, m_data.m_bitmapInfo, m_data.m_dataProvider.get(), 0, true, kCGRenderingIntentDefault);
+            image = CGImageCreate(internalSize().width(), internalSize().height(), 8, 32, m_data.m_bytesPerRow.unsafeGet(), m_data.m_colorSpace, m_data.m_bitmapInfo, m_data.m_dataProvider.get(), 0, true, kCGRenderingIntentDefault);
             break;
         case CopyBackingStore:
             image = CGBitmapContextCreateImage(context()->platformContext());
@@ -255,28 +250,34 @@ void ImageBuffer::draw(GraphicsContext* destContext, ColorSpace styleColorSpace,
     else
         image.adoptCF(copyNativeImage(DontCopyBackingStore));
 
-    destContext->drawNativeImage(image.get(), m_size, colorSpace, destRect, srcRect, op);
+    FloatRect adjustedSrcRect = srcRect;
+    adjustedSrcRect.scale(m_resolutionScale, m_resolutionScale);
+    destContext->drawNativeImage(image.get(), internalSize(), colorSpace, destRect, adjustedSrcRect, op);
 }
 
 void ImageBuffer::drawPattern(GraphicsContext* destContext, const FloatRect& srcRect, const AffineTransform& patternTransform, const FloatPoint& phase, ColorSpace styleColorSpace, CompositeOperator op, const FloatRect& destRect)
 {
+    FloatRect adjustedSrcRect = srcRect;
+    adjustedSrcRect.scale(m_resolutionScale, m_resolutionScale);
+
     if (!m_context->isAcceleratedContext()) {
         if (destContext == m_context || destContext->isAcceleratedContext()) {
             RefPtr<Image> copy = copyImage(CopyBackingStore); // Drawing into our own buffer, need to deep copy.
-            copy->drawPattern(destContext, srcRect, patternTransform, phase, styleColorSpace, op, destRect);
+            copy->drawPattern(destContext, adjustedSrcRect, patternTransform, phase, styleColorSpace, op, destRect);
         } else {
             RefPtr<Image> imageForRendering = copyImage(DontCopyBackingStore);
-            imageForRendering->drawPattern(destContext, srcRect, patternTransform, phase, styleColorSpace, op, destRect);
+            imageForRendering->drawPattern(destContext, adjustedSrcRect, patternTransform, phase, styleColorSpace, op, destRect);
         }
     } else {
         RefPtr<Image> copy = copyImage(CopyBackingStore);
-        copy->drawPattern(destContext, srcRect, patternTransform, phase, styleColorSpace, op, destRect);
+        copy->drawPattern(destContext, adjustedSrcRect, patternTransform, phase, styleColorSpace, op, destRect);
     }
 }
 
 void ImageBuffer::clip(GraphicsContext* contextToClip, const FloatRect& rect) const
 {
     CGContextRef platformContextToClip = contextToClip->platformContext();
+    // FIXME: This image needs to be grayscale to be used as an alpha mask here.
     RetainPtr<CGImageRef> image(AdoptCF, copyNativeImage(DontCopyBackingStore));
     CGContextTranslateCTM(platformContextToClip, rect.x(), rect.y() + rect.height());
     CGContextScaleCTM(platformContextToClip, 1, -1);
@@ -293,7 +294,7 @@ PassRefPtr<ByteArray> ImageBuffer::getUnmultipliedImageData(const IntRect& rect)
         m_data.m_lastFlushTime = currentTimeMS();
 #endif
     }
-    return m_data.getData(rect, m_size, m_context->isAcceleratedContext(), true);
+    return m_data.getData(rect, internalSize(), m_context->isAcceleratedContext(), true);
 }
 
 PassRefPtr<ByteArray> ImageBuffer::getPremultipliedImageData(const IntRect& rect) const
@@ -304,23 +305,24 @@ PassRefPtr<ByteArray> ImageBuffer::getPremultipliedImageData(const IntRect& rect
         m_data.m_lastFlushTime = currentTimeMS();
 #endif
     }
-    return m_data.getData(rect, m_size, m_context->isAcceleratedContext(), false);
+    return m_data.getData(rect, internalSize(), m_context->isAcceleratedContext(), false);
 }
 
 void ImageBuffer::putByteArray(Multiply multiplied, ByteArray* source, const IntSize& sourceSize, const IntRect& sourceRect, const IntPoint& destPoint)
 {
     if (!m_context->isAcceleratedContext()) {
-        m_data.putData(source, sourceSize, sourceRect, destPoint, m_size, m_context->isAcceleratedContext(), multiplied == Unmultiplied);
+        m_data.putData(source, sourceSize, sourceRect, destPoint, internalSize(), m_context->isAcceleratedContext(), multiplied == Unmultiplied);
         return;
     }
 
 #if USE(IOSURFACE_CANVAS_BACKING_STORE)
     // Make a copy of the source to ensure the bits don't change before being drawn
     IntSize sourceCopySize(sourceRect.width(), sourceRect.height());
-    OwnPtr<ImageBuffer> sourceCopy = ImageBuffer::create(sourceCopySize, ColorSpaceDeviceRGB, Unaccelerated);
+    OwnPtr<ImageBuffer> sourceCopy = ImageBuffer::create(sourceCopySize, 1, ColorSpaceDeviceRGB, Unaccelerated);
     if (!sourceCopy)
         return;
-    sourceCopy->m_data.putData(source, sourceSize, sourceRect, IntPoint(-sourceRect.x(), -sourceRect.y()), sourceCopy->size(), sourceCopy->context()->isAcceleratedContext(), multiplied == Unmultiplied);
+
+    sourceCopy->m_data.putData(source, sourceSize, sourceRect, IntPoint(-sourceRect.x(), -sourceRect.y()), sourceCopy->internalSize(), sourceCopy->context()->isAcceleratedContext(), multiplied == Unmultiplied);
 
     // Set up context for using drawImage as a direct bit copy
     CGContextRef destContext = context()->platformContext();
@@ -333,7 +335,7 @@ void ImageBuffer::putByteArray(Multiply multiplied, ByteArray* source, const Int
     CGContextSetShadowWithColor(destContext, CGSizeZero, 0, 0);
 
     // Draw the image in CG coordinate space
-    IntPoint destPointInCGCoords(destPoint.x() + sourceRect.x(), m_size.height() - (destPoint.y()+sourceRect.y()) - sourceRect.height());
+    IntPoint destPointInCGCoords(destPoint.x() + sourceRect.x(), internalSize().height() - (destPoint.y()+sourceRect.y()) - sourceRect.height());
     IntRect destRectInCGCoords(destPointInCGCoords, sourceCopySize);
     RetainPtr<CGImageRef> sourceCopyImage(AdoptCF, sourceCopy->copyNativeImage());
     CGContextDrawImage(destContext, destRectInCGCoords, sourceCopyImage.get());
@@ -418,21 +420,20 @@ String ImageBuffer::toDataURL(const String& mimeType, const double* quality) con
 
     if (CFEqual(uti.get(), jpegUTI())) {
         // JPEGs don't have an alpha channel, so we have to manually composite on top of black.
-        arr = getPremultipliedImageData(IntRect(IntPoint(0, 0), m_size));
+        arr = getPremultipliedImageData(IntRect(IntPoint(0, 0), internalSize()));
 
         unsigned char *data = arr->data();
-        for (int i = 0; i < width() * height(); i++)
+        for (int i = 0; i < internalSize().width() * internalSize().height(); i++)
             data[i * 4 + 3] = 255; // The image is already premultiplied, so we just need to make it opaque.
 
         RetainPtr<CGDataProviderRef> dataProvider;
     
-        dataProvider.adoptCF(CGDataProviderCreateWithData(0, data,
-                                                          4 * width() * height(), 0));
+        dataProvider.adoptCF(CGDataProviderCreateWithData(0, data, 4 * internalSize().width() * internalSize().height(), 0));
     
         if (!dataProvider)
             return "data:,";
 
-        image.adoptCF(CGImageCreate(width(), height(), 8, 32, 4 * width(),
+        image.adoptCF(CGImageCreate(internalSize().width(), internalSize().height(), 8, 32, 4 * internalSize().width(),
                                     CGColorSpaceCreateDeviceRGB(), kCGBitmapByteOrderDefault | kCGImageAlphaLast,
                                     dataProvider.get(), 0, false, kCGRenderingIntentDefault));
     } else
diff --git a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
index 9b912a44f..426c6568a 100644
--- a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.cpp
@@ -27,7 +27,6 @@
 #include "config.h"
 
 #if USE(ACCELERATED_COMPOSITING)
-#if USE(SKIA)
 
 #include "BitmapSkPictureCanvasLayerTextureUpdater.h"
 
@@ -110,5 +109,4 @@ void BitmapSkPictureCanvasLayerTextureUpdater::updateTextureRect(GraphicsContext
 }
 
 } // namespace WebCore
-#endif // USE(SKIA)
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
index 838b4b3e7..0aeae0cd4 100644
--- a/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/BitmapSkPictureCanvasLayerTextureUpdater.h
@@ -28,8 +28,6 @@
 #define BitmapSkPictureCanvasLayerTextureUpdater_h
 
 #if USE(ACCELERATED_COMPOSITING)
-#if USE(SKIA)
-
 #include "LayerTextureSubImage.h"
 #include "PlatformColor.h"
 #include "SkBitmap.h"
@@ -70,6 +68,5 @@ private:
     LayerTextureSubImage m_texSubImage;
 };
 } // namespace WebCore
-#endif // USE(SKIA)
 #endif // USE(ACCELERATED_COMPOSITING)
 #endif // BitmapSkPictureCanvasLayerTextureUpdater_h
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
index d8b4bbe08..5c79f0743 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.cpp
@@ -75,13 +75,12 @@ void Canvas2DLayerChromium::setTextureId(unsigned textureId)
     setNeedsCommit();
 }
 
-void Canvas2DLayerChromium::contentChanged()
+void Canvas2DLayerChromium::setNeedsDisplayRect(const FloatRect& dirtyRect)
 {
+    LayerChromium::setNeedsDisplayRect(dirtyRect);
+
     if (layerTreeHost())
         layerTreeHost()->startRateLimiter(m_context);
-
-    m_updateRect = FloatRect(FloatPoint(), contentBounds());
-    setNeedsDisplay();
 }
 
 bool Canvas2DLayerChromium::drawsContent() const
diff --git a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h
index 11a1a9539..035a2b37e 100644
--- a/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/Canvas2DLayerChromium.h
@@ -52,7 +52,7 @@ public:
 
     void setTextureId(unsigned);
 
-    virtual void contentChanged();
+    virtual void setNeedsDisplayRect(const FloatRect&);
 
     virtual bool drawsContent() const;
     virtual void paintContentsIfDirty(const Region& occludedScreenSpace);
diff --git a/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.cpp
index 181ba4e58..d533699af 100644
--- a/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.cpp
@@ -45,7 +45,7 @@ CanvasLayerChromium::CanvasLayerChromium()
 {
 }
 
-PassRefPtr<CCLayerImpl> CanvasLayerChromium::createCCLayerImpl()
+PassOwnPtr<CCLayerImpl> CanvasLayerChromium::createCCLayerImpl()
 {
     return CCCanvasLayerImpl::create(m_layerId);
 }
diff --git a/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.h b/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.h
index 9e8ce7d8c..722cc1a66 100644
--- a/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/CanvasLayerChromium.h
@@ -41,7 +41,7 @@ namespace WebCore {
 // Base class for WebGL and accelerated 2d canvases.
 class CanvasLayerChromium : public LayerChromium {
 public:
-    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl();
 
 protected:
     CanvasLayerChromium();
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
index aa7fb5cf4..7a66984bd 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
@@ -93,7 +93,7 @@ bool ContentLayerChromium::drawsContent() const
     return TiledLayerChromium::drawsContent() && m_delegate;
 }
 
-void ContentLayerChromium::paintContentsIfDirty(const Region& /* occludedScreenSpace */)
+void ContentLayerChromium::paintContentsIfDirty(const Region& occludedScreenSpace)
 {
     updateTileSizeAndTilingOption();
     createTextureUpdaterIfNeeded();
@@ -105,11 +105,11 @@ void ContentLayerChromium::paintContentsIfDirty(const Region& /* occludedScreenS
     if (drawsContent())
         layerRect = visibleLayerRect();
 
-    prepareToUpdate(layerRect);
+    prepareToUpdate(layerRect, occludedScreenSpace);
     m_needsDisplay = false;
 }
 
-void ContentLayerChromium::idlePaintContentsIfDirty()
+void ContentLayerChromium::idlePaintContentsIfDirty(const Region& occludedScreenSpace)
 {
     if (!drawsContent())
         return;
@@ -118,7 +118,7 @@ void ContentLayerChromium::idlePaintContentsIfDirty()
     if (layerRect.isEmpty())
         return;
 
-    prepareToUpdateIdle(layerRect);
+    prepareToUpdateIdle(layerRect, occludedScreenSpace);
     if (needsIdlePaint(layerRect))
         setNeedsCommit();
 }
@@ -127,13 +127,11 @@ void ContentLayerChromium::createTextureUpdaterIfNeeded()
 {
     if (m_textureUpdater)
         return;
-#if USE(SKIA)
     if (layerTreeHost()->settings().acceleratePainting)
         m_textureUpdater = FrameBufferSkPictureCanvasLayerTextureUpdater::create(ContentLayerPainter::create(m_delegate));
     else if (layerTreeHost()->settings().perTilePainting)
         m_textureUpdater = BitmapSkPictureCanvasLayerTextureUpdater::create(ContentLayerPainter::create(m_delegate), layerTreeHost()->layerRendererCapabilities().usingMapSub);
     else
-#endif // USE(SKIA)
         m_textureUpdater = BitmapCanvasLayerTextureUpdater::create(ContentLayerPainter::create(m_delegate), layerTreeHost()->layerRendererCapabilities().usingMapSub);
     m_textureUpdater->setOpaque(opaque());
 
diff --git a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
index 3e8686d0a..fa5901e2a 100644
--- a/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ContentLayerChromium.h
@@ -60,7 +60,7 @@ public:
 
     virtual bool drawsContent() const;
     virtual void paintContentsIfDirty(const Region& occludedScreenSpace);
-    virtual void idlePaintContentsIfDirty();
+    virtual void idlePaintContentsIfDirty(const Region& occludedScreenSpace);
 
     virtual void setOpaque(bool);
 
diff --git a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
index 19dfa2f00..be217d9c1 100644
--- a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.cpp
@@ -27,7 +27,6 @@
 #include "config.h"
 
 #if USE(ACCELERATED_COMPOSITING)
-#if USE(SKIA)
 
 #include "FrameBufferSkPictureCanvasLayerTextureUpdater.h"
 
@@ -99,30 +98,30 @@ LayerTextureUpdater::SampledTexelFormat FrameBufferSkPictureCanvasLayerTextureUp
 
 void FrameBufferSkPictureCanvasLayerTextureUpdater::updateTextureRect(GraphicsContext3D* context, TextureAllocator* allocator, ManagedTexture* texture, const IntRect& sourceRect, const IntRect& destRect)
 {
-    // Make sure SKIA uses the correct GL context.
+    // Make sure ganesh uses the correct GL context.
     context->makeContextCurrent();
-    // Notify SKIA to sync its internal GL state.
+    // Notify ganesh to sync its internal GL state.
     context->grContext()->resetContext();
 
     // Create an accelerated canvas to draw on.
     OwnPtr<SkCanvas> canvas = createAcceleratedCanvas(context, allocator, texture);
 
-    canvas->clipRect(SkRect(destRect));
     // The compositor expects the textures to be upside-down so it can flip
     // the final composited image. Ganesh renders the image upright so we
     // need to do a y-flip.
     canvas->translate(0.0, texture->size().height());
     canvas->scale(1.0, -1.0);
+    // Only the region corresponding to destRect on the texture must be updated.
+    canvas->clipRect(SkRect(destRect));
     // Translate the origin of contentRect to that of destRect.
     // Note that destRect is defined relative to sourceRect.
     canvas->translate(contentRect().x() - sourceRect.x() + destRect.x(),
                       contentRect().y() - sourceRect.y() + destRect.y());
     drawPicture(canvas.get());
 
-    // Flush SKIA context so that all the rendered stuff appears on the texture.
+    // Flush ganesh context so that all the rendered stuff appears on the texture.
     context->grContext()->flush();
 }
 
 } // namespace WebCore
-#endif // USE(SKIA)
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h
index 4a10c858e..5039ba902 100644
--- a/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/FrameBufferSkPictureCanvasLayerTextureUpdater.h
@@ -28,7 +28,6 @@
 #define FrameBufferSkPictureCanvasLayerTextureUpdater_h
 
 #if USE(ACCELERATED_COMPOSITING)
-#if USE(SKIA)
 
 #include "SkPictureCanvasLayerTextureUpdater.h"
 
@@ -63,6 +62,5 @@ private:
     explicit FrameBufferSkPictureCanvasLayerTextureUpdater(PassOwnPtr<LayerPainterChromium>);
 };
 } // namespace WebCore
-#endif // USE(SKIA)
 #endif // USE(ACCELERATED_COMPOSITING)
 #endif // FrameBufferSkPictureCanvasLayerTextureUpdater_h
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
index cdecf5917..4c81853b8 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
@@ -62,7 +62,8 @@
 using namespace std;
 
 namespace {
-static int s_nextGroupId = 0;
+static int s_nextGroupId = 1;
+static int s_nextAnimationId = 1;
 }
 
 namespace WebCore {
@@ -77,6 +78,7 @@ GraphicsLayerChromium::GraphicsLayerChromium(GraphicsLayerClient* client)
     , m_contentsLayerPurpose(NoContentsLayer)
     , m_contentsLayerHasBackgroundColor(false)
     , m_inSetChildren(false)
+    , m_pageScaleChanged(false)
 {
     m_layer = ContentLayerChromium::create(this);
 
@@ -88,11 +90,20 @@ GraphicsLayerChromium::~GraphicsLayerChromium()
     if (m_layer) {
         m_layer->clearDelegate();
         m_layer->clearRenderSurface();
+        // Primary layer may have at one point been m_layer. Be sure to reset
+        // the delegate, just in case.
+        m_layer->setLayerAnimationDelegate(0);
     }
+
     if (m_contentsLayer)
         m_contentsLayer->clearRenderSurface();
-    if (m_transformLayer)
+
+    if (m_transformLayer) {
         m_transformLayer->clearRenderSurface();
+        // Primary layer may have switched from m_layer to m_transformLayer.
+        // Be sure to reset the delegate, just in case.
+        m_transformLayer->setLayerAnimationDelegate(0);
+    }
 }
 
 void GraphicsLayerChromium::setName(const String& inName)
@@ -106,11 +117,11 @@ void GraphicsLayerChromium::setName(const String& inName)
 void GraphicsLayerChromium::updateNames()
 {
     if (m_layer)
-        m_layer->setName("Layer for " + m_nameBase);
+        m_layer->setDebugName("Layer for " + m_nameBase);
     if (m_transformLayer)
-        m_transformLayer->setName("TransformLayer for " + m_nameBase);
+        m_transformLayer->setDebugName("TransformLayer for " + m_nameBase);
     if (m_contentsLayer)
-        m_contentsLayer->setName("ContentsLayer for " + m_nameBase);
+        m_contentsLayer->setDebugName("ContentsLayer for " + m_nameBase);
 }
 
 bool GraphicsLayerChromium::setChildren(const Vector<GraphicsLayer*>& children)
@@ -191,6 +202,10 @@ void GraphicsLayerChromium::setSize(const FloatSize& size)
 
     GraphicsLayer::setSize(clampedSize);
     updateLayerSize();
+
+    if (m_pageScaleChanged && m_layer)
+        m_layer->setNeedsDisplay();
+    m_pageScaleChanged = false;
 }
 
 void GraphicsLayerChromium::setTransform(const TransformationMatrix& transform)
@@ -279,8 +294,6 @@ void GraphicsLayerChromium::setMaskLayer(GraphicsLayer* maskLayer)
     GraphicsLayer::setMaskLayer(maskLayer);
 
     LayerChromium* maskLayerChromium = m_maskLayer ? m_maskLayer->platformLayer() : 0;
-    if (maskLayerChromium)
-        maskLayerChromium->setIsMask(true);
     m_layer->setMaskLayer(maskLayerChromium);
 }
 
@@ -308,10 +321,8 @@ void GraphicsLayerChromium::setReplicatedByLayer(GraphicsLayer* layer)
 
 void GraphicsLayerChromium::setContentsNeedsDisplay()
 {
-    if (m_contentsLayer) {
+    if (m_contentsLayer)
         m_contentsLayer->setNeedsDisplay();
-        m_contentsLayer->contentChanged();
-    }
 }
 
 void GraphicsLayerChromium::setNeedsDisplay()
@@ -371,7 +382,6 @@ void GraphicsLayerChromium::setContentsToCanvas(PlatformLayer* platformLayer)
             m_contentsLayerPurpose = ContentsLayerForCanvas;
             childrenChanged = true;
         }
-        m_contentsLayer->setNeedsDisplay();
         updateContentsRect();
     } else {
         if (m_contentsLayer) {
@@ -388,27 +398,28 @@ void GraphicsLayerChromium::setContentsToCanvas(PlatformLayer* platformLayer)
 
 bool GraphicsLayerChromium::addAnimation(const KeyframeValueList& values, const IntSize& boxSize, const Animation* animation, const String& animationName, double timeOffset)
 {
-    return m_layer->addAnimation(values, boxSize, animation, mapAnimationNameToId(animationName), s_nextGroupId++, timeOffset);
+    primaryLayer()->setLayerAnimationDelegate(this);
+    return primaryLayer()->addAnimation(values, boxSize, animation, mapAnimationNameToId(animationName), s_nextGroupId++, timeOffset);
 }
 
 void GraphicsLayerChromium::pauseAnimation(const String& animationName, double timeOffset)
 {
-    m_layer->pauseAnimation(mapAnimationNameToId(animationName), timeOffset);
+    primaryLayer()->pauseAnimation(mapAnimationNameToId(animationName), timeOffset);
 }
 
 void GraphicsLayerChromium::removeAnimation(const String& animationName)
 {
-    m_layer->removeAnimation(mapAnimationNameToId(animationName));
+    primaryLayer()->removeAnimation(mapAnimationNameToId(animationName));
 }
 
 void GraphicsLayerChromium::suspendAnimations(double time)
 {
-    m_layer->suspendAnimations(time);
+    primaryLayer()->suspendAnimations(time);
 }
 
 void GraphicsLayerChromium::resumeAnimations()
 {
-    m_layer->resumeAnimations();
+    primaryLayer()->resumeAnimations();
 }
 
 void GraphicsLayerChromium::setContentsToMedia(PlatformLayer* layer)
@@ -420,7 +431,6 @@ void GraphicsLayerChromium::setContentsToMedia(PlatformLayer* layer)
             m_contentsLayerPurpose = ContentsLayerForVideo;
             childrenChanged = true;
         }
-        layer->setNeedsDisplay();
         updateContentsRect();
     } else {
         if (m_contentsLayer) {
@@ -566,6 +576,7 @@ void GraphicsLayerChromium::updateLayerPreserves3D()
         // Create the transform layer.
         m_transformLayer = LayerChromium::create();
         m_transformLayer->setPreserves3D(true);
+        m_transformLayer->setLayerAnimationDelegate(this);
 
         // Copy the position from this layer.
         updateLayerPosition();
@@ -598,6 +609,7 @@ void GraphicsLayerChromium::updateLayerPreserves3D()
             m_transformLayer->parent()->replaceChild(m_transformLayer.get(), m_layer.get());
 
         // Release the transform layer.
+        m_transformLayer->setLayerAnimationDelegate(0);
         m_transformLayer = 0;
 
         updateLayerPosition();
@@ -709,8 +721,10 @@ float GraphicsLayerChromium::contentsScale() const
 void GraphicsLayerChromium::deviceOrPageScaleFactorChanged()
 {
     updateContentsScale();
-    if (m_layer)
-        m_layer->pageScaleChanged();
+    // Invalidations are clamped to the layer's bounds but we receive the scale changed notification before receiving
+    // the new layer bounds. When the scale changes, we really want to invalidate the post-scale layer bounds, so we
+    // remember that the scale has changed and then invalidate the full layer bounds when we receive the new size.
+    m_pageScaleChanged = true;
 }
 
 void GraphicsLayerChromium::paintContents(GraphicsContext& context, const IntRect& clip)
@@ -720,8 +734,29 @@ void GraphicsLayerChromium::paintContents(GraphicsContext& context, const IntRec
 
 int GraphicsLayerChromium::mapAnimationNameToId(const String& animationName)
 {
-    // FIXME: need to maintain a name to id mapping in this class.
-    return 0;
+    if (animationName.isEmpty())
+        return 0;
+
+    if (!m_animationIdMap.contains(animationName))
+        m_animationIdMap.add(animationName, s_nextAnimationId++);
+
+    return m_animationIdMap.find(animationName)->second;
+}
+
+void GraphicsLayerChromium::notifyAnimationStarted(double startTime)
+{
+    if (m_client)
+        m_client->notifyAnimationStarted(this, startTime);
+}
+
+void GraphicsLayerChromium::notifyAnimationFinished(int animationId)
+{
+    for (AnimationIdMap::iterator idIter = m_animationIdMap.begin(); idIter != m_animationIdMap.end(); ++idIter) {
+        if (idIter->second == animationId) {
+            m_animationIdMap.remove(idIter);
+            return;
+        }
+    }
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
index eb3146bbd..4cca82a88 100644
--- a/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
@@ -37,12 +37,15 @@
 #include "LayerChromium.h"
 #include "GraphicsContext.h"
 #include "GraphicsLayer.h"
+#include "cc/CCLayerAnimationDelegate.h"
+
+#include <wtf/HashMap.h>
 
 namespace WebCore {
 
 class LayerChromium;
 
-class GraphicsLayerChromium : public GraphicsLayer, public ContentLayerDelegate {
+class GraphicsLayerChromium : public GraphicsLayer, public ContentLayerDelegate, public CCLayerAnimationDelegate {
 public:
     GraphicsLayerChromium(GraphicsLayerClient*);
     virtual ~GraphicsLayerChromium();
@@ -94,6 +97,7 @@ public:
     virtual void setContentsToImage(Image*);
     virtual void setContentsToMedia(PlatformLayer*);
     virtual void setContentsToCanvas(PlatformLayer*);
+    virtual bool hasContentsLayer() const { return m_contentsLayer; }
 
     virtual bool addAnimation(const KeyframeValueList&, const IntSize& boxSize, const Animation*, const String&, double timeOffset);
     virtual void pauseAnimation(const String& animationName, double timeOffset);
@@ -110,10 +114,16 @@ public:
     // ContentLayerDelegate implementation.
     virtual void paintContents(GraphicsContext&, const IntRect& clip);
 
+    // CCLayerAnimationDelegate implementation.
+    virtual void notifyAnimationStarted(double startTime);
+    virtual void notifyAnimationFinished(int animationId);
+
     // Exposed for tests.
     LayerChromium* contentsLayer() const { return m_contentsLayer.get(); }
 
 private:
+    typedef HashMap<String, int> AnimationIdMap;
+
     LayerChromium* primaryLayer() const  { return m_transformLayer.get() ? m_transformLayer.get() : m_layer.get(); }
     LayerChromium* hostLayerForChildren() const;
     LayerChromium* layerForParent() const;
@@ -156,6 +166,9 @@ private:
     ContentsLayerPurpose m_contentsLayerPurpose;
     bool m_contentsLayerHasBackgroundColor : 1;
     bool m_inSetChildren;
+    bool m_pageScaleChanged;
+
+    AnimationIdMap m_animationIdMap;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
index 1e44e8702..611ab2a6a 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
@@ -158,7 +158,7 @@ void ImageLayerChromium::setContents(Image* contents)
     setNeedsDisplay();
 }
 
-void ImageLayerChromium::paintContentsIfDirty(const Region& /* occludedScreenSpace */)
+void ImageLayerChromium::paintContentsIfDirty(const Region& occludedScreenSpace)
 {
     createTextureUpdaterIfNeeded();
     if (m_needsDisplay) {
@@ -168,7 +168,7 @@ void ImageLayerChromium::paintContentsIfDirty(const Region& /* occludedScreenSpa
         m_needsDisplay = false;
     }
 
-    prepareToUpdate(visibleLayerRect());
+    prepareToUpdate(visibleLayerRect(), occludedScreenSpace);
 }
 
 void ImageLayerChromium::createTextureUpdaterIfNeeded()
diff --git a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
index 2127b857c..deafd37e7 100644
--- a/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ImageLayerChromium.h
@@ -37,10 +37,6 @@
 #include "ContentLayerChromium.h"
 #include "PlatformImage.h"
 
-#if USE(CG)
-#include <wtf/RetainPtr.h>
-#endif
-
 namespace WebCore {
 
 class Image;
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
index 8eeda68a4..f973880fd 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -33,16 +33,15 @@
 #if USE(ACCELERATED_COMPOSITING)
 #include "LayerChromium.h"
 
-#include "cc/CCLayerAnimationController.h"
-#include "cc/CCLayerImpl.h"
-#include "cc/CCLayerTreeHost.h"
-#if USE(SKIA)
 #include "NativeImageSkia.h"
 #include "PlatformContextSkia.h"
-#endif
-#include "Region.h"
 #include "RenderLayerBacking.h"
 #include "TextStream.h"
+#include "cc/CCAnimationEvents.h"
+#include "cc/CCLayerAnimationController.h"
+#include "cc/CCLayerAnimationDelegate.h"
+#include "cc/CCLayerImpl.h"
+#include "cc/CCLayerTreeHost.h"
 #include "skia/ext/platform_canvas.h"
 
 namespace WebCore {
@@ -62,7 +61,9 @@ LayerChromium::LayerChromium()
     , m_parent(0)
     , m_layerAnimationController(CCLayerAnimationController::create())
     , m_scrollable(false)
+    , m_shouldScrollOnMainThread(false)
     , m_haveWheelEventHandlers(false)
+    , m_nonFastScrollableRegionChanged(false)
     , m_anchorPoint(0.5, 0.5)
     , m_backgroundColor(0, 0, 0, 0)
     , m_backgroundCoversViewport(false)
@@ -81,7 +82,7 @@ LayerChromium::LayerChromium()
     , m_drawOpacity(0)
     , m_targetRenderSurface(0)
     , m_contentsScale(1.0)
-    , m_pageScaleDirty(false)
+    , m_layerAnimationDelegate(0)
 {
 }
 
@@ -141,6 +142,24 @@ bool LayerChromium::hasActiveAnimation() const
     return m_layerAnimationController->hasActiveAnimation();
 }
 
+void LayerChromium::setAnimationEvent(const CCAnimationEvent& event, double wallClockTime)
+{
+    switch (event.type()) {
+
+    case CCAnimationEvent::Started: {
+        m_layerAnimationDelegate->notifyAnimationStarted(wallClockTime);
+        break;
+    }
+
+    case CCAnimationEvent::Finished: {
+        const CCAnimationFinishedEvent* finishedEvent = event.toAnimationFinishedEvent();
+        m_layerAnimationDelegate->notifyAnimationFinished(finishedEvent->animationId());
+        break;
+    }
+
+    }
+}
+
 void LayerChromium::setIsNonCompositedContent(bool isNonCompositedContent)
 {
     m_isNonCompositedContent = isNonCompositedContent;
@@ -255,12 +274,10 @@ void LayerChromium::setBounds(const IntSize& size)
 
     m_bounds = size;
 
-    if (firstResize || m_pageScaleDirty)
+    if (firstResize)
         setNeedsDisplay();
     else
         setNeedsCommit();
-
-    m_pageScaleDirty = false;
 }
 
 const LayerChromium* LayerChromium::rootLayer() const
@@ -337,8 +354,10 @@ void LayerChromium::setMaskLayer(LayerChromium* maskLayer)
     if (m_maskLayer)
         m_maskLayer->setLayerTreeHost(0);
     m_maskLayer = maskLayer;
-    if (m_maskLayer)
+    if (m_maskLayer) {
         m_maskLayer->setLayerTreeHost(m_layerTreeHost.get());
+        m_maskLayer->setIsMask(true);
+    }
     setNeedsCommit();
 }
 
@@ -418,6 +437,14 @@ void LayerChromium::setScrollable(bool scrollable)
     setNeedsCommit();
 }
 
+void LayerChromium::setShouldScrollOnMainThread(bool shouldScrollOnMainThread)
+{
+    if (m_shouldScrollOnMainThread == shouldScrollOnMainThread)
+        return;
+    m_shouldScrollOnMainThread = shouldScrollOnMainThread;
+    setNeedsCommit();
+}
+
 void LayerChromium::setHaveWheelEventHandlers(bool haveWheelEventHandlers)
 {
     if (m_haveWheelEventHandlers == haveWheelEventHandlers)
@@ -426,6 +453,15 @@ void LayerChromium::setHaveWheelEventHandlers(bool haveWheelEventHandlers)
     setNeedsCommit();
 }
 
+void LayerChromium::setNonFastScrollableRegion(const Region& region)
+{
+    if (m_nonFastScrollableRegion == region)
+        return;
+    m_nonFastScrollableRegion = region;
+    m_nonFastScrollableRegionChanged = true;
+    setNeedsCommit();
+}
+
 void LayerChromium::setDoubleSided(bool doubleSided)
 {
     if (m_doubleSided == doubleSided)
@@ -448,13 +484,10 @@ LayerChromium* LayerChromium::parent() const
     return m_parent;
 }
 
-void LayerChromium::setName(const String& name)
-{
-    m_name = name;
-}
-
 void LayerChromium::setNeedsDisplayRect(const FloatRect& dirtyRect)
 {
+    m_updateRect.unite(dirtyRect);
+
     // Simply mark the contents as dirty. For non-root layers, the call to
     // setNeedsCommit will schedule a fresh compositing pass.
     // For the root layer, setNeedsCommit has no effect.
@@ -474,14 +507,21 @@ void LayerChromium::pushPropertiesTo(CCLayerImpl* layer)
     layer->setContentBounds(contentBounds());
     layer->setDebugBorderColor(m_debugBorderColor);
     layer->setDebugBorderWidth(m_debugBorderWidth);
+    layer->setDebugName(m_debugName.isolatedCopy()); // We have to use isolatedCopy() here to safely pass ownership to another thread.
     layer->setDoubleSided(m_doubleSided);
     layer->setDrawsContent(drawsContent());
     layer->setFilters(filters());
     layer->setIsNonCompositedContent(m_isNonCompositedContent);
     layer->setMasksToBounds(m_masksToBounds);
     layer->setScrollable(m_scrollable);
+    layer->setShouldScrollOnMainThread(m_shouldScrollOnMainThread);
     layer->setHaveWheelEventHandlers(m_haveWheelEventHandlers);
-    layer->setName(m_name);
+    // Copying a Region is more expensive than most layer properties, since it involves copying two Vectors that may be
+    // arbitrarily large depending on page content, so we only push the property if it's changed.
+    if (m_nonFastScrollableRegionChanged) {
+        layer->setNonFastScrollableRegion(m_nonFastScrollableRegion);
+        m_nonFastScrollableRegionChanged = false;
+    }
     layer->setOpaque(m_opaque);
     layer->setOpacity(m_opacity);
     layer->setPosition(m_position);
@@ -505,7 +545,7 @@ void LayerChromium::pushPropertiesTo(CCLayerImpl* layer)
     m_updateRect = FloatRect();
 }
 
-PassRefPtr<CCLayerImpl> LayerChromium::createCCLayerImpl()
+PassOwnPtr<CCLayerImpl> LayerChromium::createCCLayerImpl()
 {
     return CCLayerImpl::create(m_layerId);
 }
@@ -522,41 +562,19 @@ void LayerChromium::setDebugBorderWidth(float width)
     setNeedsCommit();
 }
 
-void LayerChromium::setContentsScale(float contentsScale)
+void LayerChromium::setDebugName(const String& debugName)
 {
-    if (!needsContentsScale() || m_contentsScale == contentsScale)
-        return;
-    m_contentsScale = contentsScale;
-    setNeedsDisplay();
+    m_debugName = debugName;
+    setNeedsCommit();
 }
 
-TransformationMatrix LayerChromium::contentToScreenSpaceTransform() const
-{
-    IntSize boundsInLayerSpace = bounds();
-    IntSize boundsInContentSpace = contentBounds();
-
-    TransformationMatrix transform = screenSpaceTransform();
 
-    // Scale from content space to layer space
-    transform.scaleNonUniform(boundsInLayerSpace.width() / static_cast<double>(boundsInContentSpace.width()),
-                              boundsInLayerSpace.height() / static_cast<double>(boundsInContentSpace.height()));
-
-    return transform;
-}
-
-void LayerChromium::addSelfToOccludedScreenSpace(Region& occludedScreenSpace)
+void LayerChromium::setContentsScale(float contentsScale)
 {
-    if (!opaque() || drawOpacity() != 1 || !isPaintedAxisAlignedInScreen())
+    if (!needsContentsScale() || m_contentsScale == contentsScale)
         return;
-
-    FloatRect targetRect = contentToScreenSpaceTransform().mapRect(FloatRect(visibleLayerRect()));
-    occludedScreenSpace.unite(enclosedIntRect(targetRect));
-}
-
-bool LayerChromium::isPaintedAxisAlignedInScreen() const
-{
-    FloatQuad quad = contentToScreenSpaceTransform().mapQuad(FloatQuad(visibleLayerRect()));
-    return quad.isRectilinear();
+    m_contentsScale = contentsScale;
+    setNeedsDisplay();
 }
 
 void LayerChromium::createRenderSurface()
diff --git a/Source/WebCore/platform/graphics/chromium/LayerChromium.h b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
index 897647d2d..86fdf9515 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -39,11 +39,13 @@
 #include "GraphicsContext.h"
 #include "PlatformString.h"
 #include "ProgramBinding.h"
+#include "Region.h"
 #include "RenderSurfaceChromium.h"
 #include "ShaderChromium.h"
 #include "TransformationMatrix.h"
 
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
@@ -52,12 +54,14 @@
 
 namespace WebCore {
 
+class CCAnimationEvent;
 class CCLayerAnimationController;
+class CCLayerAnimationDelegate;
 class CCLayerImpl;
 class CCLayerTreeHost;
 class CCTextureUpdater;
 class GraphicsContext3D;
-class Region;
+class ScrollbarLayerChromium;
 
 // Base class for composited layers. Special layer types are derived from
 // this class.
@@ -96,9 +100,6 @@ public:
     void setMasksToBounds(bool);
     bool masksToBounds() const { return m_masksToBounds; }
 
-    void setName(const String&);
-    const String& name() const { return m_name; }
-
     void setMaskLayer(LayerChromium*);
     LayerChromium* maskLayer() const { return m_maskLayer.get(); }
 
@@ -131,7 +132,9 @@ public:
     const IntPoint& scrollPosition() const { return m_scrollPosition; }
 
     void setScrollable(bool);
+    void setShouldScrollOnMainThread(bool);
     void setHaveWheelEventHandlers(bool);
+    void setNonFastScrollableRegion(const Region&);
 
     IntSize scrollDelta() const { return IntSize(); }
 
@@ -159,17 +162,17 @@ public:
     // These methods typically need to be overwritten by derived classes.
     virtual bool drawsContent() const { return m_isDrawable; }
     virtual void paintContentsIfDirty(const Region& /* occludedScreenSpace */) { }
-    virtual void idlePaintContentsIfDirty() { }
+    virtual void idlePaintContentsIfDirty(const Region& /* occludedScreenSpace */) { }
     virtual void updateCompositorResources(GraphicsContext3D*, CCTextureUpdater&) { }
     virtual void setIsMask(bool) { }
     virtual void unreserveContentsTexture() { }
     virtual void bindContentsTexture() { }
-    virtual void pageScaleChanged() { m_pageScaleDirty = true; }
     virtual void protectVisibleTileTextures() { }
     virtual bool needsContentsScale() const { return false; }
 
     void setDebugBorderColor(const Color&);
     void setDebugBorderWidth(float);
+    void setDebugName(const String&);
 
     virtual void pushPropertiesTo(CCLayerImpl*);
 
@@ -198,14 +201,8 @@ public:
     float contentsScale() const { return m_contentsScale; }
     void setContentsScale(float);
 
-    TransformationMatrix contentToScreenSpaceTransform() const;
-
-    // Adds any opaque visible pixels to the occluded region.
-    virtual void addSelfToOccludedScreenSpace(Region& occludedScreenSpace);
-
     // Returns true if any of the layer's descendants has content to draw.
     bool descendantDrawsContent();
-    virtual void contentChanged() { }
 
     CCLayerTreeHost* layerTreeHost() const { return m_layerTreeHost.get(); }
 
@@ -224,8 +221,17 @@ public:
 
     CCLayerAnimationController* layerAnimationController() { return m_layerAnimationController.get(); }
     void setLayerAnimationController(PassOwnPtr<CCLayerAnimationController>);
+
+    void setLayerAnimationDelegate(CCLayerAnimationDelegate* layerAnimationDelegate) { m_layerAnimationDelegate = layerAnimationDelegate; }
+
     bool hasActiveAnimation() const;
 
+    void setAnimationEvent(const CCAnimationEvent&, double wallClockTime);
+
+    virtual Region opaqueContentsRegion() const { return Region(); };
+
+    virtual ScrollbarLayerChromium* toScrollbarLayerChromium() { return 0; }
+
 protected:
     friend class CCLayerImpl;
     friend class LayerTilerChromium;
@@ -233,8 +239,6 @@ protected:
 
     LayerChromium();
 
-    bool isPaintedAxisAlignedInScreen() const;
-
     void setNeedsCommit();
 
     // This flag is set when layer need repainting/updating.
@@ -249,7 +253,7 @@ protected:
     RefPtr<LayerChromium> m_maskLayer;
 
     // Constructs a CCLayerImpl of the correct runtime type for this LayerChromium type.
-    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl();
     int m_layerId;
 
 private:
@@ -276,13 +280,17 @@ private:
     IntRect m_visibleLayerRect;
     IntPoint m_scrollPosition;
     bool m_scrollable;
+    bool m_shouldScrollOnMainThread;
     bool m_haveWheelEventHandlers;
+    Region m_nonFastScrollableRegion;
+    bool m_nonFastScrollableRegionChanged;
     FloatPoint m_position;
     FloatPoint m_anchorPoint;
     Color m_backgroundColor;
     bool m_backgroundCoversViewport;
     Color m_debugBorderColor;
     float m_debugBorderWidth;
+    String m_debugName;
     float m_opacity;
     FilterOperations m_filters;
     float m_anchorPointZ;
@@ -311,9 +319,9 @@ private:
     IntRect m_drawableContentRect;
     float m_contentsScale;
 
-    String m_name;
-
     bool m_pageScaleDirty;
+
+    CCLayerAnimationDelegate* m_layerAnimationDelegate;
 };
 
 void sortLayers(Vector<RefPtr<LayerChromium> >::iterator, Vector<RefPtr<LayerChromium> >::iterator, void*);
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
index 542b3ad1c..4ed89fd9e 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
@@ -64,13 +64,9 @@
 #include "cc/CCSolidColorDrawQuad.h"
 #include "cc/CCTileDrawQuad.h"
 #include "cc/CCVideoDrawQuad.h"
-#if USE(SKIA)
 #include "Extensions3D.h"
 #include "NativeImageSkia.h"
 #include "PlatformContextSkia.h"
-#elif USE(CG)
-#include <CoreGraphics/CGBitmapContext.h>
-#endif
 #include <wtf/CurrentTime.h>
 #include <wtf/MainThread.h>
 
@@ -114,7 +110,6 @@ static TransformationMatrix screenMatrix(int x, int y, int width, int height)
     return screen;
 }
 
-#if USE(SKIA)
 bool contextSupportsAcceleratedPainting(GraphicsContext3D* context)
 {
     WebCore::Extensions3D* extensions = context->getExtensions();
@@ -133,7 +128,21 @@ bool contextSupportsAcceleratedPainting(GraphicsContext3D* context)
 
     return true;
 }
+
+bool needsLionIOSurfaceReadbackWorkaround()
+{
+#if OS(DARWIN)
+    static SInt32 systemVersion = 0;
+    if (!systemVersion) {
+        if (Gestalt(gestaltSystemVersion, &systemVersion) != noErr)
+            return false;
+    }
+
+    return systemVersion >= 0x1070;
+#else
+    return false;
 #endif
+}
 
 } // anonymous namespace
 
@@ -160,18 +169,18 @@ private:
 };
 
 
-PassOwnPtr<LayerRendererChromium> LayerRendererChromium::create(CCLayerTreeHostImpl* owner, PassRefPtr<GraphicsContext3D> context)
+PassOwnPtr<LayerRendererChromium> LayerRendererChromium::create(LayerRendererChromiumClient* client, PassRefPtr<GraphicsContext3D> context)
 {
-    OwnPtr<LayerRendererChromium> layerRenderer(adoptPtr(new LayerRendererChromium(owner, context)));
+    OwnPtr<LayerRendererChromium> layerRenderer(adoptPtr(new LayerRendererChromium(client, context)));
     if (!layerRenderer->initialize())
         return nullptr;
 
     return layerRenderer.release();
 }
 
-LayerRendererChromium::LayerRendererChromium(CCLayerTreeHostImpl* owner,
+LayerRendererChromium::LayerRendererChromium(LayerRendererChromiumClient* client,
                                              PassRefPtr<GraphicsContext3D> context)
-    : m_owner(owner)
+    : m_client(client)
     , m_currentRenderSurface(0)
     , m_offscreenFramebufferId(0)
     , m_context(context)
@@ -181,15 +190,34 @@ LayerRendererChromium::LayerRendererChromium(CCLayerTreeHostImpl* owner,
 {
 }
 
+class ContextLostCallbackAdapter : public GraphicsContext3D::ContextLostCallback {
+public:
+    static PassOwnPtr<ContextLostCallbackAdapter> create(LayerRendererChromiumClient* client)
+    {
+        return adoptPtr(new ContextLostCallbackAdapter(client));
+    }
+
+    virtual void onContextLost()
+    {
+        m_client->didLoseContext();
+    }
+
+private:
+    explicit ContextLostCallbackAdapter(LayerRendererChromiumClient* client)
+        : m_client(client) { }
+
+    LayerRendererChromiumClient* m_client;
+};
+
 bool LayerRendererChromium::initialize()
 {
     if (!m_context->makeContextCurrent())
         return false;
 
-#if USE(SKIA)
+    m_context->setContextLostCallback(ContextLostCallbackAdapter::create(m_client));
+
     if (settings().acceleratePainting && contextSupportsAcceleratedPainting(m_context.get()))
         m_capabilities.usingAcceleratedPainting = true;
-#endif
 
     WebCore::Extensions3D* extensions = m_context->getExtensions();
     m_capabilities.contextHasCachedFrontBuffer = extensions->supports("GL_CHROMIUM_front_buffer_cached");
@@ -285,6 +313,9 @@ void LayerRendererChromium::setVisible(bool visible)
 {
     if (!visible)
         releaseRenderSurfaceTextures();
+
+    // TODO: Replace setVisibilityCHROMIUM with an extension to explicitly manage front/backbuffers
+    // crbug.com/116049
     if (m_capabilities.usingSetVisibility) {
         Extensions3DChromium* extensions3DChromium = static_cast<Extensions3DChromium*>(m_context->getExtensions());
         extensions3DChromium->setVisibilityCHROMIUM(visible);
@@ -448,7 +479,7 @@ void LayerRendererChromium::drawDebugBorderQuad(const CCDebugBorderDrawQuad* qua
     renderMatrix.translate(0.5 * layerRect.width() + layerRect.x(), 0.5 * layerRect.height() + layerRect.y());
     renderMatrix.scaleNonUniform(layerRect.width(), layerRect.height());
     LayerRendererChromium::toGLMatrix(&glMatrix[0], projectionMatrix() * renderMatrix);
-    GLC(context(), context()->uniformMatrix4fv(program->vertexShader().matrixLocation(), false, &glMatrix[0], 1));
+    GLC(context(), context()->uniformMatrix4fv(program->vertexShader().matrixLocation(), 1, false, &glMatrix[0]));
 
     GLC(context(), context()->uniform4f(program->fragmentShader().colorLocation(), quad->color().red() / 255.0, quad->color().green() / 255.0, quad->color().blue() / 255.0, quad->color().alpha() / 255.0));
 
@@ -603,7 +634,7 @@ void LayerRendererChromium::drawTileQuad(const CCTileDrawQuad* quad)
         float edge[24];
         deviceLayerEdges.toFloatArray(edge);
         deviceLayerBounds.toFloatArray(&edge[12]);
-        GLC(context(), context()->uniform3fv(uniforms.edgeLocation, edge, 8));
+        GLC(context(), context()->uniform3fv(uniforms.edgeLocation, 8, edge));
 
         GLC(context(), context()->uniform4f(uniforms.vertexTexTransformLocation, vertexTexTranslateX, vertexTexTranslateY, vertexTexScaleX, vertexTexScaleY));
         GLC(context(), context()->uniform4f(uniforms.fragmentTexTransformLocation, fragmentTexTranslateX, fragmentTexTranslateY, fragmentTexScaleX, fragmentTexScaleY));
@@ -722,8 +753,8 @@ void LayerRendererChromium::drawYUV(const CCVideoDrawQuad* quad)
     GLC(context(), context()->uniform1i(program->fragmentShader().uTextureLocation(), 2));
     GLC(context(), context()->uniform1i(program->fragmentShader().vTextureLocation(), 3));
 
-    GLC(context(), context()->uniformMatrix3fv(program->fragmentShader().ccMatrixLocation(), 0, const_cast<float*>(CCVideoLayerImpl::yuv2RGB), 1));
-    GLC(context(), context()->uniform3fv(program->fragmentShader().yuvAdjLocation(), const_cast<float*>(CCVideoLayerImpl::yuvAdjust), 1));
+    GLC(context(), context()->uniformMatrix3fv(program->fragmentShader().ccMatrixLocation(), 1, 0, const_cast<float*>(CCVideoLayerImpl::yuv2RGB)));
+    GLC(context(), context()->uniform3fv(program->fragmentShader().yuvAdjLocation(), 1, const_cast<float*>(CCVideoLayerImpl::yuvAdjust)));
 
     const IntSize& bounds = quad->quadRect().size();
     drawTexturedQuad(quad->layerTransform(), bounds.width(), bounds.height(), quad->opacity(), FloatQuad(),
@@ -775,7 +806,7 @@ void LayerRendererChromium::drawStreamTexture(const CCVideoDrawQuad* quad)
     const CCVideoLayerImpl::StreamTextureProgram* program = streamTextureLayerProgram();
     GLC(context(), context()->useProgram(program->program()));
     ASSERT(quad->matrix());
-    GLC(context(), context()->uniformMatrix4fv(program->vertexShader().texMatrixLocation(), false, const_cast<float*>(quad->matrix()), 1));
+    GLC(context(), context()->uniformMatrix4fv(program->vertexShader().texMatrixLocation(), 1, false, const_cast<float*>(quad->matrix())));
 
     drawSingleTextureVideoQuad(quad, program, 1, quad->frame()->textureId(), Extensions3DChromium::GL_TEXTURE_EXTERNAL_OES);
 }
@@ -990,7 +1021,7 @@ void LayerRendererChromium::drawTexturedQuad(const TransformationMatrix& drawMat
     // Apply the projection matrix before sending the transform over to the shader.
     toGLMatrix(&glMatrix[0], m_projectionMatrix * renderMatrix);
 
-    GLC(m_context, m_context->uniformMatrix4fv(matrixLocation, false, &glMatrix[0], 1));
+    GLC(m_context, m_context->uniformMatrix4fv(matrixLocation, 1, false, &glMatrix[0]));
 
     if (quadLocation != -1) {
         float point[8];
@@ -1002,7 +1033,7 @@ void LayerRendererChromium::drawTexturedQuad(const TransformationMatrix& drawMat
         point[5] = quad.p3().y();
         point[6] = quad.p4().x();
         point[7] = quad.p4().y();
-        GLC(m_context, m_context->uniform2fv(quadLocation, point, 4));
+        GLC(m_context, m_context->uniform2fv(quadLocation, 4, point));
     }
 
     if (alphaLocation != -1)
@@ -1039,7 +1070,7 @@ void LayerRendererChromium::swapBuffers(const IntRect& subBuffer)
 
 void LayerRendererChromium::onSwapBuffersComplete()
 {
-    m_owner->onSwapBuffersComplete();
+    m_client->onSwapBuffersComplete();
 }
 
 void LayerRendererChromium::getFramebufferPixels(void *pixels, const IntRect& rect)
@@ -1051,8 +1082,44 @@ void LayerRendererChromium::getFramebufferPixels(void *pixels, const IntRect& re
 
     makeContextCurrent();
 
-    GLC(m_context.get(), m_context->readPixels(rect.x(), rect.y(), rect.width(), rect.height(),
-                                         GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, pixels));
+    bool doWorkaround = needsLionIOSurfaceReadbackWorkaround();
+
+    Platform3DObject temporaryTexture = NullPlatform3DObject;
+    Platform3DObject temporaryFBO = NullPlatform3DObject;
+    GraphicsContext3D* context = m_context.get();
+
+    if (doWorkaround) {
+        // On Mac OS X 10.7, calling glReadPixels against an FBO whose color attachment is an
+        // IOSurface-backed texture causes corruption of future glReadPixels calls, even those on
+        // different OpenGL contexts. It is believed that this is the root cause of top crasher
+        // http://crbug.com/99393. <rdar://problem/10949687>
+
+        temporaryTexture = context->createTexture();
+        GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, temporaryTexture));
+        GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MIN_FILTER, GraphicsContext3D::LINEAR));
+        GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_MAG_FILTER, GraphicsContext3D::LINEAR));
+        GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_S, GraphicsContext3D::CLAMP_TO_EDGE));
+        GLC(context, context->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE));
+        // Copy the contents of the current (IOSurface-backed) framebuffer into a temporary texture.
+        GLC(context, context->copyTexImage2D(GraphicsContext3D::TEXTURE_2D, 0, GraphicsContext3D::RGBA, 0, 0, rect.maxX(), rect.maxY(), 0));
+        temporaryFBO = context->createFramebuffer();
+        // Attach this texture to an FBO, and perform the readback from that FBO.
+        GLC(context, context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, temporaryFBO));
+        GLC(context, context->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, temporaryTexture, 0));
+
+        ASSERT(context->checkFramebufferStatus(GraphicsContext3D::FRAMEBUFFER) == GraphicsContext3D::FRAMEBUFFER_COMPLETE);
+    }
+
+    GLC(context, context->readPixels(rect.x(), rect.y(), rect.width(), rect.height(),
+                                     GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, pixels));
+
+    if (doWorkaround) {
+        // Clean up.
+        GLC(context, context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, 0));
+        GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, 0));
+        GLC(context, context->deleteFramebuffer(temporaryFBO));
+        GLC(context, context->deleteTexture(temporaryTexture));
+    }
 }
 
 ManagedTexture* LayerRendererChromium::getOffscreenLayerTexture()
@@ -1424,12 +1491,12 @@ void LayerRendererChromium::cleanupSharedObjects()
         m_tilerProgram->cleanup(m_context.get());
     if (m_tilerProgramOpaque)
         m_tilerProgramOpaque->cleanup(m_context.get());
-    if (m_tilerProgramAA)
-        m_tilerProgramAA->cleanup(m_context.get());
     if (m_tilerProgramSwizzle)
         m_tilerProgramSwizzle->cleanup(m_context.get());
     if (m_tilerProgramSwizzleOpaque)
         m_tilerProgramSwizzleOpaque->cleanup(m_context.get());
+    if (m_tilerProgramAA)
+        m_tilerProgramAA->cleanup(m_context.get());
     if (m_tilerProgramSwizzleAA)
         m_tilerProgramSwizzleAA->cleanup(m_context.get());
     if (m_canvasLayerProgram)
@@ -1438,18 +1505,24 @@ void LayerRendererChromium::cleanupSharedObjects()
         m_pluginLayerProgram->cleanup(m_context.get());
     if (m_pluginLayerProgramFlip)
         m_pluginLayerProgramFlip->cleanup(m_context.get());
+    if (m_pluginLayerTexRectProgram)
+        m_pluginLayerTexRectProgram->cleanup(m_context.get());
+    if (m_pluginLayerTexRectProgramFlip)
+        m_pluginLayerTexRectProgramFlip->cleanup(m_context.get());
     if (m_renderSurfaceMaskProgram)
         m_renderSurfaceMaskProgram->cleanup(m_context.get());
-    if (m_renderSurfaceMaskProgramAA)
-        m_renderSurfaceMaskProgramAA->cleanup(m_context.get());
     if (m_renderSurfaceProgram)
         m_renderSurfaceProgram->cleanup(m_context.get());
+    if (m_renderSurfaceMaskProgramAA)
+        m_renderSurfaceMaskProgramAA->cleanup(m_context.get());
     if (m_renderSurfaceProgramAA)
         m_renderSurfaceProgramAA->cleanup(m_context.get());
     if (m_videoLayerRGBAProgram)
         m_videoLayerRGBAProgram->cleanup(m_context.get());
     if (m_videoLayerYUVProgram)
         m_videoLayerYUVProgram->cleanup(m_context.get());
+    if (m_videoLayerNativeTextureProgram)
+        m_videoLayerNativeTextureProgram->cleanup(m_context.get());
     if (m_streamTextureLayerProgram)
         m_streamTextureLayerProgram->cleanup(m_context.get());
 
@@ -1457,19 +1530,22 @@ void LayerRendererChromium::cleanupSharedObjects()
     m_headsUpDisplayProgram.clear();
     m_tilerProgram.clear();
     m_tilerProgramOpaque.clear();
-    m_tilerProgramAA.clear();
     m_tilerProgramSwizzle.clear();
     m_tilerProgramSwizzleOpaque.clear();
+    m_tilerProgramAA.clear();
     m_tilerProgramSwizzleAA.clear();
     m_canvasLayerProgram.clear();
     m_pluginLayerProgram.clear();
     m_pluginLayerProgramFlip.clear();
+    m_pluginLayerTexRectProgram.clear();
+    m_pluginLayerTexRectProgramFlip.clear();
     m_renderSurfaceMaskProgram.clear();
-    m_renderSurfaceMaskProgramAA.clear();
     m_renderSurfaceProgram.clear();
+    m_renderSurfaceMaskProgramAA.clear();
     m_renderSurfaceProgramAA.clear();
     m_videoLayerRGBAProgram.clear();
     m_videoLayerYUVProgram.clear();
+    m_videoLayerNativeTextureProgram.clear();
     m_streamTextureLayerProgram.clear();
     if (m_offscreenFramebufferId)
         GLC(m_context.get(), m_context->deleteFramebuffer(m_offscreenFramebufferId));
diff --git a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
index ee9895ae1..91fcf6a51 100644
--- a/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/LayerRendererChromium.h
@@ -42,7 +42,7 @@
 #include "VideoLayerChromium.h"
 #include "cc/CCCanvasLayerImpl.h"
 #include "cc/CCHeadsUpDisplay.h"
-#include "cc/CCLayerTreeHostImpl.h"
+#include "cc/CCLayerTreeHost.h"
 #include "cc/CCPluginLayerImpl.h"
 #include "cc/CCVideoLayerImpl.h"
 #include <wtf/HashMap.h>
@@ -51,43 +51,47 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/Vector.h>
 
-#if USE(CG)
-#include <CoreGraphics/CGContext.h>
-#include <wtf/RetainPtr.h>
-#endif
-
 namespace WebCore {
 
 class CCHeadsUpDisplay;
 class CCLayerImpl;
-class CCLayerTreeHostImpl;
 class CCRenderPass;
 class GeometryBinding;
 class GraphicsContext3D;
 class TrackingTextureAllocator;
 class LayerRendererSwapBuffersCompleteCallbackAdapter;
 
+class LayerRendererChromiumClient {
+public:
+    virtual const IntSize& viewportSize() const = 0;
+    virtual const CCSettings& settings() const = 0;
+    virtual CCLayerImpl* rootLayer() = 0;
+    virtual const CCLayerImpl* rootLayer() const = 0;
+    virtual void didLoseContext() = 0;
+    virtual void onSwapBuffersComplete() = 0;
+};
+
 // Class that handles drawing of composited render layers using GL.
 class LayerRendererChromium {
     WTF_MAKE_NONCOPYABLE(LayerRendererChromium);
 public:
-    static PassOwnPtr<LayerRendererChromium> create(CCLayerTreeHostImpl*, PassRefPtr<GraphicsContext3D>);
+    static PassOwnPtr<LayerRendererChromium> create(LayerRendererChromiumClient*, PassRefPtr<GraphicsContext3D>);
 
     // Must be called in order to allow the LayerRendererChromium to destruct
     void close();
 
     ~LayerRendererChromium();
 
-    const CCSettings& settings() const { return m_owner->settings(); }
+    const CCSettings& settings() const { return m_client->settings(); }
     const LayerRendererCapabilities& capabilities() const { return m_capabilities; }
 
-    CCLayerImpl* rootLayer() { return m_owner->rootLayer(); }
-    const CCLayerImpl* rootLayer() const { return m_owner->rootLayer(); }
+    CCLayerImpl* rootLayer() { return m_client->rootLayer(); }
+    const CCLayerImpl* rootLayer() const { return m_client->rootLayer(); }
 
     GraphicsContext3D* context();
     bool contextSupportsMapSub() const { return m_capabilities.usingMapSub; }
 
-    const IntSize& viewportSize() { return m_owner->viewportSize(); }
+    const IntSize& viewportSize() { return m_client->viewportSize(); }
     int viewportWidth() { return viewportSize().width(); }
     int viewportHeight() { return viewportSize().height(); }
 
@@ -156,7 +160,7 @@ public:
                           int matrixLocation, int alphaLocation, int quadLocation);
 
 private:
-    LayerRendererChromium(CCLayerTreeHostImpl*, PassRefPtr<GraphicsContext3D>);
+    LayerRendererChromium(LayerRendererChromiumClient*, PassRefPtr<GraphicsContext3D>);
     bool initialize();
 
     void drawQuad(const CCDrawQuad*, const FloatRect& surfaceDamageRect);
@@ -200,7 +204,7 @@ private:
     friend class LayerRendererSwapBuffersCompleteCallbackAdapter;
     void onSwapBuffersComplete();
 
-    CCLayerTreeHostImpl* m_owner;
+    LayerRendererChromiumClient* m_client;
 
     LayerRendererCapabilities m_capabilities;
 
diff --git a/Source/WebCore/platform/graphics/chromium/PlatformCanvas.cpp b/Source/WebCore/platform/graphics/chromium/PlatformCanvas.cpp
index a6b25c534..c5e38d6aa 100644
--- a/Source/WebCore/platform/graphics/chromium/PlatformCanvas.cpp
+++ b/Source/WebCore/platform/graphics/chromium/PlatformCanvas.cpp
@@ -29,14 +29,10 @@
 
 #include "GraphicsContext.h"
 
-#if USE(SKIA)
 #include "NativeImageSkia.h"
 #include "PlatformContextSkia.h"
 #include "SkColorPriv.h"
 #include "skia/ext/platform_canvas.h"
-#elif USE(CG)
-#include <CoreGraphics/CGBitmapContext.h>
-#endif
 
 namespace WebCore {
 
@@ -71,62 +67,39 @@ void PlatformCanvas::createBackingCanvas()
     if (m_size.isEmpty())
         return;
 
-#if USE(SKIA)
     m_skiaCanvas = adoptPtr(skia::CreateBitmapCanvas(m_size.width(), m_size.height(), m_opaque));
-#elif USE(CG)
-    size_t bufferSize = m_size.width() * m_size.height() * 4;
-    m_pixelData = adoptArrayPtr(new uint8_t[bufferSize]);
-    memset(m_pixelData.get(), 0, bufferSize);
-#endif
 }
 
 PlatformCanvas::AutoLocker::AutoLocker(PlatformCanvas* canvas)
     : m_canvas(canvas)
-    , m_pixels(0)
 {
-#if USE(SKIA)
     if (m_canvas->m_skiaCanvas) {
         m_bitmap = &m_canvas->m_skiaCanvas->getDevice()->accessBitmap(false);
         m_bitmap->lockPixels();
-
-        if (m_bitmap->config() == SkBitmap::kARGB_8888_Config)
-            m_pixels = static_cast<uint8_t*>(m_bitmap->getPixels());
     } else
         m_bitmap = 0;
-#elif USE(CG)
-    if (canvas->m_pixelData)
-        m_pixels = &canvas->m_pixelData[0];
-#endif
 }
 
 PlatformCanvas::AutoLocker::~AutoLocker()
 {
-#if USE(SKIA)
     if (m_bitmap)
         m_bitmap->unlockPixels();
-#endif
+}
+
+const uint8_t* PlatformCanvas::AutoLocker::pixels() const
+{
+    if (m_bitmap && m_bitmap->config() == SkBitmap::kARGB_8888_Config)
+        return static_cast<const uint8_t*>(m_bitmap->getPixels());
+    return 0;
 }
 
 PlatformCanvas::Painter::Painter(PlatformCanvas* canvas, PlatformCanvas::Painter::TextOption option)
 {
-#if USE(SKIA)
     m_skiaContext = adoptPtr(new PlatformContextSkia(canvas->m_skiaCanvas.get()));
 
     m_skiaContext->setDrawingToImageBuffer(option == GrayscaleText);
 
     m_context = adoptPtr(new GraphicsContext(reinterpret_cast<PlatformGraphicsContext*>(m_skiaContext.get())));
-#elif USE(CG)
-
-    m_colorSpace = CGColorSpaceCreateDeviceRGB();
-    size_t rowBytes = canvas->size().width() * 4;
-    m_contextCG = CGBitmapContextCreate(canvas->m_pixelData.get(),
-                                        canvas->size().width(), canvas->size().height(), 8, rowBytes,
-                                        m_colorSpace.get(),
-                                        kCGImageAlphaPremultipliedFirst | kCGBitmapByteOrder32Host);
-    CGContextTranslateCTM(m_contextCG.get(), 0, canvas->size().height());
-    CGContextScaleCTM(m_contextCG.get(), 1, -1);
-    m_context = adoptPtr(new GraphicsContext(m_contextCG.get()));
-#endif
     context()->save();
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/PlatformCanvas.h b/Source/WebCore/platform/graphics/chromium/PlatformCanvas.h
index fdee71b9f..865f3d521 100644
--- a/Source/WebCore/platform/graphics/chromium/PlatformCanvas.h
+++ b/Source/WebCore/platform/graphics/chromium/PlatformCanvas.h
@@ -31,25 +31,13 @@
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
 
-#if USE(CG)
-#include <CoreGraphics/CGColorSpace.h>
-#include <CoreGraphics/CGContext.h>
-#include <wtf/OwnArrayPtr.h>
-#include <wtf/RetainPtr.h>
-#endif
-
-#if USE(SKIA)
 class SkBitmap;
 class SkCanvas;
-#endif
 
 namespace WebCore {
 
 class GraphicsContext;
-
-#if USE(SKIA)
 class PlatformContextSkia;
-#endif
 
 // A 2D buffer of pixels with an associated GraphicsContext.
 class PlatformCanvas {
@@ -65,13 +53,10 @@ public:
         explicit AutoLocker(PlatformCanvas*);
         ~AutoLocker();
 
-        const uint8_t* pixels() const { return m_pixels; }
+        const uint8_t* pixels() const;
     private:
         PlatformCanvas* m_canvas;
-#if USE(SKIA)
         const SkBitmap* m_bitmap;
-#endif
-        uint8_t* m_pixels;
     };
 
     // Scoped lock class to get temporary access to paint into this canvas.
@@ -88,12 +73,7 @@ public:
         PlatformContextSkia* skiaContext() const { return m_skiaContext.get(); }
     private:
         OwnPtr<GraphicsContext> m_context;
-#if USE(SKIA)
         OwnPtr<PlatformContextSkia> m_skiaContext;
-#elif USE(CG)
-        RetainPtr<CGColorSpaceRef> m_colorSpace;
-        RetainPtr<CGContextRef> m_contextCG;
-#endif
     };
 
     void resize(const IntSize&);
@@ -105,11 +85,7 @@ public:
 private:
     void createBackingCanvas();
 
-#if USE(SKIA)
     OwnPtr<SkCanvas> m_skiaCanvas;
-#elif USE(CG)
-    OwnArrayPtr<uint8_t> m_pixelData;
-#endif
     IntSize m_size;
     bool m_opaque;
 };
diff --git a/Source/WebCore/platform/graphics/chromium/PlatformColor.h b/Source/WebCore/platform/graphics/chromium/PlatformColor.h
index 2eca5b7d9..ab6545dce 100644
--- a/Source/WebCore/platform/graphics/chromium/PlatformColor.h
+++ b/Source/WebCore/platform/graphics/chromium/PlatformColor.h
@@ -28,10 +28,7 @@
 
 #include "Extensions3D.h"
 #include "GraphicsContext3D.h"
-
-#if USE(SKIA)
 #include "SkTypes.h" 
-#endif
 
 namespace WebCore {
 
@@ -39,11 +36,7 @@ class PlatformColor {
 public:
     static GraphicsContext3D::SourceDataFormat format()
     {
-#if USE(SKIA)
         return SK_B32_SHIFT ? GraphicsContext3D::SourceFormatRGBA8 : GraphicsContext3D::SourceFormatBGRA8;
-#elif USE(CG)
-        return GraphicsContext3D::SourceFormatBGRA8;
-#endif
     }
 
     // Returns the most efficient texture format for this platform.
diff --git a/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp
index 079ad2ede..97703957f 100644
--- a/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.cpp
@@ -52,18 +52,7 @@ PluginLayerChromium::PluginLayerChromium()
 {
 }
 
-void PluginLayerChromium::updateCompositorResources(GraphicsContext3D* rendererContext, CCTextureUpdater&)
-{
-    if (!m_needsDisplay)
-        return;
-
-    // PluginLayers are updated externally (outside of the compositor).
-    // |m_dirtyRect| covers the region that has changed since the last composite.
-    m_updateRect = m_dirtyRect;
-    m_dirtyRect = FloatRect();
-}
-
-PassRefPtr<CCLayerImpl> PluginLayerChromium::createCCLayerImpl()
+PassOwnPtr<CCLayerImpl> PluginLayerChromium::createCCLayerImpl()
 {
     return CCPluginLayerImpl::create(m_layerId);
 }
@@ -110,11 +99,5 @@ void PluginLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
     pluginLayer->setIOSurfaceProperties(m_ioSurfaceWidth, m_ioSurfaceHeight, m_ioSurfaceId);
 }
 
-void PluginLayerChromium::invalidateRect(const FloatRect& dirtyRect)
-{
-    setNeedsDisplayRect(dirtyRect);
-    m_dirtyRect.unite(dirtyRect);
-}
-
 }
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h b/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h
index 84365695b..224da814f 100644
--- a/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/PluginLayerChromium.h
@@ -37,9 +37,8 @@ namespace WebCore {
 class PluginLayerChromium : public LayerChromium {
 public:
     static PassRefPtr<PluginLayerChromium> create();
-    virtual void updateCompositorResources(GraphicsContext3D*, CCTextureUpdater&);
 
-    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl();
 
     // Code path for plugins which supply their own texture ID.
     void setTextureId(unsigned textureId);
@@ -55,8 +54,6 @@ public:
 
     virtual void pushPropertiesTo(CCLayerImpl*);
 
-    void invalidateRect(const FloatRect& dirtyRect);
-
 protected:
     PluginLayerChromium();
 
@@ -67,7 +64,6 @@ private:
     int m_ioSurfaceWidth;
     int m_ioSurfaceHeight;
     uint32_t m_ioSurfaceId;
-    FloatRect m_dirtyRect;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.cpp
new file mode 100644
index 000000000..4f7ef9320
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "ScrollbarLayerChromium.h"
+
+#include "Scrollbar.h"
+#include "cc/CCScrollbarLayerImpl.h"
+
+namespace WebCore {
+
+PassOwnPtr<CCLayerImpl> ScrollbarLayerChromium::createCCLayerImpl()
+{
+    return CCScrollbarLayerImpl::create(id());
+}
+
+PassRefPtr<ScrollbarLayerChromium> ScrollbarLayerChromium::create(Scrollbar* scrollbar, int scrollLayerId)
+{
+    return adoptRef(new ScrollbarLayerChromium(scrollbar, scrollLayerId));
+}
+
+ScrollbarLayerChromium::ScrollbarLayerChromium(Scrollbar* scrollbar, int scrollLayerId)
+    : m_scrollbar(scrollbar)
+    , m_scrollLayerId(scrollLayerId)
+    , m_scrollbarOverlayStyle(scrollbar->scrollbarOverlayStyle())
+    , m_isScrollableAreaActive(scrollbar->isScrollableAreaActive())
+    , m_isScrollViewScrollbar(scrollbar->isScrollViewScrollbar())
+    , m_orientation(scrollbar->orientation())
+    , m_controlSize(scrollbar->controlSize())
+{
+}
+
+void ScrollbarLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
+{
+    LayerChromium::pushPropertiesTo(layer);
+
+    CCScrollbarLayerImpl* scrollbarLayer = static_cast<CCScrollbarLayerImpl*>(layer);
+
+    scrollbarLayer->setScrollbarOverlayStyle(m_scrollbarOverlayStyle);
+
+    Vector<IntRect> tickmarks;
+    m_scrollbar->getTickmarks(tickmarks);
+    scrollbarLayer->setTickmarks(tickmarks);
+
+    scrollbarLayer->setIsScrollableAreaActive(m_isScrollableAreaActive);
+    scrollbarLayer->setIsScrollViewScrollbar(m_isScrollViewScrollbar);
+
+    scrollbarLayer->setOrientation(m_orientation);
+
+    scrollbarLayer->setControlSize(m_controlSize);
+
+    scrollbarLayer->setPressedPart(m_scrollbar->pressedPart());
+    scrollbarLayer->setHoveredPart(m_scrollbar->hoveredPart());
+
+    scrollbarLayer->setEnabled(m_scrollbar->enabled());
+}
+
+}
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.h b/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.h
new file mode 100644
index 000000000..ad2539e25
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/ScrollbarLayerChromium.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef ScrollbarLayerChromium_h
+#define ScrollbarLayerChromium_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "LayerChromium.h"
+#include "ScrollTypes.h"
+
+namespace WebCore {
+
+class Scrollbar;
+
+class ScrollbarLayerChromium : public LayerChromium {
+public:
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl();
+    static PassRefPtr<ScrollbarLayerChromium> create(Scrollbar*, int scrollLayerId);
+
+    virtual void pushPropertiesTo(CCLayerImpl*);
+
+    int scrollLayerId() const { return m_scrollLayerId; }
+    virtual ScrollbarLayerChromium* toScrollbarLayerChromium() { return this; }
+
+protected:
+    ScrollbarLayerChromium(Scrollbar*, int scrollLayerId);
+
+private:
+    RefPtr<Scrollbar> m_scrollbar;
+    int m_scrollLayerId;
+
+    ScrollbarOverlayStyle m_scrollbarOverlayStyle;
+    bool m_isScrollableAreaActive;
+    bool m_isScrollViewScrollbar;
+
+    ScrollbarOrientation m_orientation;
+
+    ScrollbarControlSize m_controlSize;
+};
+
+}
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/ShaderChromium.h b/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
index 9499ac7fd..2bd760a99 100644
--- a/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/ShaderChromium.h
@@ -29,10 +29,7 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "PlatformString.h"
-
-#if USE(SKIA)
 #include "SkColorPriv.h"
-#endif
 
 namespace WebCore {
 
diff --git a/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp b/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp
index 35cd35ad3..5ae7ee6a9 100644
--- a/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp
+++ b/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.cpp
@@ -27,7 +27,6 @@
 #include "config.h"
 
 #if USE(ACCELERATED_COMPOSITING)
-#if USE(SKIA)
 
 #include "SkPictureCanvasLayerTextureUpdater.h"
 
@@ -75,5 +74,4 @@ void SkPictureCanvasLayerTextureUpdater::setOpaque(bool opaque)
 }
 
 } // namespace WebCore
-#endif // USE(SKIA)
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h b/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h
index ecdefa411..ff839fe32 100644
--- a/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h
+++ b/Source/WebCore/platform/graphics/chromium/SkPictureCanvasLayerTextureUpdater.h
@@ -28,7 +28,6 @@
 #define SkPictureCanvasLayerTextureUpdater_h
 
 #if USE(ACCELERATED_COMPOSITING)
-#if USE(SKIA)
 
 #include "CanvasLayerTextureUpdater.h"
 #include "SkPicture.h"
@@ -66,6 +65,5 @@ private:
 };
 
 } // namespace WebCore
-#endif // USE(SKIA)
 #endif // USE(ACCELERATED_COMPOSITING)
 #endif // SkPictureCanvasLayerTextureUpdater_h
diff --git a/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.cpp
index ed13546ba..0dc77ada8 100644
--- a/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.cpp
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-PassRefPtr<CCLayerImpl> SolidColorLayerChromium::createCCLayerImpl()
+PassOwnPtr<CCLayerImpl> SolidColorLayerChromium::createCCLayerImpl()
 {
     return CCSolidColorLayerImpl::create(id());
 }
diff --git a/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.h b/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.h
index 1d14890bd..94a54a0ac 100644
--- a/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/SolidColorLayerChromium.h
@@ -38,7 +38,7 @@ class LayerTilerChromium;
 // setBackgroundColor() on the base class.
 class SolidColorLayerChromium : public LayerChromium {
 public:
-    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl();
     static PassRefPtr<SolidColorLayerChromium> create();
 
     virtual ~SolidColorLayerChromium();
diff --git a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
index a9cf7d6fd..0259a23d3 100644
--- a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.cpp
@@ -35,6 +35,7 @@
 #include "MathExtras.h"
 #include "Region.h"
 #include "TextStream.h"
+#include "TraceEvent.h"
 #include "cc/CCLayerImpl.h"
 #include "cc/CCTextureUpdater.h"
 #include "cc/CCTiledLayerImpl.h"
@@ -67,10 +68,10 @@ public:
         m_updateRect = m_dirtyRect;
         m_dirtyRect = IntRect();
     }
+    bool isDirtyForCurrentFrame() { return !m_dirtyRect.isEmpty() && m_updateRect.isEmpty(); }
 
     IntRect m_dirtyRect;
     IntRect m_updateRect;
-    IntRect m_opaqueRect;
     bool m_partialUpdate;
 private:
     explicit UpdatableTile(PassOwnPtr<LayerTextureUpdater::Texture> texture)
@@ -97,7 +98,7 @@ TiledLayerChromium::~TiledLayerChromium()
 {
 }
 
-PassRefPtr<CCLayerImpl> TiledLayerChromium::createCCLayerImpl()
+PassOwnPtr<CCLayerImpl> TiledLayerChromium::createCCLayerImpl()
 {
     return CCTiledLayerImpl::create(id());
 }
@@ -263,10 +264,10 @@ void TiledLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
             invalidTiles.append(tile);
             continue;
         }
-        if (tile->isDirty())
+        if (tile->isDirtyForCurrentFrame())
             continue;
 
-        tiledLayer->pushTileProperties(i, j, tile->managedTexture()->textureId(), tile->m_opaqueRect);
+        tiledLayer->pushTileProperties(i, j, tile->managedTexture()->textureId(), tile->opaqueRect());
     }
     for (Vector<UpdatableTile*>::const_iterator iter = invalidTiles.begin(); iter != invalidTiles.end(); ++iter)
         m_tiler->takeTile((*iter)->i(), (*iter)->j());
@@ -396,17 +397,23 @@ bool TiledLayerChromium::tileNeedsBufferedUpdate(UpdatableTile* tile)
     return true;
 }
 
-void TiledLayerChromium::prepareToUpdateTiles(bool idle, int left, int top, int right, int bottom)
+// FIXME: This gets rolled into CCOcclusionTracker when we stop passing around Region objects.
+static inline TransformationMatrix contentToLayerTransform(const IntSize& boundsInLayerSpace, const IntSize& boundsInContentSpace)
 {
-    // Reset m_updateRect for all tiles.
-    for (CCLayerTilingData::TileMap::const_iterator iter = m_tiler->tiles().begin(); iter != m_tiler->tiles().end(); ++iter) {
-        UpdatableTile* tile = static_cast<UpdatableTile*>(iter->second.get());
-        tile->m_updateRect = IntRect();
-        tile->m_partialUpdate = false;
-    }
+    TransformationMatrix transform;
+    // Scale from content space to layer space
+    transform.scaleNonUniform(boundsInLayerSpace.width() / static_cast<double>(boundsInContentSpace.width()),
+                              boundsInLayerSpace.height() / static_cast<double>(boundsInContentSpace.height()));
+    return transform;
+}
 
+void TiledLayerChromium::prepareToUpdateTiles(bool idle, int left, int top, int right, int bottom, const Region& occludedScreenSpace)
+{
     createTextureUpdaterIfNeeded();
 
+    // Tiles are in the layer's content space, the occluded region is in screen space.
+    TransformationMatrix contentToScreenSpace = screenSpaceTransform() * contentToLayerTransform(bounds(), contentBounds());
+
     // Create tiles as needed, expanding a dirty rect to contain all
     // the dirty regions currently being drawn. All dirty tiles that are to be painted
     // get their m_updateRect set to m_dirtyRect and m_dirtyRect cleared. This way if
@@ -418,6 +425,15 @@ void TiledLayerChromium::prepareToUpdateTiles(bool idle, int left, int top, int
             if (!tile)
                 tile = createTile(i, j);
 
+            // When not idle painting, if the visible region of the tile is occluded, don't reserve a texture or mark it for update.
+            // If any part of the tile is visible, then we need to paint it so the tile is pushed to the impl thread.
+            // This will also avoid painting the tile in the next loop, below.
+            if (!idle) {
+                IntRect visibleTileRect = intersection(m_tiler->tileBounds(i, j), visibleLayerRect());
+                if (occludedScreenSpace.contains(contentToScreenSpace.mapRect(visibleTileRect)))
+                    continue;
+            }
+
             // FIXME: Decide if partial update should be allowed based on cost
             // of update. https://bugs.webkit.org/show_bug.cgi?id=77376
             if (tileOnlyNeedsPartialUpdate(tile) && layerTreeHost() && layerTreeHost()->requestPartialTextureUpdate())
@@ -425,8 +441,10 @@ void TiledLayerChromium::prepareToUpdateTiles(bool idle, int left, int top, int
             else if (tileNeedsBufferedUpdate(tile) && layerTreeHost())
                 layerTreeHost()->deleteTextureAfterCommit(tile->managedTexture()->steal());
 
-            if (!tile->managedTexture()->isValid(m_tiler->tileSize(), m_textureFormat))
+            if (!tile->managedTexture()->isValid(m_tiler->tileSize(), m_textureFormat)) {
+                // Sets the dirty rect to a full-sized tile with border texels.
                 tile->m_dirtyRect = m_tiler->tileRect(tile);
+            }
 
             if (!tile->managedTexture()->reserve(m_tiler->tileSize(), m_textureFormat)) {
                 m_skipsIdlePaint = true;
@@ -474,24 +492,24 @@ void TiledLayerChromium::prepareToUpdateTiles(bool idle, int left, int top, int
 
             IntRect tileRect = m_tiler->tileBounds(i, j);
 
+            // Use m_updateRect as copyAndClearDirty above moved the existing dirty rect to m_updateRect if the tile isn't culled.
+            const IntRect& dirtyRect = tile->m_updateRect;
+            if (dirtyRect.isEmpty())
+                continue;
+
             // Save what was painted opaque in the tile. Keep the old area if the paint didn't touch it, and didn't paint some
             // other part of the tile opaque.
             IntRect tilePaintedRect = intersection(tileRect, m_paintRect);
             IntRect tilePaintedOpaqueRect = intersection(tileRect, paintedOpaqueRect);
             if (!tilePaintedRect.isEmpty()) {
-                IntRect paintInsideTileOpaqueRect = intersection(tile->m_opaqueRect, tilePaintedRect);
+                IntRect paintInsideTileOpaqueRect = intersection(tile->opaqueRect(), tilePaintedRect);
                 bool paintInsideTileOpaqueRectIsNonOpaque = !tilePaintedOpaqueRect.contains(paintInsideTileOpaqueRect);
-                bool opaquePaintNotInsideTileOpaqueRect = !tilePaintedOpaqueRect.isEmpty() && !tile->m_opaqueRect.contains(tilePaintedOpaqueRect);
+                bool opaquePaintNotInsideTileOpaqueRect = !tilePaintedOpaqueRect.isEmpty() && !tile->opaqueRect().contains(tilePaintedOpaqueRect);
 
                 if (paintInsideTileOpaqueRectIsNonOpaque || opaquePaintNotInsideTileOpaqueRect)
-                    tile->m_opaqueRect = tilePaintedOpaqueRect;
+                    tile->setOpaqueRect(tilePaintedOpaqueRect);
             }
 
-            // Use m_updateRect as copyAndClearDirty above moved the existing dirty rect to m_updateRect.
-            const IntRect& dirtyRect = tile->m_updateRect;
-            if (dirtyRect.isEmpty())
-                continue;
-
             // sourceRect starts as a full-sized tile with border texels included.
             IntRect sourceRect = m_tiler->tileRect(tile);
             sourceRect.intersect(dirtyRect);
@@ -535,38 +553,26 @@ void TiledLayerChromium::reserveTextures()
     }
 }
 
-void TiledLayerChromium::addSelfToOccludedScreenSpace(Region& occludedScreenSpace)
+Region TiledLayerChromium::opaqueContentsRegion() const
 {
-    if (m_skipsDraw || drawOpacity() != 1 || !isPaintedAxisAlignedInScreen())
-        return;
+    if (m_skipsDraw)
+        return Region();
 
-    if (opaque()) {
-        LayerChromium::addSelfToOccludedScreenSpace(occludedScreenSpace);
-        return;
-    }
-
-    IntRect visibleRect = visibleLayerRect();
-    TransformationMatrix contentTransform = contentToScreenSpaceTransform();
+    return m_tiler->opaqueRegionInLayerRect(visibleLayerRect());
+}
 
-    // FIXME: Create/Use a FloatRegion for the occludedScreenSpace, instead of a Region based on ints, to avoid this step and get better accuracy between layers in target space.
-    Region tileRegion;
-    int left, top, right, bottom;
-    m_tiler->layerRectToTileIndices(visibleLayerRect(), left, top, right, bottom);
-    for (int j = top; j <= bottom; ++j) {
-        for (int i = left; i <= right; ++i) {
-            UpdatableTile* tile = tileAt(i, j);
-            if (tile) {
-                IntRect visibleTileOpaqueRect = intersection(visibleRect, tile->m_opaqueRect);
-                FloatRect screenRect = contentTransform.mapRect(FloatRect(visibleTileOpaqueRect));
-                IntRect screenIntRect = enclosedIntRect(screenRect);
-                if (!screenIntRect.isEmpty())
-                    occludedScreenSpace.unite(screenIntRect);
-            }
-        }
+void TiledLayerChromium::resetUpdateState()
+{
+    // Reset m_updateRect for all tiles.
+    CCLayerTilingData::TileMap::const_iterator end = m_tiler->tiles().end();
+    for (CCLayerTilingData::TileMap::const_iterator iter = m_tiler->tiles().begin(); iter != end; ++iter) {
+        UpdatableTile* tile = static_cast<UpdatableTile*>(iter->second.get());
+        tile->m_updateRect = IntRect();
+        tile->m_partialUpdate = false;
     }
 }
 
-void TiledLayerChromium::prepareToUpdate(const IntRect& layerRect)
+void TiledLayerChromium::prepareToUpdate(const IntRect& layerRect, const Region& occludedScreenSpace)
 {
     m_skipsDraw = false;
     m_skipsIdlePaint = false;
@@ -575,16 +581,18 @@ void TiledLayerChromium::prepareToUpdate(const IntRect& layerRect)
 
     updateBounds();
 
+    resetUpdateState();
+
     if (layerRect.isEmpty() || !m_tiler->numTiles())
         return;
 
     int left, top, right, bottom;
     m_tiler->layerRectToTileIndices(layerRect, left, top, right, bottom);
 
-    prepareToUpdateTiles(false, left, top, right, bottom);
+    prepareToUpdateTiles(false, left, top, right, bottom, occludedScreenSpace);
 }
 
-void TiledLayerChromium::prepareToUpdateIdle(const IntRect& layerRect)
+void TiledLayerChromium::prepareToUpdateIdle(const IntRect& layerRect, const Region& occludedScreenSpace)
 {
     // Abort if we have already prepared a paint or run out of memory.
     if (m_skipsIdlePaint || !m_paintRect.isEmpty())
@@ -602,33 +610,39 @@ void TiledLayerChromium::prepareToUpdateIdle(const IntRect& layerRect)
     IntRect idlePaintLayerRect = idlePaintRect(layerRect);
     protectTileTextures(idlePaintLayerRect);
 
-    // Expand outwards until we find a dirty row or column to update.
     int left, top, right, bottom;
     m_tiler->layerRectToTileIndices(layerRect, left, top, right, bottom);
+
+    // Prepaint anything that was occluded but inside the layer's visible region.
+    prepareToUpdateTiles(true, left, top, right, bottom, occludedScreenSpace);
+    if (!m_paintRect.isEmpty() || m_skipsIdlePaint)
+        return;
+
+    // Expand outwards until we find a dirty row or column to update.
     int prepaintLeft, prepaintTop, prepaintRight, prepaintBottom;
     m_tiler->layerRectToTileIndices(idlePaintLayerRect, prepaintLeft, prepaintTop, prepaintRight, prepaintBottom);
     while (!m_skipsIdlePaint && (left > prepaintLeft || top > prepaintTop || right < prepaintRight || bottom < prepaintBottom)) {
         if (bottom < prepaintBottom) {
             ++bottom;
-            prepareToUpdateTiles(true, left, bottom, right, bottom);
+            prepareToUpdateTiles(true, left, bottom, right, bottom, occludedScreenSpace);
             if (!m_paintRect.isEmpty() || m_skipsIdlePaint)
                 break;
         }
         if (top > prepaintTop) {
             --top;
-            prepareToUpdateTiles(true, left, top, right, top);
+            prepareToUpdateTiles(true, left, top, right, top, occludedScreenSpace);
             if (!m_paintRect.isEmpty() || m_skipsIdlePaint)
                 break;
         }
         if (left > prepaintLeft) {
             --left;
-            prepareToUpdateTiles(true, left, top, left, bottom);
+            prepareToUpdateTiles(true, left, top, left, bottom, occludedScreenSpace);
             if (!m_paintRect.isEmpty() || m_skipsIdlePaint)
                 break;
         }
         if (right < prepaintRight) {
             ++right;
-            prepareToUpdateTiles(true, right, top, right, bottom);
+            prepareToUpdateTiles(true, right, top, right, bottom, occludedScreenSpace);
             if (!m_paintRect.isEmpty() || m_skipsIdlePaint)
                 break;
         }
diff --git a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
index 2d9995367..6ff901dfd 100644
--- a/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/TiledLayerChromium.h
@@ -66,7 +66,7 @@ public:
 
     virtual void reserveTextures();
 
-    virtual void addSelfToOccludedScreenSpace(Region& occludedScreenSpace);
+    virtual Region opaqueContentsRegion() const;
 
 protected:
     TiledLayerChromium();
@@ -86,11 +86,14 @@ protected:
     // Set invalidations to be potentially repainted during update().
     void invalidateRect(const IntRect& layerRect);
 
+    // Reset state on tiles that will be used for updating the layer.
+    void resetUpdateState();
+
     // Prepare data needed to update textures that intersect with layerRect.
-    void prepareToUpdate(const IntRect& layerRect);
+    void prepareToUpdate(const IntRect& layerRect, const Region& occludedTargetSpace);
 
     // Same as above, but this will try to paint additional surrounding content if idle.
-    void prepareToUpdateIdle(const IntRect& layerRect);
+    void prepareToUpdateIdle(const IntRect& layerRect, const Region& occludedTargetSpace);
 
     // After preparing an update, returns true if more pre-painting is needed.
     bool needsIdlePaint(const IntRect& layerRect);
@@ -102,7 +105,7 @@ protected:
     virtual TextureManager* textureManager() const;
 
 private:
-    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl();
 
     void createTilerIfNeeded();
     void setTilingOption(TilingOption);
@@ -110,7 +113,7 @@ private:
     bool tileOnlyNeedsPartialUpdate(UpdatableTile*);
     bool tileNeedsBufferedUpdate(UpdatableTile*);
 
-    void prepareToUpdateTiles(bool idle, int left, int top, int right, int bottom);
+    void prepareToUpdateTiles(bool idle, int left, int top, int right, int bottom, const Region& occludedTargetSpace);
     IntRect idlePaintRect(const IntRect& visibleLayerRect);
 
     UpdatableTile* tileAt(int, int) const;
diff --git a/Source/WebCore/platform/graphics/chromium/TransparencyWin.cpp b/Source/WebCore/platform/graphics/chromium/TransparencyWin.cpp
index fb749255e..432ca78bd 100644
--- a/Source/WebCore/platform/graphics/chromium/TransparencyWin.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TransparencyWin.cpp
@@ -109,7 +109,7 @@ class TransparencyWin::OwnedBuffers {
 public:
     OwnedBuffers(const IntSize& size, bool needReferenceBuffer)
     {
-        m_destBitmap = ImageBuffer::create(size);
+        m_destBitmap = ImageBuffer::create(size, 1);
 
         if (needReferenceBuffer) {
             m_referenceBitmap.setConfig(SkBitmap::kARGB_8888_Config, size.width(), size.height());
@@ -127,7 +127,7 @@ public:
     // Returns whether the current layer will fix a buffer of the given size.
     bool canHandleSize(const IntSize& size) const
     {
-        return m_destBitmap->size().width() >= size.width() && m_destBitmap->size().height() >= size.height();
+        return m_destBitmap->internalSize().width() >= size.width() && m_destBitmap->internalSize().height() >= size.height();
     }
 
 private:
diff --git a/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.cpp b/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.cpp
index d0fd0ce52..07f04b372 100644
--- a/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.cpp
+++ b/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.cpp
@@ -28,68 +28,88 @@
 #include "TreeSynchronizer.h"
 
 #include "LayerChromium.h"
+#include "ScrollbarLayerChromium.h"
 #include "cc/CCLayerImpl.h"
+#include "cc/CCScrollbarLayerImpl.h"
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
 
-void TreeSynchronizer::addCCLayerImplsToMapRecursive(CCLayerImplMap& map, CCLayerImpl* ccLayerImpl)
+PassOwnPtr<CCLayerImpl> TreeSynchronizer::synchronizeTrees(LayerChromium* layerChromiumRoot, PassOwnPtr<CCLayerImpl> oldCCLayerImplRoot)
 {
-    map.set(ccLayerImpl->id(), ccLayerImpl);
+    OwnPtrCCLayerImplMap oldLayers;
+    RawPtrCCLayerImplMap newLayers;
 
-    const Vector<RefPtr<CCLayerImpl> >& children = ccLayerImpl->children();
+    collectExistingCCLayerImplRecursive(oldLayers, oldCCLayerImplRoot);
+
+    OwnPtr<CCLayerImpl> newTree = synchronizeTreeRecursive(newLayers, oldLayers, layerChromiumRoot);
+
+    updateScrollbarLayerPointersRecursive(newLayers, layerChromiumRoot);
+
+    return newTree.release();
+}
+
+void TreeSynchronizer::collectExistingCCLayerImplRecursive(OwnPtrCCLayerImplMap& oldLayers, PassOwnPtr<CCLayerImpl> popCCLayerImpl)
+{
+    OwnPtr<CCLayerImpl> ccLayerImpl = popCCLayerImpl;
+
+    if (!ccLayerImpl)
+        return;
+
+    Vector<OwnPtr<CCLayerImpl> >& children = ccLayerImpl->m_children;
     for (size_t i = 0; i < children.size(); ++i)
-        addCCLayerImplsToMapRecursive(map, children[i].get());
+        collectExistingCCLayerImplRecursive(oldLayers, children[i].release());
 
-    if (CCLayerImpl* maskLayer = ccLayerImpl->maskLayer())
-        addCCLayerImplsToMapRecursive(map, maskLayer);
+    collectExistingCCLayerImplRecursive(oldLayers, ccLayerImpl->m_maskLayer.release());
+    collectExistingCCLayerImplRecursive(oldLayers, ccLayerImpl->m_replicaLayer.release());
 
-    if (CCLayerImpl* replicaLayer = ccLayerImpl->replicaLayer())
-        addCCLayerImplsToMapRecursive(map, replicaLayer);
+    int id = ccLayerImpl->id();
+    oldLayers.set(id, ccLayerImpl.release());
 }
 
-PassRefPtr<CCLayerImpl> TreeSynchronizer::synchronizeTreeRecursive(LayerChromium* layer, CCLayerImplMap& map)
+PassOwnPtr<CCLayerImpl> TreeSynchronizer::reuseOrCreateCCLayerImpl(RawPtrCCLayerImplMap& newLayers, OwnPtrCCLayerImplMap& oldLayers, LayerChromium* layer)
 {
-    RefPtr<CCLayerImpl> ccLayerImpl;
-    CCLayerImplMap::iterator it = map.find(layer->id());
-    if (it != map.end()) {
-        ccLayerImpl = it->second; // We already have an entry for this, we just need to reparent it.
-        ccLayerImpl->clearChildList();
-    } else {
+    OwnPtr<CCLayerImpl> ccLayerImpl = oldLayers.take(layer->id());
+
+    if (!ccLayerImpl)
         ccLayerImpl = layer->createCCLayerImpl();
-        map.set(layer->id(), ccLayerImpl); // Add it to the map so other layers referencing this one can pick it up.
-    }
 
+    newLayers.set(layer->id(), ccLayerImpl.get());
+    return ccLayerImpl.release();
+}
+
+PassOwnPtr<CCLayerImpl> TreeSynchronizer::synchronizeTreeRecursive(RawPtrCCLayerImplMap& newLayers, OwnPtrCCLayerImplMap& oldLayers, LayerChromium* layer)
+{
+    if (!layer)
+        return nullptr;
+
+    OwnPtr<CCLayerImpl> ccLayerImpl = reuseOrCreateCCLayerImpl(newLayers, oldLayers, layer);
+
+    ccLayerImpl->clearChildList();
     const Vector<RefPtr<LayerChromium> >& children = layer->children();
     for (size_t i = 0; i < children.size(); ++i)
-        ccLayerImpl->addChild(synchronizeTreeRecursive(children[i].get(), map));
-
-    if (LayerChromium* maskLayer = layer->maskLayer())
-        ccLayerImpl->setMaskLayer(synchronizeTreeRecursive(maskLayer, map));
-    else
-        ccLayerImpl->setMaskLayer(0);
+        ccLayerImpl->addChild(synchronizeTreeRecursive(newLayers, oldLayers, children[i].get()));
 
-    if (LayerChromium* replicaLayer = layer->replicaLayer())
-        ccLayerImpl->setReplicaLayer(synchronizeTreeRecursive(replicaLayer, map));
-    else
-        ccLayerImpl->setReplicaLayer(0);
+    ccLayerImpl->setMaskLayer(synchronizeTreeRecursive(newLayers, oldLayers, layer->maskLayer()));
+    ccLayerImpl->setReplicaLayer(synchronizeTreeRecursive(newLayers, oldLayers, layer->replicaLayer()));
 
     layer->pushPropertiesTo(ccLayerImpl.get());
     return ccLayerImpl.release();
 }
 
-PassRefPtr<CCLayerImpl> TreeSynchronizer::synchronizeTrees(LayerChromium* layerChromiumRoot, PassRefPtr<CCLayerImpl> prpOldCCLayerImplRoot)
+void TreeSynchronizer::updateScrollbarLayerPointersRecursive(const RawPtrCCLayerImplMap& newLayers, LayerChromium* layer)
 {
-    RefPtr<CCLayerImpl> oldCCLayerImplRoot = prpOldCCLayerImplRoot;
-    // Build a map from layer IDs to CCLayerImpls so we can reuse layers from the old tree.
-    CCLayerImplMap map;
-    if (oldCCLayerImplRoot)
-        addCCLayerImplsToMapRecursive(map, oldCCLayerImplRoot.get());
+    const Vector<RefPtr<LayerChromium> >& children = layer->children();
+    for (size_t i = 0; i < children.size(); ++i)
+        updateScrollbarLayerPointersRecursive(newLayers, children[i].get());
 
-    // Recursively build the new layer tree.
-    RefPtr<CCLayerImpl> newCCLayerImplRoot = synchronizeTreeRecursive(layerChromiumRoot, map);
+    ScrollbarLayerChromium* scrollbarLayer = layer->toScrollbarLayerChromium();
+    if (!scrollbarLayer)
+        return;
 
-    return newCCLayerImplRoot.release();
+    CCScrollbarLayerImpl* ccScrollbarLayerImpl = static_cast<CCScrollbarLayerImpl*>(newLayers.get(scrollbarLayer->id()));
+    ASSERT(ccScrollbarLayerImpl);
+    ccScrollbarLayerImpl->setScrollLayer(newLayers.get(scrollbarLayer->scrollLayerId()));
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.h b/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.h
index a4e494217..1dbeb8bed 100644
--- a/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.h
+++ b/Source/WebCore/platform/graphics/chromium/TreeSynchronizer.h
@@ -28,7 +28,8 @@
 
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
-#include <wtf/PassRefPtr.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
@@ -40,16 +41,19 @@ WTF_MAKE_NONCOPYABLE(TreeSynchronizer);
 public:
     // Accepts a LayerChromium tree and returns a reference to a CCLayerImpl tree that duplicates the structure
     // of the LayerChromium tree, reusing the CCLayerImpls in the tree provided by oldCCLayerImplRoot if possible.
-    static PassRefPtr<CCLayerImpl> synchronizeTrees(LayerChromium* layerRoot, PassRefPtr<CCLayerImpl> oldCCLayerImplRoot);
+    static PassOwnPtr<CCLayerImpl> synchronizeTrees(LayerChromium* layerRoot, PassOwnPtr<CCLayerImpl> oldCCLayerImplRoot);
 
 private:
     TreeSynchronizer(); // Not instantiable.
 
-    typedef HashMap<int, RefPtr<CCLayerImpl> > CCLayerImplMap;
+    typedef HashMap<int, OwnPtr<CCLayerImpl> > OwnPtrCCLayerImplMap;
+    typedef HashMap<int, CCLayerImpl*> RawPtrCCLayerImplMap;
 
     // Declared as static member functions so they can access functions on LayerChromium as a friend class.
-    static void addCCLayerImplsToMapRecursive(CCLayerImplMap&, CCLayerImpl*);
-    static PassRefPtr<CCLayerImpl> synchronizeTreeRecursive(LayerChromium*, CCLayerImplMap&);
+    static PassOwnPtr<CCLayerImpl> reuseOrCreateCCLayerImpl(RawPtrCCLayerImplMap& newLayers, OwnPtrCCLayerImplMap& oldLayers, LayerChromium*);
+    static void collectExistingCCLayerImplRecursive(OwnPtrCCLayerImplMap& oldLayers, PassOwnPtr<CCLayerImpl>);
+    static PassOwnPtr<CCLayerImpl> synchronizeTreeRecursive(RawPtrCCLayerImplMap& newLayers, OwnPtrCCLayerImplMap& oldLayers, LayerChromium*);
+    static void updateScrollbarLayerPointersRecursive(const RawPtrCCLayerImplMap& newLayers, LayerChromium*);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
index 3b44eda38..e6911981e 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
@@ -52,17 +52,11 @@ VideoLayerChromium::~VideoLayerChromium()
 {
 }
 
-PassRefPtr<CCLayerImpl> VideoLayerChromium::createCCLayerImpl()
+PassOwnPtr<CCLayerImpl> VideoLayerChromium::createCCLayerImpl()
 {
     return CCVideoLayerImpl::create(m_layerId, m_provider);
 }
 
-void VideoLayerChromium::contentChanged()
-{
-    m_updateRect = FloatRect(FloatPoint(), contentBounds());
-    setNeedsDisplay();
-}
-
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
index 65cf5c668..1f2e92012 100644
--- a/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/VideoLayerChromium.h
@@ -48,9 +48,7 @@ public:
     static PassRefPtr<VideoLayerChromium> create(VideoFrameProvider* = 0);
     virtual ~VideoLayerChromium();
 
-    virtual PassRefPtr<CCLayerImpl> createCCLayerImpl();
-
-    void contentChanged();
+    virtual PassOwnPtr<CCLayerImpl> createCCLayerImpl();
 
 private:
     explicit VideoLayerChromium(VideoFrameProvider*);
diff --git a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
index 74db7f13e..e3e19e258 100644
--- a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
+++ b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
@@ -54,6 +54,7 @@ WebGLLayerChromium::WebGLLayerChromium()
     , m_textureId(0)
     , m_textureChanged(true)
     , m_textureUpdated(false)
+    , m_contextLost(false)
     , m_drawingBuffer(0)
 {
 }
@@ -66,17 +67,23 @@ WebGLLayerChromium::~WebGLLayerChromium()
 
 bool WebGLLayerChromium::drawsContent() const
 {
-    return LayerChromium::drawsContent() && context() && (context()->getExtensions()->getGraphicsResetStatusARB() == GraphicsContext3D::NO_ERROR);
+    return LayerChromium::drawsContent() && !m_contextLost;
 }
 
-void WebGLLayerChromium::updateCompositorResources(GraphicsContext3D* rendererContext, CCTextureUpdater&)
+void WebGLLayerChromium::paintContentsIfDirty(const Region&)
 {
-    if (!drawsContent())
+    if (!drawsContent() || !m_needsDisplay || !m_textureUpdated)
         return;
 
-    if (!m_needsDisplay)
-        return;
+    drawingBuffer()->publishToPlatformLayer();
+    context()->markLayerComposited();
+    m_needsDisplay = false;
+    m_textureUpdated = false;
+    m_contextLost = context()->getExtensions()->getGraphicsResetStatusARB() != GraphicsContext3D::NO_ERROR;
+}
 
+void WebGLLayerChromium::updateCompositorResources(GraphicsContext3D* rendererContext, CCTextureUpdater&)
+{
     if (m_textureChanged) {
         rendererContext->bindTexture(GraphicsContext3D::TEXTURE_2D, m_textureId);
         // Set the min-mag filters to linear and wrap modes to GL_CLAMP_TO_EDGE
@@ -87,15 +94,6 @@ void WebGLLayerChromium::updateCompositorResources(GraphicsContext3D* rendererCo
         rendererContext->texParameteri(GraphicsContext3D::TEXTURE_2D, GraphicsContext3D::TEXTURE_WRAP_T, GraphicsContext3D::CLAMP_TO_EDGE);
         m_textureChanged = false;
     }
-    // Update the contents of the texture used by the compositor.
-    if (m_needsDisplay && m_textureUpdated) {
-        // publishToPlatformLayer prepares the contents of the off-screen render target for use by the compositor.
-        drawingBuffer()->publishToPlatformLayer();
-        context()->markLayerComposited();
-        m_updateRect = FloatRect(FloatPoint(), bounds());
-        m_needsDisplay = false;
-        m_textureUpdated = false;
-    }
 }
 
 void WebGLLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
@@ -110,26 +108,35 @@ void WebGLLayerChromium::pushPropertiesTo(CCLayerImpl* layer)
 
 bool WebGLLayerChromium::paintRenderedResultsToCanvas(ImageBuffer* imageBuffer)
 {
-    if (m_textureUpdated || !layerRendererContext() || !drawsContent())
+    if (m_textureUpdated || !m_drawingBuffer || !drawsContent())
         return false;
 
     IntSize framebufferSize = context()->getInternalFramebufferSize();
-    ASSERT(layerRendererContext());
 
-    // This would ideally be done in the webgl context, but that isn't possible yet.
-    Platform3DObject framebuffer = layerRendererContext()->createFramebuffer();
-    layerRendererContext()->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, framebuffer);
-    layerRendererContext()->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, m_textureId, 0);
+    // Since we're using the same context as WebGL, we have to restore any state we change (in this case, just the framebuffer binding).
+    // FIXME: The WebGLRenderingContext tracks the current framebuffer binding, it would be slightly more efficient to use this value
+    // rather than querying it off of the context.
+    GC3Dint previousFramebuffer = 0;
+    context()->getIntegerv(GraphicsContext3D::FRAMEBUFFER_BINDING, &previousFramebuffer);
+
+    Platform3DObject framebuffer = context()->createFramebuffer();
+    context()->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, framebuffer);
+    context()->framebufferTexture2D(GraphicsContext3D::FRAMEBUFFER, GraphicsContext3D::COLOR_ATTACHMENT0, GraphicsContext3D::TEXTURE_2D, m_textureId, 0);
 
-    Extensions3DChromium* extensions = static_cast<Extensions3DChromium*>(layerRendererContext()->getExtensions());
+    Extensions3DChromium* extensions = static_cast<Extensions3DChromium*>(context()->getExtensions());
     extensions->paintFramebufferToCanvas(framebuffer, framebufferSize.width(), framebufferSize.height(), !context()->getContextAttributes().premultipliedAlpha, imageBuffer);
-    layerRendererContext()->deleteFramebuffer(framebuffer);
+    context()->deleteFramebuffer(framebuffer);
+
+    context()->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, previousFramebuffer);
     return true;
 }
 
-void WebGLLayerChromium::contentChanged()
+void WebGLLayerChromium::setNeedsDisplayRect(const FloatRect& dirtyRect)
 {
+    LayerChromium::setNeedsDisplayRect(dirtyRect);
+
     m_textureUpdated = true;
+
     // If WebGL commands are issued outside of a the animation callbacks, then use
     // call rateLimitOffscreenContextCHROMIUM() to keep the context from getting too far ahead.
     if (layerTreeHost())
@@ -161,6 +168,7 @@ void WebGLLayerChromium::setDrawingBuffer(DrawingBuffer* drawingBuffer)
     GraphicsContext3D::Attributes attributes = context()->getContextAttributes();
     m_hasAlpha = attributes.alpha;
     m_premultipliedAlpha = attributes.premultipliedAlpha;
+    m_contextLost = context()->getExtensions()->getGraphicsResetStatusARB() != GraphicsContext3D::NO_ERROR;
 }
 
 GraphicsContext3D* WebGLLayerChromium::context() const
@@ -171,15 +179,6 @@ GraphicsContext3D* WebGLLayerChromium::context() const
     return 0;
 }
 
-GraphicsContext3D* WebGLLayerChromium::layerRendererContext()
-{
-    // FIXME: In the threaded case, paintRenderedResultsToCanvas must be
-    // refactored to be asynchronous. Currently this is unimplemented.
-    if (!layerTreeHost() || CCProxy::hasImplThread())
-        return 0;
-    return layerTreeHost()->context();
-}
-
 }
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h
index 4dc68a330..af138fa1e 100644
--- a/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h
+++ b/Source/WebCore/platform/graphics/chromium/WebGLLayerChromium.h
@@ -53,9 +53,10 @@ public:
     void setTextureId(unsigned textureId) { m_textureId = textureId; }
 
     virtual bool drawsContent() const;
+    virtual void paintContentsIfDirty(const Region&);
     virtual void updateCompositorResources(GraphicsContext3D*, CCTextureUpdater&);
     virtual void pushPropertiesTo(CCLayerImpl*);
-    virtual void contentChanged();
+    virtual void setNeedsDisplayRect(const FloatRect&);
     bool paintRenderedResultsToCanvas(ImageBuffer*);
 
     GraphicsContext3D* context() const;
@@ -66,13 +67,12 @@ private:
     WebGLLayerChromium();
     friend class WebGLLayerChromiumRateLimitTask;
 
-    GraphicsContext3D* layerRendererContext();
-
     bool m_hasAlpha;
     bool m_premultipliedAlpha;
     unsigned m_textureId;
     bool m_textureChanged;
     bool m_textureUpdated;
+    bool m_contextLost;
 
     // The DrawingBuffer holding the WebGL contents for this layer.
     // A reference is not held here, because the DrawingBuffer already holds
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCActiveGestureAnimation.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCActiveGestureAnimation.cpp
new file mode 100644
index 000000000..556e46b4e
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCActiveGestureAnimation.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCActiveGestureAnimation.h"
+
+#include "cc/CCGestureCurve.h"
+
+namespace WebCore {
+
+PassOwnPtr<CCActiveGestureAnimation> CCActiveGestureAnimation::create(double startTime, PassOwnPtr<CCGestureCurve> curve, CCGestureCurveTarget* target)
+{
+    return adoptPtr(new CCActiveGestureAnimation(startTime, curve, target));
+}
+
+CCActiveGestureAnimation::CCActiveGestureAnimation(double startTime, PassOwnPtr<CCGestureCurve> curve, CCGestureCurveTarget* target)
+    : m_startTime(startTime)
+    , m_gestureCurve(curve)
+    , m_gestureCurveTarget(target)
+{
+}
+
+CCActiveGestureAnimation::~CCActiveGestureAnimation()
+{
+}
+
+bool CCActiveGestureAnimation::animate(double time)
+{
+    // CCGestureCurves used zero-based time, so subtract start-time.
+    return m_gestureCurve->apply(time - m_startTime, m_gestureCurveTarget);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCActiveGestureAnimation.h b/Source/WebCore/platform/graphics/chromium/cc/CCActiveGestureAnimation.h
new file mode 100644
index 000000000..c71b225df
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCActiveGestureAnimation.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCActiveGestureAnimation_h
+#define CCActiveGestureAnimation_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class CCGestureCurve;
+class CCGestureCurveTarget;
+
+class CCActiveGestureAnimation {
+    WTF_MAKE_NONCOPYABLE(CCActiveGestureAnimation);
+public:
+    static PassOwnPtr<CCActiveGestureAnimation> create(double startTime, PassOwnPtr<CCGestureCurve>, CCGestureCurveTarget*);
+    ~CCActiveGestureAnimation();
+
+    bool animate(double time);
+
+private:
+    CCActiveGestureAnimation(double startTime, PassOwnPtr<CCGestureCurve>, CCGestureCurveTarget*);
+
+    double m_startTime;
+    OwnPtr<CCGestureCurve> m_gestureCurve;
+    CCGestureCurveTarget* m_gestureCurveTarget;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.cpp
new file mode 100644
index 000000000..9f41844ca
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCAnimationEvents.h"
+
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+CCAnimationEvent::CCAnimationEvent(int layerId)
+    : m_layerId(layerId)
+{
+}
+
+CCAnimationEvent::~CCAnimationEvent()
+{
+}
+
+const CCAnimationStartedEvent* CCAnimationEvent::toAnimationStartedEvent() const
+{
+    ASSERT(type() == Started);
+    return static_cast<const CCAnimationStartedEvent*>(this);
+}
+
+const CCAnimationFinishedEvent* CCAnimationEvent::toAnimationFinishedEvent() const
+{
+    ASSERT(type() == Finished);
+    return static_cast<const CCAnimationFinishedEvent*>(this);
+}
+
+PassOwnPtr<CCAnimationStartedEvent> CCAnimationStartedEvent::create(int layerId)
+{
+    return adoptPtr(new CCAnimationStartedEvent(layerId));
+}
+
+CCAnimationStartedEvent::CCAnimationStartedEvent(int layerId)
+    : CCAnimationEvent(layerId)
+{
+}
+
+CCAnimationStartedEvent::~CCAnimationStartedEvent()
+{
+}
+
+CCAnimationEvent::Type CCAnimationStartedEvent::type() const
+{
+    return Started;
+}
+
+PassOwnPtr<CCAnimationFinishedEvent> CCAnimationFinishedEvent::create(int layerId, int animationId)
+{
+    return adoptPtr(new CCAnimationFinishedEvent(layerId, animationId));
+}
+
+CCAnimationFinishedEvent::CCAnimationFinishedEvent(int layerId, int animationId)
+    : CCAnimationEvent(layerId)
+    , m_animationId(animationId)
+{
+}
+
+CCAnimationFinishedEvent::~CCAnimationFinishedEvent()
+{
+}
+
+CCAnimationEvent::Type CCAnimationFinishedEvent::type() const
+{
+    return Finished;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.h b/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.h
index b21a79e31..da94e1e27 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCAnimationEvents.h
@@ -25,20 +25,65 @@
 #ifndef CCAnimationEvents_h
 #define CCAnimationEvents_h
 
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
+class CCAnimationStartedEvent;
+class CCAnimationFinishedEvent;
+
+class CCAnimationEvent {
+public:
+    enum Type { Started, Finished };
+
+    virtual ~CCAnimationEvent();
+
+    virtual Type type() const = 0;
+
+    int layerId() const { return m_layerId; }
+
+    const CCAnimationStartedEvent* toAnimationStartedEvent() const;
+    const CCAnimationFinishedEvent* toAnimationFinishedEvent() const;
+
+protected:
+    CCAnimationEvent(int layerId);
+
+private:
+    int m_layerId;
+};
+
+// Indicates that an animation has started on a particular layer.
+class CCAnimationStartedEvent : public CCAnimationEvent {
+public:
+    static PassOwnPtr<CCAnimationStartedEvent> create(int layerId);
+
+    virtual ~CCAnimationStartedEvent();
+
+    virtual Type type() const;
+
+private:
+    explicit CCAnimationStartedEvent(int layerId);
+};
+
 // Indicates that an animation has started on a particular layer.
-struct CCAnimationStartedEvent {
-    CCAnimationStartedEvent(int layerID, double time)
-        : layerID(layerID)
-        , time(time) { }
-    int layerID;
-    double time;
+class CCAnimationFinishedEvent : public CCAnimationEvent {
+public:
+    static PassOwnPtr<CCAnimationFinishedEvent> create(int layerId, int animationId);
+
+    virtual ~CCAnimationFinishedEvent();
+
+    virtual Type type() const;
+
+    int animationId() const { return m_animationId; }
+
+private:
+    CCAnimationFinishedEvent(int layerId, int animationId);
+
+    int m_animationId;
 };
 
-typedef Vector<CCAnimationStartedEvent> CCAnimationEventsVector;
+typedef Vector<OwnPtr<CCAnimationEvent> > CCAnimationEventsVector;
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h
index 9126a7d44..c96af246e 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCCanvasLayerImpl.h
@@ -34,9 +34,9 @@ namespace WebCore {
 
 class CCCanvasLayerImpl : public CCLayerImpl {
 public:
-    static PassRefPtr<CCCanvasLayerImpl> create(int id)
+    static PassOwnPtr<CCCanvasLayerImpl> create(int id)
     {
-        return adoptRef(new CCCanvasLayerImpl(id));
+        return adoptPtr(new CCCanvasLayerImpl(id));
     }
     virtual ~CCCanvasLayerImpl();
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.cpp
index 2d6f43f31..6a062caca 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.cpp
@@ -56,7 +56,7 @@ CCDamageTracker::~CCDamageTracker()
 {
 }
 
-void CCDamageTracker::updateDamageTrackingState(const Vector<RefPtr<CCLayerImpl> >& layerList, int targetSurfaceLayerID, CCLayerImpl* targetSurfaceMaskLayer)
+void CCDamageTracker::updateDamageTrackingState(const Vector<CCLayerImpl*>& layerList, int targetSurfaceLayerID, CCLayerImpl* targetSurfaceMaskLayer)
 {
     //
     // This function computes the "damage rect" of a target surface, and updates the state
@@ -130,7 +130,7 @@ void CCDamageTracker::updateDamageTrackingState(const Vector<RefPtr<CCLayerImpl>
 
     // If the target surface already knows its entire region is damaged, we can return early.
     // FIXME: this should go away, or will be cleaner, after refactoring into RenderPass/RenderSchedule.
-    CCLayerImpl* layer = layerList[0].get();
+    CCLayerImpl* layer = layerList[0];
     CCRenderSurface* targetSurface = layer->targetRenderSurface();
 
     if (m_forceFullDamageNextUpdate || targetSurface->surfacePropertyChangedOnlyFromDescendant()) {
@@ -161,12 +161,12 @@ void CCDamageTracker::saveRectForNextFrame(int layerID, const FloatRect& targetS
     m_nextRectHistory->set(layerID, targetSpaceRect);
 }
 
-FloatRect CCDamageTracker::trackDamageFromActiveLayers(const Vector<RefPtr<CCLayerImpl> >& layerList, int targetSurfaceLayerID)
+FloatRect CCDamageTracker::trackDamageFromActiveLayers(const Vector<CCLayerImpl*>& layerList, int targetSurfaceLayerID)
 {
     FloatRect damageRect = FloatRect();
 
     for (unsigned layerIndex = 0; layerIndex < layerList.size(); ++layerIndex) {
-        CCLayerImpl* layer = layerList[layerIndex].get();
+        CCLayerImpl* layer = layerList[layerIndex];
 
         if (CCLayerTreeHostCommon::renderSurfaceContributesToTarget<CCLayerImpl>(layer, targetSurfaceLayerID))
             extendDamageForRenderSurface(layer, damageRect);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.h b/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.h
index d428f26d1..7a629c478 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCDamageTracker.h
@@ -44,13 +44,13 @@ public:
     ~CCDamageTracker();
 
     void forceFullDamageNextUpdate() { m_forceFullDamageNextUpdate = true; }
-    void updateDamageTrackingState(const Vector<RefPtr<CCLayerImpl> >& layerList, int targetSurfaceLayerID, CCLayerImpl* targetSurfaceMaskLayer);
+    void updateDamageTrackingState(const Vector<CCLayerImpl*>& layerList, int targetSurfaceLayerID, CCLayerImpl* targetSurfaceMaskLayer);
     const FloatRect& currentDamageRect() { return m_currentDamageRect; }
 
 private:
     CCDamageTracker();
 
-    FloatRect trackDamageFromActiveLayers(const Vector<RefPtr<CCLayerImpl> >& layerList, int targetSurfaceLayerID);
+    FloatRect trackDamageFromActiveLayers(const Vector<CCLayerImpl*>& layerList, int targetSurfaceLayerID);
     FloatRect trackDamageFromSurfaceMask(CCLayerImpl* targetSurfaceMaskLayer);
     FloatRect trackDamageFromLeftoverRects();
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCGestureCurve.h b/Source/WebCore/platform/graphics/chromium/cc/CCGestureCurve.h
new file mode 100644
index 000000000..3ef935b6a
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCGestureCurve.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCGestureCurve_h
+#define CCGestureCurve_h
+
+namespace WebCore {
+
+class IntPoint;
+
+class CCGestureCurveTarget {
+public:
+    virtual void setScrollIncrement(const IntPoint&) = 0;
+    // FIXME: add interfaces for setScroll(), setPageScaleAndScroll(), etc.
+
+protected:
+    virtual ~CCGestureCurveTarget() { }
+};
+
+class CCGestureCurve {
+public:
+    virtual ~CCGestureCurve() { }
+
+    virtual bool apply(double time, CCGestureCurveTarget*) = 0;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCInputHandler.h b/Source/WebCore/platform/graphics/chromium/cc/CCInputHandler.h
index 6c055994c..33721f1df 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCInputHandler.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCInputHandler.h
@@ -72,8 +72,8 @@ public:
     virtual void startPageScaleAnimation(const IntSize& targetPosition,
                                          bool anchorPoint,
                                          float pageScale,
-                                         double startTimeMs,
-                                         double durationMs) = 0;
+                                         double startTime,
+                                         double duration) = 0;
 
 protected:
     CCInputHandlerClient() { }
@@ -87,7 +87,7 @@ public:
     virtual ~CCInputHandler() { }
 
     virtual int identifier() const = 0;
-    virtual void willDraw(double frameDisplayTimeMs) = 0;
+    virtual void willDraw(double monotonicTime) = 0;
 
 protected:
     CCInputHandler() { }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp
index b615c736c..ae41fe069 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.cpp
@@ -42,31 +42,173 @@ namespace WebCore {
 namespace {
 
 template <class Keyframe>
-bool keyframesAreSorted(const Vector<Keyframe>& keyframes)
+void insertKeyframe(PassOwnPtr<Keyframe> popKeyframe, Vector<OwnPtr<Keyframe> >& keyframes)
 {
-    if (!keyframes.size())
-        return true;
-
-    for (size_t i = 0; i < keyframes.size() - 1; ++i) {
-        if (keyframes[i].time > keyframes[i+1].time)
-            return false;
+    OwnPtr<Keyframe> keyframe = popKeyframe;
+
+    // Usually, the keyframes will be added in order, so this loop would be unnecessary and
+    // we should skip it if possible.
+    if (!keyframes.isEmpty() && keyframe->time() < keyframes.last()->time()) {
+        for (size_t i = 0; i < keyframes.size(); ++i) {
+            if (keyframe->time() < keyframes[i]->time()) {
+                keyframes.insert(i, keyframe.release());
+                return;
+            }
+        }
     }
 
-    return true;
+    keyframes.append(keyframe.release());
+}
+
+PassOwnPtr<CCTimingFunction> cloneTimingFunction(const CCTimingFunction* timingFunction)
+{
+    ASSERT(timingFunction);
+    OwnPtr<CCAnimationCurve> curve(timingFunction->clone());
+    return adoptPtr(static_cast<CCTimingFunction*>(curve.leakPtr()));
 }
 
 } // namespace
 
-PassOwnPtr<CCKeyframedFloatAnimationCurve> CCKeyframedFloatAnimationCurve::create(const Vector<CCFloatKeyframe>& keyframes)
+CCKeyframe::CCKeyframe(double time, PassOwnPtr<CCTimingFunction> timingFunction)
+    : m_time(time)
+    , m_timingFunction(timingFunction)
+{
+}
+
+CCKeyframe::~CCKeyframe()
+{
+}
+
+double CCKeyframe::time() const
+{
+    return m_time;
+}
+
+const CCTimingFunction* CCKeyframe::timingFunction() const
+{
+    return m_timingFunction.get();
+}
+
+PassOwnPtr<CCFloatKeyframe> CCFloatKeyframe::create(double time, float value, PassOwnPtr<CCTimingFunction> timingFunction)
+{
+    return adoptPtr(new CCFloatKeyframe(time, value, timingFunction));
+}
+
+CCFloatKeyframe::CCFloatKeyframe(double time, float value, PassOwnPtr<CCTimingFunction> timingFunction)
+    : CCKeyframe(time, timingFunction)
+    , m_value(value)
+{
+}
+
+CCFloatKeyframe::~CCFloatKeyframe()
+{
+}
+
+float CCFloatKeyframe::value() const
 {
-    if (!keyframes.size() || !keyframesAreSorted(keyframes))
-        return nullptr;
+    return m_value;
+}
 
-    return adoptPtr(new CCKeyframedFloatAnimationCurve(keyframes));
+PassOwnPtr<CCFloatKeyframe> CCFloatKeyframe::clone() const
+{
+    return CCFloatKeyframe::create(time(), value(), timingFunction() ? cloneTimingFunction(timingFunction()) : nullptr);
 }
 
-CCKeyframedFloatAnimationCurve::CCKeyframedFloatAnimationCurve(const Vector<CCFloatKeyframe>& keyframes)
-    : m_keyframes(keyframes)
+PassOwnPtr<CCTransformKeyframe> CCTransformKeyframe::create(double time, const TransformOperations& value, PassOwnPtr<CCTimingFunction> timingFunction)
+{
+    return adoptPtr(new CCTransformKeyframe(time, value, timingFunction));
+}
+
+CCTransformKeyframe::CCTransformKeyframe(double time, const TransformOperations& value, PassOwnPtr<CCTimingFunction> timingFunction)
+    : CCKeyframe(time, timingFunction)
+    , m_value(value)
+{
+}
+
+CCTransformKeyframe::~CCTransformKeyframe()
+{
+}
+
+const TransformOperations& CCTransformKeyframe::value() const
+{
+    return m_value;
+}
+
+PassOwnPtr<CCTransformKeyframe> CCTransformKeyframe::clone() const
+{
+    // We need to do a deep copy the m_value may contain ref pointers to TransformOperation objects.
+    TransformOperations operations;
+    for (size_t j = 0; j < m_value.size(); ++j) {
+        TransformOperation::OperationType operationType = m_value.operations()[j]->getOperationType();
+        switch (operationType) {
+        case TransformOperation::SCALE_X:
+        case TransformOperation::SCALE_Y:
+        case TransformOperation::SCALE_Z:
+        case TransformOperation::SCALE_3D:
+        case TransformOperation::SCALE: {
+            ScaleTransformOperation* transform = static_cast<ScaleTransformOperation*>(m_value.operations()[j].get());
+            operations.operations().append(ScaleTransformOperation::create(transform->x(), transform->y(), transform->z(), operationType));
+            break;
+        }
+        case TransformOperation::TRANSLATE_X:
+        case TransformOperation::TRANSLATE_Y:
+        case TransformOperation::TRANSLATE_Z:
+        case TransformOperation::TRANSLATE_3D:
+        case TransformOperation::TRANSLATE: {
+            TranslateTransformOperation* transform = static_cast<TranslateTransformOperation*>(m_value.operations()[j].get());
+            operations.operations().append(TranslateTransformOperation::create(transform->x(), transform->y(), transform->z(), operationType));
+            break;
+        }
+        case TransformOperation::ROTATE_X:
+        case TransformOperation::ROTATE_Y:
+        case TransformOperation::ROTATE_3D:
+        case TransformOperation::ROTATE: {
+            RotateTransformOperation* transform = static_cast<RotateTransformOperation*>(m_value.operations()[j].get());
+            operations.operations().append(RotateTransformOperation::create(transform->x(), transform->y(), transform->z(), transform->angle(), operationType));
+            break;
+        }
+        case TransformOperation::SKEW_X:
+        case TransformOperation::SKEW_Y:
+        case TransformOperation::SKEW: {
+            SkewTransformOperation* transform = static_cast<SkewTransformOperation*>(m_value.operations()[j].get());
+            operations.operations().append(SkewTransformOperation::create(transform->angleX(), transform->angleY(), operationType));
+            break;
+        }
+        case TransformOperation::MATRIX: {
+            MatrixTransformOperation* transform = static_cast<MatrixTransformOperation*>(m_value.operations()[j].get());
+            TransformationMatrix m = transform->matrix();
+            operations.operations().append(MatrixTransformOperation::create(m.a(), m.b(), m.c(), m.d(), m.e(), m.f()));
+            break;
+        }
+        case TransformOperation::MATRIX_3D: {
+            Matrix3DTransformOperation* transform = static_cast<Matrix3DTransformOperation*>(m_value.operations()[j].get());
+            operations.operations().append(Matrix3DTransformOperation::create(transform->matrix()));
+            break;
+        }
+        case TransformOperation::PERSPECTIVE: {
+            PerspectiveTransformOperation* transform = static_cast<PerspectiveTransformOperation*>(m_value.operations()[j].get());
+            operations.operations().append(PerspectiveTransformOperation::create(transform->perspective()));
+            break;
+        }
+        case TransformOperation::IDENTITY: {
+            operations.operations().append(IdentityTransformOperation::create());
+            break;
+        }
+        case TransformOperation::NONE:
+            // Do nothing.
+            break;
+        } // switch
+    } // for each operation
+
+    return CCTransformKeyframe::create(time(), operations, timingFunction() ? cloneTimingFunction(timingFunction()) : nullptr);
+}
+
+PassOwnPtr<CCKeyframedFloatAnimationCurve> CCKeyframedFloatAnimationCurve::create()
+{
+    return adoptPtr(new CCKeyframedFloatAnimationCurve);
+}
+
+CCKeyframedFloatAnimationCurve::CCKeyframedFloatAnimationCurve()
 {
 }
 
@@ -74,159 +216,110 @@ CCKeyframedFloatAnimationCurve::~CCKeyframedFloatAnimationCurve()
 {
 }
 
+void CCKeyframedFloatAnimationCurve::addKeyframe(PassOwnPtr<CCFloatKeyframe> keyframe)
+{
+    insertKeyframe(keyframe, m_keyframes);
+}
+
 double CCKeyframedFloatAnimationCurve::duration() const
 {
-    return m_keyframes.last().time - m_keyframes.first().time;
+    return m_keyframes.last()->time() - m_keyframes.first()->time();
 }
 
 PassOwnPtr<CCAnimationCurve> CCKeyframedFloatAnimationCurve::clone() const
 {
-    return adoptPtr(new CCKeyframedFloatAnimationCurve(*this));
+    OwnPtr<CCKeyframedFloatAnimationCurve> toReturn(CCKeyframedFloatAnimationCurve::create());
+    for (size_t i = 0; i < m_keyframes.size(); ++i)
+        toReturn->addKeyframe(m_keyframes[i]->clone());
+    return toReturn.release();
 }
 
 float CCKeyframedFloatAnimationCurve::getValue(double t) const
 {
-    if (t <= m_keyframes.first().time)
-        return m_keyframes.first().value;
+    if (t <= m_keyframes.first()->time())
+        return m_keyframes.first()->value();
 
-    if (t >= m_keyframes.last().time)
-        return m_keyframes.last().value;
+    if (t >= m_keyframes.last()->time())
+        return m_keyframes.last()->value();
 
     size_t i = 0;
     for (; i < m_keyframes.size() - 1; ++i) {
-        if (t < m_keyframes[i+1].time)
+        if (t < m_keyframes[i+1]->time())
             break;
     }
 
-    float progress = static_cast<float>((t - m_keyframes[i].time) / (m_keyframes[i+1].time - m_keyframes[i].time));
-    // FIXME: apply timing function here.
-    return m_keyframes[i].value + (m_keyframes[i+1].value - m_keyframes[i].value) * progress;
+    float progress = static_cast<float>((t - m_keyframes[i]->time()) / (m_keyframes[i+1]->time() - m_keyframes[i]->time()));
+
+    if (m_keyframes[i]->timingFunction())
+        progress = m_keyframes[i]->timingFunction()->getValue(progress);
+
+    return m_keyframes[i]->value() + (m_keyframes[i+1]->value() - m_keyframes[i]->value()) * progress;
 }
 
-PassOwnPtr<CCKeyframedTransformAnimationCurve> CCKeyframedTransformAnimationCurve::create(const Vector<CCTransformKeyframe>& keyframes)
+PassOwnPtr<CCKeyframedTransformAnimationCurve> CCKeyframedTransformAnimationCurve::create()
 {
-    if (!keyframes.size() || !keyframesAreSorted(keyframes))
-        return nullptr;
+    return adoptPtr(new CCKeyframedTransformAnimationCurve);
+}
 
-    return adoptPtr(new CCKeyframedTransformAnimationCurve(keyframes));
+CCKeyframedTransformAnimationCurve::CCKeyframedTransformAnimationCurve()
+{
 }
 
-CCKeyframedTransformAnimationCurve::CCKeyframedTransformAnimationCurve(const Vector<CCTransformKeyframe>& keyframes)
-    : m_keyframes(keyframes)
+CCKeyframedTransformAnimationCurve::~CCKeyframedTransformAnimationCurve()
 {
 }
 
-CCKeyframedTransformAnimationCurve::~CCKeyframedTransformAnimationCurve() { }
+void CCKeyframedTransformAnimationCurve::addKeyframe(PassOwnPtr<CCTransformKeyframe> keyframe)
+{
+    insertKeyframe(keyframe, m_keyframes);
+}
 
 double CCKeyframedTransformAnimationCurve::duration() const
 {
-    return m_keyframes.last().time - m_keyframes.first().time;
+    return m_keyframes.last()->time() - m_keyframes.first()->time();
 }
 
 PassOwnPtr<CCAnimationCurve> CCKeyframedTransformAnimationCurve::clone() const
 {
-    Vector<CCTransformKeyframe> keyframes;
-    // We need to do a deep copy of all of the keyframes since they contain ref
-    // pointers to TransformOperation objects.
-    for (size_t i = 0; i < m_keyframes.size(); ++i) {
-        CCTransformKeyframe keyframe(m_keyframes[i].time);
-        for (size_t j = 0; j < m_keyframes[i].value.size(); ++j) {
-            TransformOperation::OperationType operationType = m_keyframes[i].value.operations()[j]->getOperationType();
-            switch (operationType) {
-            case TransformOperation::SCALE_X:
-            case TransformOperation::SCALE_Y:
-            case TransformOperation::SCALE_Z:
-            case TransformOperation::SCALE_3D:
-            case TransformOperation::SCALE: {
-                ScaleTransformOperation* transform = static_cast<ScaleTransformOperation*>(m_keyframes[i].value.operations()[j].get());
-                keyframe.value.operations().append(ScaleTransformOperation::create(transform->x(), transform->y(), transform->z(), operationType));
-                break;
-            }
-            case TransformOperation::TRANSLATE_X:
-            case TransformOperation::TRANSLATE_Y:
-            case TransformOperation::TRANSLATE_Z:
-            case TransformOperation::TRANSLATE_3D:
-            case TransformOperation::TRANSLATE: {
-                TranslateTransformOperation* transform = static_cast<TranslateTransformOperation*>(m_keyframes[i].value.operations()[j].get());
-                keyframe.value.operations().append(TranslateTransformOperation::create(transform->x(), transform->y(), transform->z(), operationType));
-                break;
-            }
-            case TransformOperation::ROTATE_X:
-            case TransformOperation::ROTATE_Y:
-            case TransformOperation::ROTATE_3D:
-            case TransformOperation::ROTATE: {
-                RotateTransformOperation* transform = static_cast<RotateTransformOperation*>(m_keyframes[i].value.operations()[j].get());
-                keyframe.value.operations().append(RotateTransformOperation::create(transform->x(), transform->y(), transform->z(), transform->angle(), operationType));
-                break;
-            }
-            case TransformOperation::SKEW_X:
-            case TransformOperation::SKEW_Y:
-            case TransformOperation::SKEW: {
-                SkewTransformOperation* transform = static_cast<SkewTransformOperation*>(m_keyframes[i].value.operations()[j].get());
-                keyframe.value.operations().append(SkewTransformOperation::create(transform->angleX(), transform->angleY(), operationType));
-                break;
-            }
-            case TransformOperation::MATRIX: {
-                MatrixTransformOperation* transform = static_cast<MatrixTransformOperation*>(m_keyframes[i].value.operations()[j].get());
-                TransformationMatrix m = transform->matrix();
-                keyframe.value.operations().append(MatrixTransformOperation::create(m.a(), m.b(), m.c(), m.d(), m.e(), m.f()));
-                break;
-            }
-            case TransformOperation::MATRIX_3D: {
-                Matrix3DTransformOperation* transform = static_cast<Matrix3DTransformOperation*>(m_keyframes[i].value.operations()[j].get());
-                keyframe.value.operations().append(Matrix3DTransformOperation::create(transform->matrix()));
-                break;
-            }
-            case TransformOperation::PERSPECTIVE: {
-                PerspectiveTransformOperation* transform = static_cast<PerspectiveTransformOperation*>(m_keyframes[i].value.operations()[j].get());
-                keyframe.value.operations().append(PerspectiveTransformOperation::create(transform->perspective()));
-                break;
-            }
-            case TransformOperation::IDENTITY: {
-                keyframe.value.operations().append(IdentityTransformOperation::create());
-                break;
-            }
-            case TransformOperation::NONE:
-                // Do nothing.
-                break;
-            } // switch
-        } // for each operation
-        keyframes.append(keyframe);
-    }
-    return CCKeyframedTransformAnimationCurve::create(keyframes);
+    OwnPtr<CCKeyframedTransformAnimationCurve> toReturn(CCKeyframedTransformAnimationCurve::create());
+    for (size_t i = 0; i < m_keyframes.size(); ++i)
+        toReturn->addKeyframe(m_keyframes[i]->clone());
+    return toReturn.release();
 }
 
 TransformationMatrix CCKeyframedTransformAnimationCurve::getValue(double t, const IntSize& layerSize) const
 {
     TransformationMatrix transformMatrix;
 
-    if (t <= m_keyframes.first().time) {
-        m_keyframes.first().value.apply(layerSize, transformMatrix);
+    if (t <= m_keyframes.first()->time()) {
+        m_keyframes.first()->value().apply(layerSize, transformMatrix);
         return transformMatrix;
     }
 
-    if (t >= m_keyframes.last().time) {
-        m_keyframes.last().value.apply(layerSize, transformMatrix);
+    if (t >= m_keyframes.last()->time()) {
+        m_keyframes.last()->value().apply(layerSize, transformMatrix);
         return transformMatrix;
     }
 
     size_t i = 0;
     for (; i < m_keyframes.size() - 1; ++i) {
-        if (t < m_keyframes[i+1].time)
+        if (t < m_keyframes[i+1]->time())
             break;
     }
 
-    // FIXME: apply timing function here.
-    double progress = (t - m_keyframes[i].time) / (m_keyframes[i+1].time - m_keyframes[i].time);
+    double progress = (t - m_keyframes[i]->time()) / (m_keyframes[i+1]->time() - m_keyframes[i]->time());
+
+    if (m_keyframes[i]->timingFunction())
+        progress = m_keyframes[i]->timingFunction()->getValue(progress);
 
-    if (m_keyframes[i].value.operationsMatch(m_keyframes[i+1].value)) {
-        for (size_t j = 0; j < m_keyframes[i+1].value.size(); ++j)
-            m_keyframes[i+1].value.operations()[j]->blend(m_keyframes[i].value.at(j), progress)->apply(transformMatrix, layerSize);
+    if (m_keyframes[i]->value().operationsMatch(m_keyframes[i+1]->value())) {
+        for (size_t j = 0; j < m_keyframes[i+1]->value().size(); ++j)
+            m_keyframes[i+1]->value().operations()[j]->blend(m_keyframes[i]->value().at(j), progress)->apply(transformMatrix, layerSize);
     } else {
         TransformationMatrix source;
 
-        m_keyframes[i].value.apply(layerSize, source);
-        m_keyframes[i+1].value.apply(layerSize, transformMatrix);
+        m_keyframes[i]->value().apply(layerSize, source);
+        m_keyframes[i+1]->value().apply(layerSize, transformMatrix);
 
         transformMatrix.blend(source, progress);
     }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h b/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h
index 1c4d64adb..c3073bf08 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCKeyframedAnimationCurve.h
@@ -27,46 +27,66 @@
 
 #include "TransformOperations.h"
 #include "cc/CCAnimationCurve.h"
+#include "cc/CCTimingFunction.h"
 
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
-struct CCFloatKeyframe {
-    CCFloatKeyframe(double time, float value)
-        : time(time)
-        , value(value)
-    {
-    }
+class CCKeyframe {
+public:
+    double time() const;
+    const CCTimingFunction* timingFunction() const;
+
+protected:
+    CCKeyframe(double time, PassOwnPtr<CCTimingFunction>);
+    virtual ~CCKeyframe();
 
-    double time;
-    float value;
+private:
+    double m_time;
+    OwnPtr<CCTimingFunction> m_timingFunction;
 };
 
-struct CCTransformKeyframe {
-    explicit CCTransformKeyframe(double time)
-        : time(time)
-    {
-    }
+class CCFloatKeyframe : public CCKeyframe {
+public:
+    static PassOwnPtr<CCFloatKeyframe> create(double time, float value, PassOwnPtr<CCTimingFunction>);
+    virtual ~CCFloatKeyframe();
+
+    float value() const;
 
-    CCTransformKeyframe(double time, const TransformOperations& value)
-        : time(time)
-        , value(value)
-    {
-    }
+    PassOwnPtr<CCFloatKeyframe> clone() const;
 
-    double time;
-    TransformOperations value;
+private:
+    CCFloatKeyframe(double time, float value, PassOwnPtr<CCTimingFunction>);
+
+    float m_value;
+};
+
+class CCTransformKeyframe : public CCKeyframe {
+public:
+    static PassOwnPtr<CCTransformKeyframe> create(double time, const TransformOperations& value, PassOwnPtr<CCTimingFunction>);
+    virtual ~CCTransformKeyframe();
+
+    const TransformOperations& value() const;
+
+    PassOwnPtr<CCTransformKeyframe> clone() const;
+
+private:
+    CCTransformKeyframe(double time, const TransformOperations& value, PassOwnPtr<CCTimingFunction>);
+
+    TransformOperations m_value;
 };
 
 class CCKeyframedFloatAnimationCurve : public CCFloatAnimationCurve {
 public:
     // It is required that the keyframes be sorted by time.
-    static PassOwnPtr<CCKeyframedFloatAnimationCurve> create(const Vector<CCFloatKeyframe>& keyframes);
+    static PassOwnPtr<CCKeyframedFloatAnimationCurve> create();
 
     virtual ~CCKeyframedFloatAnimationCurve();
 
+    void addKeyframe(PassOwnPtr<CCFloatKeyframe>);
+
     // CCAnimationCurve implementation
     virtual double duration() const;
     virtual PassOwnPtr<CCAnimationCurve> clone() const;
@@ -75,20 +95,22 @@ public:
     virtual float getValue(double t) const;
 
 private:
-    explicit CCKeyframedFloatAnimationCurve(const Vector<CCFloatKeyframe>&);
+    CCKeyframedFloatAnimationCurve();
 
     // Always sorted in order of increasing time. No two keyframes have the
     // same time.
-    Vector<CCFloatKeyframe> m_keyframes;
+    Vector<OwnPtr<CCFloatKeyframe> > m_keyframes;
 };
 
 class CCKeyframedTransformAnimationCurve : public CCTransformAnimationCurve {
 public:
     // It is required that the keyframes be sorted by time.
-    static PassOwnPtr<CCKeyframedTransformAnimationCurve> create(const Vector<CCTransformKeyframe>& keyframes);
+    static PassOwnPtr<CCKeyframedTransformAnimationCurve> create();
 
     virtual ~CCKeyframedTransformAnimationCurve();
 
+    void addKeyframe(PassOwnPtr<CCTransformKeyframe>);
+
     // CCAnimationCurve implementation
     virtual double duration() const;
     virtual PassOwnPtr<CCAnimationCurve> clone() const;
@@ -97,11 +119,11 @@ public:
     virtual TransformationMatrix getValue(double t, const IntSize&) const;
 
 private:
-    explicit CCKeyframedTransformAnimationCurve(const Vector<CCTransformKeyframe>&);
+    CCKeyframedTransformAnimationCurve();
 
     // Always sorted in order of increasing time. No two keyframes have the
     // same time.
-    Vector<CCTransformKeyframe> m_keyframes;
+    Vector<OwnPtr<CCTransformKeyframe> > m_keyframes;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp
index d9e72efc4..335d3a58e 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationController.cpp
@@ -37,16 +37,16 @@ namespace WebCore {
 
 namespace {
 
-template <typename Keyframe, typename Value>
-void appendKeyframe(Vector<Keyframe>& keyframes, double keyTime, const Value* value)
+template <class Value, class Keyframe, class Curve>
+void appendKeyframe(Curve& curve, double keyTime, const Value* value, PassOwnPtr<CCTimingFunction> timingFunction)
 {
-    keyframes.append(Keyframe(keyTime, value->value()));
+    curve.addKeyframe(Keyframe::create(keyTime, value->value(), timingFunction));
 }
 
 template <>
-void appendKeyframe<CCTransformKeyframe, TransformAnimationValue>(Vector<CCTransformKeyframe>& keyframes, double keyTime, const TransformAnimationValue* value)
+void appendKeyframe<TransformAnimationValue, CCTransformKeyframe, CCKeyframedTransformAnimationCurve>(CCKeyframedTransformAnimationCurve& curve, double keyTime, const TransformAnimationValue* value, PassOwnPtr<CCTimingFunction> timingFunction)
 {
-    keyframes.append(CCTransformKeyframe(keyTime, *value->value()));
+    curve.addKeyframe(CCTransformKeyframe::create(keyTime, *value->value(), timingFunction));
 }
 
 template <class Value, class Keyframe, class Curve>
@@ -64,21 +64,33 @@ PassOwnPtr<CCActiveAnimation> createActiveAnimation(const KeyframeValueList& val
     if (animation && animation->isFillModeSet() && (animation->fillsForwards() || animation->fillsBackwards()))
         return nullptr;
 
+    OwnPtr<Curve> curve = Curve::create();
     Vector<Keyframe> keyframes;
 
     for (size_t i = 0; i < valueList.size(); i++) {
         const Value* originalValue = static_cast<const Value*>(valueList.at(i));
 
-        // FIXME: add support for timing functions.
-        if (originalValue->timingFunction() && originalValue->timingFunction()->type() != TimingFunction::LinearFunction)
-            return nullptr;
+        OwnPtr<CCTimingFunction> timingFunction;
+        if (originalValue->timingFunction()) {
+            switch (originalValue->timingFunction()->type()) {
+            case TimingFunction::StepsFunction:
+                // FIXME: add support for steps timing function.
+                return nullptr;
+            case TimingFunction::LinearFunction:
+                // Don't set the timing function. Keyframes are interpolated linearly if there is no timing function.
+                break;
+            case TimingFunction::CubicBezierFunction:
+                const CubicBezierTimingFunction* originalTimingFunction = static_cast<const CubicBezierTimingFunction*>(originalValue->timingFunction());
+                timingFunction = CCCubicBezierTimingFunction::create(originalTimingFunction->x1(), originalTimingFunction->y1(), originalTimingFunction->x2(), originalTimingFunction->y2());
+                break;
+            } // switch
+        } else
+            timingFunction = CCEaseTimingFunction::create();
 
         double duration = (animation && animation->isDurationSet()) ? animation->duration() : 1;
-        appendKeyframe(keyframes, originalValue->keyTime() * duration, originalValue);
+        appendKeyframe<Value, Keyframe, Curve>(*curve, originalValue->keyTime() * duration, originalValue, timingFunction.release());
     }
 
-    OwnPtr<Curve> curve = Curve::create(keyframes);
-
     OwnPtr<CCActiveAnimation> anim = CCActiveAnimation::create(curve.release(), animationId, groupId, targetProperty);
 
     ASSERT(anim.get());
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp
index 2096ce398..f09dcfae0 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.cpp
@@ -49,15 +49,15 @@ CCLayerAnimationControllerImpl::~CCLayerAnimationControllerImpl()
 {
 }
 
-void CCLayerAnimationControllerImpl::animate(double frameBeginTimeSecs, CCAnimationEventsVector& events)
+void CCLayerAnimationControllerImpl::animate(double monotonicTime, CCAnimationEventsVector& events)
 {
-    startAnimationsWaitingForNextTick(frameBeginTimeSecs, events);
-    startAnimationsWaitingForStartTime(frameBeginTimeSecs, events);
-    startAnimationsWaitingForTargetAvailability(frameBeginTimeSecs, events);
-    resolveConflicts(frameBeginTimeSecs);
-    tickAnimations(frameBeginTimeSecs);
-    purgeFinishedAnimations();
-    startAnimationsWaitingForTargetAvailability(frameBeginTimeSecs, events);
+    startAnimationsWaitingForNextTick(monotonicTime, events);
+    startAnimationsWaitingForStartTime(monotonicTime, events);
+    startAnimationsWaitingForTargetAvailability(monotonicTime, events);
+    resolveConflicts(monotonicTime);
+    tickAnimations(monotonicTime);
+    purgeFinishedAnimations(events);
+    startAnimationsWaitingForTargetAvailability(monotonicTime, events);
 }
 
 void CCLayerAnimationControllerImpl::add(PassOwnPtr<CCActiveAnimation> anim)
@@ -83,28 +83,28 @@ bool CCLayerAnimationControllerImpl::hasActiveAnimation() const
     return false;
 }
 
-void CCLayerAnimationControllerImpl::startAnimationsWaitingForNextTick(double now, CCAnimationEventsVector& events)
+void CCLayerAnimationControllerImpl::startAnimationsWaitingForNextTick(double monotonicTime, CCAnimationEventsVector& events)
 {
     for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
         if (m_activeAnimations[i]->runState() == CCActiveAnimation::WaitingForNextTick) {
-            m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, now);
-            m_activeAnimations[i]->setStartTime(now);
-            events.append(CCAnimationStartedEvent(m_client->id(), now));
+            m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, monotonicTime);
+            m_activeAnimations[i]->setStartTime(monotonicTime);
+            events.append(CCAnimationStartedEvent::create(m_client->id()));
         }
     }
 }
 
-void CCLayerAnimationControllerImpl::startAnimationsWaitingForStartTime(double now, CCAnimationEventsVector& events)
+void CCLayerAnimationControllerImpl::startAnimationsWaitingForStartTime(double monotonicTime, CCAnimationEventsVector& events)
 {
     for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
-        if (m_activeAnimations[i]->runState() == CCActiveAnimation::WaitingForStartTime && m_activeAnimations[i]->startTime() <= now) {
-            m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, now);
-            events.append(CCAnimationStartedEvent(m_client->id(), now));
+        if (m_activeAnimations[i]->runState() == CCActiveAnimation::WaitingForStartTime && m_activeAnimations[i]->startTime() <= monotonicTime) {
+            m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, monotonicTime);
+            events.append(CCAnimationStartedEvent::create(m_client->id()));
         }
     }
 }
 
-void CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability(double now, CCAnimationEventsVector& events)
+void CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability(double monotonicTime, CCAnimationEventsVector& events)
 {
     // First collect running properties.
     TargetProperties blockedProperties;
@@ -134,13 +134,13 @@ void CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability
 
             // If the intersection is null, then we are free to start the animations in the group.
             if (nullIntersection) {
-                m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, now);
-                m_activeAnimations[i]->setStartTime(now);
-                events.append(CCAnimationStartedEvent(m_client->id(), now));
+                m_activeAnimations[i]->setRunState(CCActiveAnimation::Running, monotonicTime);
+                m_activeAnimations[i]->setStartTime(monotonicTime);
+                events.append(CCAnimationStartedEvent::create(m_client->id()));
                 for (size_t j = i + 1; j < m_activeAnimations.size(); ++j) {
                     if (m_activeAnimations[i]->group() == m_activeAnimations[j]->group()) {
-                        m_activeAnimations[j]->setRunState(CCActiveAnimation::Running, now);
-                        m_activeAnimations[j]->setStartTime(now);
+                        m_activeAnimations[j]->setRunState(CCActiveAnimation::Running, monotonicTime);
+                        m_activeAnimations[j]->setStartTime(monotonicTime);
                     }
                 }
             }
@@ -148,7 +148,7 @@ void CCLayerAnimationControllerImpl::startAnimationsWaitingForTargetAvailability
     }
 }
 
-void CCLayerAnimationControllerImpl::resolveConflicts(double now)
+void CCLayerAnimationControllerImpl::resolveConflicts(double monotonicTime)
 {
     // Find any animations that are animating the same property and resolve the
     // confict. We could eventually blend, but for now we'll just abort the
@@ -160,16 +160,16 @@ void CCLayerAnimationControllerImpl::resolveConflicts(double now)
             for (size_t j = i + 1; j < m_activeAnimations.size(); ++j) {
                 if (m_activeAnimations[j]->runState() == CCActiveAnimation::Running && m_activeAnimations[i]->targetProperty() == m_activeAnimations[j]->targetProperty()) {
                     if (m_activeAnimations[i]->startTime() > m_activeAnimations[j]->startTime())
-                        m_activeAnimations[j]->setRunState(CCActiveAnimation::Aborted, now);
+                        m_activeAnimations[j]->setRunState(CCActiveAnimation::Aborted, monotonicTime);
                     else
-                        m_activeAnimations[i]->setRunState(CCActiveAnimation::Aborted, now);
+                        m_activeAnimations[i]->setRunState(CCActiveAnimation::Aborted, monotonicTime);
                 }
             }
         }
     }
 }
 
-void CCLayerAnimationControllerImpl::purgeFinishedAnimations()
+void CCLayerAnimationControllerImpl::purgeFinishedAnimations(CCAnimationEventsVector& events)
 {
     // Each iteration, m_activeAnimations.size() decreases or i increments,
     // guaranteeing progress towards loop termination.
@@ -186,6 +186,7 @@ void CCLayerAnimationControllerImpl::purgeFinishedAnimations()
             }
         }
         if (allAnimsWithSameIdAreFinished) {
+            events.append(CCAnimationFinishedEvent::create(m_client->id(), m_activeAnimations[i]->id()));
             m_finishedAnimations.append(m_activeAnimations[i]->signature());
             m_activeAnimations.remove(i);
         } else
@@ -193,18 +194,19 @@ void CCLayerAnimationControllerImpl::purgeFinishedAnimations()
     }
 }
 
-void CCLayerAnimationControllerImpl::tickAnimations(double now)
+void CCLayerAnimationControllerImpl::tickAnimations(double monotonicTime)
 {
     for (size_t i = 0; i < m_activeAnimations.size(); ++i) {
         if (m_activeAnimations[i]->runState() == CCActiveAnimation::Running) {
-            double trimmed = m_activeAnimations[i]->trimTimeToCurrentIteration(now);
+            double trimmed = m_activeAnimations[i]->trimTimeToCurrentIteration(monotonicTime);
+
             switch (m_activeAnimations[i]->targetProperty()) {
 
             case CCActiveAnimation::Transform: {
                 const CCTransformAnimationCurve* transformAnimationCurve = m_activeAnimations[i]->curve()->toTransformAnimationCurve();
                 const TransformationMatrix matrix = transformAnimationCurve->getValue(trimmed, m_client->bounds());
-                if (m_activeAnimations[i]->isFinishedAt(now))
-                    m_activeAnimations[i]->setRunState(CCActiveAnimation::Finished, now);
+                if (m_activeAnimations[i]->isFinishedAt(monotonicTime))
+                    m_activeAnimations[i]->setRunState(CCActiveAnimation::Finished, monotonicTime);
 
                 m_client->setTransform(matrix);
                 break;
@@ -213,8 +215,8 @@ void CCLayerAnimationControllerImpl::tickAnimations(double now)
             case CCActiveAnimation::Opacity: {
                 const CCFloatAnimationCurve* floatAnimationCurve = m_activeAnimations[i]->curve()->toFloatAnimationCurve();
                 const float opacity = floatAnimationCurve->getValue(trimmed);
-                if (m_activeAnimations[i]->isFinishedAt(now))
-                    m_activeAnimations[i]->setRunState(CCActiveAnimation::Finished, now);
+                if (m_activeAnimations[i]->isFinishedAt(monotonicTime))
+                    m_activeAnimations[i]->setRunState(CCActiveAnimation::Finished, monotonicTime);
 
                 m_client->setOpacity(opacity);
                 break;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h
index 296066de0..6ac00e7ae 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationControllerImpl.h
@@ -61,7 +61,7 @@ public:
 
     virtual ~CCLayerAnimationControllerImpl();
 
-    void animate(double frameBeginTimeSecs, CCAnimationEventsVector&);
+    void animate(double monotonicTime, CCAnimationEventsVector&);
 
     void add(PassOwnPtr<CCActiveAnimation>);
 
@@ -78,13 +78,13 @@ private:
     // The animator is owned by the layer.
     explicit CCLayerAnimationControllerImpl(CCLayerAnimationControllerImplClient*);
 
-    void startAnimationsWaitingForNextTick(double now, CCAnimationEventsVector&);
-    void startAnimationsWaitingForStartTime(double now, CCAnimationEventsVector&);
-    void startAnimationsWaitingForTargetAvailability(double now, CCAnimationEventsVector&);
-    void resolveConflicts(double now);
-    void purgeFinishedAnimations();
+    void startAnimationsWaitingForNextTick(double monotonicTime, CCAnimationEventsVector&);
+    void startAnimationsWaitingForStartTime(double monotonicTime, CCAnimationEventsVector&);
+    void startAnimationsWaitingForTargetAvailability(double monotonicTime, CCAnimationEventsVector&);
+    void resolveConflicts(double monotonicTime);
+    void purgeFinishedAnimations(CCAnimationEventsVector&);
 
-    void tickAnimations(double now);
+    void tickAnimations(double monotonicTime);
 
     CCLayerAnimationControllerImplClient* m_client;
     Vector<OwnPtr<CCActiveAnimation> > m_activeAnimations;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationDelegate.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationDelegate.h
new file mode 100644
index 000000000..a764cc37b
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerAnimationDelegate.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCLayerAnimationDelegate_h
+#define CCLayerAnimationDelegate_h
+
+namespace WebCore {
+
+// This class is used to send notifications when layer animations begin or end.
+class CCLayerAnimationDelegate {
+public:
+    virtual void notifyAnimationStarted(double time) = 0;
+    virtual void notifyAnimationFinished(int animationId) = 0;
+};
+
+} // namespace WebCore
+
+#endif // CCLayerAnimationDelegate_h
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
index 0589dca8a..8f6078097 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.cpp
@@ -42,10 +42,13 @@ namespace WebCore {
 
 CCLayerImpl::CCLayerImpl(int id)
     : m_parent(0)
+    , m_maskLayerId(-1)
+    , m_replicaLayerId(-1)
     , m_layerId(id)
     , m_anchorPoint(0.5, 0.5)
     , m_anchorPointZ(0)
     , m_scrollable(false)
+    , m_shouldScrollOnMainThread(false)
     , m_haveWheelEventHandlers(false)
     , m_backgroundCoversViewport(false)
     , m_doubleSided(true)
@@ -73,7 +76,7 @@ CCLayerImpl::~CCLayerImpl()
     ASSERT(CCProxy::isImplThread());
 }
 
-void CCLayerImpl::addChild(PassRefPtr<CCLayerImpl> child)
+void CCLayerImpl::addChild(PassOwnPtr<CCLayerImpl> child)
 {
     child->setParent(this);
     m_children.append(child);
@@ -83,13 +86,16 @@ void CCLayerImpl::removeFromParent()
 {
     if (!m_parent)
         return;
-    for (size_t i = 0; i < m_parent->m_children.size(); ++i) {
-        if (m_parent->m_children[i].get() == this) {
-            m_parent->m_children.remove(i);
-            break;
+
+    CCLayerImpl* parent = m_parent;
+    m_parent = 0;
+
+    for (size_t i = 0; i < parent->m_children.size(); ++i) {
+        if (parent->m_children[i].get() == this) {
+            parent->m_children.remove(i);
+            return;
         }
     }
-    m_parent = 0;
 }
 
 void CCLayerImpl::removeAllChildren()
@@ -188,12 +194,6 @@ void CCLayerImpl::scrollBy(const IntSize& scroll)
     noteLayerPropertyChangedForSubtree();
 }
 
-void CCLayerImpl::cleanupResources()
-{
-    if (renderSurface())
-        renderSurface()->cleanupResources();
-}
-
 const IntRect CCLayerImpl::getDrawRect() const
 {
     // Form the matrix used by the shader to map the corners of the layer's
@@ -244,7 +244,7 @@ void CCLayerImpl::dumpLayerProperties(TextStream& ts, int indent) const
     ts << "drawsContent: " << (m_drawsContent ? "yes" : "no") << "\n";
 }
 
-void sortLayers(Vector<RefPtr<CCLayerImpl> >::iterator first, Vector<RefPtr<CCLayerImpl> >::iterator end, CCLayerSorter* layerSorter)
+void sortLayers(Vector<CCLayerImpl*>::iterator first, Vector<CCLayerImpl*>::iterator end, CCLayerSorter* layerSorter)
 {
     TRACE_EVENT("LayerRendererChromium::sortLayers", 0, 0);
     layerSorter->sort(first, end);
@@ -260,7 +260,7 @@ String CCLayerImpl::layerTreeAsText() const
 void CCLayerImpl::dumpLayer(TextStream& ts, int indent) const
 {
     writeIndent(ts, indent);
-    ts << layerTypeAsString() << "(" << m_name << ")\n";
+    ts << layerTypeAsString() << "(" << m_debugName << ")\n";
     dumpLayerProperties(ts, indent+2);
     if (m_replicaLayer) {
         writeIndent(ts, indent+2);
@@ -319,21 +319,27 @@ void CCLayerImpl::setBounds(const IntSize& bounds)
         m_layerPropertyChanged = true;
 }
 
-void CCLayerImpl::setMaskLayer(PassRefPtr<CCLayerImpl> maskLayer)
+void CCLayerImpl::setMaskLayer(PassOwnPtr<CCLayerImpl> maskLayer)
 {
-    if (m_maskLayer == maskLayer)
+    m_maskLayer = maskLayer;
+
+    int newLayerId = m_maskLayer ? m_maskLayer->id() : -1;
+    if (newLayerId == m_maskLayerId)
         return;
 
-    m_maskLayer = maskLayer;
+    m_maskLayerId = newLayerId;
     noteLayerPropertyChangedForSubtree();
 }
 
-void CCLayerImpl::setReplicaLayer(PassRefPtr<CCLayerImpl> replicaLayer)
+void CCLayerImpl::setReplicaLayer(PassOwnPtr<CCLayerImpl> replicaLayer)
 {
-    if (m_replicaLayer == replicaLayer)
+    m_replicaLayer = replicaLayer;
+
+    int newLayerId = m_replicaLayer ? m_replicaLayer->id() : -1;
+    if (newLayerId == m_replicaLayerId)
         return;
 
-    m_replicaLayer = replicaLayer;
+    m_replicaLayerId = newLayerId;
     noteLayerPropertyChangedForSubtree();
 }
 
@@ -523,6 +529,10 @@ void CCLayerImpl::setDoubleSided(bool doubleSided)
     noteLayerPropertyChangedForSubtree();
 }
 
+void CCLayerImpl::didLoseContext()
+{
+}
+
 }
 
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
index c7a4f0856..f1c7b4ee5 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerImpl.h
@@ -30,6 +30,7 @@
 #include "FilterOperations.h"
 #include "FloatRect.h"
 #include "IntRect.h"
+#include "Region.h"
 #include "TextStream.h"
 #include "TransformationMatrix.h"
 #include "cc/CCLayerAnimationControllerImpl.h"
@@ -46,11 +47,11 @@ class CCLayerSorter;
 class LayerChromium;
 class LayerRendererChromium;
 
-class CCLayerImpl : public RefCounted<CCLayerImpl>, public CCLayerAnimationControllerImplClient {
+class CCLayerImpl : public CCLayerAnimationControllerImplClient {
 public:
-    static PassRefPtr<CCLayerImpl> create(int id)
+    static PassOwnPtr<CCLayerImpl> create(int id)
     {
-        return adoptRef(new CCLayerImpl(id));
+        return adoptPtr(new CCLayerImpl(id));
     }
 
     // CCLayerAnimationControllerImplClient implementation.
@@ -65,15 +66,15 @@ public:
 
     // Tree structure.
     CCLayerImpl* parent() const { return m_parent; }
-    const Vector<RefPtr<CCLayerImpl> >& children() const { return m_children; }
-    void addChild(PassRefPtr<CCLayerImpl>);
+    const Vector<OwnPtr<CCLayerImpl> >& children() const { return m_children; }
+    void addChild(PassOwnPtr<CCLayerImpl>);
     void removeFromParent();
     void removeAllChildren();
 
-    void setMaskLayer(PassRefPtr<CCLayerImpl>);
+    void setMaskLayer(PassOwnPtr<CCLayerImpl>);
     CCLayerImpl* maskLayer() const { return m_maskLayer.get(); }
 
-    void setReplicaLayer(PassRefPtr<CCLayerImpl>);
+    void setReplicaLayer(PassOwnPtr<CCLayerImpl>);
     CCLayerImpl* replicaLayer() const { return m_replicaLayer.get(); }
 
 #ifndef NDEBUG
@@ -96,8 +97,6 @@ public:
     // Returns true if any of the layer's descendants has content to draw.
     bool descendantDrawsContent();
 
-    void cleanupResources();
-
     void setAnchorPoint(const FloatPoint&);
     const FloatPoint& anchorPoint() const { return m_anchorPoint; }
 
@@ -134,9 +133,6 @@ public:
     void setSublayerTransform(const TransformationMatrix&);
     const TransformationMatrix& sublayerTransform() const { return m_sublayerTransform; }
 
-    void setName(const String& name) { m_name = name; }
-    const String& name() const { return m_name; }
-
     // Debug layer border - visual effect only, do not change geometry/clipping/etc.
     void setDebugBorderColor(Color);
     Color debugBorderColor() const { return m_debugBorderColor; }
@@ -144,6 +140,10 @@ public:
     float debugBorderWidth() const { return m_debugBorderWidth; }
     bool hasDebugBorders() const;
 
+    // Debug layer name.
+    void setDebugName(const String& debugName) { m_debugName = debugName; }
+    String debugName() const { return m_debugName; }
+
     CCRenderSurface* renderSurface() const { return m_renderSurface.get(); }
     void createRenderSurface();
     void clearRenderSurface() { m_renderSurface.clear(); }
@@ -181,9 +181,15 @@ public:
     bool scrollable() const { return m_scrollable; }
     void setScrollable(bool scrollable) { m_scrollable = scrollable; }
 
+    bool shouldScrollOnMainThread() const { return m_shouldScrollOnMainThread; }
+    void setShouldScrollOnMainThread(bool shouldScrollOnMainThread) { m_shouldScrollOnMainThread = shouldScrollOnMainThread; }
+
     bool haveWheelEventHandlers() const { return m_haveWheelEventHandlers; }
     void setHaveWheelEventHandlers(bool haveWheelEventHandlers) { m_haveWheelEventHandlers = haveWheelEventHandlers; }
 
+    const Region& nonFastScrollableRegion() const { return m_nonFastScrollableRegion; }
+    void setNonFastScrollableRegion(const Region& region) { m_nonFastScrollableRegion = region; }
+
     const IntRect& visibleLayerRect() const { return m_visibleLayerRect; }
     void setVisibleLayerRect(const IntRect& visibleLayerRect) { m_visibleLayerRect = visibleLayerRect; }
 
@@ -209,6 +215,13 @@ public:
 
     CCLayerAnimationControllerImpl* layerAnimationController() { return m_layerAnimationController.get(); }
 
+    virtual Region opaqueContentsRegion() const { return Region(); };
+
+    // Indicates that the context previously used to render this layer
+    // was lost and that a new one has been created. Won't be called
+    // until the new context has been created successfully.
+    virtual void didLoseContext();
+
 protected:
     explicit CCLayerImpl(int);
 
@@ -236,9 +249,12 @@ private:
 
     // Properties internal to CCLayerImpl
     CCLayerImpl* m_parent;
-    Vector<RefPtr<CCLayerImpl> > m_children;
-    RefPtr<CCLayerImpl> m_maskLayer;
-    RefPtr<CCLayerImpl> m_replicaLayer;
+    Vector<OwnPtr<CCLayerImpl> > m_children;
+    // m_maskLayer can be temporarily stolen during tree sync, we need this ID to confirm newly assigned layer is still the previous one
+    int m_maskLayerId;
+    OwnPtr<CCLayerImpl> m_maskLayer;
+    int m_replicaLayerId; // ditto
+    OwnPtr<CCLayerImpl> m_replicaLayer;
     int m_layerId;
 
     // Properties synchronized from the associated LayerChromium.
@@ -248,7 +264,9 @@ private:
     IntSize m_contentBounds;
     IntPoint m_scrollPosition;
     bool m_scrollable;
+    bool m_shouldScrollOnMainThread;
     bool m_haveWheelEventHandlers;
+    Region m_nonFastScrollableRegion;
     Color m_backgroundColor;
     bool m_backgroundCoversViewport;
 
@@ -282,8 +300,6 @@ private:
     int m_debugID;
 #endif
 
-    String m_name;
-
     // Render surface this layer draws into. This is a surface that can belong
     // either to this layer (if m_targetRenderSurface == m_renderSurface) or
     // to an ancestor of this layer. The target render surface determines the
@@ -299,6 +315,9 @@ private:
     Color m_debugBorderColor;
     float m_debugBorderWidth;
 
+    // Debug layer name.
+    String m_debugName;
+
     FilterOperations m_filters;
 
     TransformationMatrix m_drawTransform;
@@ -324,7 +343,7 @@ private:
     OwnPtr<CCLayerAnimationControllerImpl> m_layerAnimationController;
 };
 
-void sortLayers(Vector<RefPtr<CCLayerImpl> >::iterator first, Vector<RefPtr<CCLayerImpl> >::iterator end, CCLayerSorter*);
+void sortLayers(Vector<CCLayerImpl*>::iterator first, Vector<CCLayerImpl*>::iterator end, CCLayerSorter*);
 
 }
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.cpp
index 97d6d185a..2d6d2f7f7 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.cpp
@@ -35,8 +35,8 @@
 
 namespace WebCore {
 
-template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
+template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>& it)
 {
     it.m_targetRenderSurfaceLayerIndex = 0;
     it.m_currentLayerIndex = CCLayerIteratorValue::LayerIndexRepresentingTargetRenderSurface;
@@ -44,15 +44,15 @@ void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<LayerType, Rende
     m_highestTargetRenderSurfaceLayer = 0;
 }
 
-template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
+template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>& it)
 {
     it.m_targetRenderSurfaceLayerIndex = CCLayerIteratorValue::InvalidTargetRenderSurfaceLayerIndex;
     it.m_currentLayerIndex = 0;
 }
 
-template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
+template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>& it)
 {
     // If the current layer has a RS, move to its layer list. Otherwise, visit the next layer in the current RS layer list.
     if (it.currentLayerRepresentsContributingRenderSurface()) {
@@ -85,23 +85,23 @@ void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<LayerType, Render
     }
 }
 
-template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
+template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>& it)
 {
     it.m_targetRenderSurfaceLayerIndex = 0;
     it.m_currentLayerIndex = it.targetRenderSurfaceChildren().size() - 1;
     goToHighestInSubtree(it);
 }
 
-template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
+template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>& it)
 {
     it.m_targetRenderSurfaceLayerIndex = CCLayerIteratorValue::InvalidTargetRenderSurfaceLayerIndex;
     it.m_currentLayerIndex = 0;
 }
 
-template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
+template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>& it)
 {
     // Moves to the previous layer in the current RS layer list. Then we check if the
     // new current layer has its own RS, in which case there are things in that RS layer list that are higher, so
@@ -128,8 +128,8 @@ void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<LayerType, Render
     }
 }
 
-template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>& it)
+template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>& it)
 {
     if (it.currentLayerRepresentsTargetRenderSurface())
         return;
@@ -147,23 +147,23 @@ void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<L
 }
 
 // Declare each of the above functions for LayerChromium and CCLayerImpl classes so that they are linked.
-template void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<LayerChromium, RenderSurfaceChromium, BackToFront> &);
-template void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<LayerChromium, RenderSurfaceChromium, BackToFront>&);
-template void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<LayerChromium, RenderSurfaceChromium, BackToFront>&);
-
-template void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<CCLayerImpl, CCRenderSurface, BackToFront>&);
-template void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<CCLayerImpl, CCRenderSurface, BackToFront>&);
-template void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<CCLayerImpl, CCRenderSurface, BackToFront>&);
-
-template void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<LayerChromium, RenderSurfaceChromium, FrontToBack>&);
-template void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<LayerChromium, RenderSurfaceChromium, FrontToBack>&);
-template void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<LayerChromium, RenderSurfaceChromium, FrontToBack>&);
-template void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<LayerChromium, RenderSurfaceChromium, FrontToBack>&);
-
-template void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<CCLayerImpl, CCRenderSurface, FrontToBack>&);
-template void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<CCLayerImpl, CCRenderSurface, FrontToBack>&);
-template void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<CCLayerImpl, CCRenderSurface, FrontToBack>&);
-template void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<CCLayerImpl, CCRenderSurface, FrontToBack>&);
+template void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, BackToFront> &);
+template void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, BackToFront>&);
+template void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, BackToFront>&);
+
+template void CCLayerIteratorActions::BackToFront::begin(CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, BackToFront>&);
+template void CCLayerIteratorActions::BackToFront::end(CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, BackToFront>&);
+template void CCLayerIteratorActions::BackToFront::next(CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, BackToFront>&);
+
+template void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, FrontToBack>&);
+
+template void CCLayerIteratorActions::FrontToBack::next(CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::end(CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::begin(CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, FrontToBack>&);
+template void CCLayerIteratorActions::FrontToBack::goToHighestInSubtree(CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, FrontToBack>&);
 
 } // namespace WebCore
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.h
index be985e153..d89bd6912 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerIterator.h
@@ -92,15 +92,15 @@ struct CCLayerIteratorValue {
 };
 
 // An iterator class for walking over layers in the RenderSurface-Layer tree.
-template <typename LayerType, typename RenderSurfaceType, typename IteratorActionType>
+template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename IteratorActionType>
 class CCLayerIterator {
-    typedef CCLayerIterator<LayerType, RenderSurfaceType, IteratorActionType> CCLayerIteratorType;
+    typedef CCLayerIterator<LayerType, LayerList, RenderSurfaceType, IteratorActionType> CCLayerIteratorType;
 
 public:
     CCLayerIterator() : m_renderSurfaceLayerList(0) { }
 
-    static CCLayerIteratorType begin(const Vector<RefPtr<LayerType> >* renderSurfaceLayerList) { return CCLayerIteratorType(renderSurfaceLayerList, true); }
-    static CCLayerIteratorType end(const Vector<RefPtr<LayerType> >* renderSurfaceLayerList) { return CCLayerIteratorType(renderSurfaceLayerList, false); }
+    static CCLayerIteratorType begin(const LayerList* renderSurfaceLayerList) { return CCLayerIteratorType(renderSurfaceLayerList, true); }
+    static CCLayerIteratorType end(const LayerList* renderSurfaceLayerList) { return CCLayerIteratorType(renderSurfaceLayerList, false); }
 
     CCLayerIteratorType& operator++() { m_actions.next(*this); return *this; }
     bool operator==(const CCLayerIterator& other) const
@@ -117,10 +117,10 @@ public:
     bool representsContributingRenderSurface() const { return !representsTargetRenderSurface() && currentLayerRepresentsContributingRenderSurface(); }
     bool representsItself() const { return !representsTargetRenderSurface() && !representsContributingRenderSurface(); }
 
-    LayerType* targetRenderSurfaceLayer() const { return (*m_renderSurfaceLayerList)[m_targetRenderSurfaceLayerIndex].get(); }
+    LayerType* targetRenderSurfaceLayer() const { return getRawPtr((*m_renderSurfaceLayerList)[m_targetRenderSurfaceLayerIndex]); }
 
 private:
-    CCLayerIterator(const Vector<RefPtr<LayerType> >* renderSurfaceLayerList, bool start)
+    CCLayerIterator(const LayerList* renderSurfaceLayerList, bool start)
         : m_renderSurfaceLayerList(renderSurfaceLayerList)
     {
         if (start && !renderSurfaceLayerList->isEmpty())
@@ -129,16 +129,19 @@ private:
             m_actions.end(*this);
     }
 
-    inline LayerType* currentLayer() const { return currentLayerRepresentsTargetRenderSurface() ? targetRenderSurfaceLayer() : targetRenderSurfaceChildren()[m_currentLayerIndex].get(); }
+    inline static LayerChromium* getRawPtr(const RefPtr<LayerChromium>& ptr) { return ptr.get(); }
+    inline static CCLayerImpl* getRawPtr(CCLayerImpl* ptr) { return ptr; }
+
+    inline LayerType* currentLayer() const { return currentLayerRepresentsTargetRenderSurface() ? targetRenderSurfaceLayer() : getRawPtr(targetRenderSurfaceChildren()[m_currentLayerIndex]); }
 
     inline bool currentLayerRepresentsContributingRenderSurface() const { return CCLayerTreeHostCommon::renderSurfaceContributesToTarget<LayerType>(currentLayer(), targetRenderSurfaceLayer()->id()); }
     inline bool currentLayerRepresentsTargetRenderSurface() const { return m_currentLayerIndex == CCLayerIteratorValue::LayerIndexRepresentingTargetRenderSurface; }
 
     inline RenderSurfaceType* targetRenderSurface() const { return targetRenderSurfaceLayer()->renderSurface(); }
-    inline const Vector<RefPtr<LayerType> >& targetRenderSurfaceChildren() const { return targetRenderSurface()->layerList(); }
+    inline const LayerList& targetRenderSurfaceChildren() const { return targetRenderSurface()->layerList(); }
 
     IteratorActionType m_actions;
-    const Vector<RefPtr<LayerType> >* m_renderSurfaceLayerList;
+    const LayerList* m_renderSurfaceLayerList;
 
     // The iterator's current position.
 
@@ -161,14 +164,14 @@ struct CCLayerIteratorActions {
     // Walks layers sorted by z-order from back to front.
     class BackToFront {
     public:
-        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-        void begin(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
+        template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+        void begin(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>&);
 
-        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-        void end(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
+        template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+        void end(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>&);
 
-        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-        void next(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
+        template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+        void next(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>&);
 
     private:
         int m_highestTargetRenderSurfaceLayer;
@@ -177,18 +180,18 @@ struct CCLayerIteratorActions {
     // Walks layers sorted by z-order from front to back
     class FrontToBack {
     public:
-        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-        void begin(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
+        template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+        void begin(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>&);
 
-        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-        void end(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
+        template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+        void end(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>&);
 
-        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-        void next(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
+        template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+        void next(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>&);
 
     private:
-        template <typename LayerType, typename RenderSurfaceType, typename ActionType>
-        void goToHighestInSubtree(CCLayerIterator<LayerType, RenderSurfaceType, ActionType>&);
+        template <typename LayerType, typename LayerList, typename RenderSurfaceType, typename ActionType>
+        void goToHighestInSubtree(CCLayerIterator<LayerType, LayerList, RenderSurfaceType, ActionType>&);
     };
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.cpp
index 752855447..c434a1d95 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.cpp
@@ -295,7 +295,7 @@ void CCLayerSorter::createGraphNodes(LayerList::iterator first, LayerList::itera
     float minZ = FLT_MAX;
     float maxZ = -FLT_MAX;
     for (LayerList::const_iterator it = first; it < last; it++) {
-        m_nodes.append(GraphNode(it->get()));
+        m_nodes.append(GraphNode(*it));
         GraphNode& node = m_nodes.at(m_nodes.size() - 1);
         CCRenderSurface* renderSurface = node.layer->renderSurface();
         if (!node.layer->drawsContent() && !renderSurface)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.h
index 2c30d5dae..8ab9b7581 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerSorter.h
@@ -39,7 +39,7 @@ class CCLayerSorter {
 public:
     CCLayerSorter();
 
-    typedef Vector<RefPtr<CCLayerImpl> > LayerList;
+    typedef Vector<CCLayerImpl*> LayerList;
 
     void sort(LayerList::iterator first, LayerList::iterator last);
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.cpp
index cfefbd2b8..19d0251dc 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.cpp
@@ -112,6 +112,24 @@ IntRect CCLayerTilingData::tileRect(const Tile* tile) const
     return tileRect;
 }
 
+Region CCLayerTilingData::opaqueRegionInLayerRect(const IntRect& layerRect) const
+{
+    Region opaqueRegion;
+    int left, top, right, bottom;
+    layerRectToTileIndices(layerRect, left, top, right, bottom);
+    for (int j = top; j <= bottom; ++j) {
+        for (int i = left; i <= right; ++i) {
+            Tile* tile = tileAt(i, j);
+            if (!tile)
+                continue;
+
+            IntRect tileOpaqueRect = intersection(layerRect, tile->opaqueRect());
+            opaqueRegion.unite(tileOpaqueRect);
+        }
+    }
+    return opaqueRegion;
+}
+
 void CCLayerTilingData::setBounds(const IntSize& size)
 {
     m_tilingData.setTotalSize(size.width(), size.height());
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.h
index 869d42e15..9e18695e8 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTilingData.h
@@ -30,6 +30,7 @@
 #if USE(ACCELERATED_COMPOSITING)
 
 #include "IntRect.h"
+#include "Region.h"
 #include "TilingData.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashTraits.h>
@@ -69,9 +70,13 @@ public:
         int i() const { return m_i; }
         int j() const { return m_j; }
         void moveTo(int i, int j) { m_i = i; m_j = j; }
+
+        const IntRect& opaqueRect() const { return m_opaqueRect; }
+        void setOpaqueRect(const IntRect& opaqueRect) { m_opaqueRect = opaqueRect; }
     private:
         int m_i;
         int m_j;
+        IntRect m_opaqueRect;
     };
     // Default hash key traits for integers disallow 0 and -1 as a key, so
     // use a custom hash trait which disallows -1 and -2 instead.
@@ -96,6 +101,8 @@ public:
     void layerRectToTileIndices(const IntRect&, int &left, int &top, int &right, int &bottom) const;
     IntRect tileRect(const Tile*) const;
 
+    Region opaqueRegionInLayerRect(const IntRect&) const;
+
     void reset();
 
 protected:
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
index 501ee17de..34bce1181 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.cpp
@@ -35,6 +35,7 @@
 #include "cc/CCLayerIterator.h"
 #include "cc/CCLayerTreeHostCommon.h"
 #include "cc/CCLayerTreeHostImpl.h"
+#include "cc/CCOcclusionTracker.h"
 #include "cc/CCSingleThreadProxy.h"
 #include "cc/CCThread.h"
 #include "cc/CCThreadProxy.h"
@@ -66,6 +67,9 @@ CCLayerTreeHost::CCLayerTreeHost(CCLayerTreeHostClient* client, const CCSettings
     , m_client(client)
     , m_frameNumber(0)
     , m_layerRendererInitialized(false)
+    , m_contextLost(false)
+    , m_numTimesRecreateShouldFail(0)
+    , m_numFailedRecreateAttempts(0)
     , m_settings(settings)
     , m_visible(true)
     , m_pageScaleFactor(1)
@@ -114,7 +118,7 @@ void CCLayerTreeHost::initializeLayerRenderer()
     TRACE_EVENT("CCLayerTreeHost::initializeLayerRenderer", this, 0);
     if (!m_proxy->initializeLayerRenderer()) {
         // Uh oh, better tell the client that we can't do anything with this context.
-        m_client->didRecreateGraphicsContext(false);
+        m_client->didRecreateContext(false);
         return;
     }
 
@@ -131,6 +135,40 @@ void CCLayerTreeHost::initializeLayerRenderer()
     m_layerRendererInitialized = true;
 }
 
+CCLayerTreeHost::RecreateResult CCLayerTreeHost::recreateContext()
+{
+    TRACE_EVENT0("cc", "CCLayerTreeHost::recreateContext");
+    ASSERT(m_contextLost);
+
+    bool recreated = false;
+    if (!m_numTimesRecreateShouldFail)
+        recreated = m_proxy->recreateContext();
+    else
+        m_numTimesRecreateShouldFail--;
+
+    if (recreated) {
+        m_client->didRecreateContext(true);
+        m_contextLost = false;
+        return RecreateSucceeded;
+    }
+
+    // Tolerate a certain number of recreation failures to work around races
+    // in the context-lost machinery.
+    m_numFailedRecreateAttempts++;
+    if (m_numFailedRecreateAttempts < 5) {
+        // FIXME: The single thread does not self-schedule context
+        // recreation. So force another recreation attempt to happen by requesting
+        // another commit.
+        if (!CCProxy::hasImplThread())
+            setNeedsCommit();
+        return RecreateFailedButTryAgain;
+    }
+
+    // We have tried too many times to recreate the context. Tell the host to fall
+    // back to software rendering.
+    m_client->didRecreateContext(false);
+    return RecreateFailedAndGaveUp;
+}
 
 void CCLayerTreeHost::deleteContentsTexturesOnImplThread(TextureAllocator* allocator)
 {
@@ -169,13 +207,11 @@ void CCLayerTreeHost::finishCommitOnImplThread(CCLayerTreeHostImpl* hostImpl)
 {
     ASSERT(CCProxy::isImplThread());
 
-    // Synchronize trees, if one exists at all...
-    if (rootLayer()) {
-        hostImpl->setRootLayer(TreeSynchronizer::synchronizeTrees(rootLayer(), hostImpl->rootLayer()));
-        // We may have added an animation during the tree sync. This will cause hostImpl to visit its controllers.
+    hostImpl->setRootLayer(TreeSynchronizer::synchronizeTrees(rootLayer(), hostImpl->releaseRootLayer()));
+
+    // We may have added an animation during the tree sync. This will cause hostImpl to visit its controllers.
+    if (rootLayer())
         hostImpl->setNeedsAnimateLayers();
-    } else
-        hostImpl->setRootLayer(0);
 
     hostImpl->setSourceFrameNumber(frameNumber());
     hostImpl->setViewportSize(viewportSize());
@@ -191,9 +227,9 @@ void CCLayerTreeHost::commitComplete()
     m_contentsTextureManager->unprotectAllTextures();
 }
 
-PassRefPtr<GraphicsContext3D> CCLayerTreeHost::createLayerTreeHostContext3D()
+PassRefPtr<GraphicsContext3D> CCLayerTreeHost::createContext()
 {
-    return m_client->createLayerTreeHostContext3D();
+    return m_client->createContext();
 }
 
 PassOwnPtr<CCLayerTreeHostImpl> CCLayerTreeHost::createLayerTreeHostImpl(CCLayerTreeHostImplClient* client)
@@ -201,15 +237,18 @@ PassOwnPtr<CCLayerTreeHostImpl> CCLayerTreeHost::createLayerTreeHostImpl(CCLayer
     return CCLayerTreeHostImpl::create(m_settings, client);
 }
 
-void CCLayerTreeHost::didRecreateGraphicsContext(bool success)
+void CCLayerTreeHost::didLoseContext()
 {
-    m_client->didRecreateGraphicsContext(success);
+    TRACE_EVENT("CCLayerTreeHost::didLoseContext", 0, this);
+    ASSERT(CCProxy::isMainThread());
+    m_contextLost = true;
+    m_numFailedRecreateAttempts = 0;
+    setNeedsCommit();
 }
 
 // Temporary hack until WebViewImpl context creation gets simplified
 GraphicsContext3D* CCLayerTreeHost::context()
 {
-    ASSERT(!CCProxy::hasImplThread());
     return m_proxy->context();
 }
 
@@ -220,6 +259,10 @@ bool CCLayerTreeHost::compositeAndReadback(void *pixels, const IntRect& rect)
         if (!m_layerRendererInitialized)
             return false;
     }
+    if (m_contextLost) {
+        if (recreateContext() != RecreateSucceeded)
+            return false;
+    }
     m_triggerIdlePaints = false;
     bool ret = m_proxy->compositeAndReadback(pixels, rect);
     m_triggerIdlePaints = true;
@@ -259,10 +302,10 @@ void CCLayerTreeHost::setNeedsRedraw()
         m_client->scheduleComposite();
 }
 
-void CCLayerTreeHost::setAnimationEvents(PassOwnPtr<CCAnimationEventsVector> events)
+void CCLayerTreeHost::setAnimationEvents(PassOwnPtr<CCAnimationEventsVector> events, double wallClockTime)
 {
     ASSERT(CCThreadProxy::isMainThread());
-    // FIXME: need to walk the tree.
+    setAnimationEventsRecursive(*events, m_rootLayer.get(), wallClockTime);
 }
 
 void CCLayerTreeHost::setRootLayer(PassRefPtr<LayerChromium> rootLayer)
@@ -309,10 +352,7 @@ void CCLayerTreeHost::setVisible(bool visible)
 
     m_visible = visible;
 
-    if (!m_layerRendererInitialized)
-        return;
-
-    if (!visible) {
+    if (!visible && m_layerRendererInitialized) {
         m_contentsTextureManager->reduceMemoryToLimit(TextureManager::lowLimitBytes(viewportSize()));
         m_contentsTextureManager->unprotectAllTextures();
     }
@@ -326,6 +366,9 @@ void CCLayerTreeHost::setVisible(bool visible)
 void CCLayerTreeHost::didBecomeInvisibleOnImplThread(CCLayerTreeHostImpl* hostImpl)
 {
     ASSERT(CCProxy::isImplThread());
+    if (!m_layerRendererInitialized)
+        return;
+
     if (m_proxy->layerRendererCapabilities().contextHasCachedFrontBuffer)
         contentsTextureManager()->evictAndDeleteAllTextures(hostImpl->contentsTextureAllocator());
     else {
@@ -337,16 +380,15 @@ void CCLayerTreeHost::didBecomeInvisibleOnImplThread(CCLayerTreeHostImpl* hostIm
     // If the frontbuffer is cached, then clobber the impl tree. Otherwise,
     // push over the tree changes.
     if (m_proxy->layerRendererCapabilities().contextHasCachedFrontBuffer) {
-        hostImpl->setRootLayer(0);
+        hostImpl->setRootLayer(nullptr);
         return;
     }
 
-    if (rootLayer()) {
-        hostImpl->setRootLayer(TreeSynchronizer::synchronizeTrees(rootLayer(), hostImpl->rootLayer()));
-        // We may have added an animation during the tree sync. This will cause hostImpl to visit its controllers.
+    hostImpl->setRootLayer(TreeSynchronizer::synchronizeTrees(rootLayer(), hostImpl->releaseRootLayer()));
+
+    // We may have added an animation during the tree sync. This will cause hostImpl to visit its controllers.
+    if (rootLayer())
         hostImpl->setNeedsAnimateLayers();
-    } else
-        hostImpl->setRootLayer(0);
 }
 
 void CCLayerTreeHost::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec)
@@ -354,9 +396,11 @@ void CCLayerTreeHost::startPageScaleAnimation(const IntSize& targetPosition, boo
     m_proxy->startPageScaleAnimation(targetPosition, useAnchor, scale, durationSec);
 }
 
-void CCLayerTreeHost::loseCompositorContext(int numTimes)
+void CCLayerTreeHost::loseContext(int numTimes)
 {
-    m_proxy->loseCompositorContext(numTimes);
+    TRACE_EVENT1("cc", "CCLayerTreeHost::loseCompositorContext", "numTimes", numTimes);
+    m_numTimesRecreateShouldFail = numTimes - 1;
+    m_proxy->loseContext();
 }
 
 TextureManager* CCLayerTreeHost::contentsTextureManager() const
@@ -378,6 +422,10 @@ bool CCLayerTreeHost::updateLayers()
         if (!m_layerRendererInitialized)
             return false;
     }
+    if (m_contextLost) {
+        if (recreateContext() != RecreateSucceeded)
+            return false;
+    }
 
     if (!rootLayer())
         return true;
@@ -440,7 +488,7 @@ void CCLayerTreeHost::updateLayers(LayerChromium* rootLayer)
 void CCLayerTreeHost::reserveTextures()
 {
     // Use BackToFront since it's cheap and this isn't order-dependent.
-    typedef CCLayerIterator<LayerChromium, RenderSurfaceChromium, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
+    typedef CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
 
     CCLayerIteratorType end = CCLayerIteratorType::end(&m_updateList);
     for (CCLayerIteratorType it = CCLayerIteratorType::begin(&m_updateList); it != end; ++it) {
@@ -458,7 +506,7 @@ void CCLayerTreeHost::paintContentsIfDirty(LayerChromium* layer, PaintType paint
     if (PaintVisible == paintType)
         layer->paintContentsIfDirty(occludedScreenSpace);
     else
-        layer->idlePaintContentsIfDirty();
+        layer->idlePaintContentsIfDirty(occludedScreenSpace);
 }
 
 void CCLayerTreeHost::paintMaskAndReplicaForRenderSurface(LayerChromium* renderSurfaceLayer, PaintType paintType)
@@ -486,90 +534,36 @@ void CCLayerTreeHost::paintMaskAndReplicaForRenderSurface(LayerChromium* renderS
     }
 }
 
-struct RenderSurfaceRegion {
-    RenderSurfaceChromium* surface;
-    Region occludedInScreen;
-};
-
-// Add the surface to the top of the stack and copy the occlusion from the old top of the stack to the new.
-static void enterTargetRenderSurface(Vector<RenderSurfaceRegion>& stack, RenderSurfaceChromium* newTarget)
-{
-    if (stack.isEmpty()) {
-        stack.append(RenderSurfaceRegion());
-        stack.last().surface = newTarget;
-    } else if (stack.last().surface != newTarget) {
-        // If we are entering a subtree that is going to move pixels around, then the occlusion we've computed
-        // so far won't apply to the pixels we're drawing here in the same way. We discard the occlusion thus
-        // far to be safe, and ensure we don't cull any pixels that are moved such that they become visible.
-        const RenderSurfaceChromium* oldAncestorThatMovesPixels = stack.last().surface->nearestAncestorThatMovesPixels();
-        const RenderSurfaceChromium* newAncestorThatMovesPixels = newTarget->nearestAncestorThatMovesPixels();
-        bool enteringSubtreeThatMovesPixels = newAncestorThatMovesPixels && newAncestorThatMovesPixels != oldAncestorThatMovesPixels;
-
-        stack.append(RenderSurfaceRegion());
-        stack.last().surface = newTarget;
-        int lastIndex = stack.size() - 1;
-        if (!enteringSubtreeThatMovesPixels)
-            stack[lastIndex].occludedInScreen = stack[lastIndex - 1].occludedInScreen;
-    }
-}
-
-// Pop the top of the stack off, push on the new surface, and merge the old top's occlusion into the new top surface.
-static void leaveTargetRenderSurface(Vector<RenderSurfaceRegion>& stack, RenderSurfaceChromium* newTarget)
-{
-    int lastIndex = stack.size() - 1;
-    bool surfaceWillBeAtTopAfterPop = stack.size() > 1 && stack[lastIndex - 1].surface == newTarget;
-
-    if (surfaceWillBeAtTopAfterPop) {
-        // Merge the top of the stack down.
-        stack[lastIndex - 1].occludedInScreen.unite(stack[lastIndex].occludedInScreen);
-        stack.removeLast();
-    } else {
-        // Replace the top of the stack with the new pushed surface. Copy the occluded region to the top.
-        stack.last().surface = newTarget;
-    }
-}
-
 void CCLayerTreeHost::paintLayerContents(const LayerList& renderSurfaceLayerList, PaintType paintType)
 {
     // Use FrontToBack to allow for testing occlusion and performing culling during the tree walk.
-    typedef CCLayerIterator<LayerChromium, RenderSurfaceChromium, CCLayerIteratorActions::FrontToBack> CCLayerIteratorType;
+    typedef CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, CCLayerIteratorActions::FrontToBack> CCLayerIteratorType;
 
-    // The stack holds occluded regions for subtrees in the RenderSurface-Layer tree, so that when we leave a subtree we may
-    // apply a mask to it, but not to the parts outside the subtree.
-    // - The first time we see a new subtree under a target, we add that target to the top of the stack. This can happen as a layer representing itself, or as a target surface.
-    // - When we visit a target surface, we apply its mask to its subtree, which is at the top of the stack.
-    // - When we visit a layer representing itself, we add its occlusion to the current subtree, which is at the top of the stack.
-    // - When we visit a layer representing a contributing surface, the current target will never be the top of the stack since we just came from the contributing surface.
-    // We merge the occlusion at the top of the stack with the new current subtree. This new target is pushed onto the stack if not already there.
-    Vector<RenderSurfaceRegion> targetSurfaceStack;
+    CCOcclusionTracker occlusionTracker(IntRect(IntPoint(), viewportSize()));
+    occlusionTracker.setUsePaintTracking(false); // FIXME: Remove this to turn on paint tracking for paint culling
 
     CCLayerIteratorType end = CCLayerIteratorType::end(&renderSurfaceLayerList);
     for (CCLayerIteratorType it = CCLayerIteratorType::begin(&renderSurfaceLayerList); it != end; ++it) {
         if (it.representsTargetRenderSurface()) {
             ASSERT(it->renderSurface()->drawOpacity());
 
-            enterTargetRenderSurface(targetSurfaceStack, it->renderSurface());
+            occlusionTracker.finishedTargetRenderSurface(*it, it->renderSurface());
             paintMaskAndReplicaForRenderSurface(*it, paintType);
-            // FIXME: add the replica layer to the current occlusion
-
-            if (it->maskLayer() || it->renderSurface()->drawOpacity() < 1 || it->renderSurface()->filters().hasFilterThatAffectsOpacity())
-                targetSurfaceStack.last().occludedInScreen = Region();
         } else if (it.representsItself()) {
             ASSERT(!it->bounds().isEmpty());
 
-            enterTargetRenderSurface(targetSurfaceStack, it->targetRenderSurface());
-            paintContentsIfDirty(*it, paintType, targetSurfaceStack.last().occludedInScreen);
-            it->addSelfToOccludedScreenSpace(targetSurfaceStack.last().occludedInScreen);
-        } else {
-            leaveTargetRenderSurface(targetSurfaceStack, it.targetRenderSurfaceLayer()->renderSurface());
-        }
+            occlusionTracker.enterTargetRenderSurface(it->targetRenderSurface());
+            paintContentsIfDirty(*it, paintType, occlusionTracker.currentOcclusionInScreenSpace());
+            occlusionTracker.markOccludedBehindLayer(*it);
+        } else
+            occlusionTracker.leaveToTargetRenderSurface(it.targetRenderSurfaceLayer()->renderSurface());
     }
 }
 
 void CCLayerTreeHost::updateCompositorResources(GraphicsContext3D* context, CCTextureUpdater& updater)
 {
     // Use BackToFront since it's cheap and this isn't order-dependent.
-    typedef CCLayerIterator<LayerChromium, RenderSurfaceChromium, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
+    typedef CCLayerIterator<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
 
     CCLayerIteratorType end = CCLayerIteratorType::end(&m_updateList);
     for (CCLayerIteratorType it = CCLayerIteratorType::begin(&m_updateList); it != end; ++it) {
@@ -647,4 +641,15 @@ void CCLayerTreeHost::deleteTextureAfterCommit(PassOwnPtr<ManagedTexture> textur
     m_deleteTextureAfterCommitList.append(texture);
 }
 
+void CCLayerTreeHost::setAnimationEventsRecursive(const CCAnimationEventsVector& events, LayerChromium* layer, double wallClockTime)
+{
+    for (size_t eventIndex = 0; eventIndex < events.size(); ++eventIndex) {
+        if (layer->id() == events[eventIndex]->layerId())
+            layer->setAnimationEvent(*events[eventIndex], wallClockTime);
+    }
+
+    for (size_t childIndex = 0; childIndex < layer->children().size(); ++childIndex)
+        setAnimationEventsRecursive(events, layer->children()[childIndex].get(), wallClockTime);
 }
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
index 1662f50c3..d5262262d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHost.h
@@ -55,8 +55,8 @@ public:
     virtual void updateAnimations(double frameBeginTime) = 0;
     virtual void layout() = 0;
     virtual void applyScrollAndScale(const IntSize& scrollDelta, float pageScale) = 0;
-    virtual PassRefPtr<GraphicsContext3D> createLayerTreeHostContext3D() = 0;
-    virtual void didRecreateGraphicsContext(bool success) = 0;
+    virtual PassRefPtr<GraphicsContext3D> createContext() = 0;
+    virtual void didRecreateContext(bool success) = 0;
     virtual void didCommitAndDrawFrame() = 0;
     virtual void didCompleteSwapBuffers() = 0;
 
@@ -130,13 +130,21 @@ public:
     void beginCommitOnImplThread(CCLayerTreeHostImpl*);
     void finishCommitOnImplThread(CCLayerTreeHostImpl*);
     void commitComplete();
-    PassRefPtr<GraphicsContext3D> createLayerTreeHostContext3D();
+    PassRefPtr<GraphicsContext3D> createContext();
     virtual PassOwnPtr<CCLayerTreeHostImpl> createLayerTreeHostImpl(CCLayerTreeHostImplClient*);
     void didBecomeInvisibleOnImplThread(CCLayerTreeHostImpl*);
-    void didRecreateGraphicsContext(bool success);
+    void didLoseContext();
+    enum RecreateResult {
+        RecreateSucceeded,
+        RecreateFailedButTryAgain,
+        RecreateFailedAndGaveUp,
+    };
+    RecreateResult recreateContext();
     void didCommitAndDrawFrame() { m_client->didCommitAndDrawFrame(); }
     void didCompleteSwapBuffers() { m_client->didCompleteSwapBuffers(); }
     void deleteContentsTexturesOnImplThread(TextureAllocator*);
+    // Returns false if we should abort this frame due to initialization failure.
+    bool updateLayers();
 
     CCLayerTreeHostClient* client() { return m_client; }
 
@@ -145,6 +153,8 @@ public:
     // Only used when compositing on the main thread.
     void composite();
 
+    // NOTE: The returned value can only be used to make GL calls or make the
+    // context current on the thread the compositor is running on!
     GraphicsContext3D* context();
 
     // Composites and attempts to read back the result into the provided
@@ -159,14 +169,14 @@ public:
     const LayerRendererCapabilities& layerRendererCapabilities() const;
 
     // Test only hook
-    void loseCompositorContext(int numTimes);
+    void loseContext(int numTimes);
 
     void setNeedsAnimate();
     // virtual for testing
     virtual void setNeedsCommit();
     void setNeedsRedraw();
 
-    void setAnimationEvents(PassOwnPtr<CCAnimationEventsVector>);
+    void setAnimationEvents(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime);
 
     LayerChromium* rootLayer() { return m_rootLayer.get(); }
     const LayerChromium* rootLayer() const { return m_rootLayer.get(); }
@@ -185,9 +195,6 @@ public:
     bool visible() const { return m_visible; }
     void setVisible(bool);
 
-    // Returns false if we should abort this frame due to initialization failure.
-    bool updateLayers();
-
     void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec);
 
     void updateCompositorResources(GraphicsContext3D*, CCTextureUpdater&);
@@ -218,6 +225,8 @@ private:
     void reserveTextures();
     void clearPendingUpdate();
 
+    void setAnimationEventsRecursive(const CCAnimationEventsVector&, LayerChromium*, double wallClockTime);
+
     int m_compositorIdentifier;
 
     bool m_animating;
@@ -228,6 +237,9 @@ private:
 
     OwnPtr<CCProxy> m_proxy;
     bool m_layerRendererInitialized;
+    bool m_contextLost;
+    int m_numTimesRecreateShouldFail;
+    int m_numFailedRecreateAttempts;
 
     RefPtr<LayerChromium> m_rootLayer;
     OwnPtr<TextureManager> m_contentsTextureManager;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
index 4fc869400..c86d74d86 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.cpp
@@ -149,11 +149,9 @@ static bool subtreeShouldRenderToSeparateSurface(LayerType* layer, bool axisAlig
 
 // Recursively walks the layer tree starting at the given node and computes all the
 // necessary transformations, clipRects, render surfaces, etc.
-template<typename LayerType, typename RenderSurfaceType, typename LayerSorter>
-static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, LayerType* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, RenderSurfaceType* nearestAncestorThatMovesPixels, Vector<RefPtr<LayerType> >& renderSurfaceLayerList, Vector<RefPtr<LayerType> >& layerList, LayerSorter* layerSorter, int maxTextureSize)
+template<typename LayerType, typename LayerList, typename RenderSurfaceType, typename LayerSorter>
+static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, LayerType* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, RenderSurfaceType* nearestAncestorThatMovesPixels, LayerList& renderSurfaceLayerList, LayerList& layerList, LayerSorter* layerSorter, int maxTextureSize)
 {
-    typedef Vector<RefPtr<LayerType> > LayerList;
-
     // This function computes the new matrix transformations recursively for this
     // layer and all its descendants. It also computes the appropriate render surfaces.
     // Some important points to remember:
@@ -390,7 +388,7 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
 
     for (size_t i = 0; i < layer->children().size(); ++i) {
         LayerType* child = layer->children()[i].get();
-        bool drawsContent = calculateDrawTransformsAndVisibilityInternal<LayerType, RenderSurfaceType, LayerSorter>(child, rootLayer, sublayerMatrix, nextHierarchyMatrix, nearestAncestorThatMovesPixels, renderSurfaceLayerList, descendants, layerSorter, maxTextureSize);
+        bool drawsContent = calculateDrawTransformsAndVisibilityInternal<LayerType, LayerList, RenderSurfaceType, LayerSorter>(child, rootLayer, sublayerMatrix, nextHierarchyMatrix, nearestAncestorThatMovesPixels, renderSurfaceLayerList, descendants, layerSorter, maxTextureSize);
 
         if (drawsContent) {
             if (child->renderSurface()) {
@@ -495,11 +493,11 @@ static bool calculateDrawTransformsAndVisibilityInternal(LayerType* layer, Layer
 // FIXME: Instead of using the following function to set visibility rects on a second
 // tree pass, revise calculateVisibleLayerRect() so that this can be done in a single
 // pass inside calculateDrawTransformsAndVisibilityInternal<>().
-template<typename LayerType, typename RenderSurfaceType>
-static void walkLayersAndCalculateVisibleLayerRects(const Vector<RefPtr<LayerType> >& renderSurfaceLayerList)
+template<typename LayerType, typename LayerList, typename RenderSurfaceType>
+static void walkLayersAndCalculateVisibleLayerRects(const LayerList& renderSurfaceLayerList)
 {
     // Use BackToFront since it's cheap and this isn't order-dependent.
-    typedef CCLayerIterator<LayerType, RenderSurfaceType, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
+    typedef CCLayerIterator<LayerType, LayerList, RenderSurfaceType, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
 
     CCLayerIteratorType end = CCLayerIteratorType::end(&renderSurfaceLayerList);
     for (CCLayerIteratorType it = CCLayerIteratorType::begin(&renderSurfaceLayerList); it != end; ++it) {
@@ -512,14 +510,14 @@ static void walkLayersAndCalculateVisibleLayerRects(const Vector<RefPtr<LayerTyp
 
 void CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(LayerChromium* layer, LayerChromium* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<RefPtr<LayerChromium> >& renderSurfaceLayerList, Vector<RefPtr<LayerChromium> >& layerList, int maxTextureSize)
 {
-    WebCore::calculateDrawTransformsAndVisibilityInternal<LayerChromium, RenderSurfaceChromium, void*>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, 0, renderSurfaceLayerList, layerList, 0, maxTextureSize);
-    walkLayersAndCalculateVisibleLayerRects<LayerChromium, RenderSurfaceChromium>(renderSurfaceLayerList);
+    WebCore::calculateDrawTransformsAndVisibilityInternal<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium, void>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, 0, renderSurfaceLayerList, layerList, 0, maxTextureSize);
+    walkLayersAndCalculateVisibleLayerRects<LayerChromium, Vector<RefPtr<LayerChromium> >, RenderSurfaceChromium>(renderSurfaceLayerList);
 }
 
-void CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(CCLayerImpl* layer, CCLayerImpl* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<RefPtr<CCLayerImpl> >& renderSurfaceLayerList, Vector<RefPtr<CCLayerImpl> >& layerList, CCLayerSorter* layerSorter, int maxTextureSize)
+void CCLayerTreeHostCommon::calculateDrawTransformsAndVisibility(CCLayerImpl* layer, CCLayerImpl* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<CCLayerImpl*>& renderSurfaceLayerList, Vector<CCLayerImpl*>& layerList, CCLayerSorter* layerSorter, int maxTextureSize)
 {
-    calculateDrawTransformsAndVisibilityInternal<CCLayerImpl, CCRenderSurface, CCLayerSorter>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, 0, renderSurfaceLayerList, layerList, layerSorter, maxTextureSize);
-    walkLayersAndCalculateVisibleLayerRects<CCLayerImpl, CCRenderSurface>(renderSurfaceLayerList);
+    calculateDrawTransformsAndVisibilityInternal<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, CCLayerSorter>(layer, rootLayer, parentMatrix, fullHierarchyMatrix, 0, renderSurfaceLayerList, layerList, layerSorter, maxTextureSize);
+    walkLayersAndCalculateVisibleLayerRects<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface>(renderSurfaceLayerList);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.h
index 2e0cbcf2c..df23cd01f 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostCommon.h
@@ -43,7 +43,7 @@ public:
     template<typename LayerType> static IntRect calculateVisibleLayerRect(LayerType*);
 
     static void calculateDrawTransformsAndVisibility(LayerChromium*, LayerChromium* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<RefPtr<LayerChromium> >& renderSurfaceLayerList, Vector<RefPtr<LayerChromium> >& layerList, int maxTextureSize);
-    static void calculateDrawTransformsAndVisibility(CCLayerImpl*, CCLayerImpl* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<RefPtr<CCLayerImpl> >& renderSurfaceLayerList, Vector<RefPtr<CCLayerImpl> >& layerList, CCLayerSorter*, int maxTextureSize);
+    static void calculateDrawTransformsAndVisibility(CCLayerImpl*, CCLayerImpl* rootLayer, const TransformationMatrix& parentMatrix, const TransformationMatrix& fullHierarchyMatrix, Vector<CCLayerImpl*>& renderSurfaceLayerList, Vector<CCLayerImpl*>& layerList, CCLayerSorter*, int maxTextureSize);
 
     template<typename LayerType> static bool renderSurfaceContributesToTarget(LayerType*, int targetSurfaceLayerID);
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
index d30c68c37..002e7826d 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.cpp
@@ -31,6 +31,7 @@
 #include "LayerRendererChromium.h"
 #include "TraceEvent.h"
 #include "cc/CCDamageTracker.h"
+#include "cc/CCDelayBasedTimeSource.h"
 #include "cc/CCLayerIterator.h"
 #include "cc/CCLayerTreeHost.h"
 #include "cc/CCLayerTreeHostCommon.h"
@@ -39,8 +40,48 @@
 #include "cc/CCThreadTask.h"
 #include <wtf/CurrentTime.h>
 
+namespace {
+const double lowFrequencyAnimationInterval = 1;
+} // namespace
+
 namespace WebCore {
 
+class CCLayerTreeHostImplTimeSourceAdapter : public CCTimeSourceClient {
+    WTF_MAKE_NONCOPYABLE(CCLayerTreeHostImplTimeSourceAdapter);
+public:
+    static PassOwnPtr<CCLayerTreeHostImplTimeSourceAdapter> create(CCLayerTreeHostImpl* layerTreeHostImpl, PassRefPtr<CCDelayBasedTimeSource> timeSource)
+    {
+        return adoptPtr(new CCLayerTreeHostImplTimeSourceAdapter(layerTreeHostImpl, timeSource));
+    }
+    virtual ~CCLayerTreeHostImplTimeSourceAdapter()
+    {
+        m_timeSource->setClient(0);
+        m_timeSource->setActive(false);
+    }
+
+    virtual void onTimerTick()
+    {
+        m_layerTreeHostImpl->animate(monotonicallyIncreasingTime(), currentTime());
+    }
+
+    void setActive(bool active)
+    {
+        if (active != m_timeSource->active())
+            m_timeSource->setActive(active);
+    }
+
+private:
+    CCLayerTreeHostImplTimeSourceAdapter(CCLayerTreeHostImpl* layerTreeHostImpl, PassRefPtr<CCDelayBasedTimeSource> timeSource)
+        : m_layerTreeHostImpl(layerTreeHostImpl)
+        , m_timeSource(timeSource)
+    {
+        m_timeSource->setClient(this);
+    }
+
+    CCLayerTreeHostImpl* m_layerTreeHostImpl;
+    RefPtr<CCDelayBasedTimeSource> m_timeSource;
+};
+
 PassOwnPtr<CCLayerTreeHostImpl> CCLayerTreeHostImpl::create(const CCSettings& settings, CCLayerTreeHostImplClient* client)
 {
     return adoptPtr(new CCLayerTreeHostImpl(settings, client));
@@ -50,6 +91,7 @@ CCLayerTreeHostImpl::CCLayerTreeHostImpl(const CCSettings& settings, CCLayerTree
     : m_client(client)
     , m_sourceFrameNumber(-1)
     , m_frameNumber(0)
+    , m_scrollLayerImpl(0)
     , m_settings(settings)
     , m_visible(true)
     , m_pageScale(1)
@@ -59,6 +101,7 @@ CCLayerTreeHostImpl::CCLayerTreeHostImpl(const CCSettings& settings, CCLayerTree
     , m_maxPageScale(0)
     , m_needsAnimateLayers(false)
     , m_pinchGestureActive(false)
+    , m_timeSourceClientAdapter(CCLayerTreeHostImplTimeSourceAdapter::create(this, CCDelayBasedTimeSource::create(lowFrequencyAnimationInterval * 1000.0, CCProxy::currentThread())))
 {
     ASSERT(CCProxy::isImplThread());
 }
@@ -96,13 +139,13 @@ GraphicsContext3D* CCLayerTreeHostImpl::context()
     return m_layerRenderer ? m_layerRenderer->context() : 0;
 }
 
-void CCLayerTreeHostImpl::animate(double frameBeginTimeMs)
+void CCLayerTreeHostImpl::animate(double monotonicTime, double wallClockTime)
 {
-    animatePageScale(frameBeginTimeMs);
-    animateLayers(frameBeginTimeMs);
+    animatePageScale(monotonicTime);
+    animateLayers(monotonicTime, wallClockTime);
 }
 
-void CCLayerTreeHostImpl::startPageScaleAnimation(const IntSize& targetPosition, bool anchorPoint, float pageScale, double startTimeMs, double durationMs)
+void CCLayerTreeHostImpl::startPageScaleAnimation(const IntSize& targetPosition, bool anchorPoint, float pageScale, double startTime, double duration)
 {
     if (!m_scrollLayerImpl)
         return;
@@ -113,15 +156,15 @@ void CCLayerTreeHostImpl::startPageScaleAnimation(const IntSize& targetPosition,
     IntSize scaledContentSize = contentSize();
     scaledContentSize.scale(m_pageScaleDelta);
 
-    m_pageScaleAnimation = CCPageScaleAnimation::create(scrollTotal, scaleTotal, m_viewportSize, scaledContentSize, startTimeMs);
+    m_pageScaleAnimation = CCPageScaleAnimation::create(scrollTotal, scaleTotal, m_viewportSize, scaledContentSize, startTime);
 
     if (anchorPoint) {
         IntSize windowAnchor(targetPosition);
         windowAnchor.scale(scaleTotal / pageScale);
         windowAnchor -= scrollTotal;
-        m_pageScaleAnimation->zoomWithAnchor(windowAnchor, pageScale, durationMs);
+        m_pageScaleAnimation->zoomWithAnchor(windowAnchor, pageScale, duration);
     } else
-        m_pageScaleAnimation->zoomTo(targetPosition, pageScale, durationMs);
+        m_pageScaleAnimation->zoomTo(targetPosition, pageScale, duration);
 
     m_client->setNeedsRedrawOnImplThread();
     m_client->setNeedsCommitOnImplThread();
@@ -134,7 +177,7 @@ void CCLayerTreeHostImpl::trackDamageForAllSurfaces(CCLayerImpl* rootDrawLayer,
     // damage rect. The root damage rect is then used to scissor each surface.
 
     for (int surfaceIndex = renderSurfaceLayerList.size() - 1; surfaceIndex >= 0 ; --surfaceIndex) {
-        CCLayerImpl* renderSurfaceLayer = renderSurfaceLayerList[surfaceIndex].get();
+        CCLayerImpl* renderSurfaceLayer = renderSurfaceLayerList[surfaceIndex];
         CCRenderSurface* renderSurface = renderSurfaceLayer->renderSurface();
         ASSERT(renderSurface);
         renderSurface->damageTracker()->updateDamageTrackingState(renderSurface->layerList(), renderSurfaceLayer->id(), renderSurfaceLayer->maskLayer());
@@ -198,7 +241,7 @@ void CCLayerTreeHostImpl::calculateRenderPasses(CCRenderPassList& passes, CCLaye
     m_rootDamageRect = rootLayer()->renderSurface()->damageTracker()->currentDamageRect();
 
     for (int surfaceIndex = renderSurfaceLayerList.size() - 1; surfaceIndex >= 0 ; --surfaceIndex) {
-        CCLayerImpl* renderSurfaceLayer = renderSurfaceLayerList[surfaceIndex].get();
+        CCLayerImpl* renderSurfaceLayer = renderSurfaceLayerList[surfaceIndex];
         CCRenderSurface* renderSurface = renderSurfaceLayer->renderSurface();
 
         OwnPtr<CCRenderPass> pass = CCRenderPass::create(renderSurface);
@@ -210,7 +253,7 @@ void CCLayerTreeHostImpl::calculateRenderPasses(CCRenderPassList& passes, CCLaye
 
         const CCLayerList& layerList = renderSurface->layerList();
         for (unsigned layerIndex = 0; layerIndex < layerList.size(); ++layerIndex) {
-            CCLayerImpl* layer = layerList[layerIndex].get();
+            CCLayerImpl* layer = layerList[layerIndex];
             if (layer->visibleLayerRect().isEmpty())
                 continue;
 
@@ -233,20 +276,27 @@ void CCLayerTreeHostImpl::optimizeRenderPasses(CCRenderPassList& passes)
 
     bool haveDamageRect = layerRendererCapabilities().usingPartialSwap;
 
+    // FIXME: compute overdraw metrics only occasionally, not every frame.
+    CCOverdrawCounts overdrawCounts;
     for (unsigned i = 0; i < passes.size(); ++i) {
-        FloatRect damageRect = passes[i]->targetSurface()->damageTracker()->currentDamageRect();
-        passes[i]->optimizeQuads(haveDamageRect, damageRect);
+        FloatRect damageRect = passes[i]->surfaceDamageRect();
+        passes[i]->optimizeQuads(haveDamageRect, damageRect, &overdrawCounts);
     }
+
+    float normalization = 1000.f / (m_layerRenderer->viewportWidth() * m_layerRenderer->viewportHeight());
+    PlatformSupport::histogramCustomCounts("Renderer4.pixelOverdrawOpaque", static_cast<int>(normalization * overdrawCounts.m_pixelsDrawnOpaque), 100, 1000000, 50);
+    PlatformSupport::histogramCustomCounts("Renderer4.pixelOverdrawTransparent", static_cast<int>(normalization * overdrawCounts.m_pixelsDrawnTransparent), 100, 1000000, 50);
+    PlatformSupport::histogramCustomCounts("Renderer4.pixelOverdrawCulled", static_cast<int>(normalization * overdrawCounts.m_pixelsCulled), 100, 1000000, 50);
 }
 
-void CCLayerTreeHostImpl::animateLayersRecursive(CCLayerImpl* current, double frameBeginTimeSecs, CCAnimationEventsVector& events, bool& didAnimate, bool& needsAnimateLayers)
+void CCLayerTreeHostImpl::animateLayersRecursive(CCLayerImpl* current, double monotonicTime, double wallClockTime, CCAnimationEventsVector& events, bool& didAnimate, bool& needsAnimateLayers)
 {
     bool subtreeNeedsAnimateLayers = false;
 
     CCLayerAnimationControllerImpl* currentController = current->layerAnimationController();
 
     bool hadActiveAnimation = currentController->hasActiveAnimation();
-    currentController->animate(frameBeginTimeSecs, events);
+    currentController->animate(monotonicTime, events);
     bool startedAnimation = events.size() > 0;
 
     // We animated if we either ticked a running animation, or started a new animation.
@@ -259,7 +309,7 @@ void CCLayerTreeHostImpl::animateLayersRecursive(CCLayerImpl* current, double fr
 
     for (size_t i = 0; i < current->children().size(); ++i) {
         bool childNeedsAnimateLayers = false;
-        animateLayersRecursive(current->children()[i].get(), frameBeginTimeSecs, events, didAnimate, childNeedsAnimateLayers);
+        animateLayersRecursive(current->children()[i].get(), monotonicTime, wallClockTime, events, didAnimate, childNeedsAnimateLayers);
         if (childNeedsAnimateLayers)
             subtreeNeedsAnimateLayers = true;
     }
@@ -294,7 +344,7 @@ void CCLayerTreeHostImpl::drawLayers()
     for (size_t i = 0; i < passes.size(); ++i)
         m_layerRenderer->drawRenderPass(passes[i].get());
 
-    typedef CCLayerIterator<CCLayerImpl, CCRenderSurface, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
+    typedef CCLayerIterator<CCLayerImpl, Vector<CCLayerImpl*>, CCRenderSurface, CCLayerIteratorActions::BackToFront> CCLayerIteratorType;
 
     CCLayerIteratorType end = CCLayerIteratorType::end(&renderSurfaceLayerList);
     for (CCLayerIteratorType it = CCLayerIteratorType::begin(&renderSurfaceLayerList); it != end; ++it) {
@@ -311,7 +361,8 @@ void CCLayerTreeHostImpl::drawLayers()
 
 void CCLayerTreeHostImpl::finishAllRendering()
 {
-    m_layerRenderer->finish();
+    if (m_layerRenderer)
+        m_layerRenderer->finish();
 }
 
 bool CCLayerTreeHostImpl::isContextLost()
@@ -331,10 +382,15 @@ TextureAllocator* CCLayerTreeHostImpl::contentsTextureAllocator() const
 
 void CCLayerTreeHostImpl::swapBuffers()
 {
-    ASSERT(m_layerRenderer && !isContextLost());
+    ASSERT(m_layerRenderer);
     m_layerRenderer->swapBuffers(enclosingIntRect(m_rootDamageRect));
 }
 
+void CCLayerTreeHostImpl::didLoseContext()
+{
+    m_client->didLoseContextOnImplThread();
+}
+
 void CCLayerTreeHostImpl::onSwapBuffersComplete()
 {
     m_client->onSwapBuffersCompleteOnImplThread();
@@ -342,7 +398,7 @@ void CCLayerTreeHostImpl::onSwapBuffersComplete()
 
 void CCLayerTreeHostImpl::readback(void* pixels, const IntRect& rect)
 {
-    ASSERT(m_layerRenderer && !isContextLost());
+    ASSERT(m_layerRenderer);
     m_layerRenderer->getFramebufferPixels(pixels, rect);
 }
 
@@ -363,7 +419,7 @@ static CCLayerImpl* findScrollLayer(CCLayerImpl* layer)
     return 0;
 }
 
-void CCLayerTreeHostImpl::setRootLayer(PassRefPtr<CCLayerImpl> layer)
+void CCLayerTreeHostImpl::setRootLayer(PassOwnPtr<CCLayerImpl> layer)
 {
     m_rootLayerImpl = layer;
 
@@ -377,8 +433,18 @@ void CCLayerTreeHostImpl::setVisible(bool visible)
         return;
     m_visible = visible;
 
-    if (m_layerRenderer)
-        m_layerRenderer->setVisible(visible);
+    if (!m_layerRenderer)
+        return;
+
+    m_layerRenderer->setVisible(visible);
+
+    // Reset the damage tracker because the front/back buffers may have been damaged by the GPU
+    // process on visibility change.
+    if (visible && m_layerRenderer->capabilities().usingPartialSwap)
+        setFullRootLayerDamage();
+
+    const bool shouldTickInBackground = !visible && m_needsAnimateLayers;
+    m_timeSourceClientAdapter->setActive(shouldTickInBackground);
 }
 
 bool CCLayerTreeHostImpl::initializeLayerRenderer(PassRefPtr<GraphicsContext3D> context)
@@ -386,10 +452,16 @@ bool CCLayerTreeHostImpl::initializeLayerRenderer(PassRefPtr<GraphicsContext3D>
     OwnPtr<LayerRendererChromium> layerRenderer;
     layerRenderer = LayerRendererChromium::create(this, context);
 
-    if (m_layerRenderer)
+    if (m_layerRenderer) {
         m_layerRenderer->close();
+        sendDidLoseContextRecursive(m_rootLayerImpl.get());
+    }
 
     m_layerRenderer = layerRenderer.release();
+
+    if (!m_visible && m_layerRenderer)
+         m_layerRenderer->setVisible(m_visible);
+
     return m_layerRenderer;
 }
 
@@ -470,6 +542,10 @@ void CCLayerTreeHostImpl::updateMaxScrollPosition()
         return;
 
     FloatSize viewBounds = m_viewportSize;
+    if (CCLayerImpl* clipLayer = m_scrollLayerImpl->parent()) {
+        if (clipLayer->masksToBounds())
+            viewBounds = clipLayer->bounds();
+    }
     viewBounds.scale(1 / m_pageScaleDelta);
 
     IntSize maxScroll = contentSize() - expandedIntSize(viewBounds);
@@ -487,7 +563,7 @@ void CCLayerTreeHostImpl::setNeedsRedraw()
     m_client->setNeedsRedrawOnImplThread();
 }
 
-CCInputHandlerClient::ScrollStatus CCLayerTreeHostImpl::scrollBegin(const IntPoint& point, CCInputHandlerClient::ScrollInputType type)
+CCInputHandlerClient::ScrollStatus CCLayerTreeHostImpl::scrollBegin(const IntPoint& viewportPoint, CCInputHandlerClient::ScrollInputType type)
 {
     // TODO: Check for scrollable sublayers.
     if (!m_scrollLayerImpl || !m_scrollLayerImpl->scrollable()) {
@@ -495,6 +571,17 @@ CCInputHandlerClient::ScrollStatus CCLayerTreeHostImpl::scrollBegin(const IntPoi
         return ScrollIgnored;
     }
 
+    if (m_scrollLayerImpl->shouldScrollOnMainThread()) {
+        TRACE_EVENT("scrollBegin Failed shouldScrollOnMainThread", this, 0);
+        return ScrollFailed;
+    }
+
+    IntPoint scrollLayerContentPoint(m_scrollLayerImpl->screenSpaceTransform().inverse().mapPoint(viewportPoint));
+    if (m_scrollLayerImpl->nonFastScrollableRegion().contains(scrollLayerContentPoint)) {
+        TRACE_EVENT("scrollBegin Failed nonFastScrollableRegion", this, 0);
+        return ScrollFailed;
+    }
+
     if (type == CCInputHandlerClient::Wheel && m_scrollLayerImpl->haveWheelEventHandlers()) {
         TRACE_EVENT("scrollBegin Failed wheelEventHandlers", this, 0);
         return ScrollFailed;
@@ -643,26 +730,26 @@ void CCLayerTreeHostImpl::setFullRootLayerDamage()
     }
 }
 
-void CCLayerTreeHostImpl::animatePageScale(double frameBeginTimeMs)
+void CCLayerTreeHostImpl::animatePageScale(double monotonicTime)
 {
     if (!m_pageScaleAnimation)
         return;
 
     IntSize scrollTotal = toSize(m_scrollLayerImpl->scrollPosition() + m_scrollLayerImpl->scrollDelta());
 
-    setPageScaleDelta(m_pageScaleAnimation->pageScaleAtTime(frameBeginTimeMs) / m_pageScale);
-    IntSize nextScroll = m_pageScaleAnimation->scrollOffsetAtTime(frameBeginTimeMs);
+    setPageScaleDelta(m_pageScaleAnimation->pageScaleAtTime(monotonicTime) / m_pageScale);
+    IntSize nextScroll = m_pageScaleAnimation->scrollOffsetAtTime(monotonicTime);
     nextScroll.scale(1 / m_pageScaleDelta);
     m_scrollLayerImpl->scrollBy(nextScroll - scrollTotal);
     m_client->setNeedsRedrawOnImplThread();
 
-    if (m_pageScaleAnimation->isAnimationCompleteAtTime(frameBeginTimeMs)) {
+    if (m_pageScaleAnimation->isAnimationCompleteAtTime(monotonicTime)) {
         m_pageScaleAnimation.clear();
         m_client->setNeedsCommitOnImplThread();
     }
 }
 
-void CCLayerTreeHostImpl::animateLayers(double frameBeginTimeMs)
+void CCLayerTreeHostImpl::animateLayers(double monotonicTime, double wallClockTime)
 {
     if (!m_settings.threadedAnimationEnabled || !m_needsAnimateLayers || !m_rootLayerImpl)
         return;
@@ -672,13 +759,28 @@ void CCLayerTreeHostImpl::animateLayers(double frameBeginTimeMs)
     OwnPtr<CCAnimationEventsVector> events(adoptPtr(new CCAnimationEventsVector));
 
     bool didAnimate = false;
-    animateLayersRecursive(m_rootLayerImpl.get(), frameBeginTimeMs / 1000, *events, didAnimate, m_needsAnimateLayers);
+    animateLayersRecursive(m_rootLayerImpl.get(), monotonicTime, wallClockTime, *events, didAnimate, m_needsAnimateLayers);
 
     if (!events->isEmpty())
-        m_client->postAnimationEventsToMainThreadOnImplThread(events.release());
+        m_client->postAnimationEventsToMainThreadOnImplThread(events.release(), wallClockTime);
 
     if (didAnimate)
         m_client->setNeedsRedrawOnImplThread();
+
+    const bool shouldTickInBackground = m_needsAnimateLayers && !m_visible;
+    m_timeSourceClientAdapter->setActive(shouldTickInBackground);
+}
+
+void CCLayerTreeHostImpl::sendDidLoseContextRecursive(CCLayerImpl* current)
+{
+    if (!current)
+        return;
+
+    current->didLoseContext();
+    sendDidLoseContextRecursive(current->maskLayer());
+    sendDidLoseContextRecursive(current->replicaLayer());
+    for (size_t i = 0; i < current->children().size(); ++i)
+        sendDidLoseContextRecursive(current->children()[i].get());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
index e438db0c4..1cfd0fb67 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCLayerTreeHostImpl.h
@@ -25,6 +25,7 @@
 #ifndef CCLayerTreeHostImpl_h
 #define CCLayerTreeHostImpl_h
 
+#include "LayerRendererChromium.h"
 #include "cc/CCAnimationEvents.h"
 #include "cc/CCInputHandler.h"
 #include "cc/CCLayerSorter.h"
@@ -39,6 +40,7 @@ namespace WebCore {
 class CCCompletionEvent;
 class CCPageScaleAnimation;
 class CCLayerImpl;
+class CCLayerTreeHostImplTimeSourceAdapter;
 class LayerRendererChromium;
 class TextureAllocator;
 struct LayerRendererCapabilities;
@@ -47,14 +49,15 @@ class TransformationMatrix;
 // CCLayerTreeHost->CCProxy callback interface.
 class CCLayerTreeHostImplClient {
 public:
+    virtual void didLoseContextOnImplThread() = 0;
     virtual void onSwapBuffersCompleteOnImplThread() = 0;
     virtual void setNeedsRedrawOnImplThread() = 0;
     virtual void setNeedsCommitOnImplThread() = 0;
-    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>) = 0;
+    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime) = 0;
 };
 
 // CCLayerTreeHostImpl owns the CCLayerImpl tree as well as associated rendering state
-class CCLayerTreeHostImpl : public CCInputHandlerClient {
+class CCLayerTreeHostImpl : public CCInputHandlerClient, LayerRendererChromiumClient {
     WTF_MAKE_NONCOPYABLE(CCLayerTreeHostImpl);
 public:
     static PassOwnPtr<CCLayerTreeHostImpl> create(const CCSettings&, CCLayerTreeHostImplClient*);
@@ -68,14 +71,23 @@ public:
     virtual void pinchGestureBegin();
     virtual void pinchGestureUpdate(float, const IntPoint&);
     virtual void pinchGestureEnd();
-    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool anchorPoint, float pageScale, double startTimeMs, double durationMs);
+    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool anchorPoint, float pageScale, double startTime, double duration);
 
     // Virtual for testing.
     virtual void beginCommit();
     virtual void commitComplete();
-    virtual void animate(double frameDisplayTimeMs);
+    virtual void animate(double monotonicTime, double wallClockTime);
     virtual void drawLayers();
 
+    // LayerRendererChromiumClient implementation
+    virtual const IntSize& viewportSize() const { return m_viewportSize; }
+    virtual const CCSettings& settings() const { return m_settings; }
+    virtual CCLayerImpl* rootLayer() { return m_rootLayerImpl.get(); }
+    virtual const CCLayerImpl* rootLayer() const  { return m_rootLayerImpl.get(); }
+    virtual void didLoseContext();
+    virtual void onSwapBuffersComplete();
+
+    // Implementation
     bool canDraw();
     GraphicsContext3D* context();
 
@@ -89,14 +101,13 @@ public:
     TextureAllocator* contentsTextureAllocator() const;
 
     void swapBuffers();
-    void onSwapBuffersComplete();
 
     void readback(void* pixels, const IntRect&);
 
-    CCLayerImpl* rootLayer() const { return m_rootLayerImpl.get(); }
-    void setRootLayer(PassRefPtr<CCLayerImpl>);
+    void setRootLayer(PassOwnPtr<CCLayerImpl>);
+    PassOwnPtr<CCLayerImpl> releaseRootLayer() { return m_rootLayerImpl.release(); }
 
-    CCLayerImpl* scrollLayer() const { return m_scrollLayerImpl.get(); }
+    CCLayerImpl* scrollLayer() const { return m_scrollLayerImpl; }
 
     bool visible() const { return m_visible; }
     void setVisible(bool);
@@ -105,13 +116,10 @@ public:
     void setSourceFrameNumber(int frameNumber) { m_sourceFrameNumber = frameNumber; }
 
     void setViewportSize(const IntSize&);
-    const IntSize& viewportSize() const { return m_viewportSize; }
 
     void setPageScaleFactorAndLimits(float pageScale, float minPageScale, float maxPageScale);
     float pageScale() const { return m_pageScale; }
 
-    const CCSettings& settings() const { return m_settings; }
-
     PassOwnPtr<CCScrollAndScaleSet> processScrollDeltas();
 
     // Where possible, redraws are scissored to a damage region calculated from changes to
@@ -126,17 +134,17 @@ public:
 protected:
     CCLayerTreeHostImpl(const CCSettings&, CCLayerTreeHostImplClient*);
 
-    void animatePageScale(double frameBeginTimeMs);
+    void animatePageScale(double monotonicTime);
 
     // Virtual for testing.
-    virtual void animateLayers(double frameBeginTimeMs);
+    virtual void animateLayers(double monotonicTime, double wallClockTime);
 
     CCLayerTreeHostImplClient* m_client;
     int m_sourceFrameNumber;
     int m_frameNumber;
 
 private:
-    typedef Vector<RefPtr<CCLayerImpl> > CCLayerList;
+    typedef Vector<CCLayerImpl*> CCLayerList;
 
     void computeDoubleTapZoomDeltas(CCScrollAndScaleSet* scrollInfo);
     void computePinchZoomDeltas(CCScrollAndScaleSet* scrollInfo);
@@ -149,12 +157,13 @@ private:
     void trackDamageForAllSurfaces(CCLayerImpl* rootDrawLayer, const CCLayerList& renderSurfaceLayerList);
     void calculateRenderPasses(CCRenderPassList&, CCLayerList& renderSurfaceLayerList);
     void optimizeRenderPasses(CCRenderPassList&);
-    void animateLayersRecursive(CCLayerImpl*, double frameBeginTimeSecs, CCAnimationEventsVector&, bool& didAnimate, bool& needsAnimateLayers);
+    void animateLayersRecursive(CCLayerImpl*, double monotonicTime, double wallClockTime, CCAnimationEventsVector&, bool& didAnimate, bool& needsAnimateLayers);
     IntSize contentSize() const;
+    void sendDidLoseContextRecursive(CCLayerImpl*);
 
     OwnPtr<LayerRendererChromium> m_layerRenderer;
-    RefPtr<CCLayerImpl> m_rootLayerImpl;
-    RefPtr<CCLayerImpl> m_scrollLayerImpl;
+    OwnPtr<CCLayerImpl> m_rootLayerImpl;
+    CCLayerImpl* m_scrollLayerImpl;
     CCSettings m_settings;
     IntSize m_viewportSize;
     bool m_visible;
@@ -171,6 +180,9 @@ private:
 
     OwnPtr<CCPageScaleAnimation> m_pageScaleAnimation;
 
+    // This is used for ticking animations slowly when hidden.
+    OwnPtr<CCLayerTreeHostImplTimeSourceAdapter> m_timeSourceClientAdapter;
+
     CCLayerSorter m_layerSorter;
 
     FloatRect m_rootDamageRect;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
index c5611ac27..f1c933882 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.cpp
@@ -39,6 +39,22 @@ using namespace std;
 namespace WebCore {
 
 template<typename LayerType, typename RenderSurfaceType>
+CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace)
+    : m_scissorRectInScreenSpace(scissorRectInScreenSpace)
+    , m_surfaceDamageClient(0)
+    , m_usePaintTracking(true) // FIXME: Remove this when paint tracking is on for paint culling.
+{
+}
+
+template<typename LayerType, typename RenderSurfaceType>
+CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace, const DamageClientType* surfaceDamageClient)
+    : m_scissorRectInScreenSpace(scissorRectInScreenSpace)
+    , m_surfaceDamageClient(surfaceDamageClient)
+    , m_usePaintTracking(true) // FIXME: Remove this when paint tracking is on for paint culling.
+{
+}
+
+template<typename LayerType, typename RenderSurfaceType>
 void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::enterTargetRenderSurface(const RenderSurfaceType* newTarget)
 {
     if (!m_stack.isEmpty() && m_stack.last().surface == newTarget)
@@ -170,8 +186,9 @@ static inline TransformationMatrix contentToTargetSurfaceTransform(const LayerTy
     return transform;
 }
 
+// FIXME: Remove usePaintTracking when paint tracking is on for paint culling.
 template<typename LayerType>
-static inline Region computeOcclusionBehindLayer(const LayerType* layer, const TransformationMatrix& transform)
+static inline Region computeOcclusionBehindLayer(const LayerType* layer, const TransformationMatrix& transform, bool usePaintTracking)
 {
     Region opaqueRegion;
 
@@ -182,7 +199,14 @@ static inline Region computeOcclusionBehindLayer(const LayerType* layer, const T
 
     if (layer->opaque())
         opaqueRegion = enclosedIntRect(unoccludedQuad.boundingBox());
-    // FIXME: Capture opaque paints: else opaqueRegion = layer->opaqueContentsRegion(transform);
+    else if (usePaintTracking && transform.isIdentity())
+        opaqueRegion = layer->opaqueContentsRegion();
+    else if (usePaintTracking) {
+        Region contentRegion = layer->opaqueContentsRegion();
+        Vector<IntRect> contentRects = contentRegion.rects();
+        for (size_t i = 0; i < contentRects.size(); ++i)
+            opaqueRegion.unite(enclosedIntRect(transform.mapRect(FloatRect(contentRects[i]))));
+    }
     return opaqueRegion;
 }
 
@@ -191,6 +215,8 @@ void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::markOccludedBehindLay
 {
     ASSERT(!m_stack.isEmpty());
     ASSERT(layer->targetRenderSurface() == m_stack.last().surface);
+    if (m_stack.isEmpty())
+        return;
 
     if (layer->drawOpacity() != 1)
         return;
@@ -198,45 +224,31 @@ void CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::markOccludedBehindLay
     TransformationMatrix contentToScreenSpace = contentToScreenSpaceTransform<LayerType>(layer);
     TransformationMatrix contentToTargetSurface = contentToTargetSurfaceTransform<LayerType>(layer);
 
-    m_stack.last().occlusionInScreen.unite(computeOcclusionBehindLayer<LayerType>(layer, contentToScreenSpace));
-    m_stack.last().occlusionInTarget.unite(computeOcclusionBehindLayer<LayerType>(layer, contentToTargetSurface));
+    // FIXME: Remove m_usePaintTracking when paint tracking is on for paint culling.
+    m_stack.last().occlusionInScreen.unite(computeOcclusionBehindLayer<LayerType>(layer, contentToScreenSpace, m_usePaintTracking));
+    m_stack.last().occlusionInTarget.unite(computeOcclusionBehindLayer<LayerType>(layer, contentToTargetSurface, m_usePaintTracking));
 }
 
-static inline bool testContentRectOccluded(const IntRect& contentRect, const TransformationMatrix& contentSpaceTransform, const Region& occlusion)
+static inline bool testContentRectOccluded(const IntRect& contentRect, const TransformationMatrix& contentSpaceTransform, const IntRect& scissorRect, const Region& occlusion)
 {
-    FloatQuad transformedQuad = contentSpaceTransform.mapQuad(FloatQuad(contentRect));
-    return occlusion.contains(transformedQuad.enclosingBoundingBox());
+    FloatRect transformedRect = contentSpaceTransform.mapRect(FloatRect(contentRect));
+    // Take the enclosingIntRect, as we want to include partial pixels in the test.
+    IntRect targetRect = intersection(enclosingIntRect(transformedRect), scissorRect);
+    return targetRect.isEmpty() || occlusion.contains(targetRect);
 }
 
 template<typename LayerType, typename RenderSurfaceType>
 bool CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::occluded(const LayerType* layer, const IntRect& contentRect) const
 {
+    ASSERT(!m_stack.isEmpty());
     if (m_stack.isEmpty())
         return false;
 
     ASSERT(layer->targetRenderSurface() == m_stack.last().surface);
 
-    if (testContentRectOccluded(contentRect, contentToScreenSpaceTransform<LayerType>(layer), m_stack.last().occlusionInScreen))
+    if (testContentRectOccluded(contentRect, contentToScreenSpaceTransform<LayerType>(layer), m_scissorRectInScreenSpace, m_stack.last().occlusionInScreen))
         return true;
-    if (testContentRectOccluded(contentRect, contentToTargetSurfaceTransform<LayerType>(layer), m_stack.last().occlusionInTarget))
-        return true;
-    return false;
-}
-
-template<typename LayerType, typename RenderSurfaceType>
-bool CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::surfaceOccluded(const LayerType* layer, const IntRect& surfaceContentRect) const
-{
-    // A surface is not occluded by layers drawing into itself, so we need to use occlusion from one spot down on the stack.
-    if (m_stack.size() < 2)
-        return false;
-
-    ASSERT(layer->renderSurface());
-    ASSERT(layer->renderSurface() == m_stack.last().surface);
-
-    TransformationMatrix surfaceContentToScreenSpace = contentToScreenSpaceTransform<LayerType>(layer);
-
-    const StackObject& secondLast = m_stack[m_stack.size()-2];
-    if (testContentRectOccluded(surfaceContentRect, surfaceContentToScreenSpace, secondLast.occlusionInScreen))
+    if (testContentRectOccluded(contentRect, contentToTargetSurfaceTransform<LayerType>(layer), layerScissorRectInTargetSurface(layer), m_stack.last().occlusionInTarget))
         return true;
     return false;
 }
@@ -256,22 +268,20 @@ static inline IntRect rectSubtractRegion(const IntRect& rect, const Region& regi
     return boundsRect;
 }
 
-static IntRect computeUnoccludedContentRect(const IntRect& contentRect, const TransformationMatrix& contentSpaceTransform, const Region& occlusion)
+static inline IntRect computeUnoccludedContentRect(const IntRect& contentRect, const TransformationMatrix& contentSpaceTransform, const IntRect& scissorRect, const Region& occlusion)
 {
-    FloatQuad transformedQuad = contentSpaceTransform.mapQuad(FloatQuad(contentRect));
-    if (!transformedQuad.isRectilinear())
-        return contentRect;
-    // Take the enclosingIntRect at each step here, as we want to contain any unoccluded partial pixels in the resulting IntRect.
-    IntRect shrunkRect = rectSubtractRegion(enclosingIntRect(transformedQuad.boundingBox()), occlusion);
+    FloatRect transformedRect = contentSpaceTransform.mapRect(FloatRect(contentRect));
+    // Take the enclosingIntRect at each step, as we want to contain any unoccluded partial pixels in the resulting IntRect.
+    IntRect shrunkRect = rectSubtractRegion(intersection(enclosingIntRect(transformedRect), scissorRect), occlusion);
     IntRect unoccludedRect = enclosingIntRect(contentSpaceTransform.inverse().mapRect(FloatRect(shrunkRect)));
-    // The use of enclosingIntRect, with floating point rounding, can give us a result that is not a sub-rect of contentRect, but our
-    // return value should be a sub-rect.
+    // The rect back in content space is a bounding box and may extend outside of the original contentRect, so clamp it to the contentRectBounds.
     return intersection(unoccludedRect, contentRect);
 }
 
 template<typename LayerType, typename RenderSurfaceType>
 IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::unoccludedContentRect(const LayerType* layer, const IntRect& contentRect) const
 {
+    ASSERT(!m_stack.isEmpty());
     if (m_stack.isEmpty())
         return contentRect;
 
@@ -281,31 +291,24 @@ IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::unoccludedContentR
     TransformationMatrix contentToScreenSpace = contentToScreenSpaceTransform<LayerType>(layer);
     TransformationMatrix contentToTargetSurface = contentToTargetSurfaceTransform<LayerType>(layer);
 
-    IntRect unoccludedInScreen = computeUnoccludedContentRect(contentRect, contentToScreenSpace, m_stack.last().occlusionInScreen);
-    IntRect unoccludedInTarget = computeUnoccludedContentRect(contentRect, contentToTargetSurface, m_stack.last().occlusionInTarget);
+    IntRect unoccludedInScreen = computeUnoccludedContentRect(contentRect, contentToScreenSpace, m_scissorRectInScreenSpace, m_stack.last().occlusionInScreen);
+    if (unoccludedInScreen.isEmpty())
+        return IntRect();
+    IntRect unoccludedInTarget = computeUnoccludedContentRect(contentRect, contentToTargetSurface, layerScissorRectInTargetSurface(layer), m_stack.last().occlusionInTarget);
 
     return intersection(unoccludedInScreen, unoccludedInTarget);
 }
 
 template<typename LayerType, typename RenderSurfaceType>
-IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::surfaceUnoccludedContentRect(const LayerType* layer, const IntRect& surfaceContentRect) const
+IntRect CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::layerScissorRectInTargetSurface(const LayerType* layer) const
 {
-    // A surface is not occluded by layers drawing into itself, so we need to use occlusion from one spot down on the stack.
-    if (m_stack.size() < 2)
-        return surfaceContentRect;
-
-    ASSERT(layer->renderSurface());
-    ASSERT(layer->renderSurface() == m_stack.last().surface);
-
-    // We want to return a rect that contains all the visible parts of |contentRect| in both screen space and in the target surface.
-    // So we find the visible parts of |contentRect| in each space, and take the intersection.
-
-    TransformationMatrix contentToScreenSpace = contentToScreenSpaceTransform<LayerType>(layer);
-
-    const StackObject& secondLast = m_stack[m_stack.size()-2];
-    IntRect unoccludedInScreen = computeUnoccludedContentRect(surfaceContentRect, contentToScreenSpace, secondLast.occlusionInScreen);
-
-    return unoccludedInScreen;
+    const RenderSurfaceType* targetSurface = m_stack.last().surface;
+    FloatRect totalScissor = targetSurface->contentRect();
+    if (m_surfaceDamageClient)
+        totalScissor.intersect(m_surfaceDamageClient->damageRect(targetSurface));
+    if (!layer->clipRect().isEmpty())
+        totalScissor.intersect(layer->clipRect());
+    return enclosingIntRect(totalScissor);
 }
 
 template<typename LayerType, typename RenderSurfaceType>
@@ -324,27 +327,29 @@ const Region& CCOcclusionTrackerBase<LayerType, RenderSurfaceType>::currentOcclu
 
 
 // Declare the possible functions here for the linker.
+template CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace);
+template CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace, const CCOcclusionTrackerDamageClient* surfaceDamageClient);
 template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::enterTargetRenderSurface(const RenderSurfaceChromium* newTarget);
 template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::finishedTargetRenderSurface(const LayerChromium* owningLayer, const RenderSurfaceChromium* finishedTarget);
 template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::leaveToTargetRenderSurface(const RenderSurfaceChromium* newTarget);
 template void CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::markOccludedBehindLayer(const LayerChromium*);
 template bool CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::occluded(const LayerChromium*, const IntRect& contentRect) const;
-template bool CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::surfaceOccluded(const LayerChromium*, const IntRect& surfaceContentRect) const;
 template IntRect CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::unoccludedContentRect(const LayerChromium*, const IntRect& contentRect) const;
-template IntRect CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::surfaceUnoccludedContentRect(const LayerChromium*, const IntRect& surfaceContentRect) const;
 template const Region& CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::currentOcclusionInScreenSpace() const;
 template const Region& CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::currentOcclusionInTargetSurface() const;
+template IntRect CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium>::layerScissorRectInTargetSurface(const LayerChromium*) const;
 
+template CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace);
+template CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace, const CCOcclusionTrackerDamageClientImpl* surfaceDamageClient);
 template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::enterTargetRenderSurface(const CCRenderSurface* newTarget);
 template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::finishedTargetRenderSurface(const CCLayerImpl* owningLayer, const CCRenderSurface* finishedTarget);
 template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::leaveToTargetRenderSurface(const CCRenderSurface* newTarget);
 template void CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::markOccludedBehindLayer(const CCLayerImpl*);
 template bool CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::occluded(const CCLayerImpl*, const IntRect& contentRect) const;
-template bool CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::surfaceOccluded(const CCLayerImpl*, const IntRect& surfaceContentRect) const;
 template IntRect CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::unoccludedContentRect(const CCLayerImpl*, const IntRect& contentRect) const;
-template IntRect CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::surfaceUnoccludedContentRect(const CCLayerImpl*, const IntRect& surfaceContentRect) const;
 template const Region& CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::currentOcclusionInScreenSpace() const;
 template const Region& CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::currentOcclusionInTargetSurface() const;
+template IntRect CCOcclusionTrackerBase<CCLayerImpl, CCRenderSurface>::layerScissorRectInTargetSurface(const CCLayerImpl*) const;
 
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
index d1c833e1a..19fc2c1dd 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCOcclusionTracker.h
@@ -36,6 +36,15 @@ class CCRenderSurface;
 class LayerChromium;
 class RenderSurfaceChromium;
 
+template<typename RenderSurfaceType>
+class CCOcclusionTrackerDamageClientBase {
+public:
+    virtual FloatRect damageRect(const RenderSurfaceType*) const = 0;
+};
+
+typedef CCOcclusionTrackerDamageClientBase<RenderSurfaceChromium> CCOcclusionTrackerDamageClient;
+typedef CCOcclusionTrackerDamageClientBase<CCRenderSurface> CCOcclusionTrackerDamageClientImpl;
+
 // This class is used to track occlusion of layers while traversing them in a front-to-back order. As each layer is visited, one of the
 // methods in this class is called to notify it about the current target surface.
 // Then, occlusion in the content space of the current layer may be queried, via methods such as occluded() and unoccludedContentRect().
@@ -43,8 +52,11 @@ class RenderSurfaceChromium;
 // Finally, once finished with the layer, occlusion behind the layer should be marked by calling markOccludedBehindLayer().
 template<typename LayerType, typename RenderSurfaceType>
 class CCOcclusionTrackerBase {
+    WTF_MAKE_NONCOPYABLE(CCOcclusionTrackerBase);
+    typedef CCOcclusionTrackerDamageClientBase<RenderSurfaceType> DamageClientType;
 public:
-    CCOcclusionTrackerBase() { }
+    CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace);
+    CCOcclusionTrackerBase(IntRect scissorRectInScreenSpace, const DamageClientType*);
 
     // Called when visiting a layer representing itself. If the target was not already current, then this indicates we have entered a new surface subtree.
     void enterTargetRenderSurface(const RenderSurfaceType* newTarget);
@@ -65,10 +77,8 @@ public:
     // Gives an unoccluded sub-rect of |contentRect| in the content space of the layer. Used when considering occlusion for a layer that paints/draws something.
     IntRect unoccludedContentRect(const LayerType*, const IntRect& contentRect) const;
 
-    // Returns true if the given rect in content space for the RenderSurface owned by the layer is fully occluded in either screen space or the layer's target surface.
-    bool surfaceOccluded(const LayerType*, const IntRect& contentRect) const;
-    // Gives an unoccluded sub-rect of |contentRect| in the content space of the RenderSurface owned by the layer. Used when considering occlusion for a target surface.
-    IntRect surfaceUnoccludedContentRect(const LayerType*, const IntRect& contentRect) const;
+    // FIXME: Remove this when paint tracking is on for paint culling.
+    void setUsePaintTracking(bool use) { m_usePaintTracking = use; }
 
     // FIXME: Remove these in future, they are to make CLs for transitioning to this easier.
     const Region& currentOcclusionInScreenSpace() const;
@@ -90,8 +100,13 @@ protected:
     // We merge the occlusion at the top of the stack with the new current subtree. This new target is pushed onto the stack if not already there.
     Vector<StackObject, 1> m_stack;
 
+    // Allow tests to override this.
+    virtual IntRect layerScissorRectInTargetSurface(const LayerType*) const;
+
 private:
-    WTF_MAKE_NONCOPYABLE(CCOcclusionTrackerBase);
+    IntRect m_scissorRectInScreenSpace;
+    const DamageClientType* m_surfaceDamageClient;
+    bool m_usePaintTracking; // FIXME: Remove this when paint tracking is on for paint culling.
 };
 
 typedef CCOcclusionTrackerBase<LayerChromium, RenderSurfaceChromium> CCOcclusionTracker;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPageScaleAnimation.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCPageScaleAnimation.cpp
index 33b6f22fb..49a125d23 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCPageScaleAnimation.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPageScaleAnimation.cpp
@@ -22,7 +22,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -36,13 +36,13 @@
 
 namespace WebCore {
 
-PassOwnPtr<CCPageScaleAnimation> CCPageScaleAnimation::create(const IntSize& scrollStart, float pageScaleStart, const IntSize& windowSize, const IntSize& contentSize, double startTimeMs)
+PassOwnPtr<CCPageScaleAnimation> CCPageScaleAnimation::create(const IntSize& scrollStart, float pageScaleStart, const IntSize& windowSize, const IntSize& contentSize, double startTime)
 {
-    return adoptPtr(new CCPageScaleAnimation(scrollStart, pageScaleStart, windowSize, contentSize, startTimeMs));
+    return adoptPtr(new CCPageScaleAnimation(scrollStart, pageScaleStart, windowSize, contentSize, startTime));
 }
 
 
-CCPageScaleAnimation::CCPageScaleAnimation(const IntSize& scrollStart, float pageScaleStart, const IntSize& windowSize, const IntSize& contentSize, double startTimeMs)
+CCPageScaleAnimation::CCPageScaleAnimation(const IntSize& scrollStart, float pageScaleStart, const IntSize& windowSize, const IntSize& contentSize, double startTime)
     : m_scrollStart(scrollStart)
     , m_pageScaleStart(pageScaleStart)
     , m_windowSize(windowSize)
@@ -50,11 +50,11 @@ CCPageScaleAnimation::CCPageScaleAnimation(const IntSize& scrollStart, float pag
     , m_anchorMode(false)
     , m_scrollEnd(scrollStart)
     , m_pageScaleEnd(pageScaleStart)
-    , m_startTimeMs(startTimeMs)
+    , m_startTime(startTime)
 {
 }
 
-void CCPageScaleAnimation::zoomTo(const IntSize& finalScroll, float finalPageScale, double durationMs)
+void CCPageScaleAnimation::zoomTo(const IntSize& finalScroll, float finalPageScale, double duration)
 {
     if (m_pageScaleStart != finalPageScale) {
         // For uniform-looking zooming, infer the anchor (point that remains in
@@ -78,18 +78,18 @@ void CCPageScaleAnimation::zoomTo(const IntSize& finalScroll, float finalPageSca
         float ratioY = (startRect.y() - endRect.y()) / (endRect.height() - startRect.height());
 
         IntSize anchor(m_windowSize.width() * ratioX, m_windowSize.height() * ratioY);
-        zoomWithAnchor(anchor, finalPageScale, durationMs);
+        zoomWithAnchor(anchor, finalPageScale, duration);
     } else {
         // If this is a pure translation, then there exists no anchor. Linearly
         // interpolate the scroll offset instead.
         m_scrollEnd = finalScroll;
         m_pageScaleEnd = finalPageScale;
-        m_durationMs = durationMs;
+        m_duration = duration;
         m_anchorMode = false;
     }
 }
 
-void CCPageScaleAnimation::zoomWithAnchor(const IntSize& anchor, float finalPageScale, double durationMs)
+void CCPageScaleAnimation::zoomWithAnchor(const IntSize& anchor, float finalPageScale, double duration)
 {
     m_scrollEnd = m_scrollStart + anchor;
     m_scrollEnd.scale(finalPageScale / m_pageScaleStart);
@@ -103,31 +103,31 @@ void CCPageScaleAnimation::zoomWithAnchor(const IntSize& anchor, float finalPage
 
     m_anchor = anchor;
     m_pageScaleEnd = finalPageScale;
-    m_durationMs = durationMs;
+    m_duration = duration;
     m_anchorMode = true;
 }
 
-IntSize CCPageScaleAnimation::scrollOffsetAtTime(double timeMs) const
+IntSize CCPageScaleAnimation::scrollOffsetAtTime(double time) const
 {
-    return scrollOffsetAtRatio(progressRatioForTime(timeMs));
+    return scrollOffsetAtRatio(progressRatioForTime(time));
 }
 
-float CCPageScaleAnimation::pageScaleAtTime(double timeMs) const
+float CCPageScaleAnimation::pageScaleAtTime(double time) const
 {
-    return pageScaleAtRatio(progressRatioForTime(timeMs));
+    return pageScaleAtRatio(progressRatioForTime(time));
 }
 
-bool CCPageScaleAnimation::isAnimationCompleteAtTime(double timeMs) const
+bool CCPageScaleAnimation::isAnimationCompleteAtTime(double time) const
 {
-    return timeMs >= endTimeMs();
+    return time >= endTime();
 }
 
-float CCPageScaleAnimation::progressRatioForTime(double timeMs) const
+float CCPageScaleAnimation::progressRatioForTime(double time) const
 {
-    if (isAnimationCompleteAtTime(timeMs))
+    if (isAnimationCompleteAtTime(time))
         return 1;
 
-    return (timeMs - m_startTimeMs) / m_durationMs;
+    return (time - m_startTime) / m_duration;
 }
 
 IntSize CCPageScaleAnimation::scrollOffsetAtRatio(float ratio) const
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPageScaleAnimation.h b/Source/WebCore/platform/graphics/chromium/cc/CCPageScaleAnimation.h
index f4b1bf47a..d9acb4911 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCPageScaleAnimation.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPageScaleAnimation.h
@@ -39,39 +39,39 @@ public:
     // Construct with the starting page scale and scroll offset (which is in
     // pageScaleStart space). The window size is the user-viewable area
     // in pixels.
-    static PassOwnPtr<CCPageScaleAnimation> create(const IntSize& scrollStart, float pageScaleStart, const IntSize& windowSize, const IntSize& contentSize, double startTimeMs);
+    static PassOwnPtr<CCPageScaleAnimation> create(const IntSize& scrollStart, float pageScaleStart, const IntSize& windowSize, const IntSize& contentSize, double startTime);
 
     // The following methods initialize the animation. Call one of them
     // immediately after construction to set the final scroll and page scale.
 
     // Zoom while explicitly specifying the top-left scroll position. The
     // scroll offset is in finalPageScale coordinates.
-    void zoomTo(const IntSize& finalScroll, float finalPageScale, double durationMs);
+    void zoomTo(const IntSize& finalScroll, float finalPageScale, double duration);
 
     // Zoom based on a specified onscreen anchor, which will remain at the same
     // position on the screen throughout the animation. The anchor is in local
     // space relative to scrollStart.
-    void zoomWithAnchor(const IntSize& anchor, float finalPageScale, double durationMs);
+    void zoomWithAnchor(const IntSize& anchor, float finalPageScale, double duration);
 
     // Call these functions while the animation is in progress to output the
     // current state.
-    IntSize scrollOffsetAtTime(double timeMs) const;
-    float pageScaleAtTime(double timeMs) const;
-    bool isAnimationCompleteAtTime(double timeMs) const;
+    IntSize scrollOffsetAtTime(double time) const;
+    float pageScaleAtTime(double time) const;
+    bool isAnimationCompleteAtTime(double time) const;
 
     // The following methods return state which is invariant throughout the
     // course of the animation.
-    double startTimeMs() const { return m_startTimeMs; }
-    double durationMs() const { return m_durationMs; }
-    double endTimeMs() const { return m_startTimeMs + m_durationMs; }
+    double startTime() const { return m_startTime; }
+    double duration() const { return m_duration; }
+    double endTime() const { return m_startTime + m_duration; }
     const IntSize& finalScrollOffset() const { return m_scrollEnd; }
     float finalPageScale() const { return m_pageScaleEnd; }
 
 protected:
-    CCPageScaleAnimation(const IntSize& scrollStart, float pageScaleStart, const IntSize& windowSize, const IntSize& contentSize, double startTimeMs);
+    CCPageScaleAnimation(const IntSize& scrollStart, float pageScaleStart, const IntSize& windowSize, const IntSize& contentSize, double startTime);
 
 private:
-    float progressRatioForTime(double timeMs) const;
+    float progressRatioForTime(double time) const;
     IntSize scrollOffsetAtRatio(float ratio) const;
     float pageScaleAtRatio(float ratio) const;
 
@@ -85,8 +85,8 @@ private:
     IntSize m_scrollEnd;
     float m_pageScaleEnd;
 
-    double m_startTimeMs;
-    double m_durationMs;
+    double m_startTime;
+    double m_duration;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp
index 5e4aca6d9..74538168e 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.cpp
@@ -53,7 +53,9 @@ CCPluginLayerImpl::CCPluginLayerImpl(int id)
 
 CCPluginLayerImpl::~CCPluginLayerImpl()
 {
-    cleanupResources();
+    // FIXME: it seems there is no layer renderer / GraphicsContext3D available here. Ideally we
+    // would like to delete m_ioSurfaceTextureId.
+    m_ioSurfaceTextureId = 0;
 }
 
 void CCPluginLayerImpl::willDraw(LayerRendererChromium* layerRenderer)
@@ -101,6 +103,16 @@ void CCPluginLayerImpl::dumpLayerProperties(TextStream& ts, int indent) const
     CCLayerImpl::dumpLayerProperties(ts, indent);
 }
 
+void CCPluginLayerImpl::didLoseContext()
+{
+    if (m_ioSurfaceId) {
+        // We don't have a valid texture ID in the new context; however,
+        // the IOSurface is still valid.
+        m_ioSurfaceTextureId = 0;
+        m_ioSurfaceChanged = true;
+    }
+}
+
 void CCPluginLayerImpl::setIOSurfaceProperties(int width, int height, uint32_t ioSurfaceId)
 {
     if (m_ioSurfaceId != ioSurfaceId)
@@ -111,13 +123,6 @@ void CCPluginLayerImpl::setIOSurfaceProperties(int width, int height, uint32_t i
     m_ioSurfaceId = ioSurfaceId;
 }
 
-void CCPluginLayerImpl::cleanupResources()
-{
-    // FIXME: it seems there is no layer renderer / GraphicsContext3D available here. Ideally we
-    // would like to delete m_ioSurfaceTextureId.
-    m_ioSurfaceTextureId = 0;
-}
-
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h
index 39a95951d..370e09d94 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCPluginLayerImpl.h
@@ -35,9 +35,9 @@ namespace WebCore {
 
 class CCPluginLayerImpl : public CCLayerImpl {
 public:
-    static PassRefPtr<CCPluginLayerImpl> create(int id)
+    static PassOwnPtr<CCPluginLayerImpl> create(int id)
     {
-        return adoptRef(new CCPluginLayerImpl(id));
+        return adoptPtr(new CCPluginLayerImpl(id));
     }
     virtual ~CCPluginLayerImpl();
 
@@ -50,6 +50,7 @@ public:
     typedef ProgramBinding<VertexShaderPosTexTransform, FragmentShaderRGBATexRectFlipAlpha> TexRectProgramFlip;
 
     virtual void dumpLayerProperties(TextStream&, int indent) const;
+    virtual void didLoseContext();
 
     void setTextureId(unsigned id) { m_textureId = id; }
     void setFlipped(bool flipped) { m_flipped = flipped; }
@@ -61,8 +62,6 @@ private:
 
     virtual const char* layerTypeAsString() const { return "PluginLayer"; }
 
-    void cleanupResources();
-
     unsigned m_textureId;
     bool m_flipped;
     FloatRect m_uvRect;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.cpp
index e4d601451..9ebb71dc7 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.cpp
@@ -69,28 +69,38 @@ CCThread* CCProxy::implThread()
     return s_implThread;
 }
 
+CCThread* CCProxy::currentThread()
+{
+    ThreadIdentifier currentThreadIdentifier = WTF::currentThread();
+    if (s_mainThread && s_mainThread->threadID() == currentThreadIdentifier)
+        return s_mainThread;
+    if (s_implThread && s_implThread->threadID() == currentThreadIdentifier)
+        return s_implThread;
+    return 0;
+}
+
 #ifndef NDEBUG
 bool CCProxy::isMainThread()
 {
     ASSERT(s_mainThread);
-    if (implThreadIsOverridden && currentThread() == threadIDOverridenToBeImplThread)
+    if (implThreadIsOverridden && WTF::currentThread() == threadIDOverridenToBeImplThread)
         return false;
-    return currentThread() == s_mainThread->threadID();
+    return WTF::currentThread() == s_mainThread->threadID();
 }
 
 bool CCProxy::isImplThread()
 {
     WTF::ThreadIdentifier implThreadID = s_implThread ? s_implThread->threadID() : 0;
-    if (implThreadIsOverridden && currentThread() == threadIDOverridenToBeImplThread)
+    if (implThreadIsOverridden && WTF::currentThread() == threadIDOverridenToBeImplThread)
         return true;
-    return currentThread() == implThreadID;
+    return WTF::currentThread() == implThreadID;
 }
 
 void CCProxy::setCurrentThreadIsImplThread(bool isImplThread)
 {
     implThreadIsOverridden = isImplThread;
     if (isImplThread)
-        threadIDOverridenToBeImplThread = currentThread();
+        threadIDOverridenToBeImplThread = WTF::currentThread();
 }
 #endif
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
index b4358aadd..016226ca5 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCProxy.h
@@ -53,6 +53,9 @@ public:
     static void setImplThread(CCThread*);
     static CCThread* implThread();
 
+    // Returns 0 if the current thread is neither the main thread nor the impl thread.
+    static CCThread* currentThread();
+
     virtual ~CCProxy();
 
     virtual bool compositeAndReadback(void *pixels, const IntRect&) = 0;
@@ -70,6 +73,10 @@ public:
     // Attempts to initialize the layer renderer. Returns false if the context isn't usable for compositing.
     virtual bool initializeLayerRenderer() = 0;
 
+    // Attempts to recreate the context and layer renderer after a context lost. Returns false if the renderer couldn't be
+    // reinitialized.
+    virtual bool recreateContext() = 0;
+
     virtual int compositorIdentifier() const = 0;
 
     virtual const LayerRendererCapabilities& layerRendererCapabilities() const = 0;
@@ -95,7 +102,7 @@ public:
     virtual GraphicsContext3D* context() = 0;
 
     // Testing hooks
-    virtual void loseCompositorContext(int numTimes) = 0;
+    virtual void loseContext() = 0;
 
 #ifndef NDEBUG
     static void setCurrentThreadIsImplThread(bool);
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
index 4f6435dc0..1c4a499cc 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.cpp
@@ -75,7 +75,22 @@ static IntRect rectSubtractRegion(const Region& region, const IntRect& rect)
     return rect;
 }
 
-void CCQuadCuller::cullOccludedQuads(CCQuadList& quadList, bool haveDamageRect, const FloatRect& damageRect)
+static float wedgeProduct(const FloatPoint& p1, const FloatPoint& p2)
+{
+    return p1.x() * p2.y() - p1.y() * p2.x();
+}
+
+// Computes area of quads that are possibly non-rectangular. Can
+// be easily extended to polygons.
+static float quadArea(const FloatQuad& quad)
+{
+    return fabs(0.5 * (wedgeProduct(quad.p1(), quad.p2()) +
+                   wedgeProduct(quad.p2(), quad.p3()) +
+                   wedgeProduct(quad.p3(), quad.p4()) +
+                   wedgeProduct(quad.p4(), quad.p1())));
+}
+
+void CCQuadCuller::cullOccludedQuads(CCQuadList& quadList, bool haveDamageRect, const FloatRect& damageRect, CCOverdrawCounts* overdrawMetrics)
 {
     if (!quadList.size())
         return;
@@ -96,21 +111,43 @@ void CCQuadCuller::cullOccludedQuads(CCQuadList& quadList, bool haveDamageRect,
 
         IntRect transformedVisibleQuadRect = rectSubtractRegion(opaqueCoverageThusFar, transformedQuadRect);
         bool keepQuad = !transformedVisibleQuadRect.isEmpty();
-        if (!keepQuad)
-            continue;
 
         // See if we can reduce the number of pixels to draw by reducing the size of the draw
         // quad - we do this by changing its visible rect.
-        if (transformedVisibleQuadRect != transformedQuadRect && drawQuad->isLayerAxisAlignedIntRect())
-            drawQuad->setQuadVisibleRect(drawQuad->quadTransform().inverse().mapRect(transformedVisibleQuadRect));
-
-        // When adding rect to opaque region, deflate it to stay conservative.
-        if (drawQuad->isLayerAxisAlignedIntRect() && !drawQuad->opaqueRect().isEmpty()) {
-            FloatRect floatOpaqueRect = drawQuad->quadTransform().mapRect(FloatRect(drawQuad->opaqueRect()));
-            opaqueCoverageThusFar.unite(Region(enclosedIntRect(floatOpaqueRect)));
+        bool didReduceQuadSize = false;
+        if (keepQuad) {
+            if (transformedVisibleQuadRect != transformedQuadRect && drawQuad->isLayerAxisAlignedIntRect()) {
+                drawQuad->setQuadVisibleRect(drawQuad->quadTransform().inverse().mapRect(transformedVisibleQuadRect));
+                didReduceQuadSize = true;
+            }
+
+            // When adding rect to opaque region, deflate it to stay conservative.
+            if (drawQuad->isLayerAxisAlignedIntRect() && !drawQuad->opaqueRect().isEmpty()) {
+                FloatRect floatOpaqueRect = drawQuad->quadTransform().mapRect(FloatRect(drawQuad->opaqueRect()));
+                opaqueCoverageThusFar.unite(Region(enclosedIntRect(floatOpaqueRect)));
+            }
+
+            culledList.append(quadList[i].release());
         }
 
-        culledList.append(quadList[i].release());
+        if (overdrawMetrics) {
+            // We compute the area of the transformed quad, as this should be in pixels.
+            float area = quadArea(drawQuad->quadTransform().mapQuad(FloatQuad(drawQuad->quadRect())));
+            if (keepQuad) {
+                if (didReduceQuadSize) {
+                    float visibleQuadRectArea = quadArea(drawQuad->quadTransform().mapQuad(FloatQuad(drawQuad->quadVisibleRect())));
+                    overdrawMetrics->m_pixelsCulled += area - visibleQuadRectArea;
+                    area = visibleQuadRectArea;
+                }
+                IntRect visibleOpaqueRect(drawQuad->quadVisibleRect());
+                visibleOpaqueRect.intersect(drawQuad->opaqueRect());
+                FloatQuad visibleOpaqueQuad = drawQuad->quadTransform().mapQuad(FloatQuad(visibleOpaqueRect));
+                float opaqueArea = quadArea(visibleOpaqueQuad);
+                overdrawMetrics->m_pixelsDrawnOpaque += opaqueArea;
+                overdrawMetrics->m_pixelsDrawnTransparent += area - opaqueArea;
+            } else
+                overdrawMetrics->m_pixelsCulled += area;
+        }
     }
     quadList.clear(); // Release anything that remains.
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h
index 3cc315ec4..89582573b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCQuadCuller.h
@@ -32,7 +32,9 @@ namespace WebCore {
 
 class CCQuadCuller {
 public:
-    static void cullOccludedQuads(CCQuadList&, bool haveDamageRect, const FloatRect& damageRect);
+    // Passing 0 for CCOverdrawCounts* is valid, and disable the extra computation
+    // done to estimate over draw statistics.
+    static void cullOccludedQuads(CCQuadList&, bool haveDamageRect, const FloatRect& damageRect, CCOverdrawCounts*);
 
 private:
     // Make non-instantiable.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
index da4b2222c..bd877ec30 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.cpp
@@ -65,9 +65,9 @@ void CCRenderPass::appendQuadsForRenderSurfaceLayer(CCLayerImpl* layer)
     m_sharedQuadStateList.append(sharedQuadState.release());
 }
 
-void CCRenderPass::optimizeQuads(bool haveDamageRect, const FloatRect& damageRect)
+void CCRenderPass::optimizeQuads(bool haveDamageRect, const FloatRect& damageRect, CCOverdrawCounts* overdraw)
 {
-    CCQuadCuller::cullOccludedQuads(m_quadList, haveDamageRect, damageRect);
+    CCQuadCuller::cullOccludedQuads(m_quadList, haveDamageRect, damageRect, overdraw);
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
index 11fbd4016..2affce541 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderPass.h
@@ -38,6 +38,22 @@ class CCSharedQuadState;
 
 typedef Vector<OwnPtr<CCDrawQuad> > CCQuadList;
 
+struct CCOverdrawCounts {
+    CCOverdrawCounts()
+       : m_pixelsDrawnOpaque(0)
+       , m_pixelsDrawnTransparent(0)
+       , m_pixelsCulled(0)
+    {
+    }
+    // Count of pixels that are opaque (and thus occlude). Ideally this is no more
+    // than wiewport width x height.
+    float m_pixelsDrawnOpaque;
+    // Count of pixels that are possibly transparent, and cannot occlude.
+    float m_pixelsDrawnTransparent;
+    // Count of pixels not drawn as they are occluded by somthing opaque.
+    float m_pixelsCulled;
+};
+
 class CCRenderPass {
     WTF_MAKE_NONCOPYABLE(CCRenderPass);
 public:
@@ -46,7 +62,8 @@ public:
     void appendQuadsForLayer(CCLayerImpl*);
     void appendQuadsForRenderSurfaceLayer(CCLayerImpl*);
 
-    void optimizeQuads(bool haveDamageRect, const FloatRect& damageRect);
+    // Passing in 0 for CCOverdrawCounts is valid, and disables performing overdraw calculations.
+    void optimizeQuads(bool haveDamageRect, const FloatRect& damageRect, CCOverdrawCounts*);
 
     const CCQuadList& quadList() const { return m_quadList; }
     CCRenderSurface* targetSurface() const { return m_targetSurface; }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
index 169999808..25ac8fa9b 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.cpp
@@ -58,15 +58,6 @@ CCRenderSurface::CCRenderSurface(CCLayerImpl* owningLayer)
 
 CCRenderSurface::~CCRenderSurface()
 {
-    cleanupResources();
-}
-
-void CCRenderSurface::cleanupResources()
-{
-    if (!m_contentsTexture)
-        return;
-
-    m_contentsTexture.clear();
 }
 
 FloatRect CCRenderSurface::drawableContentRect() const
@@ -216,7 +207,7 @@ void CCRenderSurface::drawSurface(LayerRendererChromium* layerRenderer, CCLayerI
         float edge[24];
         layerQuad.toFloatArray(edge);
         deviceRect.toFloatArray(&edge[12]);
-        GLC(context3D, context3D->uniform3fv(shaderEdgeLocation, edge, 8));
+        GLC(context3D, context3D->uniform3fv(shaderEdgeLocation, 8, edge));
     }
 
     // Map device space quad to layer space.
@@ -239,7 +230,7 @@ SkBitmap CCRenderSurface::applyFilters(LayerRendererChromium* layerRenderer)
 
 String CCRenderSurface::name() const
 {
-    return String::format("RenderSurface(id=%i,owner=%s)", m_owningLayer->id(), m_owningLayer->name().utf8().data());
+    return String::format("RenderSurface(id=%i,owner=%s)", m_owningLayer->id(), m_owningLayer->debugName().utf8().data());
 }
 
 static void writeIndent(TextStream& ts, int indent)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
index 1bcec9260..141ed2d24 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCRenderSurface.h
@@ -55,7 +55,7 @@ public:
 
     bool prepareContentsTexture(LayerRendererChromium*);
     void releaseContentsTexture();
-    void cleanupResources();
+
     void draw(LayerRendererChromium*, const FloatRect& surfaceDamageRect);
 
     String name() const;
@@ -95,7 +95,7 @@ public:
     bool skipsDraw() const { return m_skipsDraw; }
 
     void clearLayerList() { m_layerList.clear(); }
-    Vector<RefPtr<CCLayerImpl> >& layerList() { return m_layerList; }
+    Vector<CCLayerImpl*>& layerList() { return m_layerList; }
 
     void setMaskLayer(CCLayerImpl* maskLayer) { m_maskLayer = maskLayer; }
 
@@ -133,7 +133,7 @@ private:
     TransformationMatrix m_originTransform;
     FilterOperations m_filters;
     IntRect m_clipRect;
-    Vector<RefPtr<CCLayerImpl> > m_layerList;
+    Vector<CCLayerImpl*> m_layerList;
 
     // The nearest ancestor target surface that will contain the contents of this surface, and that is going
     // to move pixels within the surface (such as with a blur). This can point to itself.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp
index 8580467f0..633f21d47 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.cpp
@@ -86,10 +86,19 @@ void CCScheduler::didSwapBuffersComplete()
     m_frameRateController->didFinishFrame();
 }
 
-void CCScheduler::didSwapBuffersAbort()
+void CCScheduler::didLoseContext()
 {
-    TRACE_EVENT("CCScheduler::didSwapBuffersAbort", this, 0);
+    TRACE_EVENT("CCScheduler::didLoseContext", this, 0);
     m_frameRateController->didAbortAllPendingFrames();
+    m_stateMachine.didLoseContext();
+    processScheduledActions();
+}
+
+void CCScheduler::didRecreateContext()
+{
+    TRACE_EVENT("CCScheduler::didRecreateContext", this, 0);
+    m_stateMachine.didRecreateContext();
+    processScheduledActions();
 }
 
 void CCScheduler::beginFrame()
@@ -151,6 +160,9 @@ void CCScheduler::processScheduledActions()
             m_client->scheduledActionDrawAndSwap();
             m_frameRateController->didBeginFrame();
             break;
+        case CCSchedulerStateMachine::ACTION_BEGIN_CONTEXT_RECREATION:
+            m_client->scheduledActionBeginContextRecreation();
+            break;
         }
     } while (action != CCSchedulerStateMachine::ACTION_NONE);
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.h b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.h
index 7310581b1..f8ba21f99 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScheduler.h
@@ -44,6 +44,7 @@ public:
     virtual void scheduledActionDrawAndSwap() = 0;
     virtual void scheduledActionUpdateMoreResources() = 0;
     virtual void scheduledActionCommit() = 0;
+    virtual void scheduledActionBeginContextRecreation() = 0;
 
 protected:
     virtual ~CCSchedulerClient() { }
@@ -71,7 +72,9 @@ public:
 
     void setMaxFramesPending(int);
     void didSwapBuffersComplete();
-    void didSwapBuffersAbort();
+
+    void didLoseContext();
+    void didRecreateContext();
 
     bool commitPending() const { return m_stateMachine.commitPending(); }
     bool redrawPending() const { return m_stateMachine.redrawPending(); }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp
index d1aa5ccdc..054a4edd7 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.cpp
@@ -38,27 +38,60 @@ CCSchedulerStateMachine::CCSchedulerStateMachine()
     , m_updateMoreResourcesPending(false)
     , m_insideVSync(false)
     , m_visible(false)
-    , m_canDraw(true) { }
+    , m_canDraw(true)
+    , m_contextState(CONTEXT_ACTIVE)
+{
+}
+
+bool CCSchedulerStateMachine::hasDrawnThisFrame() const
+{
+    return m_currentFrameNumber == m_lastFrameNumberWhereDrawWasCalled;
+}
+
+bool CCSchedulerStateMachine::shouldDraw() const
+{
+    if (m_needsForcedRedraw)
+        return true;
+
+    if (!m_needsRedraw)
+        return false;
+    if (!m_insideVSync)
+        return false;
+    if (!m_visible)
+        return false;
+    if (hasDrawnThisFrame())
+        return false;
+    if (!m_canDraw)
+        return false;
+    if (m_contextState != CONTEXT_ACTIVE)
+        return false;
+    return true;
+}
 
 CCSchedulerStateMachine::Action CCSchedulerStateMachine::nextAction() const
 {
-    bool canDraw = m_currentFrameNumber != m_lastFrameNumberWhereDrawWasCalled;
-    bool shouldDraw = (m_needsRedraw && m_insideVSync && m_visible && canDraw && m_canDraw) || m_needsForcedRedraw;
+
     switch (m_commitState) {
     case COMMIT_STATE_IDLE:
-        if (shouldDraw)
+        if (m_contextState != CONTEXT_ACTIVE && m_needsForcedRedraw)
+            return ACTION_DRAW;
+        if (m_contextState == CONTEXT_LOST)
+            return ACTION_BEGIN_CONTEXT_RECREATION;
+        if (m_contextState == CONTEXT_RECREATING)
+            return ACTION_NONE;
+        if (shouldDraw())
             return ACTION_DRAW;
         if (m_needsCommit && m_visible)
             return ACTION_BEGIN_FRAME;
         return ACTION_NONE;
 
     case COMMIT_STATE_FRAME_IN_PROGRESS:
-        if (shouldDraw)
+        if (shouldDraw())
             return ACTION_DRAW;
         return ACTION_NONE;
 
     case COMMIT_STATE_UPDATING_RESOURCES:
-        if (shouldDraw)
+        if (shouldDraw())
             return ACTION_DRAW;
         if (!m_updateMoreResourcesPending)
             return ACTION_BEGIN_UPDATE_MORE_RESOURCES;
@@ -68,7 +101,7 @@ CCSchedulerStateMachine::Action CCSchedulerStateMachine::nextAction() const
         return ACTION_COMMIT;
 
     case COMMIT_STATE_WAITING_FOR_FIRST_DRAW:
-        if (shouldDraw)
+        if (shouldDraw() || m_contextState == CONTEXT_LOST)
             return ACTION_DRAW;
         // COMMIT_STATE_WAITING_FOR_FIRST_DRAW wants to enforce a draw. If m_canDraw is false,
         // proceed to the next step (similar as in COMMIT_STATE_IDLE).
@@ -115,12 +148,18 @@ void CCSchedulerStateMachine::updateState(Action action)
             m_commitState = COMMIT_STATE_IDLE;
         }
         return;
+
+    case ACTION_BEGIN_CONTEXT_RECREATION:
+        ASSERT(m_commitState == COMMIT_STATE_IDLE);
+        ASSERT(m_contextState == CONTEXT_LOST);
+        m_contextState = CONTEXT_RECREATING;
+        return;
     }
 }
 
 bool CCSchedulerStateMachine::vsyncCallbackNeeded() const
 {
-    if (!m_visible) {
+    if (!m_visible || m_contextState != CONTEXT_ACTIVE) {
         if (m_needsForcedRedraw)
             return true;
 
@@ -176,4 +215,18 @@ void CCSchedulerStateMachine::beginUpdateMoreResourcesComplete(bool morePending)
         m_commitState = COMMIT_STATE_READY_TO_COMMIT;
 }
 
+void CCSchedulerStateMachine::didLoseContext()
+{
+    if (m_contextState == CONTEXT_LOST || m_contextState == CONTEXT_RECREATING)
+        return;
+    m_contextState = CONTEXT_LOST;
+}
+
+void CCSchedulerStateMachine::didRecreateContext()
+{
+    ASSERT(m_contextState == CONTEXT_RECREATING);
+    m_contextState = CONTEXT_ACTIVE;
+    setNeedsCommit();
+}
+
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.h b/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.h
index 7de718846..22fcdf422 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSchedulerStateMachine.h
@@ -51,6 +51,11 @@ public:
         COMMIT_STATE_WAITING_FOR_FIRST_DRAW,
     };
 
+    enum ContextState {
+        CONTEXT_ACTIVE,
+        CONTEXT_LOST,
+        CONTEXT_RECREATING,
+    };
     bool commitPending() const
     {
         return m_commitState != COMMIT_STATE_IDLE;
@@ -64,6 +69,7 @@ public:
         ACTION_BEGIN_UPDATE_MORE_RESOURCES,
         ACTION_COMMIT,
         ACTION_DRAW,
+        ACTION_BEGIN_CONTEXT_RECREATION
     };
     Action nextAction() const;
     void updateState(Action);
@@ -107,7 +113,13 @@ public:
     // when such behavior would be undesirable.
     void setCanDraw(bool can) { m_canDraw = can; }
 
+    void didLoseContext();
+    void didRecreateContext();
+
 protected:
+    bool shouldDraw() const;
+    bool hasDrawnThisFrame() const;
+
     CommitState m_commitState;
 
     int m_currentFrameNumber;
@@ -119,6 +131,7 @@ protected:
     bool m_insideVSync;
     bool m_visible;
     bool m_canDraw;
+    ContextState m_contextState;
 };
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp
new file mode 100644
index 000000000..872a35832
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.cpp
@@ -0,0 +1,284 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "CCScrollbarLayerImpl.h"
+
+#include "CCTileDrawQuad.h"
+#include "LayerRendererChromium.h"
+#include "ManagedTexture.h"
+#include "PlatformCanvas.h"
+#include "ScrollbarTheme.h"
+
+namespace WebCore {
+
+PassOwnPtr<CCScrollbarLayerImpl> CCScrollbarLayerImpl::create(int id)
+{
+    return adoptPtr(new CCScrollbarLayerImpl(id));
+}
+
+CCScrollbarLayerImpl::CCScrollbarLayerImpl(int id)
+    : CCLayerImpl(id)
+    , m_scrollLayer(0)
+    , m_scrollbar(this)
+{
+}
+
+void CCScrollbarLayerImpl::willDraw(LayerRendererChromium* layerRenderer)
+{
+    if (bounds().isEmpty() || contentBounds().isEmpty())
+        return;
+
+    if (!m_texture)
+        m_texture = ManagedTexture::create(layerRenderer->renderSurfaceTextureManager());
+
+    IntSize textureSize = contentBounds();
+    if (!m_texture->reserve(textureSize, GraphicsContext3D::RGBA))
+        return;
+
+    PlatformCanvas canvas;
+    canvas.resize(textureSize);
+    {
+        PlatformCanvas::Painter painter(&canvas, PlatformCanvas::Painter::GrayscaleText);
+        paint(painter.context());
+    }
+
+    {
+        PlatformCanvas::AutoLocker locker(&canvas);
+        GraphicsContext3D* context = layerRenderer->context();
+        m_texture->bindTexture(context, layerRenderer->renderSurfaceTextureAllocator());
+
+        // FIXME: Skia uses BGRA actually, we correct that with the swizzle pixel shader.
+        GLC(context, context->texImage2D(GraphicsContext3D::TEXTURE_2D, 0, m_texture->format(), canvas.size().width(), canvas.size().height(), 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, locker.pixels()));
+    }
+}
+
+void CCScrollbarLayerImpl::appendQuads(CCQuadList& quadList, const CCSharedQuadState* sharedQuadState)
+{
+    if (!m_texture->isReserved())
+        return;
+
+    IntRect quadRect(IntPoint(), bounds());
+    quadList.append(CCTileDrawQuad::create(sharedQuadState, quadRect, quadRect, m_texture->textureId(), IntPoint(), m_texture->size(), GraphicsContext3D::NEAREST, true, true, true, true, true));
+}
+
+void CCScrollbarLayerImpl::didDraw()
+{
+    m_texture->unreserve();
+}
+
+void CCScrollbarLayerImpl::paint(GraphicsContext* context)
+{
+    ScrollbarTheme* theme = ScrollbarTheme::theme(); // FIXME: should make impl-side clone if needed
+
+    context->clearRect(IntRect(IntPoint(), contentBounds()));
+    theme->paint(&m_scrollbar, context, IntRect(IntPoint(), contentBounds()));
+}
+
+
+int CCScrollbarLayerImpl::CCScrollbar::x() const
+{
+    return frameRect().x();
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::y() const
+{
+    return frameRect().y();
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::width() const
+{
+    return frameRect().width();
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::height() const
+{
+    return frameRect().height();
+}
+
+IntSize CCScrollbarLayerImpl::CCScrollbar::size() const
+{
+    return frameRect().size();
+}
+
+IntPoint CCScrollbarLayerImpl::CCScrollbar::location() const
+{
+    return frameRect().location();
+}
+
+ScrollView* CCScrollbarLayerImpl::CCScrollbar::parent() const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+ScrollView* CCScrollbarLayerImpl::CCScrollbar::root() const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+void CCScrollbarLayerImpl::CCScrollbar::setFrameRect(const IntRect&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+IntRect CCScrollbarLayerImpl::CCScrollbar::frameRect() const
+{
+    return IntRect(IntPoint(), m_owner->contentBounds());
+}
+
+void CCScrollbarLayerImpl::CCScrollbar::invalidate()
+{
+    invalidateRect(frameRect());
+}
+
+void CCScrollbarLayerImpl::CCScrollbar::invalidateRect(const IntRect&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+ScrollbarOverlayStyle CCScrollbarLayerImpl::CCScrollbar::scrollbarOverlayStyle() const
+{
+    return m_owner->m_scrollbarOverlayStyle;
+}
+
+void CCScrollbarLayerImpl::CCScrollbar::getTickmarks(Vector<IntRect>& tickmarks) const
+{
+    tickmarks = m_owner->m_tickmarks;
+}
+
+bool CCScrollbarLayerImpl::CCScrollbar::isScrollableAreaActive() const
+{
+    return m_owner->m_isScrollableAreaActive;
+}
+
+bool CCScrollbarLayerImpl::CCScrollbar::isScrollViewScrollbar() const
+{
+    return m_owner->m_isScrollViewScrollbar;
+}
+
+IntPoint CCScrollbarLayerImpl::CCScrollbar::convertFromContainingWindow(const IntPoint& windowPoint)
+{
+    ASSERT_NOT_REACHED();
+    return windowPoint;
+}
+
+bool CCScrollbarLayerImpl::CCScrollbar::isCustomScrollbar() const
+{
+    return false;
+}
+
+ScrollbarOrientation CCScrollbarLayerImpl::CCScrollbar::orientation() const
+{
+    return m_owner->m_orientation;
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::value() const
+{
+    if (!m_owner->m_scrollLayer)
+        return 0;
+    if (orientation() == HorizontalScrollbar)
+        return m_owner->m_scrollLayer->scrollPosition().x() + m_owner->m_scrollLayer->scrollDelta().width();
+    return m_owner->m_scrollLayer->scrollPosition().y() + m_owner->m_scrollLayer->scrollDelta().height();
+}
+
+float CCScrollbarLayerImpl::CCScrollbar::currentPos() const
+{
+    return value();
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::visibleSize() const
+{
+    return totalSize() - maximum();
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::totalSize() const
+{
+    if (!m_owner->m_scrollLayer || !m_owner->m_scrollLayer->children().size())
+        return 0;
+    // Copy & paste from CCLayerTreeHostImpl...
+    // FIXME: Hardcoding the first child here is weird. Think of
+    // a cleaner way to get the contentBounds on the Impl side.
+    if (orientation() == HorizontalScrollbar)
+        return m_owner->m_scrollLayer->children()[0]->contentBounds().width();
+    return m_owner->m_scrollLayer->children()[0]->contentBounds().height();
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::maximum() const
+{
+    if (!m_owner->m_scrollLayer)
+        return 0;
+    if (orientation() == HorizontalScrollbar)
+        return m_owner->m_scrollLayer->maxScrollPosition().width();
+    return m_owner->m_scrollLayer->maxScrollPosition().height();
+}
+
+ScrollbarControlSize CCScrollbarLayerImpl::CCScrollbar::controlSize() const
+{
+    return m_owner->m_controlSize;
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::lineStep() const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+int CCScrollbarLayerImpl::CCScrollbar::pageStep() const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+ScrollbarPart CCScrollbarLayerImpl::CCScrollbar::pressedPart() const
+{
+    return m_owner->m_pressedPart;
+}
+
+ScrollbarPart CCScrollbarLayerImpl::CCScrollbar::hoveredPart() const
+{
+    return m_owner->m_hoveredPart;
+}
+
+void CCScrollbarLayerImpl::CCScrollbar::styleChanged()
+{
+}
+
+bool CCScrollbarLayerImpl::CCScrollbar::enabled() const
+{
+    return m_owner->m_enabled;
+}
+
+void CCScrollbarLayerImpl::CCScrollbar::setEnabled(bool)
+{
+    ASSERT_NOT_REACHED();
+}
+
+}
+#endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h
new file mode 100644
index 000000000..f6f005360
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCScrollbarLayerImpl.h
@@ -0,0 +1,149 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCScrollbarLayerImpl_h
+#define CCScrollbarLayerImpl_h
+
+#if USE(ACCELERATED_COMPOSITING)
+
+#include "CCLayerImpl.h"
+#include "ManagedTexture.h"
+#include "ScrollbarThemeClient.h"
+
+namespace WebCore {
+
+class GraphicsContext;
+class ScrollView;
+
+class CCScrollbarLayerImpl : public CCLayerImpl {
+public:
+    static PassOwnPtr<CCScrollbarLayerImpl> create(int id);
+
+    void setScrollbarOverlayStyle(ScrollbarOverlayStyle scrollbarOverlayStyle) { m_scrollbarOverlayStyle = scrollbarOverlayStyle; }
+    void setTickmarks(const Vector<IntRect>& tickmarks) { m_tickmarks = tickmarks; }
+    void setIsScrollableAreaActive(bool isScrollableAreaActive) { m_isScrollableAreaActive = isScrollableAreaActive; }
+    void setIsScrollViewScrollbar(bool isScrollViewScrollbar) { m_isScrollViewScrollbar = isScrollViewScrollbar; }
+
+    void setOrientation(ScrollbarOrientation orientation) { m_orientation = orientation; }
+
+    void setControlSize(ScrollbarControlSize controlSize) { m_controlSize = controlSize; }
+
+    void setPressedPart(ScrollbarPart pressedPart) { m_pressedPart = pressedPart; }
+    void setHoveredPart(ScrollbarPart hoveredPart) { m_hoveredPart = hoveredPart; }
+
+    void setEnabled(bool enabled) { m_enabled = enabled; }
+
+
+    CCLayerImpl* scrollLayer() const { return m_scrollLayer; }
+    void setScrollLayer(CCLayerImpl* scrollLayer) { m_scrollLayer = scrollLayer; }
+
+    virtual void willDraw(LayerRendererChromium*);
+    virtual void appendQuads(CCQuadList&, const CCSharedQuadState*);
+    virtual void didDraw();
+
+protected:
+    explicit CCScrollbarLayerImpl(int id);
+
+private:
+    void paint(GraphicsContext*);
+
+    CCLayerImpl* m_scrollLayer;
+    OwnPtr<ManagedTexture> m_texture;
+
+    // nested class only to avoid namespace problem
+    class CCScrollbar : public ScrollbarThemeClient {
+    public:
+        explicit CCScrollbar(CCScrollbarLayerImpl* owner) : m_owner(owner) { }
+
+        // ScrollbarThemeClient implementation
+        virtual int x() const;
+        virtual int y() const;
+        virtual int width() const;
+        virtual int height() const;
+        virtual IntSize size() const;
+        virtual IntPoint location() const;
+
+        virtual ScrollView* parent() const;
+        virtual ScrollView* root() const;
+
+        virtual void setFrameRect(const IntRect&);
+        virtual IntRect frameRect() const;
+
+        virtual void invalidate();
+        virtual void invalidateRect(const IntRect&);
+
+        virtual ScrollbarOverlayStyle scrollbarOverlayStyle() const;
+        virtual void getTickmarks(Vector<IntRect>&) const;
+        virtual bool isScrollableAreaActive() const;
+        virtual bool isScrollViewScrollbar() const;
+
+        virtual IntPoint convertFromContainingWindow(const IntPoint& windowPoint);
+
+        virtual bool isCustomScrollbar() const;
+        virtual ScrollbarOrientation orientation() const;
+
+        virtual int value() const;
+        virtual float currentPos() const;
+        virtual int visibleSize() const;
+        virtual int totalSize() const;
+        virtual int maximum() const;
+        virtual ScrollbarControlSize controlSize() const;
+
+        virtual int lineStep() const;
+        virtual int pageStep() const;
+
+        virtual ScrollbarPart pressedPart() const;
+        virtual ScrollbarPart hoveredPart() const;
+
+        virtual void styleChanged();
+
+        virtual bool enabled() const;
+        virtual void setEnabled(bool);
+
+    private:
+        CCScrollbarLayerImpl* m_owner;
+
+    };
+    CCScrollbar m_scrollbar;
+
+    ScrollbarOverlayStyle m_scrollbarOverlayStyle;
+    Vector<IntRect> m_tickmarks;
+    bool m_isScrollableAreaActive;
+    bool m_isScrollViewScrollbar;
+
+    ScrollbarOrientation m_orientation;
+
+    ScrollbarControlSize m_controlSize;
+
+    ScrollbarPart m_pressedPart;
+    ScrollbarPart m_hoveredPart;
+
+    bool m_enabled;
+};
+
+}
+#endif // USE(ACCELERATED_COMPOSITING)
+
+#endif
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
index ea8c40f12..b6fc76b52 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.cpp
@@ -45,11 +45,9 @@ PassOwnPtr<CCProxy> CCSingleThreadProxy::create(CCLayerTreeHost* layerTreeHost)
 
 CCSingleThreadProxy::CCSingleThreadProxy(CCLayerTreeHost* layerTreeHost)
     : m_layerTreeHost(layerTreeHost)
+    , m_contextLost(false)
     , m_compositorIdentifier(-1)
     , m_layerRendererInitialized(false)
-    , m_numFailedRecreateAttempts(0)
-    , m_graphicsContextLost(false)
-    , m_timesRecreateShouldFail(0)
     , m_nextFrameIsNewlyCommittedFrame(false)
 {
     TRACE_EVENT("CCSingleThreadProxy::CCSingleThreadProxy", this, 0);
@@ -74,11 +72,6 @@ bool CCSingleThreadProxy::compositeAndReadback(void *pixels, const IntRect& rect
     TRACE_EVENT("CCSingleThreadProxy::compositeAndReadback", this, 0);
     ASSERT(CCProxy::isMainThread());
 
-    if (!recreateContextIfNeeded()) {
-        TRACE_EVENT("compositeAndReadback_EarlyOut_ContextLost", this, 0);
-        return false;
-    }
-
     if (!commitIfNeeded())
         return false;
 
@@ -90,12 +83,15 @@ bool CCSingleThreadProxy::compositeAndReadback(void *pixels, const IntRect& rect
     if (m_layerTreeHostImpl->isContextLost())
         return false;
 
+    m_layerTreeHostImpl->swapBuffers();
+    didSwapFrame();
+
     return true;
 }
 
-void CCSingleThreadProxy::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec)
+void CCSingleThreadProxy::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double duration)
 {
-    m_layerTreeHostImpl->startPageScaleAnimation(targetPosition, useAnchor, scale, monotonicallyIncreasingTime() * 1000.0, durationSec * 1000.0);
+    m_layerTreeHostImpl->startPageScaleAnimation(targetPosition, useAnchor, scale, monotonicallyIncreasingTime(), duration);
 }
 
 GraphicsContext3D* CCSingleThreadProxy::context()
@@ -125,7 +121,7 @@ bool CCSingleThreadProxy::isStarted() const
 bool CCSingleThreadProxy::initializeContext()
 {
     ASSERT(CCProxy::isMainThread());
-    RefPtr<GraphicsContext3D> context = m_layerTreeHost->createLayerTreeHostContext3D();
+    RefPtr<GraphicsContext3D> context = m_layerTreeHost->createContext();
     if (!context)
         return false;
     ASSERT(context->hasOneRef());
@@ -148,6 +144,33 @@ bool CCSingleThreadProxy::initializeLayerRenderer()
     }
 }
 
+bool CCSingleThreadProxy::recreateContext()
+{
+    TRACE_EVENT0("cc", "CCSingleThreadProxy::recreateContext");
+    ASSERT(CCProxy::isMainThread());
+    ASSERT(m_contextLost);
+
+    RefPtr<GraphicsContext3D> context = m_layerTreeHost->createContext();
+    if (!context)
+        return false;
+
+    ASSERT(context->hasOneRef());
+    bool initialized;
+    {
+        DebugScopedSetImplThread impl;
+        m_layerTreeHost->deleteContentsTexturesOnImplThread(m_layerTreeHostImpl->contentsTextureAllocator());
+        initialized = m_layerTreeHostImpl->initializeLayerRenderer(context);
+        if (initialized) {
+            m_layerRendererCapabilitiesForMainThread = m_layerTreeHostImpl->layerRendererCapabilities();
+        }
+    }
+
+    if (initialized)
+        m_contextLost = false;
+
+    return initialized;
+}
+
 const LayerRendererCapabilities& CCSingleThreadProxy::layerRendererCapabilities() const
 {
     ASSERT(m_layerRendererInitialized);
@@ -155,10 +178,11 @@ const LayerRendererCapabilities& CCSingleThreadProxy::layerRendererCapabilities(
     return m_layerRendererCapabilitiesForMainThread;
 }
 
-void CCSingleThreadProxy::loseCompositorContext(int numTimes)
+void CCSingleThreadProxy::loseContext()
 {
-    m_graphicsContextLost = true;
-    m_timesRecreateShouldFail = numTimes - 1;
+    ASSERT(CCProxy::isMainThread());
+    m_layerTreeHost->didLoseContext();
+    m_contextLost = true;
 }
 
 void CCSingleThreadProxy::setNeedsAnimate()
@@ -212,12 +236,14 @@ void CCSingleThreadProxy::setNeedsRedraw()
 
 void CCSingleThreadProxy::setVisible(bool visible)
 {
+    m_layerTreeHostImpl->setVisible(visible);
+
     if (!visible) {
         DebugScopedSetImplThread impl;
         m_layerTreeHost->didBecomeInvisibleOnImplThread(m_layerTreeHostImpl.get());
-        m_layerTreeHostImpl->setVisible(false);
         return;
     }
+
     setNeedsCommit();
 }
 
@@ -233,72 +259,23 @@ void CCSingleThreadProxy::stop()
     m_layerTreeHost = 0;
 }
 
-void CCSingleThreadProxy::postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector> events)
+void CCSingleThreadProxy::postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector> events, double wallClockTime)
 {
     ASSERT(CCProxy::isImplThread());
     DebugScopedSetMainThread main;
-    m_layerTreeHost->setAnimationEvents(events);
+    m_layerTreeHost->setAnimationEvents(events, wallClockTime);
 }
 
 // Called by the legacy scheduling path (e.g. where render_widget does the scheduling)
 void CCSingleThreadProxy::compositeImmediately()
 {
-    if (!recreateContextIfNeeded())
-        return;
-
     if (!commitIfNeeded())
         return;
 
-    if (doComposite())
+    if (doComposite()) {
         m_layerTreeHostImpl->swapBuffers();
-}
-
-bool CCSingleThreadProxy::recreateContextIfNeeded()
-{
-    ASSERT(CCProxy::isMainThread());
-
-    if (!m_graphicsContextLost && m_layerTreeHostImpl->isContextLost()) {
-        m_graphicsContextLost = true;
-        m_numFailedRecreateAttempts = 0;
-    }
-
-    if (!m_graphicsContextLost)
-        return true;
-    RefPtr<GraphicsContext3D> context;
-    if (!m_timesRecreateShouldFail)
-        context = m_layerTreeHost->createLayerTreeHostContext3D();
-    else
-        m_timesRecreateShouldFail--;
-
-    if (context) {
-        ASSERT(context->hasOneRef());
-        bool ok;
-        {
-            DebugScopedSetImplThread impl;
-            m_layerTreeHost->deleteContentsTexturesOnImplThread(m_layerTreeHostImpl->contentsTextureAllocator());
-            ok = m_layerTreeHostImpl->initializeLayerRenderer(context);
-            if (ok)
-                m_layerRendererCapabilitiesForMainThread = m_layerTreeHostImpl->layerRendererCapabilities();
-        }
-        if (ok) {
-            m_layerTreeHost->didRecreateGraphicsContext(true);
-            m_graphicsContextLost = false;
-            return true;
-        }
+        didSwapFrame();
     }
-
-    // Tolerate a certain number of recreation failures to work around races
-    // in the context-lost machinery.
-    m_numFailedRecreateAttempts++;
-    if (m_numFailedRecreateAttempts < 5) {
-        setNeedsCommit();
-        return false;
-    }
-
-    // We have tried too many times to recreate the context. Tell the host to fall
-    // back to software rendering.
-    m_layerTreeHost->didRecreateGraphicsContext(false);
-    return false;
 }
 
 bool CCSingleThreadProxy::commitIfNeeded()
@@ -314,34 +291,31 @@ bool CCSingleThreadProxy::commitIfNeeded()
 
 bool CCSingleThreadProxy::doComposite()
 {
-    ASSERT(!m_graphicsContextLost);
-
+    ASSERT(!m_contextLost);
     {
       DebugScopedSetImplThread impl;
-      double frameDisplayTimeMs = monotonicallyIncreasingTime() * 1000.0;
-      m_layerTreeHostImpl->animate(frameDisplayTimeMs);
+      double monotonicTime = monotonicallyIncreasingTime();
+      double wallClockTime = currentTime();
+
+      m_layerTreeHostImpl->animate(monotonicTime, wallClockTime);
       m_layerTreeHostImpl->drawLayers();
     }
 
     if (m_layerTreeHostImpl->isContextLost()) {
-        // Trying to recover the context right here will not work if GPU process
-        // died. This is because GpuChannelHost::OnErrorMessage will only be
-        // called at the next iteration of the message loop, reverting our
-        // recovery attempts here. Instead, we detach the root layer from the
-        // renderer, recreate the renderer at the next message loop iteration
-        // and request a repaint yet again.
-        m_graphicsContextLost = true;
-        m_numFailedRecreateAttempts = 0;
-        setNeedsCommit();
+        m_contextLost = true;
+        m_layerTreeHost->didLoseContext();
         return false;
     }
 
+    return true;
+}
+
+void CCSingleThreadProxy::didSwapFrame()
+{
     if (m_nextFrameIsNewlyCommittedFrame) {
         m_nextFrameIsNewlyCommittedFrame = false;
         m_layerTreeHost->didCommitAndDrawFrame();
     }
-
-    return true;
 }
 
 }
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
index 71b5e99b2..ebbd96e2c 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSingleThreadProxy.h
@@ -43,15 +43,16 @@ public:
 
     // CCProxy implementation
     virtual bool compositeAndReadback(void *pixels, const IntRect&);
-    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec);
+    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double duration);
     virtual GraphicsContext3D* context();
     virtual void finishAllRendering();
     virtual bool isStarted() const;
     virtual bool initializeContext();
     virtual bool initializeLayerRenderer();
+    virtual bool recreateContext();
     virtual int compositorIdentifier() const { return m_compositorIdentifier; }
     virtual const LayerRendererCapabilities& layerRendererCapabilities() const;
-    virtual void loseCompositorContext(int numTimes);
+    virtual void loseContext();
     virtual void setNeedsAnimate();
     virtual void setNeedsCommit();
     virtual void setNeedsRedraw();
@@ -61,23 +62,26 @@ public:
     virtual size_t maxPartialTextureUpdates() const { return std::numeric_limits<size_t>::max(); }
 
     // CCLayerTreeHostImplClient implementation
+    virtual void didLoseContextOnImplThread() { }
     virtual void onSwapBuffersCompleteOnImplThread() { ASSERT_NOT_REACHED(); }
     virtual void setNeedsRedrawOnImplThread() { m_layerTreeHost->setNeedsCommit(); }
     virtual void setNeedsCommitOnImplThread() { m_layerTreeHost->setNeedsCommit(); }
-    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>);
+    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime);
 
     // Called by the legacy path where RenderWidget does the scheduling.
     void compositeImmediately();
 
 private:
     explicit CCSingleThreadProxy(CCLayerTreeHost*);
-    bool recreateContextIfNeeded();
+
     bool commitIfNeeded();
     void doCommit();
     bool doComposite();
+    void didSwapFrame();
 
     // Accessed on main thread only.
     CCLayerTreeHost* m_layerTreeHost;
+    bool m_contextLost;
     int m_compositorIdentifier;
 
     // Holds on to the context between initializeContext() and initializeLayerRenderer() calls. Shouldn't
@@ -89,9 +93,6 @@ private:
     bool m_layerRendererInitialized;
     LayerRendererCapabilities m_layerRendererCapabilitiesForMainThread;
 
-    int m_numFailedRecreateAttempts;
-    bool m_graphicsContextLost;
-    int m_timesRecreateShouldFail; // Used during testing.
     bool m_nextFrameIsNewlyCommittedFrame;
 };
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorLayerImpl.h
index c7edc18b2..2e7441666 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCSolidColorLayerImpl.h
@@ -35,9 +35,9 @@ class LayerRendererChromium;
 
 class CCSolidColorLayerImpl : public CCLayerImpl {
 public:
-    static PassRefPtr<CCSolidColorLayerImpl> create(int id)
+    static PassOwnPtr<CCSolidColorLayerImpl> create(int id)
     {
-        return adoptRef(new CCSolidColorLayerImpl(id));
+        return adoptPtr(new CCSolidColorLayerImpl(id));
     }
     virtual ~CCSolidColorLayerImpl();
 
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
index 75ef13623..8454e21ff 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.cpp
@@ -59,6 +59,7 @@ PassOwnPtr<CCProxy> CCThreadProxy::create(CCLayerTreeHost* layerTreeHost)
 CCThreadProxy::CCThreadProxy(CCLayerTreeHost* layerTreeHost)
     : m_animateRequested(false)
     , m_commitRequested(false)
+    , m_contextLost(false)
     , m_layerTreeHost(layerTreeHost)
     , m_compositorIdentifier(-1)
     , m_layerRendererInitialized(false)
@@ -133,17 +134,17 @@ void CCThreadProxy::requestReadbackOnImplThread(ReadbackRequest* request)
     m_schedulerOnImplThread->setNeedsForcedRedraw();
 }
 
-void CCThreadProxy::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec)
+void CCThreadProxy::startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double duration)
 {
     ASSERT(CCProxy::isMainThread());
-    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::requestStartPageScaleAnimationOnImplThread, targetPosition, useAnchor, scale, durationSec));
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::requestStartPageScaleAnimationOnImplThread, targetPosition, useAnchor, scale, duration));
 }
 
-void CCThreadProxy::requestStartPageScaleAnimationOnImplThread(IntSize targetPosition, bool useAnchor, float scale, double durationSec)
+void CCThreadProxy::requestStartPageScaleAnimationOnImplThread(IntSize targetPosition, bool useAnchor, float scale, double duration)
 {
     ASSERT(CCProxy::isImplThread());
     if (m_layerTreeHostImpl)
-        m_layerTreeHostImpl->startPageScaleAnimation(targetPosition, useAnchor, scale, monotonicallyIncreasingTime() * 1000.0, durationSec * 1000.0);
+        m_layerTreeHostImpl->startPageScaleAnimation(targetPosition, useAnchor, scale, monotonicallyIncreasingTime(), duration);
 }
 
 GraphicsContext3D* CCThreadProxy::context()
@@ -170,7 +171,7 @@ bool CCThreadProxy::isStarted() const
 bool CCThreadProxy::initializeContext()
 {
     TRACE_EVENT("CCThreadProxy::initializeContext", this, 0);
-    RefPtr<GraphicsContext3D> context = m_layerTreeHost->createLayerTreeHostContext3D();
+    RefPtr<GraphicsContext3D> context = m_layerTreeHost->createContext();
     if (!context)
         return false;
     ASSERT(context->hasOneRef());
@@ -193,9 +194,9 @@ bool CCThreadProxy::initializeLayerRenderer()
     bool initializeSucceeded = false;
     LayerRendererCapabilities capabilities;
     CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::initializeLayerRendererOnImplThread,
-                                          AllowCrossThreadAccess(&completion),
-                                          AllowCrossThreadAccess(&initializeSucceeded),
-                                          AllowCrossThreadAccess(&capabilities)));
+                                                       AllowCrossThreadAccess(&completion),
+                                                       AllowCrossThreadAccess(&initializeSucceeded),
+                                                       AllowCrossThreadAccess(&capabilities)));
     completion.wait();
 
     if (initializeSucceeded) {
@@ -205,6 +206,39 @@ bool CCThreadProxy::initializeLayerRenderer()
     return initializeSucceeded;
 }
 
+bool CCThreadProxy::recreateContext()
+{
+    TRACE_EVENT0("cc", "CCThreadProxy::recreateContext");
+    ASSERT(isMainThread());
+
+    // Try to create the context.
+    RefPtr<GraphicsContext3D> context = m_layerTreeHost->createContext();
+    if (!context)
+        return false;
+    ASSERT(context->hasOneRef());
+
+    // Leak the context pointer so we can transfer ownership of it to the other side...
+    GraphicsContext3D* contextPtr = context.release().leakRef();
+    ASSERT(contextPtr->hasOneRef());
+
+    // Make a blocking call to recreateContextOnImplThread. The results of that
+    // call are pushed into the recreateSucceeded and capabilities local
+    // variables.
+    CCCompletionEvent completion;
+    bool recreateSucceeded = false;
+    LayerRendererCapabilities capabilities;
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::recreateContextOnImplThread,
+                                                       AllowCrossThreadAccess(&completion),
+                                                       AllowCrossThreadAccess(contextPtr),
+                                                       AllowCrossThreadAccess(&recreateSucceeded),
+                                                       AllowCrossThreadAccess(&capabilities)));
+    completion.wait();
+
+    if (recreateSucceeded)
+        m_layerRendererCapabilitiesMainThreadCopy = capabilities;
+    return recreateSucceeded;
+}
+
 int CCThreadProxy::compositorIdentifier() const
 {
     ASSERT(isMainThread());
@@ -217,9 +251,9 @@ const LayerRendererCapabilities& CCThreadProxy::layerRendererCapabilities() cons
     return m_layerRendererCapabilitiesMainThreadCopy;
 }
 
-void CCThreadProxy::loseCompositorContext(int numTimes)
+void CCThreadProxy::loseContext()
 {
-    ASSERT_NOT_REACHED();
+    CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::didLoseContextOnImplThread));
 }
 
 void CCThreadProxy::setNeedsAnimate()
@@ -244,6 +278,13 @@ void CCThreadProxy::setNeedsCommit()
     CCProxy::implThread()->postTask(createCCThreadTask(this, &CCThreadProxy::setNeedsCommitOnImplThread));
 }
 
+void CCThreadProxy::didLoseContextOnImplThread()
+{
+    ASSERT(isImplThread());
+    TRACE_EVENT0("cc", "CCThreadProxy::didLoseContextOnImplThread");
+    m_schedulerOnImplThread->didLoseContext();
+}
+
 void CCThreadProxy::onSwapBuffersCompleteOnImplThread()
 {
     ASSERT(isImplThread());
@@ -259,11 +300,11 @@ void CCThreadProxy::setNeedsCommitOnImplThread()
     m_schedulerOnImplThread->setNeedsCommit();
 }
 
-void CCThreadProxy::postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector> events)
+void CCThreadProxy::postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector> events, double wallClockTime)
 {
     ASSERT(isImplThread());
     TRACE_EVENT("CCThreadProxy::postAnimationEventsToMainThreadOnImplThread", this, 0);
-    m_mainThreadProxy->postTask(createCCThreadTask(this, &CCThreadProxy::setAnimationEvents, events));
+    m_mainThreadProxy->postTask(createCCThreadTask(this, &CCThreadProxy::setAnimationEvents, events, wallClockTime));
 }
 
 void CCThreadProxy::setNeedsRedraw()
@@ -511,6 +552,12 @@ void CCThreadProxy::scheduledActionCommit()
     m_commitCompletionEventOnImplThread = 0;
 }
 
+void CCThreadProxy::scheduledActionBeginContextRecreation()
+{
+    ASSERT(isImplThread());
+    m_mainThreadProxy->postTask(createCCThreadTask(this, &CCThreadProxy::beginContextRecreation));
+}
+
 void CCThreadProxy::scheduledActionDrawAndSwap()
 {
     TRACE_EVENT("CCThreadProxy::scheduledActionDrawAndSwap", this, 0);
@@ -519,26 +566,23 @@ void CCThreadProxy::scheduledActionDrawAndSwap()
         return;
 
     // FIXME: compute the frame display time more intelligently
-    double frameDisplayTimeMs = monotonicallyIncreasingTime() * 1000.0;
+    double monotonicTime = monotonicallyIncreasingTime();
+    double wallClockTime = currentTime();
 
-    m_inputHandlerOnImplThread->willDraw(frameDisplayTimeMs);
-    m_layerTreeHostImpl->animate(frameDisplayTimeMs);
+    m_inputHandlerOnImplThread->willDraw(monotonicTime);
+    m_layerTreeHostImpl->animate(monotonicTime, wallClockTime);
     m_layerTreeHostImpl->drawLayers();
 
     // Check for a pending compositeAndReadback.
     if (m_readbackRequestOnImplThread) {
-      m_layerTreeHostImpl->readback(m_readbackRequestOnImplThread->pixels, m_readbackRequestOnImplThread->rect);
-      m_readbackRequestOnImplThread->success = !m_layerTreeHostImpl->isContextLost();
-      m_readbackRequestOnImplThread->completion.signal();
-      m_readbackRequestOnImplThread = 0;
+        m_layerTreeHostImpl->readback(m_readbackRequestOnImplThread->pixels, m_readbackRequestOnImplThread->rect);
+        m_readbackRequestOnImplThread->success = !m_layerTreeHostImpl->isContextLost();
+        m_readbackRequestOnImplThread->completion.signal();
+        m_readbackRequestOnImplThread = 0;
     }
 
     m_layerTreeHostImpl->swapBuffers();
 
-    // FIXME: handle case where m_layerTreeHostImpl->isContextLost.
-    // FIXME: pass didSwapBuffersAbort if m_layerTreeHostImpl->isContextLost.
-    ASSERT(!m_layerTreeHostImpl->isContextLost());
-
     // Process any finish request
     if (m_finishAllRenderingCompletionEventOnImplThread) {
         m_layerTreeHostImpl->finishAllRendering();
@@ -569,12 +613,55 @@ void CCThreadProxy::didCompleteSwapBuffers()
     m_layerTreeHost->didCompleteSwapBuffers();
 }
 
-void CCThreadProxy::setAnimationEvents(PassOwnPtr<CCAnimationEventsVector> events)
+void CCThreadProxy::setAnimationEvents(PassOwnPtr<CCAnimationEventsVector> events, double wallClockTime)
 {
+    TRACE_EVENT0("cc", "CCThreadProxy::setAnimationEvents");
     ASSERT(isMainThread());
     if (!m_layerTreeHost)
         return;
-    m_layerTreeHost->setAnimationEvents(events);
+    m_layerTreeHost->setAnimationEvents(events, wallClockTime);
+}
+
+class CCThreadProxyContextRecreationTimer : public CCTimer, CCTimerClient {
+public:
+    static PassOwnPtr<CCThreadProxyContextRecreationTimer> create(CCThreadProxy* proxy) { return adoptPtr(new CCThreadProxyContextRecreationTimer(proxy)); }
+
+    virtual void onTimerFired()
+    {
+        m_proxy->tryToRecreateContext();
+    }
+
+    enum Recreation { RecreationTickRateMs = 30 };
+
+private:
+    explicit CCThreadProxyContextRecreationTimer(CCThreadProxy* proxy)
+        : CCTimer(CCProxy::mainThread(), this)
+        , m_proxy(proxy)
+    {
+    }
+
+    CCThreadProxy* m_proxy;
+};
+
+void CCThreadProxy::beginContextRecreation()
+{
+    TRACE_EVENT0("cc", "CCThreadProxy::beginContextRecreation");
+    ASSERT(isMainThread());
+    ASSERT(!m_contextRecreationTimer);
+    m_contextRecreationTimer = CCThreadProxyContextRecreationTimer::create(this);
+    m_layerTreeHost->didLoseContext();
+    m_contextRecreationTimer->startOneShot(CCThreadProxyContextRecreationTimer::RecreationTickRateMs);
+}
+
+void CCThreadProxy::tryToRecreateContext()
+{
+    ASSERT(isMainThread());
+    ASSERT(m_layerTreeHost);
+    CCLayerTreeHost::RecreateResult result = m_layerTreeHost->recreateContext();
+    if (result == CCLayerTreeHost::RecreateFailedButTryAgain)
+        m_contextRecreationTimer->startOneShot(CCThreadProxyContextRecreationTimer::RecreationTickRateMs);
+    else if (result == CCLayerTreeHost::RecreateSucceeded)
+        m_contextRecreationTimer.clear();
 }
 
 void CCThreadProxy::initializeImplOnImplThread(CCCompletionEvent* completion)
@@ -637,4 +724,17 @@ size_t CCThreadProxy::maxPartialTextureUpdates() const
     return textureUpdatesPerFrame;
 }
 
+void CCThreadProxy::recreateContextOnImplThread(CCCompletionEvent* completion, GraphicsContext3D* contextPtr, bool* recreateSucceeded, LayerRendererCapabilities* capabilities)
+{
+    TRACE_EVENT0("cc", "CCThreadProxy::recreateContextOnImplThread");
+    ASSERT(isImplThread());
+    m_layerTreeHost->deleteContentsTexturesOnImplThread(m_layerTreeHostImpl->contentsTextureAllocator());
+    *recreateSucceeded = m_layerTreeHostImpl->initializeLayerRenderer(adoptRef(contextPtr));
+    if (*recreateSucceeded) {
+        *capabilities = m_layerTreeHostImpl->layerRendererCapabilities();
+        m_schedulerOnImplThread->didRecreateContext();
+    }
+    completion->signal();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
index 330ef51ca..057691213 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCThreadProxy.h
@@ -31,6 +31,7 @@
 #include "cc/CCProxy.h"
 #include "cc/CCScheduler.h"
 #include "cc/CCThread.h"
+#include "cc/CCTimer.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
@@ -41,6 +42,7 @@ class CCScheduler;
 class CCScopedThreadProxy;
 class CCTextureUpdater;
 class CCThread;
+class CCThreadProxyContextRecreationTimer;
 
 class CCThreadProxy : public CCProxy, CCLayerTreeHostImplClient, CCSchedulerClient {
 public:
@@ -50,15 +52,16 @@ public:
 
     // CCProxy implementation
     virtual bool compositeAndReadback(void *pixels, const IntRect&);
-    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double durationSec);
+    virtual void startPageScaleAnimation(const IntSize& targetPosition, bool useAnchor, float scale, double duration);
     virtual GraphicsContext3D* context();
     virtual void finishAllRendering();
     virtual bool isStarted() const;
     virtual bool initializeContext();
     virtual bool initializeLayerRenderer();
+    virtual bool recreateContext();
     virtual int compositorIdentifier() const;
     virtual const LayerRendererCapabilities& layerRendererCapabilities() const;
-    virtual void loseCompositorContext(int numTimes);
+    virtual void loseContext();
     virtual void setNeedsAnimate();
     virtual void setNeedsCommit();
     virtual void setNeedsRedraw();
@@ -68,10 +71,11 @@ public:
     virtual size_t maxPartialTextureUpdates() const;
 
     // CCLayerTreeHostImplClient implementation
+    virtual void didLoseContextOnImplThread();
     virtual void onSwapBuffersCompleteOnImplThread();
     virtual void setNeedsRedrawOnImplThread();
     virtual void setNeedsCommitOnImplThread();
-    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>);
+    virtual void postAnimationEventsToMainThreadOnImplThread(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime);
 
     // CCSchedulerClient implementation
     virtual bool canDraw();
@@ -80,15 +84,19 @@ public:
     virtual void scheduledActionDrawAndSwap();
     virtual void scheduledActionUpdateMoreResources();
     virtual void scheduledActionCommit();
+    virtual void scheduledActionBeginContextRecreation();
 
 private:
     explicit CCThreadProxy(CCLayerTreeHost*);
+    friend class CCThreadProxyContextRecreationTimer;
 
     // Called on main thread
     void beginFrameAndCommit(int sequenceNumber, double frameBeginTime, PassOwnPtr<CCScrollAndScaleSet>);
     void didCommitAndDrawFrame();
     void didCompleteSwapBuffers();
-    void setAnimationEvents(PassOwnPtr<CCAnimationEventsVector>);
+    void setAnimationEvents(PassOwnPtr<CCAnimationEventsVector>, double wallClockTime);
+    void beginContextRecreation();
+    void tryToRecreateContext();
 
     // Called on impl thread
     struct ReadbackRequest {
@@ -109,10 +117,13 @@ private:
     void setVisibleOnImplThread(CCCompletionEvent*, bool visible);
     void layerTreeHostClosedOnImplThread(CCCompletionEvent*);
     void setFullRootLayerDamageOnImplThread();
+    void recreateContextOnImplThread(CCCompletionEvent*, GraphicsContext3D*, bool* recreateSucceeded, LayerRendererCapabilities*);
 
     // Accessed on main thread only.
     bool m_animateRequested;
     bool m_commitRequested;
+    bool m_contextLost;
+    OwnPtr<CCThreadProxyContextRecreationTimer> m_contextRecreationTimer;
     CCLayerTreeHost* m_layerTreeHost;
     int m_compositorIdentifier;
     bool m_layerRendererInitialized;
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
index 47d0a708c..e8d2a6c45 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.cpp
@@ -52,14 +52,10 @@ public:
     Platform3DObject textureId() const { return m_textureId; }
     void setTextureId(Platform3DObject textureId) { m_textureId = textureId; }
 
-    const IntRect& opaqueRect() const { return m_opaqueRect; }
-    void setOpaqueRect(const IntRect& opaqueRect) { m_opaqueRect = opaqueRect; }
-
 private:
     DrawableTile() : m_textureId(0) { }
 
     Platform3DObject m_textureId;
-    IntRect m_opaqueRect;
 };
 
 CCTiledLayerImpl::CCTiledLayerImpl(int id)
@@ -203,6 +199,14 @@ void CCTiledLayerImpl::pushTileProperties(int i, int j, Platform3DObject texture
     tile->setOpaqueRect(opaqueRect);
 }
 
+Region CCTiledLayerImpl::opaqueContentsRegion() const
+{
+    if (m_skipsDraw)
+        return Region();
+
+    return m_tiler->opaqueRegionInLayerRect(visibleLayerRect());
+}
+
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.h
index 7ad71599b..84fe47621 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTiledLayerImpl.h
@@ -37,9 +37,9 @@ class DrawableTile;
 
 class CCTiledLayerImpl : public CCLayerImpl {
 public:
-    static PassRefPtr<CCTiledLayerImpl> create(int id)
+    static PassOwnPtr<CCTiledLayerImpl> create(int id)
     {
-        return adoptRef(new CCTiledLayerImpl(id));
+        return adoptPtr(new CCTiledLayerImpl(id));
     }
     virtual ~CCTiledLayerImpl();
 
@@ -56,6 +56,8 @@ public:
     void setContentsSwizzled(bool contentsSwizzled) { m_contentsSwizzled = contentsSwizzled; }
     bool contentsSwizzled() const { return m_contentsSwizzled; }
 
+    virtual Region opaqueContentsRegion() const;
+
     typedef ProgramBinding<VertexShaderTile, FragmentShaderRGBATexAlpha> Program;
     // Shader program that swaps red and blue components of texture.
     // Used when texture format does not match native color format.
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTimingFunction.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCTimingFunction.cpp
new file mode 100644
index 000000000..decc00c8f
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTimingFunction.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "cc/CCTimingFunction.h"
+
+#include <wtf/OwnPtr.h>
+
+namespace {
+const double epsilon = 1e-6;
+} // namespace
+
+namespace WebCore {
+
+CCTimingFunction::CCTimingFunction()
+{
+}
+
+CCTimingFunction::~CCTimingFunction()
+{
+}
+
+double CCTimingFunction::duration() const
+{
+    return 1.0;
+}
+
+PassOwnPtr<CCCubicBezierTimingFunction> CCCubicBezierTimingFunction::create(double x1, double y1, double x2, double y2)
+{
+    return adoptPtr(new CCCubicBezierTimingFunction(x1, y1, x2, y2));
+}
+
+CCCubicBezierTimingFunction::CCCubicBezierTimingFunction(double x1, double y1, double x2, double y2)
+    : m_curve(x1, y1, x2, y2)
+{
+}
+
+CCCubicBezierTimingFunction::~CCCubicBezierTimingFunction()
+{
+}
+
+float CCCubicBezierTimingFunction::getValue(double x) const
+{
+    UnitBezier temp(m_curve);
+    return static_cast<float>(temp.solve(x, epsilon));
+}
+
+PassOwnPtr<CCAnimationCurve> CCCubicBezierTimingFunction::clone() const
+{
+    return adoptPtr(new CCCubicBezierTimingFunction(*this));
+}
+
+// These numbers come from http://www.w3.org/TR/css3-transitions/#transition-timing-function_tag.
+PassOwnPtr<CCTimingFunction> CCEaseTimingFunction::create()
+{
+    return CCCubicBezierTimingFunction::create(0.25, 0.1, 0.25, 1);
+}
+
+PassOwnPtr<CCTimingFunction> CCEaseInTimingFunction::create()
+{
+    return CCCubicBezierTimingFunction::create(0.42, 0, 1.0, 1);
+}
+
+PassOwnPtr<CCTimingFunction> CCEaseOutTimingFunction::create()
+{
+    return CCCubicBezierTimingFunction::create(0, 0, 0.58, 1);
+}
+
+PassOwnPtr<CCTimingFunction> CCEaseInOutTimingFunction::create()
+{
+    return CCCubicBezierTimingFunction::create(0.42, 0, 0.58, 1);
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCTimingFunction.h b/Source/WebCore/platform/graphics/chromium/cc/CCTimingFunction.h
new file mode 100644
index 000000000..77e5c43c5
--- /dev/null
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCTimingFunction.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CCTimingFunction_h
+#define CCTimingFunction_h
+
+#include "UnitBezier.h"
+#include "cc/CCAnimationCurve.h"
+
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+// See http://www.w3.org/TR/css3-transitions/.
+class CCTimingFunction : public CCFloatAnimationCurve {
+public:
+    virtual ~CCTimingFunction();
+
+    // Partial implementation of CCFloatAnimationCurve.
+    virtual double duration() const;
+
+protected:
+    CCTimingFunction();
+};
+
+class CCCubicBezierTimingFunction : public CCTimingFunction {
+public:
+    static PassOwnPtr<CCCubicBezierTimingFunction> create(double x1, double y1, double x2, double y2);
+    virtual ~CCCubicBezierTimingFunction();
+
+    // Partial implementation of CCFloatAnimationCurve.
+    virtual float getValue(double time) const;
+    virtual PassOwnPtr<CCAnimationCurve> clone() const;
+
+protected:
+    CCCubicBezierTimingFunction(double x1, double y1, double x2, double y2);
+
+    UnitBezier m_curve;
+};
+
+class CCEaseTimingFunction {
+public:
+    static PassOwnPtr<CCTimingFunction> create();
+};
+
+class CCEaseInTimingFunction {
+public:
+    static PassOwnPtr<CCTimingFunction> create();
+};
+
+class CCEaseOutTimingFunction {
+public:
+    static PassOwnPtr<CCTimingFunction> create();
+};
+
+class CCEaseInOutTimingFunction {
+public:
+    static PassOwnPtr<CCTimingFunction> create();
+};
+
+} // namespace WebCore
+
+#endif // CCTimingFunction_h
+
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
index 35f269f50..fd53e41d3 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.cpp
@@ -34,6 +34,7 @@
 #include "LayerRendererChromium.h"
 #include "NotImplemented.h"
 #include "ProgramBinding.h"
+#include "cc/CCLayerTreeHostImpl.h"
 #include "cc/CCProxy.h"
 #include "cc/CCVideoDrawQuad.h"
 #include <wtf/text/WTFString.h>
@@ -89,7 +90,6 @@ CCVideoLayerImpl::~CCVideoLayerImpl()
     }
     for (unsigned i = 0; i < MaxPlanes; ++i)
         m_textures[i].m_texture.clear();
-    cleanupResources();
 }
 
 void CCVideoLayerImpl::stopUsingProvider()
diff --git a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
index caa72dfb9..4c4e23102 100644
--- a/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
+++ b/Source/WebCore/platform/graphics/chromium/cc/CCVideoLayerImpl.h
@@ -43,9 +43,9 @@ template<class VertexShader, class FragmentShader> class ProgramBinding;
 class CCVideoLayerImpl : public CCLayerImpl
                        , public VideoFrameProvider::Client {
 public:
-    static PassRefPtr<CCVideoLayerImpl> create(int id, VideoFrameProvider* provider)
+    static PassOwnPtr<CCVideoLayerImpl> create(int id, VideoFrameProvider* provider)
     {
-        return adoptRef(new CCVideoLayerImpl(id, provider));
+        return adoptPtr(new CCVideoLayerImpl(id, provider));
     }
     virtual ~CCVideoLayerImpl();
 
diff --git a/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp b/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
new file mode 100644
index 000000000..e5601c8f8
--- /dev/null
+++ b/Source/WebCore/platform/graphics/efl/GraphicsContext3DEfl.cpp
@@ -0,0 +1,860 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(WEBGL) || USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsContext3DPrivate.h"
+
+#include "ImageData.h"
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, RenderStyle renderStyle)
+{
+    bool renderDirectlyToEvasGLObject = (renderStyle == RenderDirectlyToHostWindow);
+
+    OwnPtr<GraphicsContext3DPrivate> internal = GraphicsContext3DPrivate::create(attrs, hostWindow, renderDirectlyToEvasGLObject);
+    if (!internal)
+        return 0;
+
+    RefPtr<GraphicsContext3D> context = adoptRef(new GraphicsContext3D(attrs, hostWindow, renderDirectlyToEvasGLObject));
+    context->m_private = internal.release();
+    return context.release();
+}
+
+GraphicsContext3D::GraphicsContext3D(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, bool renderDirectlyToHostWindow)
+    : m_currentWidth(0)
+    , m_currentHeight(0)
+{
+}
+
+GraphicsContext3D::~GraphicsContext3D()
+{
+}
+
+PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D() const
+{
+    return m_private->platformGraphicsContext3D();
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+PlatformLayer* GraphicsContext3D::platformLayer() const
+{
+    notImplemented();
+    return 0;
+}
+#endif
+
+bool GraphicsContext3D::makeContextCurrent()
+{
+    return m_private->makeContextCurrent();
+}
+
+bool GraphicsContext3D::isGLES2Compliant() const
+{
+    return m_private->isGLES2Compliant();
+}
+
+void GraphicsContext3D::activeTexture(GC3Denum texture)
+{
+    m_private->activeTexture(texture);
+}
+
+void GraphicsContext3D::attachShader(Platform3DObject program, Platform3DObject shader)
+{
+    m_private->attachShader(program, shader);
+}
+
+void GraphicsContext3D::bindAttribLocation(Platform3DObject program, GC3Duint index, const String& name)
+{
+    m_private->bindAttribLocation(program, index, name);
+}
+
+void GraphicsContext3D::bindBuffer(GC3Denum target, Platform3DObject buffer)
+{
+    m_private->bindBuffer(target, buffer);
+}
+
+void GraphicsContext3D::bindFramebuffer(GC3Denum target, Platform3DObject buffer)
+{
+    m_private->bindFramebuffer(target, buffer);
+}
+
+void GraphicsContext3D::bindRenderbuffer(GC3Denum target, Platform3DObject renderbuffer)
+{
+    m_private->bindRenderbuffer(target, renderbuffer);
+}
+
+void GraphicsContext3D::bindTexture(GC3Denum target, Platform3DObject texture)
+{
+    m_private->bindTexture(target, texture);
+}
+
+void GraphicsContext3D::blendColor(GC3Dclampf red, GC3Dclampf green, GC3Dclampf blue, GC3Dclampf alpha)
+{
+    m_private->blendColor(red, green, blue, alpha);
+}
+
+void GraphicsContext3D::blendEquation(GC3Denum mode)
+{
+    m_private->blendEquation(mode);
+}
+
+void GraphicsContext3D::blendEquationSeparate(GC3Denum modeRGB, GC3Denum modeAlpha)
+{
+    m_private->blendEquationSeparate(modeRGB, modeAlpha);
+}
+
+void GraphicsContext3D::blendFunc(GC3Denum srcFactor, GC3Denum dstFactor)
+{
+    m_private->blendFunc(srcFactor, dstFactor);
+}
+
+void GraphicsContext3D::blendFuncSeparate(GC3Denum srcRGB, GC3Denum dstRGB, GC3Denum srcAlpha, GC3Denum dstAlpha)
+{
+    m_private->blendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+}
+
+void GraphicsContext3D::bufferData(GC3Denum target, GC3Dsizeiptr size, GC3Denum usage)
+{
+    m_private->bufferData(target, size, 0, usage);
+}
+
+void GraphicsContext3D::bufferData(GC3Denum target, GC3Dsizeiptr size, const void* data, GC3Denum usage)
+{
+    m_private->bufferData(target, size, data, usage);
+}
+
+void GraphicsContext3D::bufferSubData(GC3Denum target, GC3Dintptr offset, GC3Dsizeiptr size, const void* data)
+{
+    m_private->bufferSubData(target, offset, size, data);
+}
+
+GC3Denum GraphicsContext3D::checkFramebufferStatus(GC3Denum target)
+{
+    return m_private->checkFramebufferStatus(target);
+}
+
+void GraphicsContext3D::clear(GC3Dbitfield mask)
+{
+    m_private->clear(mask);
+}
+
+void GraphicsContext3D::clearColor(GC3Dclampf red, GC3Dclampf green, GC3Dclampf blue, GC3Dclampf alpha)
+{
+    m_private->clearColor(red, green, blue, alpha);
+}
+
+void GraphicsContext3D::clearDepth(GC3Dclampf depth)
+{
+    m_private->clearDepth(depth);
+}
+
+void GraphicsContext3D::clearStencil(GC3Dint clearValue)
+{
+    m_private->clearStencil(clearValue);
+}
+
+void GraphicsContext3D::colorMask(GC3Dboolean red, GC3Dboolean green, GC3Dboolean blue, GC3Dboolean alpha)
+{
+    m_private->colorMask(red, green, blue, alpha);
+}
+
+void GraphicsContext3D::compileShader(Platform3DObject shader)
+{
+    m_private->compileShader(shader);
+}
+
+void GraphicsContext3D::copyTexImage2D(GC3Denum target, GC3Dint level, GC3Denum internalformat, GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height, GC3Dint border)
+{
+    m_private->copyTexImage2D(target, level, internalformat, x, y, width, height, border);
+}
+
+void GraphicsContext3D::copyTexSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xOffset, GC3Dint yOffset, GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height)
+{
+    m_private->copyTexSubImage2D(target, level, xOffset, yOffset, x, y, width, height);
+}
+
+void GraphicsContext3D::cullFace(GC3Denum mode)
+{
+    m_private->cullFace(mode);
+}
+
+void GraphicsContext3D::depthFunc(GC3Denum func)
+{
+    m_private->depthFunc(func);
+}
+
+void GraphicsContext3D::depthMask(GC3Dboolean flag)
+{
+    m_private->depthMask(flag);
+}
+
+void GraphicsContext3D::depthRange(GC3Dclampf zNear, GC3Dclampf zFar)
+{
+    m_private->depthRange(zNear, zFar);
+}
+
+void GraphicsContext3D::detachShader(Platform3DObject program, Platform3DObject shader)
+{
+    m_private->detachShader(program, shader);
+}
+
+void GraphicsContext3D::disable(GC3Denum cap)
+{
+    m_private->disable(cap);
+}
+
+void GraphicsContext3D::disableVertexAttribArray(GC3Duint index)
+{
+    m_private->disableVertexAttribArray(index);
+}
+
+void GraphicsContext3D::drawArrays(GC3Denum mode, GC3Dint first, GC3Dsizei count)
+{
+    m_private->drawArrays(mode, first, count);
+}
+
+void GraphicsContext3D::drawElements(GC3Denum mode, GC3Dsizei count, GC3Denum type, GC3Dintptr offset)
+{
+    m_private->drawElements(mode, count, type, offset);
+}
+
+void GraphicsContext3D::enable(GC3Denum cap)
+{
+    m_private->enable(cap);
+}
+
+void GraphicsContext3D::enableVertexAttribArray(GC3Duint index)
+{
+    m_private->enableVertexAttribArray(index);
+}
+
+void GraphicsContext3D::finish()
+{
+    m_private->finish();
+}
+
+void GraphicsContext3D::flush()
+{
+    m_private->flush();
+}
+
+void GraphicsContext3D::framebufferRenderbuffer(GC3Denum target, GC3Denum attachment, GC3Denum renderbufferTarget, Platform3DObject buffer)
+{
+    m_private->framebufferRenderbuffer(target, attachment, renderbufferTarget, buffer);
+}
+
+void GraphicsContext3D::framebufferTexture2D(GC3Denum target, GC3Denum attachment, GC3Denum texTarget, Platform3DObject texture, GC3Dint level)
+{
+    m_private->framebufferTexture2D(target, attachment, texTarget, texture, level);
+}
+
+void GraphicsContext3D::frontFace(GC3Denum mode)
+{
+    m_private->frontFace(mode);
+}
+
+void GraphicsContext3D::generateMipmap(GC3Denum target)
+{
+    m_private->generateMipmap(target);
+}
+
+bool GraphicsContext3D::getActiveAttrib(Platform3DObject program, GC3Duint index, ActiveInfo& info)
+{
+    return m_private->getActiveAttrib(program, index, info);
+}
+
+bool GraphicsContext3D::getActiveUniform(Platform3DObject program, GC3Duint index, ActiveInfo& info)
+{
+    return m_private->getActiveUniform(program, index, info);
+}
+
+void GraphicsContext3D::getAttachedShaders(Platform3DObject program, GC3Dsizei maxCount, GC3Dsizei* count, Platform3DObject* shaders)
+{
+    m_private->getAttachedShaders(program, maxCount, count, shaders);
+}
+
+int GraphicsContext3D::getAttribLocation(Platform3DObject program, const String& name)
+{
+    return m_private->getAttribLocation(program, name);
+}
+
+void GraphicsContext3D::getBooleanv(GC3Denum paramName, GC3Dboolean* value)
+{
+    m_private->getBooleanv(paramName, value);
+}
+
+void GraphicsContext3D::getBufferParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value)
+{
+    m_private->getBufferParameteriv(target, paramName, value);
+}
+
+GraphicsContext3D::Attributes GraphicsContext3D::getContextAttributes()
+{
+    return m_private->getContextAttributes();
+}
+
+GC3Denum GraphicsContext3D::getError()
+{
+    return m_private->getError();
+}
+
+void GraphicsContext3D::getFloatv(GC3Denum paramName, GC3Dfloat* value)
+{
+    m_private->getFloatv(paramName, value);
+}
+
+void GraphicsContext3D::getFramebufferAttachmentParameteriv(GC3Denum target, GC3Denum attachment, GC3Denum paramName, GC3Dint* value)
+{
+    m_private->getFramebufferAttachmentParameteriv(target, attachment, paramName, value);
+}
+
+void GraphicsContext3D::getIntegerv(GC3Denum paramName, GC3Dint* value)
+{
+    m_private->getIntegerv(paramName, value);
+}
+
+void GraphicsContext3D::getProgramiv(Platform3DObject program, GC3Denum paramName, GC3Dint* value)
+{
+    m_private->getProgramiv(program, paramName, value);
+}
+
+String GraphicsContext3D::getProgramInfoLog(Platform3DObject program)
+{
+    return m_private->getProgramInfoLog(program);
+}
+
+void GraphicsContext3D::getRenderbufferParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value)
+{
+    m_private->getRenderbufferParameteriv(target, paramName, value);
+}
+
+void GraphicsContext3D::getShaderiv(Platform3DObject shader, GC3Denum paramName, GC3Dint* value)
+{
+    m_private->getShaderiv(shader, paramName, value);
+}
+
+String GraphicsContext3D::getShaderInfoLog(Platform3DObject shader)
+{
+    return m_private->getShaderInfoLog(shader);
+}
+
+String GraphicsContext3D::getShaderSource(Platform3DObject shader)
+{
+    return m_private->getShaderSource(shader);
+}
+
+String GraphicsContext3D::getString(GC3Denum name)
+{
+    return m_private->getString(name);
+}
+
+void GraphicsContext3D::getTexParameterfv(GC3Denum target, GC3Denum paramName, GC3Dfloat* value)
+{
+    m_private->getTexParameterfv(target, paramName, value);
+}
+
+void GraphicsContext3D::getTexParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value)
+{
+    m_private->getTexParameteriv(target, paramName, value);
+}
+
+void GraphicsContext3D::getUniformfv(Platform3DObject program, GC3Dint location, GC3Dfloat* value)
+{
+    m_private->getUniformfv(program, location, value);
+}
+
+void GraphicsContext3D::getUniformiv(Platform3DObject program, GC3Dint location, GC3Dint* value)
+{
+    m_private->getUniformiv(program, location, value);
+}
+
+GC3Dint GraphicsContext3D::getUniformLocation(Platform3DObject program, const String& name)
+{
+    return m_private->getUniformLocation(program, name);
+}
+
+void GraphicsContext3D::getVertexAttribfv(GC3Duint index, GC3Denum paramName, GC3Dfloat* value)
+{
+    m_private->getVertexAttribfv(index, paramName, value);
+}
+
+void GraphicsContext3D::getVertexAttribiv(GC3Duint index, GC3Denum paramName, GC3Dint* value)
+{
+    m_private->getVertexAttribiv(index, paramName, value);
+}
+
+long GraphicsContext3D::getVertexAttribOffset(GC3Duint index, GC3Denum paramName)
+{
+    return m_private->getVertexAttribOffset(index, paramName);
+}
+
+void GraphicsContext3D::hint(GC3Denum target, GC3Denum mode)
+{
+    m_private->hint(target, mode);
+}
+
+GC3Dboolean GraphicsContext3D::isBuffer(Platform3DObject obj)
+{
+    return m_private->isBuffer(obj);
+}
+
+GC3Dboolean GraphicsContext3D::isEnabled(GC3Denum cap)
+{
+    return m_private->isEnabled(cap);
+}
+
+GC3Dboolean GraphicsContext3D::isFramebuffer(Platform3DObject obj)
+{
+    return m_private->isFramebuffer(obj);
+}
+
+GC3Dboolean GraphicsContext3D::isProgram(Platform3DObject obj)
+{
+    return m_private->isProgram(obj);
+}
+
+GC3Dboolean GraphicsContext3D::isRenderbuffer(Platform3DObject obj)
+{
+    return m_private->isRenderbuffer(obj);
+}
+
+GC3Dboolean GraphicsContext3D::isShader(Platform3DObject obj)
+{
+    return m_private->isShader(obj);
+}
+
+GC3Dboolean GraphicsContext3D::isTexture(Platform3DObject obj)
+{
+    return m_private->isTexture(obj);
+}
+
+void GraphicsContext3D::lineWidth(GC3Dfloat width)
+{
+    m_private->lineWidth(width);
+}
+
+void GraphicsContext3D::linkProgram(Platform3DObject program)
+{
+    m_private->linkProgram(program);
+}
+
+void GraphicsContext3D::pixelStorei(GC3Denum paramName, GC3Dint param)
+{
+    m_private->pixelStorei(paramName, param);
+}
+
+void GraphicsContext3D::polygonOffset(GC3Dfloat factor, GC3Dfloat units)
+{
+    m_private->polygonOffset(factor, units);
+}
+
+void GraphicsContext3D::readPixels(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, void* data)
+{
+    m_private->readPixels(x, y, width, height, format, type, data);
+}
+
+void GraphicsContext3D::releaseShaderCompiler()
+{
+    notImplemented();
+}
+
+void GraphicsContext3D::renderbufferStorage(GC3Denum target, GC3Denum internalformat, GC3Dsizei width, GC3Dsizei height)
+{
+    m_private->renderbufferStorage(target, internalformat, width, height);
+}
+
+void GraphicsContext3D::sampleCoverage(GC3Dclampf value, GC3Dboolean invert)
+{
+    m_private->sampleCoverage(value, invert);
+}
+
+void GraphicsContext3D::scissor(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height)
+{
+    m_private->scissor(x, y, width, height);
+}
+
+void GraphicsContext3D::shaderSource(Platform3DObject program, const String& string)
+{
+    m_private->shaderSource(program, string);
+}
+
+void GraphicsContext3D::stencilFunc(GC3Denum func, GC3Dint ref, GC3Duint mask)
+{
+    m_private->stencilFunc(func, ref, mask);
+}
+
+void GraphicsContext3D::stencilFuncSeparate(GC3Denum face, GC3Denum func, GC3Dint ref, GC3Duint mask)
+{
+    m_private->stencilFuncSeparate(face, func, ref, mask);
+}
+
+void GraphicsContext3D::stencilMask(GC3Duint mask)
+{
+    m_private->stencilMask(mask);
+}
+
+void GraphicsContext3D::stencilMaskSeparate(GC3Denum face, GC3Duint mask)
+{
+    m_private->stencilMaskSeparate(face, mask);
+}
+
+void GraphicsContext3D::stencilOp(GC3Denum fail, GC3Denum zfail, GC3Denum zpass)
+{
+    m_private->stencilOp(fail, zfail, zpass);
+}
+
+void GraphicsContext3D::stencilOpSeparate(GC3Denum face, GC3Denum fail, GC3Denum zfail, GC3Denum zpass)
+{
+    m_private->stencilOpSeparate(face, fail, zfail, zpass);
+}
+
+bool GraphicsContext3D::texImage2D(GC3Denum target, GC3Dint level, GC3Denum internalformat, GC3Dsizei width, GC3Dsizei height, GC3Dint border, GC3Denum format, GC3Denum type, const void* pixels)
+{
+    return m_private->texImage2D(target, level, internalformat, width, height, border, format, type, pixels);
+}
+
+void GraphicsContext3D::texParameterf(GC3Denum target, GC3Denum paramName, GC3Dfloat param)
+{
+    m_private->texParameterf(target, paramName, param);
+}
+
+void GraphicsContext3D::texParameteri(GC3Denum target, GC3Denum paramName, GC3Dint param)
+{
+    m_private->texParameteri(target, paramName, param);
+}
+
+void GraphicsContext3D::texSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xOffset, GC3Dint yOffset, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, const void* pixels)
+{
+    m_private->texSubImage2D(target, level, xOffset, yOffset, width, height, format, type, pixels);
+}
+
+void GraphicsContext3D::uniform1f(GC3Dint location, GC3Dfloat x)
+{
+    m_private->uniform1f(location, x);
+}
+
+void GraphicsContext3D::uniform1fv(GC3Dint location, GGC3Dsizei size, C3Dfloat* v)
+{
+    m_private->uniform1fv(location, size, v);
+}
+
+void GraphicsContext3D::uniform1i(GC3Dint location, GC3Dint x)
+{
+    m_private->uniform1i(location, x);
+}
+
+void GraphicsContext3D::uniform1iv(GC3Dint location, GGC3Dsizei size, C3Dint* v)
+{
+    m_private->uniform1iv(location, size, v);
+}
+
+void GraphicsContext3D::uniform2f(GC3Dint location, GC3Dfloat x, float y)
+{
+    m_private->uniform2f(location, x, y);
+}
+
+void GraphicsContext3D::uniform2fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* v)
+{
+    m_private->uniform2fv(location, size, v);
+}
+
+void GraphicsContext3D::uniform2i(GC3Dint location, GC3Dint x, GC3Dint y)
+{
+    m_private->uniform2i(location, x, y);
+}
+
+void GraphicsContext3D::uniform2iv(GC3Dint location, GC3Dsizei size, GC3Dint* v)
+{
+    m_private->uniform2iv(location, size, v);
+}
+
+void GraphicsContext3D::uniform3f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z)
+{
+    m_private->uniform3f(location, x, y, z);
+}
+
+void GraphicsContext3D::uniform3fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* v)
+{
+    m_private->uniform3fv(location, size, v);
+}
+
+void GraphicsContext3D::uniform3i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z)
+{
+    m_private->uniform3i(location, x, y, z);
+}
+
+void GraphicsContext3D::uniform3iv(GC3Dint location, GC3Dsizei size, GC3Dint* v)
+{
+    m_private->uniform3iv(location, size, v);
+}
+
+void GraphicsContext3D::uniform4f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z, GC3Dfloat w)
+{
+    m_private->uniform4f(location, x, y, z, w);
+}
+
+void GraphicsContext3D::uniform4fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* v)
+{
+    m_private->uniform4fv(location, size, v);
+}
+
+void GraphicsContext3D::uniform4i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z, GC3Dint w)
+{
+    m_private->uniform4i(location, x, y, z, w);
+}
+
+void GraphicsContext3D::uniform4iv(GC3Dint location, GC3Dsizei size, GC3Dint* v)
+{
+    m_private->uniform4iv(location, size, v);
+}
+
+void GraphicsContext3D::uniformMatrix2fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
+{
+    m_private->uniformMatrix2fv(location, size, transpose, value);
+}
+
+void GraphicsContext3D::uniformMatrix3fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
+{
+    m_private->uniformMatrix3fv(location, size, transpose, value);
+}
+
+void GraphicsContext3D::uniformMatrix4fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
+{
+    m_private->uniformMatrix4fv(location, size, transpose, value);
+}
+
+void GraphicsContext3D::useProgram(Platform3DObject program)
+{
+    m_private->useProgram(program);
+}
+
+void GraphicsContext3D::validateProgram(Platform3DObject program)
+{
+    m_private->validateProgram(program);
+}
+
+void GraphicsContext3D::vertexAttrib1f(GC3Duint index, GC3Dfloat x)
+{
+    m_private->vertexAttrib1f(index, x);
+}
+
+void GraphicsContext3D::vertexAttrib1fv(GC3Duint index, GC3Dfloat* values)
+{
+    m_private->vertexAttrib1fv(index, values);
+}
+
+void GraphicsContext3D::vertexAttrib2f(GC3Duint index, GC3Dfloat x, GC3Dfloat y)
+{
+    m_private->vertexAttrib2f(index, x, y);
+}
+
+void GraphicsContext3D::vertexAttrib2fv(GC3Duint index, GC3Dfloat* values)
+{
+    m_private->vertexAttrib2fv(index, values);
+}
+
+void GraphicsContext3D::vertexAttrib3f(GC3Duint index, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z)
+{
+    m_private->vertexAttrib3f(index, x, y, z);
+}
+
+void GraphicsContext3D::vertexAttrib3fv(GC3Duint index, GC3Dfloat* values)
+{
+    m_private->vertexAttrib3fv(index, values);
+}
+
+void GraphicsContext3D::vertexAttrib4f(GC3Duint index, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z, GC3Dfloat w)
+{
+    m_private->vertexAttrib4f(index, x, y, z, w);
+}
+
+void GraphicsContext3D::vertexAttrib4fv(GC3Duint index, GC3Dfloat* values)
+{
+    m_private->vertexAttrib4fv(index, values);
+}
+
+void GraphicsContext3D::vertexAttribPointer(GC3Duint index, GC3Dint size, GC3Denum type, GC3Dboolean normalized, GC3Dsizei stride, GC3Dintptr offset)
+{
+    m_private->vertexAttribPointer(index, size, type, normalized, stride, offset);
+}
+
+void GraphicsContext3D::viewport(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height)
+{
+    m_private->viewport(x, y, width, height);
+}
+
+void GraphicsContext3D::reshape(int width, int height)
+{
+    notImplemented();
+}
+
+void GraphicsContext3D::markContextChanged()
+{
+    notImplemented();
+}
+
+void GraphicsContext3D::markLayerComposited()
+{
+    notImplemented();
+}
+
+bool GraphicsContext3D::layerComposited() const
+{
+    notImplemented();
+    return false;
+}
+
+void GraphicsContext3D::paintRenderingResultsToCanvas(CanvasRenderingContext* context, DrawingBuffer* drawingBuffer)
+{
+    notImplemented();
+}
+
+PassRefPtr<ImageData> GraphicsContext3D::paintRenderingResultsToImageData(DrawingBuffer* drawingBuffer)
+{
+    notImplemented();
+    return 0;
+}
+
+bool GraphicsContext3D::paintCompositedResultsToCanvas(CanvasRenderingContext*)
+{
+    return false;
+}
+
+Platform3DObject GraphicsContext3D::createBuffer()
+{
+    return m_private->createBuffer();
+}
+
+Platform3DObject GraphicsContext3D::createFramebuffer()
+{
+    return m_private->createFramebuffer();
+}
+
+Platform3DObject GraphicsContext3D::createProgram()
+{
+    return m_private->createProgram();
+}
+
+Platform3DObject GraphicsContext3D::createRenderbuffer()
+{
+    return m_private->createRenderbuffer();
+}
+
+Platform3DObject GraphicsContext3D::createShader(GC3Denum type)
+{
+    return m_private->createShader(type);
+}
+
+Platform3DObject GraphicsContext3D::createTexture()
+{
+    return m_private->createTexture();
+}
+
+void GraphicsContext3D::deleteBuffer(Platform3DObject buffer)
+{
+    m_private->deleteBuffer(buffer);
+}
+
+void GraphicsContext3D::deleteFramebuffer(Platform3DObject buffer)
+{
+    m_private->deleteFramebuffer(buffer);
+}
+
+void GraphicsContext3D::deleteProgram(Platform3DObject program)
+{
+    m_private->deleteProgram(program);
+}
+
+void GraphicsContext3D::deleteRenderbuffer(Platform3DObject buffer)
+{
+    m_private->deleteRenderbuffer(buffer);
+}
+
+void GraphicsContext3D::deleteShader(Platform3DObject shader)
+{
+    m_private->deleteShader(shader);
+}
+
+void GraphicsContext3D::deleteTexture(Platform3DObject texture)
+{
+    m_private->deleteTexture(texture);
+}
+
+void GraphicsContext3D::synthesizeGLError(GC3Denum error)
+{
+    m_private->synthesizeGLError(error);
+}
+
+Extensions3D* GraphicsContext3D::getExtensions()
+{
+    return m_private->getExtensions();
+}
+
+IntSize GraphicsContext3D::getInternalFramebufferSize() const
+{
+    notImplemented();
+    return IntSize();
+}
+
+void GraphicsContext3D::setContextLostCallback(PassOwnPtr<ContextLostCallback>)
+{
+    notImplemented();
+}
+
+bool GraphicsContext3D::getImageData(Image* image, GC3Denum format, GC3Denum type, bool premultiplyAlpha,
+                                     bool ignoreGammaAndColorProfile, Vector<uint8_t>& outputVector)
+{
+    notImplemented();
+    return false;
+}
+
+void GraphicsContext3D::validateAttributes()
+{
+    notImplemented();
+}
+
+void GraphicsContext3D::readRenderingResults(unsigned char* pixels, int pixelsSize)
+{
+    notImplemented();
+}
+
+bool GraphicsContext3D::reshapeFBOs(const IntSize&)
+{
+    notImplemented();
+}
+
+void GraphicsContext3D::resolveMultisamplingIfNecessary(const IntRect&)
+{
+    notImplemented();
+}
+
+bool GraphicsContext3D::isResourceSafe()
+{
+    notImplemented();
+    return false;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEBGL)
diff --git a/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.cpp b/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.cpp
new file mode 100644
index 000000000..08153f004
--- /dev/null
+++ b/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.cpp
@@ -0,0 +1,1124 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(WEBGL) || USE(ACCELERATED_COMPOSITING)
+
+#include "GraphicsContext3DPrivate.h"
+
+#include "HostWindow.h"
+#include "NotImplemented.h"
+#include "PageClientEfl.h"
+
+#include <wtf/OwnArrayPtr.h>
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+PassOwnPtr<GraphicsContext3DPrivate> GraphicsContext3DPrivate::create(GraphicsContext3D::Attributes attributes, HostWindow* hostWindow, bool renderDirectlyToHostWindow)
+{
+    OwnPtr<GraphicsContext3DPrivate> internal = adoptPtr(new GraphicsContext3DPrivate());
+
+    if (!internal->initialize(attributes, hostWindow, renderDirectlyToHostWindow))
+        return nullptr;
+
+    return internal.release();
+}
+
+GraphicsContext3DPrivate::GraphicsContext3DPrivate()
+    : m_boundFBO(0)
+    , m_boundTexture(0)
+    , m_boundArrayBuffer(0)
+    , m_evasGL(0)
+    , m_context(0)
+    , m_surface(0)
+    , m_api(0)
+{
+}
+
+GraphicsContext3DPrivate::~GraphicsContext3DPrivate()
+{
+    if (!m_evasGL)
+        return;
+
+    if (m_surface)
+        evas_gl_surface_destroy(m_evasGL, m_surface);
+
+    if (m_context)
+        evas_gl_context_destroy(m_evasGL, m_context);
+
+    evas_gl_free(m_evasGL);
+}
+
+bool GraphicsContext3DPrivate::initialize(GraphicsContext3D::Attributes attributes, HostWindow* hostWindow, bool renderDirectlyToHostWindow)
+{
+    PageClientEfl* pageClient = static_cast<PageClientEfl*>(hostWindow->platformPageClient());
+
+    Evas* evas = evas_object_evas_get(pageClient->view());
+
+    // Create a new Evas_GL object for gl rendering on efl.
+    m_evasGL = evas_gl_new(evas);
+    if (!m_evasGL)
+        return false;
+
+    // Get the API for rendering using OpenGL.
+    // This returns a structure that contains all the OpenGL functions we can use to render in Evas
+    m_api = evas_gl_api_get(m_evasGL);
+    if (!m_api)
+        return false;
+
+    Evas_GL_Context* shareContext = 0;
+
+#if USE(ACCELERATED_COMPOSITING)
+    // GC3D with RenderOffscreen style for WebGL has to be shared with AC's context when AC is enabled.
+    if (!renderDirectlyToHostWindow) {
+        GraphicsContext3D* context = pageClient->acceleratedCompositingContext();
+        if (context)
+            shareContext = static_cast<Evas_GL_Context*>(context->platformGraphicsContext3D());
+    }
+#endif
+
+    // Create a context
+    m_context = evas_gl_context_create(m_evasGL, shareContext);
+    if (!m_context)
+        return false;
+
+    // Create a surface
+    if (!createSurface(pageClient, renderDirectlyToHostWindow))
+        return false;
+
+    return makeContextCurrent();
+}
+
+bool GraphicsContext3DPrivate::createSurface(PageClientEfl* pageClient, bool renderDirectlyToHostWindow)
+{
+    // If RenderStyle is RenderOffscreen, we will be rendering to a FBO,
+    // so Evas_GL_Surface has a 1x1 dummy surface.
+    int x = 0;
+    int y = 0;
+    int width = 1;
+    int height = 1;
+
+    // But, in case of RenderDirectlyToHostWindow, we have to render to a render target surface with the same size as our webView.
+    if (renderDirectlyToHostWindow)
+        evas_object_geometry_get(pageClient->view(), &x, &y, &width, &height);
+
+    Evas_GL_Config config = {
+        EVAS_GL_RGBA_8888,
+        EVAS_GL_DEPTH_BIT_8,
+        EVAS_GL_STENCIL_NONE, // FIXME: set EVAS_GL_STENCIL_BIT_8 after fixing Evas_GL bug.
+        EVAS_GL_OPTIONS_NONE
+    };
+
+    // Create a new Evas_GL_Surface object
+    m_surface = evas_gl_surface_create(m_evasGL, &config, width, height);
+    if (!m_surface)
+        return false;
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (renderDirectlyToHostWindow) {
+        Evas_Native_Surface nativeSurface;
+        // Fill in the Native Surface information from the given Evas GL surface.
+        evas_gl_native_surface_get(m_evasGL, m_surface, &nativeSurface);
+
+        // Create and specially set up a evas_object which act as the render targer surface.
+        if (!pageClient->createEvasObjectForAcceleratedCompositing(&nativeSurface, x, y, width, height))
+            return false;
+    }
+#endif
+    return true;
+}
+
+PlatformGraphicsContext3D GraphicsContext3DPrivate::platformGraphicsContext3D() const
+{
+    return m_context;
+}
+
+bool GraphicsContext3DPrivate::makeContextCurrent()
+{
+    return evas_gl_make_current(m_evasGL, m_surface, m_context);
+}
+
+bool GraphicsContext3DPrivate::isGLES2Compliant() const
+{
+    return true;
+}
+
+void GraphicsContext3DPrivate::activeTexture(GC3Denum texture)
+{
+    makeContextCurrent();
+    m_api->glActiveTexture(texture);
+}
+
+void GraphicsContext3DPrivate::attachShader(Platform3DObject program, Platform3DObject shader)
+{
+    makeContextCurrent();
+    m_api->glAttachShader(program, shader);
+}
+
+void GraphicsContext3DPrivate::bindAttribLocation(Platform3DObject program, GC3Duint index, const String& name)
+{
+    makeContextCurrent();
+    m_api->glBindAttribLocation(program, index, name.utf8().data());
+}
+
+void GraphicsContext3DPrivate::bindBuffer(GC3Denum target, Platform3DObject buffer)
+{
+    makeContextCurrent();
+    m_api->glBindBuffer(target, buffer);
+
+    if (target == GL_ARRAY_BUFFER)
+        m_boundArrayBuffer = buffer;
+}
+
+void GraphicsContext3DPrivate::bindFramebuffer(GC3Denum target, Platform3DObject framebuffer)
+{
+    makeContextCurrent();
+
+    if (framebuffer != m_boundFBO) {
+        m_api->glBindFramebuffer(target, framebuffer);
+        m_boundFBO = framebuffer;
+    }
+}
+
+void GraphicsContext3DPrivate::bindRenderbuffer(GC3Denum target, Platform3DObject buffer)
+{
+    makeContextCurrent();
+    m_api->glBindRenderbuffer(target, buffer);
+}
+
+void GraphicsContext3DPrivate::bindTexture(GC3Denum target, Platform3DObject texture)
+{
+    makeContextCurrent();
+    m_api->glBindTexture(target, texture);
+    m_boundTexture = texture;
+}
+
+void GraphicsContext3DPrivate::blendColor(GC3Dclampf red, GC3Dclampf green, GC3Dclampf blue, GC3Dclampf alpha)
+{
+    makeContextCurrent();
+    m_api->glBlendColor(red, green, blue, alpha);
+}
+
+void GraphicsContext3DPrivate::blendEquation(GC3Denum mode)
+{
+    makeContextCurrent();
+    m_api->glBlendEquation(mode);
+}
+
+void GraphicsContext3DPrivate::blendEquationSeparate(GC3Denum modeRGB, GC3Denum modeAlpha)
+{
+    makeContextCurrent();
+    m_api->glBlendEquationSeparate(modeRGB, modeAlpha);
+}
+
+void GraphicsContext3DPrivate::blendFunc(GC3Denum srcFactor, GC3Denum dstFactor)
+{
+    makeContextCurrent();
+    m_api->glBlendFunc(srcFactor, dstFactor);
+}
+
+void GraphicsContext3DPrivate::blendFuncSeparate(GC3Denum srcRGB, GC3Denum dstRGB, GC3Denum srcAlpha, GC3Denum dstAlpha)
+{
+    makeContextCurrent();
+    m_api->glBlendFuncSeparate(srcRGB, dstRGB, srcAlpha, dstAlpha);
+}
+
+void GraphicsContext3DPrivate::bufferData(GC3Denum target, GC3Dsizeiptr size, const void* data, GC3Denum usage)
+{
+    makeContextCurrent();
+    m_api->glBufferData(target, size, data, usage);
+}
+
+void GraphicsContext3DPrivate::bufferSubData(GC3Denum target, GC3Dintptr offset, GC3Dsizeiptr size, const void* data)
+{
+    makeContextCurrent();
+    m_api->glBufferSubData(target, offset, size, data);
+}
+
+GC3Denum GraphicsContext3DPrivate::checkFramebufferStatus(GC3Denum target)
+{
+    makeContextCurrent();
+    return m_api->glCheckFramebufferStatus(target);
+}
+
+void GraphicsContext3DPrivate::clear(GC3Dbitfield mask)
+{
+    makeContextCurrent();
+    m_api->glClear(mask);
+}
+
+void GraphicsContext3DPrivate::clearColor(GC3Dclampf red, GC3Dclampf green, GC3Dclampf blue, GC3Dclampf alpha)
+{
+    makeContextCurrent();
+    m_api->glClearColor(red, green, blue, alpha);
+}
+
+void GraphicsContext3DPrivate::clearDepth(GC3Dclampf depth)
+{
+    makeContextCurrent();
+    m_api->glClearDepthf(depth);
+}
+
+void GraphicsContext3DPrivate::clearStencil(GC3Dint clearValue)
+{
+    makeContextCurrent();
+    m_api->glClearStencil(clearValue);
+}
+
+void GraphicsContext3DPrivate::colorMask(GC3Dboolean red, GC3Dboolean green, GC3Dboolean blue, GC3Dboolean alpha)
+{
+    makeContextCurrent();
+    m_api->glColorMask(red, green, blue, alpha);
+}
+
+void GraphicsContext3DPrivate::compileShader(Platform3DObject shader)
+{
+    makeContextCurrent();
+    m_api->glCompileShader(shader);
+}
+
+void GraphicsContext3DPrivate::copyTexImage2D(GC3Denum target, GC3Dint level, GC3Denum internalFormat, GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height, GC3Dint border)
+{
+    makeContextCurrent();
+    m_api->glCopyTexImage2D(target, level, internalFormat, x, y, width, height, border);
+}
+
+void GraphicsContext3DPrivate::copyTexSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xOffset, GC3Dint yOffset, GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height)
+{
+    makeContextCurrent();
+    m_api->glCopyTexSubImage2D(target, level, xOffset, yOffset, x, y, width, height);
+}
+
+void GraphicsContext3DPrivate::cullFace(GC3Denum mode)
+{
+    makeContextCurrent();
+    m_api->glCullFace(mode);
+}
+
+void GraphicsContext3DPrivate::depthFunc(GC3Denum func)
+{
+    makeContextCurrent();
+    m_api->glDepthFunc(func);
+}
+
+void GraphicsContext3DPrivate::depthMask(GC3Dboolean flag)
+{
+    makeContextCurrent();
+    m_api->glDepthMask(flag);
+}
+
+void GraphicsContext3DPrivate::depthRange(GC3Dclampf zNear, GC3Dclampf zFar)
+{
+    makeContextCurrent();
+    m_api->glDepthRangef(zNear, zFar);
+}
+
+void GraphicsContext3DPrivate::detachShader(Platform3DObject program, Platform3DObject shader)
+{
+    makeContextCurrent();
+    m_api->glDetachShader(program, shader);
+}
+
+void GraphicsContext3DPrivate::disable(GC3Denum cap)
+{
+    makeContextCurrent();
+    m_api->glDisable(cap);
+}
+
+void GraphicsContext3DPrivate::disableVertexAttribArray(GC3Duint index)
+{
+    makeContextCurrent();
+    m_api->glDisableVertexAttribArray(index);
+}
+
+void GraphicsContext3DPrivate::drawArrays(GC3Denum mode, GC3Dint first, GC3Dsizei count)
+{
+    makeContextCurrent();
+    m_api->glDrawArrays(mode, first, count);
+}
+
+void GraphicsContext3DPrivate::drawElements(GC3Denum mode, GC3Dsizei count, GC3Denum type, GC3Dintptr offset)
+{
+    makeContextCurrent();
+    m_api->glDrawElements(mode, count, type, reinterpret_cast<GLvoid*>(static_cast<intptr_t>(offset)));
+}
+
+void GraphicsContext3DPrivate::enable(GC3Denum cap)
+{
+    makeContextCurrent();
+    m_api->glEnable(cap);
+}
+
+void GraphicsContext3DPrivate::enableVertexAttribArray(GC3Duint index)
+{
+    makeContextCurrent();
+    m_api->glEnableVertexAttribArray(index);
+}
+
+void GraphicsContext3DPrivate::finish()
+{
+    makeContextCurrent();
+    m_api->glFinish();
+}
+
+void GraphicsContext3DPrivate::flush()
+{
+    makeContextCurrent();
+    m_api->glFlush();
+}
+
+void GraphicsContext3DPrivate::framebufferRenderbuffer(GC3Denum target, GC3Denum attachment, GC3Denum renderbufferTarget, Platform3DObject renderbuffer)
+{
+    makeContextCurrent();
+    m_api->glFramebufferRenderbuffer(target, attachment, renderbufferTarget, renderbuffer);
+}
+
+void GraphicsContext3DPrivate::framebufferTexture2D(GC3Denum target, GC3Denum attachment, GC3Denum texTarget, Platform3DObject texture, GC3Dint level)
+{
+    makeContextCurrent();
+    m_api->glFramebufferTexture2D(target, attachment, texTarget, texture, level);
+}
+
+void GraphicsContext3DPrivate::frontFace(GC3Denum mode)
+{
+    makeContextCurrent();
+    m_api->glFrontFace(mode);
+}
+
+void GraphicsContext3DPrivate::generateMipmap(GC3Denum target)
+{
+    makeContextCurrent();
+    m_api->glGenerateMipmap(target);
+}
+
+bool GraphicsContext3DPrivate::getActiveAttrib(Platform3DObject program, GC3Duint index, ActiveInfo& info)
+{
+    if (!program) {
+        synthesizeGLError(GL_INVALID_VALUE);
+        return false;
+    }
+
+    makeContextCurrent();
+
+    GLint maxNameLength = 0;
+    m_api->glGetProgramiv(program, GL_ACTIVE_ATTRIBUTE_MAX_LENGTH, &maxNameLength);
+    if (!maxNameLength)
+        return false;
+
+    OwnArrayPtr<char> name = adoptArrayPtr(new char[maxNameLength]);
+    if (!name) {
+        synthesizeGLError(GL_OUT_OF_MEMORY);
+        return false;
+    }
+
+    GLsizei length = 0;
+    GLint size = 0;
+    GLenum type = 0;
+    m_api->glGetActiveAttrib(program, index, maxNameLength, &length, &size, &type, name.get());
+    if (!length)
+        return false;
+
+    info.name = String::fromUTF8(name.get(), length);
+    info.type = type;
+    info.size = size;
+    return true;
+}
+
+bool GraphicsContext3DPrivate::getActiveUniform(Platform3DObject program, GC3Duint index, ActiveInfo& info)
+{
+    if (!program) {
+        synthesizeGLError(GL_INVALID_VALUE);
+        return false;
+    }
+
+    makeContextCurrent();
+
+    GLint maxNameLength = 0;
+    m_api->glGetProgramiv(program, GL_ACTIVE_UNIFORM_MAX_LENGTH, &maxNameLength);
+    if (!maxNameLength)
+        return false;
+
+    OwnArrayPtr<char> name = adoptArrayPtr(new char[maxNameLength]);
+    if (!name) {
+        synthesizeGLError(GL_OUT_OF_MEMORY);
+        return false;
+    }
+
+    GLsizei length = 0;
+    GLint size = 0;
+    GLenum type = 0;
+    m_api->glGetActiveUniform(program, index, maxNameLength, &length, &size, &type, name.get());
+    if (!length)
+        return false;
+
+    info.name = String::fromUTF8(name.get(), length);
+    info.type = type;
+    info.size = size;
+    return true;
+}
+
+void GraphicsContext3DPrivate::getAttachedShaders(Platform3DObject program, GC3Dsizei maxCount, GC3Dsizei* count, Platform3DObject* shaders)
+{
+    makeContextCurrent();
+    m_api->glGetAttachedShaders(program, maxCount, count, shaders);
+}
+
+int GraphicsContext3DPrivate::getAttribLocation(Platform3DObject program, const String& name)
+{
+    makeContextCurrent();
+    return m_api->glGetAttribLocation(program, name.utf8().data());
+}
+
+void GraphicsContext3DPrivate::getBooleanv(GC3Denum paramName, GC3Dboolean* value)
+{
+    makeContextCurrent();
+    m_api->glGetBooleanv(paramName, value);
+}
+
+void GraphicsContext3DPrivate::getBufferParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetBufferParameteriv(target, paramName, value);
+}
+
+GraphicsContext3D::Attributes GraphicsContext3DPrivate::getContextAttributes()
+{
+    return m_attributes;
+}
+
+GC3Denum GraphicsContext3DPrivate::getError()
+{
+    if (!m_syntheticErrors.isEmpty()) {
+        GC3Denum error = m_syntheticErrors.first();
+        m_syntheticErrors.remove(m_syntheticErrors.begin());
+        return error;
+    }
+
+    makeContextCurrent();
+    return m_api->glGetError();
+}
+
+void GraphicsContext3DPrivate::getFloatv(GC3Denum paramName, GC3Dfloat* value)
+{
+    makeContextCurrent();
+    m_api->glGetFloatv(paramName, value);
+}
+
+void GraphicsContext3DPrivate::getFramebufferAttachmentParameteriv(GC3Denum target, GC3Denum attachment, GC3Denum paramName, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetFramebufferAttachmentParameteriv(target, attachment, paramName, value);
+}
+
+void GraphicsContext3DPrivate::getIntegerv(GC3Denum paramName, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetIntegerv(paramName, value);
+}
+
+void GraphicsContext3DPrivate::getProgramiv(Platform3DObject program, GC3Denum paramName, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetProgramiv(program, paramName, value);
+}
+
+String GraphicsContext3DPrivate::getProgramInfoLog(Platform3DObject program)
+{
+    makeContextCurrent();
+
+    GLint logLength = 0;
+    m_api->glGetProgramiv(program, GraphicsContext3D::INFO_LOG_LENGTH, &logLength);
+    if (!logLength)
+        return String();
+
+    OwnArrayPtr<char> log = adoptArrayPtr(new char[logLength]);
+    if (!log)
+        return String();
+
+    GLint returnedLogLength = 0;
+    m_api->glGetProgramInfoLog(program, logLength, &returnedLogLength, log.get());
+    ASSERT(logLength == returnedLogLength + 1);
+
+    String result = String::fromUTF8(log.get(), returnedLogLength);
+    return result;
+}
+
+void GraphicsContext3DPrivate::getRenderbufferParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetRenderbufferParameteriv(target, paramName, value);
+}
+
+void GraphicsContext3DPrivate::getShaderiv(Platform3DObject shader, GC3Denum paramName, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetShaderiv(shader, paramName, value);
+}
+
+String GraphicsContext3DPrivate::getShaderInfoLog(Platform3DObject shader)
+{
+    makeContextCurrent();
+
+    GLint logLength = 0;
+    m_api->glGetShaderiv(shader, GraphicsContext3D::INFO_LOG_LENGTH, &logLength);
+    if (logLength <= 1)
+        return String();
+
+    OwnArrayPtr<char> log = adoptArrayPtr(new char[logLength]);
+    if (!log)
+        return String();
+
+    GLint returnedLogLength = 0;
+    m_api->glGetShaderInfoLog(shader, logLength, &returnedLogLength, log.get());
+    ASSERT(logLength == returnedLogLength + 1);
+
+    String result = String::fromUTF8(log.get(), returnedLogLength);
+    return result;
+}
+
+String GraphicsContext3DPrivate::getShaderSource(Platform3DObject shader)
+{
+    makeContextCurrent();
+
+    GLint logLength = 0;
+    m_api->glGetShaderiv(shader, GL_SHADER_SOURCE_LENGTH, &logLength);
+    if (logLength <= 1)
+        return String();
+
+    OwnArrayPtr<char> log = adoptArrayPtr(new char[logLength]);
+    if (!log)
+        return String();
+
+    GLint returnedLogLength = 0;
+    m_api->glGetShaderSource(shader, logLength, &returnedLogLength, log.get());
+    ASSERT(logLength == returnedLogLength + 1);
+
+    String result = String::fromUTF8(log.get(), returnedLogLength);
+    return result;
+}
+
+String GraphicsContext3DPrivate::getString(GC3Denum name)
+{
+    makeContextCurrent();
+    return String(reinterpret_cast<const char*>(m_api->glGetString(name)));
+}
+
+void GraphicsContext3DPrivate::getTexParameterfv(GC3Denum target, GC3Denum paramName, GC3Dfloat* value)
+{
+    makeContextCurrent();
+    m_api->glGetTexParameterfv(target, paramName, value);
+}
+
+void GraphicsContext3DPrivate::getTexParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetTexParameteriv(target, paramName, value);
+}
+
+void GraphicsContext3DPrivate::getUniformfv(Platform3DObject program, GC3Dint location, GC3Dfloat* value)
+{
+    makeContextCurrent();
+    m_api->glGetUniformfv(program, location, value);
+}
+
+void GraphicsContext3DPrivate::getUniformiv(Platform3DObject program, GC3Dint location, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetUniformiv(program, location, value);
+}
+
+GC3Dint GraphicsContext3DPrivate::getUniformLocation(Platform3DObject program, const String& name)
+{
+    makeContextCurrent();
+    return m_api->glGetUniformLocation(program, name.utf8().data());
+}
+
+void GraphicsContext3DPrivate::getVertexAttribfv(GC3Duint index, GC3Denum paramName, GC3Dfloat* value)
+{
+    makeContextCurrent();
+    m_api->glGetVertexAttribfv(index, paramName, value);
+}
+
+void GraphicsContext3DPrivate::getVertexAttribiv(GC3Duint index, GC3Denum paramName, GC3Dint* value)
+{
+    makeContextCurrent();
+    m_api->glGetVertexAttribiv(index, paramName, value);
+}
+
+GC3Dsizeiptr GraphicsContext3DPrivate::getVertexAttribOffset(GC3Duint index, GC3Denum paramName)
+{
+    makeContextCurrent();
+    void* pointer = 0;
+    m_api->glGetVertexAttribPointerv(index, paramName, &pointer);
+    return reinterpret_cast<GC3Dsizeiptr>(pointer);
+}
+
+void GraphicsContext3DPrivate::hint(GC3Denum target, GC3Denum mode)
+{
+    makeContextCurrent();
+    m_api->glHint(target, mode);
+}
+
+GC3Dboolean GraphicsContext3DPrivate::isBuffer(Platform3DObject buffer)
+{
+    makeContextCurrent();
+    return m_api->glIsBuffer(buffer);
+}
+
+GC3Dboolean GraphicsContext3DPrivate::isEnabled(GC3Denum cap)
+{
+    makeContextCurrent();
+    return m_api->glIsEnabled(cap);
+}
+
+GC3Dboolean GraphicsContext3DPrivate::isFramebuffer(Platform3DObject framebuffer)
+{
+    makeContextCurrent();
+    return m_api->glIsFramebuffer(framebuffer);
+}
+
+GC3Dboolean GraphicsContext3DPrivate::isProgram(Platform3DObject program)
+{
+    makeContextCurrent();
+    return m_api->glIsProgram(program);
+}
+
+GC3Dboolean GraphicsContext3DPrivate::isRenderbuffer(Platform3DObject renderbuffer)
+{
+    makeContextCurrent();
+    return m_api->glIsRenderbuffer(renderbuffer);
+}
+
+GC3Dboolean GraphicsContext3DPrivate::isShader(Platform3DObject shader)
+{
+    makeContextCurrent();
+    return m_api->glIsShader(shader);
+}
+
+GC3Dboolean GraphicsContext3DPrivate::isTexture(Platform3DObject texture)
+{
+    makeContextCurrent();
+    return m_api->glIsTexture(texture);
+}
+
+void GraphicsContext3DPrivate::lineWidth(GC3Dfloat width)
+{
+    makeContextCurrent();
+    m_api->glLineWidth(width);
+}
+
+void GraphicsContext3DPrivate::linkProgram(Platform3DObject program)
+{
+    makeContextCurrent();
+    m_api->glLinkProgram(program);
+}
+
+void GraphicsContext3DPrivate::pixelStorei(GC3Denum paramName, GC3Dint param)
+{
+    makeContextCurrent();
+    m_api->glPixelStorei(paramName, param);
+}
+
+void GraphicsContext3DPrivate::polygonOffset(GC3Dfloat factor, GC3Dfloat units)
+{
+    makeContextCurrent();
+    m_api->glPolygonOffset(factor, units);
+}
+
+void GraphicsContext3DPrivate::readPixels(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, void* data)
+{
+    makeContextCurrent();
+
+    m_api->glFlush();
+    m_api->glReadPixels(x, y, width, height, format, type, data);
+}
+
+void GraphicsContext3DPrivate::renderbufferStorage(GC3Denum target, GC3Denum internalFormat, GC3Dsizei width, GC3Dsizei height)
+{
+    makeContextCurrent();
+    m_api->glRenderbufferStorage(target, internalFormat, width, height);
+}
+
+void GraphicsContext3DPrivate::sampleCoverage(GC3Dclampf value, GC3Dboolean invert)
+{
+    makeContextCurrent();
+    m_api->glSampleCoverage(value, invert);
+}
+
+void GraphicsContext3DPrivate::scissor(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height)
+{
+    makeContextCurrent();
+    m_api->glScissor(x, y, width, height);
+}
+
+void GraphicsContext3DPrivate::shaderSource(Platform3DObject shader, const String& string)
+{
+    makeContextCurrent();
+    const char* str = string.utf8().data();
+    int length = string.length();
+    m_api->glShaderSource(shader, 1, &str, &length);
+}
+
+void GraphicsContext3DPrivate::stencilFunc(GC3Denum func, GC3Dint ref, GC3Duint mask)
+{
+    makeContextCurrent();
+    m_api->glStencilFunc(func, ref, mask);
+}
+
+void GraphicsContext3DPrivate::stencilFuncSeparate(GC3Denum face, GC3Denum func, GC3Dint ref, GC3Duint mask)
+{
+    makeContextCurrent();
+    m_api->glStencilFuncSeparate(face, func, ref, mask);
+}
+
+void GraphicsContext3DPrivate::stencilMask(GC3Duint mask)
+{
+    makeContextCurrent();
+    m_api->glStencilMask(mask);
+}
+
+void GraphicsContext3DPrivate::stencilMaskSeparate(GC3Denum face, GC3Duint mask)
+{
+    makeContextCurrent();
+    m_api->glStencilMaskSeparate(face, mask);
+}
+
+void GraphicsContext3DPrivate::stencilOp(GC3Denum fail, GC3Denum zFail, GC3Denum zPass)
+{
+    makeContextCurrent();
+    m_api->glStencilOp(fail, zFail, zPass);
+}
+
+void GraphicsContext3DPrivate::stencilOpSeparate(GC3Denum face, GC3Denum fail, GC3Denum zFail, GC3Denum zPass)
+{
+    makeContextCurrent();
+    m_api->glStencilOpSeparate(face, fail, zFail, zPass);
+}
+
+bool GraphicsContext3DPrivate::texImage2D(GC3Denum target, GC3Dint level, GC3Denum internalFormat, GC3Dsizei width, GC3Dsizei height, GC3Dint border, GC3Denum format, GC3Denum type, const void* pixels)
+{
+    makeContextCurrent();
+    m_api->glTexImage2D(target, level, internalFormat, width, height, border, format, type, pixels);
+    return true;
+}
+
+void GraphicsContext3DPrivate::texParameterf(GC3Denum target, GC3Denum paramName, GC3Dfloat param)
+{
+    makeContextCurrent();
+    m_api->glTexParameterf(target, paramName, param);
+}
+
+void GraphicsContext3DPrivate::texParameteri(GC3Denum target, GC3Denum paramName, GC3Dint param)
+{
+    makeContextCurrent();
+    m_api->glTexParameteri(target, paramName, param);
+}
+
+void GraphicsContext3DPrivate::texSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xOffset, GC3Dint yOffset, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, const void* pixels)
+{
+    makeContextCurrent();
+    m_api->glTexSubImage2D(target, level, xOffset, yOffset, width, height, format, type, pixels);
+}
+
+void GraphicsContext3DPrivate::uniform1f(GC3Dint location, GC3Dfloat x)
+{
+    makeContextCurrent();
+    m_api->glUniform1f(location, x);
+}
+
+void GraphicsContext3DPrivate::uniform1fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
+{
+    makeContextCurrent();
+    m_api->glUniform1fv(location, size, array);
+}
+
+void GraphicsContext3DPrivate::uniform1i(GC3Dint location, GC3Dint x)
+{
+    makeContextCurrent();
+    m_api->glUniform1i(location, x);
+}
+
+void GraphicsContext3DPrivate::uniform1iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
+{
+    makeContextCurrent();
+    m_api->glUniform1iv(location, size, array);
+}
+
+void GraphicsContext3DPrivate::uniform2f(GC3Dint location, GC3Dfloat x, GC3Dfloat y)
+{
+    makeContextCurrent();
+    m_api->glUniform2f(location, x, y);
+}
+
+void GraphicsContext3DPrivate::uniform2fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
+{
+    makeContextCurrent();
+    m_api->glUniform2fv(location, size, array);
+}
+
+void GraphicsContext3DPrivate::uniform2i(GC3Dint location, GC3Dint x, GC3Dint y)
+{
+    makeContextCurrent();
+    m_api->glUniform2i(location, x, y);
+}
+
+void GraphicsContext3DPrivate::uniform2iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
+{
+    makeContextCurrent();
+    m_api->glUniform2iv(location, size, array);
+}
+
+void GraphicsContext3DPrivate::uniform3f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z)
+{
+    makeContextCurrent();
+    m_api->glUniform3f(location, x, y, z);
+}
+
+void GraphicsContext3DPrivate::uniform3fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
+{
+    makeContextCurrent();
+    m_api->glUniform3fv(location, size, array);
+}
+
+void GraphicsContext3DPrivate::uniform3i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z)
+{
+    makeContextCurrent();
+    m_api->glUniform3i(location, x, y, z);
+}
+
+void GraphicsContext3DPrivate::uniform3iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
+{
+    makeContextCurrent();
+    m_api->glUniform3iv(location, size, array);
+}
+
+void GraphicsContext3DPrivate::uniform4f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z, GC3Dfloat w)
+{
+    makeContextCurrent();
+    m_api->glUniform4f(location, x, y, z, w);
+}
+
+void GraphicsContext3DPrivate::uniform4fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
+{
+    makeContextCurrent();
+    m_api->glUniform4fv(location, size, array);
+}
+
+void GraphicsContext3DPrivate::uniform4i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z, GC3Dint w)
+{
+    makeContextCurrent();
+    m_api->glUniform4i(location, x, y, z, w);
+}
+
+void GraphicsContext3DPrivate::uniform4iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
+{
+    makeContextCurrent();
+    m_api->glUniform4iv(location, size, array);
+}
+
+void GraphicsContext3DPrivate::uniformMatrix2fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
+{
+    makeContextCurrent();
+    m_api->glUniformMatrix2fv(location, size, transpose, value);
+}
+
+void GraphicsContext3DPrivate::uniformMatrix3fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
+{
+    makeContextCurrent();
+    m_api->glUniformMatrix3fv(location, size, transpose, value);
+}
+
+void GraphicsContext3DPrivate::uniformMatrix4fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* value)
+{
+    makeContextCurrent();
+    m_api->glUniformMatrix4fv(location, size, transpose, value);
+}
+
+void GraphicsContext3DPrivate::useProgram(Platform3DObject program)
+{
+    makeContextCurrent();
+    m_api->glUseProgram(program);
+}
+
+void GraphicsContext3DPrivate::validateProgram(Platform3DObject program)
+{
+    makeContextCurrent();
+    m_api->glValidateProgram(program);
+}
+
+void GraphicsContext3DPrivate::vertexAttrib1f(GC3Duint index, GC3Dfloat x)
+{
+    makeContextCurrent();
+    m_api->glVertexAttrib1f(index, x);
+}
+
+void GraphicsContext3DPrivate::vertexAttrib1fv(GC3Duint index, GC3Dfloat* values)
+{
+    makeContextCurrent();
+    m_api->glVertexAttrib1fv(index, values);
+}
+
+void GraphicsContext3DPrivate::vertexAttrib2f(GC3Duint index, GC3Dfloat x, GC3Dfloat y)
+{
+    makeContextCurrent();
+    m_api->glVertexAttrib2f(index, x, y);
+}
+
+void GraphicsContext3DPrivate::vertexAttrib2fv(GC3Duint index, GC3Dfloat* values)
+{
+    makeContextCurrent();
+    m_api->glVertexAttrib2fv(index, values);
+}
+
+void GraphicsContext3DPrivate::vertexAttrib3f(GC3Duint index, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z)
+{
+    makeContextCurrent();
+    m_api->glVertexAttrib3f(index, x, y, z);
+}
+
+void GraphicsContext3DPrivate::vertexAttrib3fv(GC3Duint index, GC3Dfloat* values)
+{
+    makeContextCurrent();
+    m_api->glVertexAttrib3fv(index, values);
+}
+
+void GraphicsContext3DPrivate::vertexAttrib4f(GC3Duint index, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z, GC3Dfloat w)
+{
+    makeContextCurrent();
+    m_api->glVertexAttrib4f(index, x, y, z, w);
+}
+
+void GraphicsContext3DPrivate::vertexAttrib4fv(GC3Duint index, GC3Dfloat* values)
+{
+    makeContextCurrent();
+    m_api->glVertexAttrib4fv(index, values);
+}
+
+void GraphicsContext3DPrivate::vertexAttribPointer(GC3Duint index, GC3Dint size, GC3Denum type, GC3Dboolean normalized, GC3Dsizei stride, GC3Dintptr offset)
+{
+    makeContextCurrent();
+
+    if (m_boundArrayBuffer <= 0)
+        return;
+
+    m_api->glVertexAttribPointer(index, size, type, normalized, stride, reinterpret_cast<GLvoid*>(static_cast<intptr_t>(offset)));
+}
+
+void GraphicsContext3DPrivate::viewport(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height)
+{
+    makeContextCurrent();
+    m_api->glViewport(x, y, width, height);
+}
+
+Platform3DObject GraphicsContext3DPrivate::createBuffer()
+{
+    makeContextCurrent();
+    Platform3DObject buffer = 0;
+    m_api->glGenBuffers(1, &buffer);
+    return buffer;
+}
+
+Platform3DObject GraphicsContext3DPrivate::createFramebuffer()
+{
+    makeContextCurrent();
+    Platform3DObject buffer = 0;
+    m_api->glGenFramebuffers(1, &buffer);
+    return buffer;
+}
+
+Platform3DObject GraphicsContext3DPrivate::createProgram()
+{
+    makeContextCurrent();
+    return m_api->glCreateProgram();
+}
+
+Platform3DObject GraphicsContext3DPrivate::createRenderbuffer()
+{
+    makeContextCurrent();
+    Platform3DObject buffer;
+    m_api->glGenRenderbuffers(1, &buffer);
+    return buffer;
+}
+
+Platform3DObject GraphicsContext3DPrivate::createShader(GC3Denum shaderType)
+{
+    makeContextCurrent();
+    return m_api->glCreateShader(shaderType);
+}
+
+Platform3DObject GraphicsContext3DPrivate::createTexture()
+{
+    makeContextCurrent();
+    Platform3DObject texture;
+    m_api->glGenTextures(1, &texture);
+    return texture;
+}
+
+void GraphicsContext3DPrivate::deleteBuffer(Platform3DObject buffer)
+{
+    makeContextCurrent();
+    m_api->glDeleteBuffers(1, &buffer);
+}
+
+void GraphicsContext3DPrivate::deleteFramebuffer(Platform3DObject framebuffer)
+{
+    makeContextCurrent();
+    m_api->glDeleteFramebuffers(1, &framebuffer);
+}
+
+void GraphicsContext3DPrivate::deleteProgram(Platform3DObject program)
+{
+    makeContextCurrent();
+    m_api->glDeleteProgram(program);
+}
+
+void GraphicsContext3DPrivate::deleteRenderbuffer(Platform3DObject renderbuffer)
+{
+    makeContextCurrent();
+    m_api->glDeleteRenderbuffers(1, &renderbuffer);
+}
+
+void GraphicsContext3DPrivate::deleteShader(Platform3DObject shader)
+{
+    makeContextCurrent();
+    m_api->glDeleteShader(shader);
+}
+
+void GraphicsContext3DPrivate::deleteTexture(Platform3DObject texture)
+{
+    makeContextCurrent();
+    m_api->glDeleteTextures(1, &texture);
+}
+
+void GraphicsContext3DPrivate::synthesizeGLError(GC3Denum error)
+{
+    m_syntheticErrors.add(error);
+}
+
+Extensions3D* GraphicsContext3DPrivate::getExtensions()
+{
+    notImplemented();
+    return 0;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEBGL) || USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.h b/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.h
new file mode 100644
index 000000000..d02b87845
--- /dev/null
+++ b/Source/WebCore/platform/graphics/efl/GraphicsContext3DPrivate.h
@@ -0,0 +1,227 @@
+/*
+    Copyright (C) 2012 Samsung Electronics
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef GraphicsContext3DPrivate_h
+#define GraphicsContext3DPrivate_h
+
+#include "GraphicsContext3D.h"
+
+#include <Evas_GL.h>
+
+namespace WebCore {
+
+class PageClientEfl;
+
+class GraphicsContext3DPrivate {
+public:
+    static PassOwnPtr<GraphicsContext3DPrivate> create(GraphicsContext3D::Attributes attrs, HostWindow*, bool renderDirectlyToEvasGLObject);
+    ~GraphicsContext3DPrivate();
+
+    PlatformGraphicsContext3D platformGraphicsContext3D() const;
+
+#if USE(ACCELERATED_COMPOSITING)
+    PlatformLayer* platformLayer() const;
+#endif
+
+    bool makeContextCurrent();
+
+    bool isGLES2Compliant() const;
+
+    void activeTexture(GC3Denum texture);
+    void attachShader(Platform3DObject program, Platform3DObject shader);
+    void bindAttribLocation(Platform3DObject, GC3Duint index, const String& name);
+    void bindBuffer(GC3Denum target, Platform3DObject);
+    void bindFramebuffer(GC3Denum target, Platform3DObject);
+    void bindRenderbuffer(GC3Denum target, Platform3DObject);
+    void bindTexture(GC3Denum target, Platform3DObject);
+    void blendColor(GC3Dclampf red, GC3Dclampf green, GC3Dclampf blue, GC3Dclampf alpha);
+    void blendEquation(GC3Denum mode);
+    void blendEquationSeparate(GC3Denum modeRGB, GC3Denum modeAlpha);
+    void blendFunc(GC3Denum srcFactor, GC3Denum dstFactor);
+    void blendFuncSeparate(GC3Denum srcRGB, GC3Denum dstRGB, GC3Denum srcAlpha, GC3Denum dstAlpha);
+
+    void bufferData(GC3Denum target, GC3Dsizeiptr, const void* data, GC3Denum usage);
+    void bufferSubData(GC3Denum target, GC3Dintptr offset, GC3Dsizeiptr, const void* data);
+
+    GC3Denum checkFramebufferStatus(GC3Denum target);
+    void clear(GC3Dbitfield mask);
+    void clearColor(GC3Dclampf red, GC3Dclampf green, GC3Dclampf blue, GC3Dclampf alpha);
+    void clearDepth(GC3Dclampf depth);
+    void clearStencil(GC3Dint clearValue);
+    void colorMask(GC3Dboolean red, GC3Dboolean green, GC3Dboolean blue, GC3Dboolean alpha);
+    void compileShader(Platform3DObject);
+
+    void copyTexImage2D(GC3Denum target, GC3Dint level, GC3Denum internalFormat, GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height, GC3Dint border);
+    void copyTexSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xOffset, GC3Dint yOffset, GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height);
+    void cullFace(GC3Denum mode);
+    void depthFunc(GC3Denum func);
+    void depthMask(GC3Dboolean flag);
+    void depthRange(GC3Dclampf zNear, GC3Dclampf zFar);
+    void detachShader(Platform3DObject, Platform3DObject);
+    void disable(GC3Denum cap);
+    void disableVertexAttribArray(GC3Duint index);
+    void drawArrays(GC3Denum mode, GC3Dint first, GC3Dsizei count);
+    void drawElements(GC3Denum mode, GC3Dsizei count, GC3Denum type, GC3Dintptr offset);
+
+    void enable(GC3Denum cap);
+    void enableVertexAttribArray(GC3Duint index);
+    void finish();
+    void flush();
+    void framebufferRenderbuffer(GC3Denum target, GC3Denum attachment, GC3Denum renderbufferTarget, Platform3DObject);
+    void framebufferTexture2D(GC3Denum target, GC3Denum attachment, GC3Denum texTarget, Platform3DObject, GC3Dint level);
+    void frontFace(GC3Denum mode);
+    void generateMipmap(GC3Denum target);
+
+    bool getActiveAttrib(Platform3DObject program, GC3Duint index, ActiveInfo&);
+    bool getActiveUniform(Platform3DObject program, GC3Duint index, ActiveInfo&);
+    void getAttachedShaders(Platform3DObject program, GC3Dsizei maxCount, GC3Dsizei* count, Platform3DObject* shaders);
+    GC3Dint getAttribLocation(Platform3DObject, const String& name);
+    void getBooleanv(GC3Denum paramName, GC3Dboolean* value);
+    void getBufferParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value);
+    GraphicsContext3D::Attributes getContextAttributes();
+    GC3Denum getError();
+    void getFloatv(GC3Denum paramName, GC3Dfloat* value);
+    void getFramebufferAttachmentParameteriv(GC3Denum target, GC3Denum attachment, GC3Denum paramName, GC3Dint* value);
+    void getIntegerv(GC3Denum paramName, GC3Dint* value);
+    void getProgramiv(Platform3DObject program, GC3Denum paramName, GC3Dint* value);
+    String getProgramInfoLog(Platform3DObject);
+    void getRenderbufferParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value);
+    void getShaderiv(Platform3DObject, GC3Denum paramName, GC3Dint* value);
+    String getShaderInfoLog(Platform3DObject);
+
+    String getShaderSource(Platform3DObject);
+    String getString(GC3Denum name);
+    void getTexParameterfv(GC3Denum target, GC3Denum paramName, GC3Dfloat* value);
+    void getTexParameteriv(GC3Denum target, GC3Denum paramName, GC3Dint* value);
+    void getUniformfv(Platform3DObject program, GC3Dint location, GC3Dfloat* value);
+    void getUniformiv(Platform3DObject program, GC3Dint location, GC3Dint* value);
+    GC3Dint getUniformLocation(Platform3DObject, const String& name);
+    void getVertexAttribfv(GC3Duint index, GC3Denum paramName, GC3Dfloat* value);
+    void getVertexAttribiv(GC3Duint index, GC3Denum paramName, GC3Dint* value);
+    GC3Dsizeiptr getVertexAttribOffset(GC3Duint index, GC3Denum paramName);
+
+    void hint(GC3Denum target, GC3Denum mode);
+    GC3Dboolean isBuffer(Platform3DObject);
+    GC3Dboolean isEnabled(GC3Denum cap);
+    GC3Dboolean isFramebuffer(Platform3DObject);
+    GC3Dboolean isProgram(Platform3DObject);
+    GC3Dboolean isRenderbuffer(Platform3DObject);
+    GC3Dboolean isShader(Platform3DObject);
+    GC3Dboolean isTexture(Platform3DObject);
+    void lineWidth(GC3Dfloat);
+    void linkProgram(Platform3DObject);
+    void pixelStorei(GC3Denum paramName, GC3Dint param);
+    void polygonOffset(GC3Dfloat factor, GC3Dfloat units);
+
+    void readPixels(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, void* data);
+
+    void renderbufferStorage(GC3Denum target, GC3Denum internalFormat, GC3Dsizei width, GC3Dsizei height);
+    void sampleCoverage(GC3Dclampf value, GC3Dboolean invert);
+    void scissor(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height);
+    void shaderSource(Platform3DObject, const String&);
+    void stencilFunc(GC3Denum func, GC3Dint ref, GC3Duint mask);
+    void stencilFuncSeparate(GC3Denum face, GC3Denum func, GC3Dint ref, GC3Duint mask);
+    void stencilMask(GC3Duint mask);
+    void stencilMaskSeparate(GC3Denum face, GC3Duint mask);
+    void stencilOp(GC3Denum fail, GC3Denum zFail, GC3Denum zPass);
+    void stencilOpSeparate(GC3Denum face, GC3Denum fail, GC3Denum zFail, GC3Denum zPass);
+
+    bool texImage2D(GC3Denum target, GC3Dint level, GC3Denum internalFormat, GC3Dsizei width, GC3Dsizei height, GC3Dint border, GC3Denum format, GC3Denum type, const void* pixels);
+    void texParameterf(GC3Denum target, GC3Denum paramName, GC3Dfloat param);
+    void texParameteri(GC3Denum target, GC3Denum paramName, GC3Dint param);
+    void texSubImage2D(GC3Denum target, GC3Dint level, GC3Dint xOffset, GC3Dint yOffset, GC3Dsizei width, GC3Dsizei height, GC3Denum format, GC3Denum type, const void* pixels);
+
+    void uniform1f(GC3Dint location, GC3Dfloat x);
+    void uniform1fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
+    void uniform1i(GC3Dint location, GC3Dint x);
+    void uniform1iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
+    void uniform2f(GC3Dint location, GC3Dfloat x, float y);
+    void uniform2fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
+    void uniform2i(GC3Dint location, GC3Dint x, GC3Dint y);
+    void uniform2iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
+    void uniform3f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z);
+    void uniform3fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
+    void uniform3i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z);
+    void uniform3iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
+    void uniform4f(GC3Dint location, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z, GC3Dfloat w);
+    void uniform4fv(GC3Dint location, GC3Dsizei, GC3Dfloat* v);
+    void uniform4i(GC3Dint location, GC3Dint x, GC3Dint y, GC3Dint z, GC3Dint w);
+    void uniform4iv(GC3Dint location, GC3Dsizei, GC3Dint* v);
+    void uniformMatrix2fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
+    void uniformMatrix3fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
+    void uniformMatrix4fv(GC3Dint location, GC3Dsizei, GC3Dboolean transpose, GC3Dfloat* value);
+
+    void useProgram(Platform3DObject);
+    void validateProgram(Platform3DObject);
+
+    void vertexAttrib1f(GC3Duint index, GC3Dfloat x);
+    void vertexAttrib1fv(GC3Duint index, GC3Dfloat* values);
+    void vertexAttrib2f(GC3Duint index, GC3Dfloat x, GC3Dfloat y);
+    void vertexAttrib2fv(GC3Duint index, GC3Dfloat* values);
+    void vertexAttrib3f(GC3Duint index, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z);
+    void vertexAttrib3fv(GC3Duint index, GC3Dfloat* values);
+    void vertexAttrib4f(GC3Duint index, GC3Dfloat x, GC3Dfloat y, GC3Dfloat z, GC3Dfloat w);
+    void vertexAttrib4fv(GC3Duint index, GC3Dfloat* values);
+    void vertexAttribPointer(GC3Duint index, GC3Dint size, GC3Denum type, GC3Dboolean normalized,
+                             GC3Dsizei stride, GC3Dintptr offset);
+
+    void viewport(GC3Dint x, GC3Dint y, GC3Dsizei width, GC3Dsizei height);
+
+    Platform3DObject createBuffer();
+    Platform3DObject createFramebuffer();
+    Platform3DObject createProgram();
+    Platform3DObject createRenderbuffer();
+    Platform3DObject createShader(GC3Denum);
+    Platform3DObject createTexture();
+
+    void deleteBuffer(Platform3DObject);
+    void deleteFramebuffer(Platform3DObject);
+    void deleteProgram(Platform3DObject);
+    void deleteRenderbuffer(Platform3DObject);
+    void deleteShader(Platform3DObject);
+    void deleteTexture(Platform3DObject);
+
+    void synthesizeGLError(GC3Denum error);
+
+    Extensions3D* getExtensions();
+
+private:
+    GraphicsContext3DPrivate();
+
+    bool initialize(GraphicsContext3D::Attributes attrs, HostWindow*, bool renderDirectlyToHostWindow);
+
+    bool createSurface(PageClientEfl*, bool renderDirectlyToEvasGLObject);
+
+    GraphicsContext3D::Attributes m_attributes;
+
+    Platform3DObject m_boundFBO;
+    Platform3DObject m_boundTexture;
+    Platform3DObject m_boundArrayBuffer;
+
+    ListHashSet<GC3Denum> m_syntheticErrors;
+
+    Evas_GL* m_evasGL;
+    Evas_GL_Context* m_context;
+    Evas_GL_Surface* m_surface;
+    Evas_GL_API* m_api;
+};
+
+} // namespace WebCore
+
+#endif // GraphicsLayerEfl_h
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp
index 40ec330d4..c3a986815 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterMesh.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterMesh.h b/Source/WebCore/platform/graphics/filters/CustomFilterMesh.h
index b557d3eaf..46f37f361 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterMesh.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterMesh.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterNumberParameter.h b/Source/WebCore/platform/graphics/filters/CustomFilterNumberParameter.h
index 36568d59a..0ade173f2 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterNumberParameter.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterNumberParameter.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterOperation.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterOperation.cpp
index 93af2b73a..c05a40f62 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterOperation.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterOperation.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterOperation.h b/Source/WebCore/platform/graphics/filters/CustomFilterOperation.h
index 66eb2c8b1..4d8392682 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterOperation.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterOperation.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterParameter.h b/Source/WebCore/platform/graphics/filters/CustomFilterParameter.h
index cd8cb8805..e9c062952 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterParameter.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterParameter.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
index d257f3f83..130441a1c 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
index 8c9056d39..84e6c205a 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgram.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterProgramClient.h b/Source/WebCore/platform/graphics/filters/CustomFilterProgramClient.h
index 488247d9f..3b0b7c054 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterProgramClient.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterProgramClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterShader.cpp b/Source/WebCore/platform/graphics/filters/CustomFilterShader.cpp
index cacfeb615..8ef66cfa3 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterShader.cpp
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterShader.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/CustomFilterShader.h b/Source/WebCore/platform/graphics/filters/CustomFilterShader.h
index 6141c18c7..af35bb1cf 100644
--- a/Source/WebCore/platform/graphics/filters/CustomFilterShader.h
+++ b/Source/WebCore/platform/graphics/filters/CustomFilterShader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/FEComposite.cpp b/Source/WebCore/platform/graphics/filters/FEComposite.cpp
index fbc2c1671..5be22f8e2 100644
--- a/Source/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/Source/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -116,6 +116,14 @@ bool FEComposite::setK4(float k4)
     return true;
 }
 
+void FEComposite::correctFilterResultIfNeeded()
+{
+    if (m_type != FECOMPOSITE_OPERATOR_ARITHMETIC)
+        return;
+
+    forceValidPreMultipliedPixels();
+}
+
 template <int b1, int b2, int b3, int b4>
 static inline void computeArithmeticPixels(unsigned char* source, unsigned char* destination, int pixelArrayLength,
                                     float k1, float k2, float k3, float k4)
diff --git a/Source/WebCore/platform/graphics/filters/FEComposite.h b/Source/WebCore/platform/graphics/filters/FEComposite.h
index 35f2505e3..24ba3078f 100644
--- a/Source/WebCore/platform/graphics/filters/FEComposite.h
+++ b/Source/WebCore/platform/graphics/filters/FEComposite.h
@@ -59,6 +59,8 @@ public:
     float k4() const;
     bool setK4(float);
 
+    virtual void correctFilterResultIfNeeded() OVERRIDE;
+
     virtual void platformApplySoftware();
     virtual void dump();
     
@@ -66,6 +68,9 @@ public:
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
+protected:
+    virtual bool requiresValidPreMultipliedPixels() OVERRIDE { return m_type != FECOMPOSITE_OPERATOR_ARITHMETIC; }
+
 private:
     FEComposite(Filter*, const CompositeOperationType&, float, float, float, float);
 
diff --git a/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp b/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
index 95f51fc9b..9bf2495c0 100644
--- a/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
+++ b/Source/WebCore/platform/graphics/filters/FECustomFilter.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -229,7 +229,7 @@ void FECustomFilter::bindProgramAndBuffers(ByteArray* srcPixelArray)
         orthogonalProjectionMatrix(projectionMatrix, -0.5, 0.5, -0.5, 0.5);
         float glProjectionMatrix[16];
         projectionMatrix.toColumnMajorFloatArray(glProjectionMatrix);
-        m_context->uniformMatrix4fv(m_shader->projectionMatrixLocation(), false, &glProjectionMatrix[0], 1);
+        m_context->uniformMatrix4fv(m_shader->projectionMatrixLocation(), 1, false, &glProjectionMatrix[0]);
     }
     
     m_context->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, m_mesh->verticesBufferObject());
diff --git a/Source/WebCore/platform/graphics/filters/FECustomFilter.h b/Source/WebCore/platform/graphics/filters/FECustomFilter.h
index 1fa2d292a..c977c8591 100644
--- a/Source/WebCore/platform/graphics/filters/FECustomFilter.h
+++ b/Source/WebCore/platform/graphics/filters/FECustomFilter.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/platform/graphics/filters/FEDropShadow.cpp b/Source/WebCore/platform/graphics/filters/FEDropShadow.cpp
index 5944feca5..3dd5a2763 100644
--- a/Source/WebCore/platform/graphics/filters/FEDropShadow.cpp
+++ b/Source/WebCore/platform/graphics/filters/FEDropShadow.cpp
@@ -103,7 +103,7 @@ void FEDropShadow::platformApplySoftware()
     ShadowBlur contextShadow(blurRadius, offset, m_shadowColor, ColorSpaceDeviceRGB);
 
     // TODO: Direct pixel access to ImageBuffer would avoid copying the ImageData.
-    IntRect shadowArea(IntPoint(), resultImage->size());
+    IntRect shadowArea(IntPoint(), resultImage->internalSize());
     RefPtr<ByteArray> srcPixelArray = resultImage->getPremultipliedImageData(shadowArea);
 
     contextShadow.blurLayerImage(srcPixelArray->data(), shadowArea.size(), 4 * shadowArea.size().width());
diff --git a/Source/WebCore/platform/graphics/filters/FilterEffect.cpp b/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
index f972c98a4..9bf1689f7 100644
--- a/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
+++ b/Source/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -102,6 +102,11 @@ void FilterEffect::apply()
             return;
     }
     determineAbsolutePaintRect();
+
+    if (requiresValidPreMultipliedPixels()) {
+        for (unsigned i = 0; i < size; ++i)
+            inputEffect(i)->correctFilterResultIfNeeded();
+    }
     
     // Add platform specific apply functions here and return earlier.
 #if USE(SKIA)
@@ -111,6 +116,35 @@ void FilterEffect::apply()
     platformApplySoftware();
 }
 
+void FilterEffect::forceValidPreMultipliedPixels()
+{
+    // Must operate on pre-multiplied results; other formats cannot have invalid pixels.
+    if (!m_premultipliedImageResult)
+        return;
+
+    ByteArray* imageArray = m_premultipliedImageResult.get();
+    unsigned char* pixelData = imageArray->data();
+    int pixelArrayLength = imageArray->length();
+
+    // We must have four bytes per pixel, and complete pixels
+    ASSERT(!(pixelArrayLength % 4));
+    int numPixels = pixelArrayLength / 4;
+
+    // Iterate over each pixel, checking alpha and adjusting color components if necessary
+    while (--numPixels >= 0) {
+        // Alpha is the 4th byte in a pixel
+        unsigned char a = *(pixelData + 3);
+        // Clamp each component to alpha, and increment the pixel location
+        for (int i = 0; i < 3; ++i) {
+            if (*pixelData > a)
+                *pixelData = a;
+            ++pixelData;
+        }
+        // Increment for alpha
+        ++pixelData;
+    }
+}
+
 void FilterEffect::clearResult()
 {
     if (m_imageBufferResult)
@@ -127,7 +161,7 @@ ImageBuffer* FilterEffect::asImageBuffer()
         return 0;
     if (m_imageBufferResult)
         return m_imageBufferResult.get();
-    m_imageBufferResult = ImageBuffer::create(m_absolutePaintRect.size(), ColorSpaceLinearRGB, m_filter->renderingMode());
+    m_imageBufferResult = ImageBuffer::create(m_absolutePaintRect.size(), 1, ColorSpaceLinearRGB, m_filter->renderingMode());
     IntRect destinationRect(IntPoint(), m_absolutePaintRect.size());
     if (m_premultipliedImageResult)
         m_imageBufferResult->putByteArray(Premultiplied, m_premultipliedImageResult.get(), destinationRect.size(), destinationRect, IntPoint());
@@ -264,7 +298,7 @@ ImageBuffer* FilterEffect::createImageBufferResult()
     ASSERT(!hasResult());
     if (m_absolutePaintRect.isEmpty())
         return 0;
-    m_imageBufferResult = ImageBuffer::create(m_absolutePaintRect.size(), ColorSpaceLinearRGB, m_filter->renderingMode());
+    m_imageBufferResult = ImageBuffer::create(m_absolutePaintRect.size(), 1, ColorSpaceLinearRGB, m_filter->renderingMode());
     if (!m_imageBufferResult)
         return 0;
     ASSERT(m_imageBufferResult->context());
diff --git a/Source/WebCore/platform/graphics/filters/FilterEffect.h b/Source/WebCore/platform/graphics/filters/FilterEffect.h
index 1bae4ca0a..8b4ad6f92 100644
--- a/Source/WebCore/platform/graphics/filters/FilterEffect.h
+++ b/Source/WebCore/platform/graphics/filters/FilterEffect.h
@@ -86,6 +86,11 @@ public:
 
     void apply();
     
+    // Correct any invalid pixels, if necessary, in the result of a filter operation.
+    // This method is used to ensure valid pixel values on filter inputs and the final result.
+    // Only the arithmetic composite filter ever needs to perform correction.
+    virtual void correctFilterResultIfNeeded() { }
+
     virtual void platformApplySoftware() = 0;
 #if USE(SKIA)
     virtual bool platformApplySkia() { return false; }
@@ -131,6 +136,13 @@ protected:
     ByteArray* createUnmultipliedImageResult();
     ByteArray* createPremultipliedImageResult();
 
+    // Return true if the filter will only operate correctly on valid RGBA values, with
+    // alpha in [0,255] and each color component in [0, alpha].
+    virtual bool requiresValidPreMultipliedPixels() { return true; }
+
+    // If a pre-multiplied image, check every pixel for validity and correct if necessary.
+    void forceValidPreMultipliedPixels();
+
 private:
     OwnPtr<ImageBuffer> m_imageBufferResult;
     RefPtr<ByteArray> m_unmultipliedImageResult;
diff --git a/Source/WebCore/platform/graphics/glx/GLContextGLX.cpp b/Source/WebCore/platform/graphics/glx/GLContextGLX.cpp
new file mode 100644
index 000000000..cdced6832
--- /dev/null
+++ b/Source/WebCore/platform/graphics/glx/GLContextGLX.cpp
@@ -0,0 +1,308 @@
+/*
+ * Copyright (C) 2011, 2012 Igalia, S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "GLContext.h"
+
+#if ENABLE(WEBGL) || USE(TEXTURE_MAPPER_GL)
+#include "GraphicsContext3D.h"
+#include "OpenGLShims.h"
+#include <GL/glx.h>
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+// We do not want to call glXMakeContextCurrent using different Display pointers,
+// because it might lead to crashes in some drivers (fglrx). We use a shared display
+// pointer here.
+static Display* gSharedDisplay = 0;
+static Display* sharedDisplay()
+{
+    if (!gSharedDisplay)
+        gSharedDisplay = XOpenDisplay(0);
+    return gSharedDisplay;
+}
+
+// Because of driver bugs, exiting the program when there are active pbuffers
+// can crash the X server (this has been observed with the official Nvidia drivers).
+// We need to ensure that we clean everything up on exit. There are several reasons
+// that GraphicsContext3Ds will still be alive at exit, including user error (memory
+// leaks) and the page cache. In any case, we don't want the X server to crash.
+typedef Vector<GLContext*> ActiveContextList;
+static ActiveContextList& activeContextList()
+{
+    DEFINE_STATIC_LOCAL(ActiveContextList, activeContexts, ());
+    return activeContexts;
+}
+
+void GLContext::addActiveContext(GLContext* context)
+{
+    static bool addedAtExitHandler = false;
+    if (!addedAtExitHandler) {
+        atexit(&GLContext::cleanupActiveContextsAtExit);
+        addedAtExitHandler = true;
+    }
+    activeContextList().append(context);
+}
+
+void GLContext::removeActiveContext(GLContext* context)
+{
+    ActiveContextList& contextList = activeContextList();
+    size_t i = contextList.find(context);
+    if (i != notFound)
+        contextList.remove(i);
+}
+
+void GLContext::cleanupActiveContextsAtExit()
+{
+    ActiveContextList& contextList = activeContextList();
+    for (size_t i = 0; i < contextList.size(); ++i)
+        delete contextList[i];
+
+    if (!gSharedDisplay)
+        return;
+    XCloseDisplay(gSharedDisplay);
+    gSharedDisplay = 0;
+}
+
+GLContext* GLContext::getCurrent()
+{
+    ActiveContextList& contextList = activeContextList();
+    GLXContext current = glXGetCurrentContext();
+    for (size_t i = 0; i < contextList.size(); ++i) {
+        if (current == contextList[i]->m_context)
+            return contextList[i];
+    }
+    return 0;
+}
+
+GLContext* GLContext::createSharingContext(GLContext* sharingContext)
+{
+    return createContext(0, sharingContext ? sharingContext->m_context : 0);
+}
+
+GLContext* GLContext::createWindowContext(XID window, GLXContext sharingContext)
+{
+    Display* display = sharedDisplay();
+    XWindowAttributes attributes;
+    if (!XGetWindowAttributes(display, window, &attributes))
+        return 0;
+
+    XVisualInfo visualInfo;
+    visualInfo.visualid = XVisualIDFromVisual(attributes.visual);
+
+    int numReturned = 0;
+    XVisualInfo* visualInfoList = XGetVisualInfo(display, VisualIDMask, &visualInfo, &numReturned);
+    GLXContext context = glXCreateContext(display, visualInfoList, sharingContext, True);
+    XFree(visualInfoList);
+
+    if (!context)
+        return 0;
+
+    // GLXPbuffer and XID are both the same types underneath, so we have to share
+    // a constructor here with the window path.
+    GLContext* contextWrapper = new GLContext(context);
+    contextWrapper->m_window = window;
+    return contextWrapper;
+}
+
+GLContext* GLContext::createPbufferContext(GLXContext sharingContext)
+{
+    int fbConfigAttributes[] = {
+        GLX_DRAWABLE_TYPE, GLX_PBUFFER_BIT,
+        GLX_RENDER_TYPE, GLX_RGBA_BIT,
+        GLX_RED_SIZE, 1,
+        GLX_GREEN_SIZE, 1,
+        GLX_BLUE_SIZE, 1,
+        GLX_ALPHA_SIZE, 1,
+        GLX_DOUBLEBUFFER, GL_FALSE,
+        0
+    };
+
+    int returnedElements;
+    Display* display = sharedDisplay();
+    GLXFBConfig* configs = glXChooseFBConfig(display, 0, fbConfigAttributes, &returnedElements);
+    if (!returnedElements) {
+        XFree(configs);
+        return 0;
+    }
+
+    // We will be rendering to a texture, so our pbuffer does not need to be large.
+    static const int pbufferAttributes[] = { GLX_PBUFFER_WIDTH, 1, GLX_PBUFFER_HEIGHT, 1, 0 };
+    GLXPbuffer pbuffer = glXCreatePbuffer(display, configs[0], pbufferAttributes);
+    if (!pbuffer) {
+        XFree(configs);
+        return 0;
+    }
+
+    GLXContext context = glXCreateNewContext(display, configs[0], GLX_RGBA_TYPE, sharingContext, GL_TRUE);
+    XFree(configs);
+    if (!context)
+        return 0;
+
+    // GLXPbuffer and XID are both the same types underneath, so we have to share
+    // a constructor here with the window path.
+    GLContext* contextWrapper = new GLContext(context);
+    contextWrapper->m_pbuffer = pbuffer;
+    return contextWrapper;
+}
+
+GLContext* GLContext::createPixmapContext(GLXContext sharingContext)
+{
+    static int visualAttributes[] = {
+        GLX_RGBA,
+        GLX_RED_SIZE, 1,
+        GLX_GREEN_SIZE, 1,
+        GLX_BLUE_SIZE, 1,
+        GLX_ALPHA_SIZE, 1,
+        0
+    };
+
+    Display* display = sharedDisplay();
+    XVisualInfo* visualInfo = glXChooseVisual(display, DefaultScreen(display), visualAttributes);
+    if (!visualInfo)
+        return 0;
+
+    GLXContext context = glXCreateContext(display, visualInfo, sharingContext, GL_TRUE);
+    if (!context) {
+        XFree(visualInfo);
+        return 0;
+    }
+
+    Pixmap pixmap = XCreatePixmap(display, DefaultRootWindow(display), 1, 1, visualInfo->depth);
+    if (!pixmap) {
+        XFree(visualInfo);
+        return 0;
+    }
+
+    GLXPixmap glxPixmap = glXCreateGLXPixmap(display, visualInfo, pixmap);
+    if (!glxPixmap) {
+        XFreePixmap(display, pixmap);
+        XFree(visualInfo);
+        return 0;
+    }
+
+    return new GLContext(context, pixmap, glxPixmap);
+}
+
+GLContext* GLContext::createContext(XID window, GLXContext sharingContext)
+{
+    if (!sharedDisplay())
+        return 0;
+
+    static bool initialized = false;
+    static bool success = true;
+    if (!initialized) {
+        success = initializeOpenGLShims();
+        initialized = true;
+    }
+    if (!success)
+        return 0;
+
+    GLContext* context = window ? createWindowContext(window, sharingContext) : 0;
+    if (!context)
+        context = createPbufferContext(sharingContext);
+    if (!context)
+        context = createPixmapContext(sharingContext);
+    if (!context)
+        return 0;
+
+    return context;
+}
+
+GLContext::GLContext(GLXContext context)
+    : m_context(context)
+    , m_window(0)
+    , m_pbuffer(0)
+    , m_pixmap(0)
+    , m_glxPixmap(0)
+{
+    addActiveContext(this);
+}
+
+GLContext::GLContext(GLXContext context, Pixmap pixmap, GLXPixmap glxPixmap)
+    : m_context(context)
+    , m_window(0)
+    , m_pbuffer(0)
+    , m_pixmap(pixmap)
+    , m_glxPixmap(glxPixmap)
+{
+    addActiveContext(this);
+}
+
+GLContext::~GLContext()
+{
+    if (m_context) {
+        // This may be necessary to prevent crashes with NVidia's closed source drivers. Originally
+        // from Mozilla's 3D canvas implementation at: http://bitbucket.org/ilmari/canvas3d/
+        glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, 0);
+        glXMakeCurrent(m_display, None, None);
+        glXDestroyContext(m_display, m_context);
+    }
+
+    if (m_pbuffer) {
+        glXDestroyPbuffer(sharedDisplay(), m_pbuffer);
+        m_pbuffer = 0;
+    }
+    if (m_glxPixmap) {
+        glXDestroyGLXPixmap(sharedDisplay(), m_glxPixmap);
+        m_glxPixmap = 0;
+    }
+    if (m_pixmap) {
+        XFreePixmap(sharedDisplay(), m_pixmap);
+        m_pixmap = 0;
+    }
+    removeActiveContext(this);
+}
+
+bool GLContext::canRenderToDefaultFramebuffer()
+{
+    return m_window;
+}
+
+bool GLContext::makeContextCurrent()
+{
+    ASSERT(m_context && (m_window || m_pbuffer || m_glxPixmap));
+    if (glXGetCurrentContext() == m_context)
+        return true;
+
+    if (m_window)
+        return glXMakeCurrent(sharedDisplay(), m_window, m_context);
+
+    if (m_pbuffer)
+        return glXMakeCurrent(sharedDisplay(), m_pbuffer, m_context);
+
+    return ::glXMakeCurrent(sharedDisplay(), m_glxPixmap, m_context);
+}
+
+void GLContext::swapBuffers()
+{
+    if (m_window)
+        glXSwapBuffers(sharedDisplay(), m_window);
+}
+
+#if ENABLE(WEBGL)
+PlatformGraphicsContext3D GLContext::platformContext()
+{
+    return m_context;
+}
+#endif
+
+} // namespace WebCore
+
+#endif // ENABLE(WEBGL) || && USE(TEXTURE_MAPPER_GL)
diff --git a/Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.cpp b/Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.cpp
deleted file mode 100644
index a628a4bd6..000000000
--- a/Source/WebCore/platform/graphics/glx/GraphicsContext3DPrivate.cpp
+++ /dev/null
@@ -1,252 +0,0 @@
-/*
- * Copyright (C) 2011 Igalia S.L.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Lesser General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Lesser General Public License for more details.
- *
- *  You should have received a copy of the GNU Lesser General Public
- *  License along with this library; if not, write to the Free
- *  Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301 USA
- */
-
-#include "config.h"
-#include "GraphicsContext3DPrivate.h"
-
-#if ENABLE(WEBGL)
-
-#include "GraphicsContext3D.h"
-#include "OpenGLShims.h"
-#include <GL/glx.h>
-#include <dlfcn.h>
-
-// We do not want to call glXMakeContextCurrent using different Display pointers,
-// because it might lead to crashes in some drivers (fglrx). We use a shared display
-// pointer here.
-static Display* gSharedDisplay = 0;
-static Display* sharedDisplay()
-{
-    if (!gSharedDisplay)
-        gSharedDisplay = XOpenDisplay(0);
-    return gSharedDisplay;
-}
-
-namespace WebCore {
-
-// Because of driver bugs, exiting the program when there are active pbuffers
-// can crash the X server (this has been observed with the official Nvidia drivers).
-// We need to ensure that we clean everything up on exit. There are several reasons
-// that GraphicsContext3Ds will still be alive at exit, including user error (memory
-// leaks) and the page cache. In any case, we don't want the X server to crash.
-static bool cleaningUpAtExit = false;
-static Vector<GraphicsContext3D*>& activeGraphicsContexts()
-{
-    DEFINE_STATIC_LOCAL(Vector<GraphicsContext3D*>, contexts, ());
-    return contexts;
-}
-
-void GraphicsContext3DPrivate::addActiveGraphicsContext(GraphicsContext3D* context)
-{
-    static bool addedAtExitHandler = false;
-    if (!addedAtExitHandler) {
-        atexit(&GraphicsContext3DPrivate::cleanupActiveContextsAtExit);
-        addedAtExitHandler = true;
-    }
-    activeGraphicsContexts().append(context);
-}
-
-void GraphicsContext3DPrivate::removeActiveGraphicsContext(GraphicsContext3D* context)
-{
-    if (cleaningUpAtExit)
-        return;
-
-    Vector<GraphicsContext3D*>& contexts = activeGraphicsContexts();
-    size_t location = contexts.find(context);
-    if (location != WTF::notFound)
-        contexts.remove(location);
-}
-
-void GraphicsContext3DPrivate::cleanupActiveContextsAtExit()
-{
-    cleaningUpAtExit = true;
-
-    Vector<GraphicsContext3D*>& contexts = activeGraphicsContexts();
-    for (size_t i = 0; i < contexts.size(); i++)
-        contexts[i]->~GraphicsContext3D();
-
-    if (!gSharedDisplay)
-        return;
-    XCloseDisplay(gSharedDisplay);
-    gSharedDisplay = 0;
-}
-
-PassOwnPtr<GraphicsContext3DPrivate> GraphicsContext3DPrivate::create()
-{
-    if (!sharedDisplay())
-        return nullptr;
-
-    static bool initialized = false;
-    static bool success = true;
-    if (!initialized) {
-        success = initializeOpenGLShims();
-        initialized = true;
-    }
-    if (!success)
-        return nullptr;
-
-    GraphicsContext3DPrivate* internal = createPbufferContext();
-    if (!internal)
-        internal = createPixmapContext();
-    if (!internal)
-        return nullptr;
-
-    // The GraphicsContext3D constructor requires that this context is the current OpenGL context.
-    internal->makeContextCurrent();
-    return adoptPtr(internal);
-}
-
-GraphicsContext3DPrivate* GraphicsContext3DPrivate::createPbufferContext()
-{
-    int fbConfigAttributes[] = {
-        GLX_DRAWABLE_TYPE, GLX_PBUFFER_BIT,
-        GLX_RENDER_TYPE, GLX_RGBA_BIT,
-        GLX_RED_SIZE, 1,
-        GLX_GREEN_SIZE, 1,
-        GLX_BLUE_SIZE, 1,
-        GLX_ALPHA_SIZE, 1,
-        GLX_DEPTH_SIZE, 1,
-        GLX_STENCIL_SIZE, 1,
-        GLX_SAMPLE_BUFFERS, 1,
-        GLX_DOUBLEBUFFER, GL_FALSE,
-        GLX_SAMPLES, 4,
-        0
-    };
-    int returnedElements;
-    GLXFBConfig* configs = glXChooseFBConfig(sharedDisplay(), 0, fbConfigAttributes, &returnedElements);
-    if (!configs) {
-        fbConfigAttributes[20] = 0; // Attempt without anti-aliasing.
-        configs = glXChooseFBConfig(sharedDisplay(), 0, fbConfigAttributes, &returnedElements);
-    }
-    if (!returnedElements) {
-        XFree(configs);
-        return 0;
-    }
-
-    // We will be rendering to a texture, so our pbuffer does not need to be large.
-    static const int pbufferAttributes[] = { GLX_PBUFFER_WIDTH, 1, GLX_PBUFFER_HEIGHT, 1, 0 };
-    GLXPbuffer pbuffer = glXCreatePbuffer(sharedDisplay(), configs[0], pbufferAttributes);
-    if (!pbuffer) {
-        XFree(configs);
-        return 0;
-    }
-
-    GLXContext context = glXCreateNewContext(sharedDisplay(), configs[0], GLX_RGBA_TYPE, 0, GL_TRUE);
-    XFree(configs);
-    if (!context)
-        return 0;
-    return new GraphicsContext3DPrivate(context, pbuffer);
-}
-
-GraphicsContext3DPrivate* GraphicsContext3DPrivate::createPixmapContext()
-{
-    static int visualAttributes[] = {
-        GLX_RGBA,
-        GLX_RED_SIZE, 1,
-        GLX_GREEN_SIZE, 1,
-        GLX_BLUE_SIZE, 1,
-        GLX_ALPHA_SIZE, 1,
-        GLX_DOUBLEBUFFER,
-        0
-    };
-
-    XVisualInfo* visualInfo = glXChooseVisual(sharedDisplay(), DefaultScreen(sharedDisplay()), visualAttributes);
-    if (!visualInfo)
-        return 0;
- 
-    GLXContext context = glXCreateContext(sharedDisplay(), visualInfo, 0, GL_TRUE);
-    if (!context) {
-        XFree(visualInfo);
-        return 0;
-    }
-
-    Pixmap pixmap = XCreatePixmap(sharedDisplay(), DefaultRootWindow(sharedDisplay()), 1, 1, visualInfo->depth);
-    if (!pixmap) {
-        XFree(visualInfo);
-        return 0;
-    }
-
-    GLXPixmap glxPixmap = glXCreateGLXPixmap(sharedDisplay(), visualInfo, pixmap);
-    if (!glxPixmap) {
-        XFreePixmap(sharedDisplay(), pixmap);
-        XFree(visualInfo);
-        return 0;
-    }
-
-    return new GraphicsContext3DPrivate(context, pixmap, glxPixmap);
-}
-
-GraphicsContext3DPrivate::GraphicsContext3DPrivate(GLXContext context, GLXPbuffer pbuffer)
-    : m_context(context)
-    , m_pbuffer(pbuffer)
-    , m_pixmap(0)
-    , m_glxPixmap(0)
-{
-}
-
-GraphicsContext3DPrivate::GraphicsContext3DPrivate(GLXContext context, Pixmap pixmap, GLXPixmap glxPixmap)
-    : m_context(context)
-    , m_pbuffer(0)
-    , m_pixmap(pixmap)
-    , m_glxPixmap(glxPixmap)
-{
-}
-
-GraphicsContext3DPrivate::~GraphicsContext3DPrivate()
-{
-    if (m_context) {
-        // This may be necessary to prevent crashes with NVidia's closed source drivers. Originally
-        // from Mozilla's 3D canvas implementation at: http://bitbucket.org/ilmari/canvas3d/
-        ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, 0);
-
-        ::glXMakeContextCurrent(sharedDisplay(), 0, 0, 0);
-        ::glXDestroyContext(sharedDisplay(), m_context);
-        m_context = 0;
-    }
-
-    if (m_pbuffer) {
-        ::glXDestroyPbuffer(sharedDisplay(), m_pbuffer);
-        m_pbuffer = 0;
-    }
-    if (m_glxPixmap) {
-        glXDestroyGLXPixmap(sharedDisplay(), m_glxPixmap);
-        m_glxPixmap = 0;
-    }
-    if (m_pixmap) {
-        XFreePixmap(sharedDisplay(), m_pixmap);
-        m_pixmap = 0;
-    }
-}
-
-bool GraphicsContext3DPrivate::makeContextCurrent()
-{
-    if (::glXGetCurrentContext() == m_context)
-        return true;
-    if (!m_context)
-        return false;
-    if (m_pbuffer)
-        return ::glXMakeCurrent(sharedDisplay(), m_pbuffer, m_context);
-
-    ASSERT(m_glxPixmap);
-    return ::glXMakeCurrent(sharedDisplay(), m_glxPixmap, m_context);
-}
-
-} // namespace WebCore
-
-#endif // ENABLE_WEBGL
diff --git a/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp b/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
index a77345caa..24af3d8c9 100644
--- a/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
+++ b/Source/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
@@ -38,6 +38,7 @@ GraphicsContext3D* SharedGraphicsContext3D::get()
     attributes.antialias = false;
     attributes.canRecoverFromContextLoss = false; // Canvas contexts can not handle lost contexts.
     attributes.shareResources = true;
+    attributes.preferDiscreteGPU = true;
     static GraphicsContext3D* context = GraphicsContext3D::create(attributes, 0).leakRef();
     if (context && !context->makeContextCurrent())
         context = 0;
diff --git a/Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.cpp
index 2427c06b2..b8538707c 100644
--- a/Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/GRefPtrGStreamer.cpp
@@ -19,6 +19,7 @@
 
 #include "config.h"
 #include "GRefPtrGStreamer.h"
+#include "GStreamerVersioning.h"
 
 #if USE(GSTREAMER)
 #include <gst/gstelement.h>
@@ -33,10 +34,8 @@ template <> GRefPtr<GstElement> adoptGRef(GstElement* ptr)
 
 template <> GstElement* refGPtr<GstElement>(GstElement* ptr)
 {
-    if (ptr) {
-        gst_object_ref(GST_OBJECT(ptr));
-        gst_object_sink(GST_OBJECT(ptr));
-    }
+    if (ptr)
+        webkitGstObjectRefSink(GST_OBJECT(ptr));
 
     return ptr;
 }
@@ -55,10 +54,9 @@ template <> GRefPtr<GstPad> adoptGRef(GstPad* ptr)
 
 template <> GstPad* refGPtr<GstPad>(GstPad* ptr)
 {
-    if (ptr) {
-        gst_object_ref(GST_OBJECT(ptr));
-        gst_object_sink(GST_OBJECT(ptr));
-    }
+    if (ptr)
+        webkitGstObjectRefSink(GST_OBJECT(ptr));
+
     return ptr;
 }
 
@@ -76,10 +74,9 @@ template <> GRefPtr<GstPadTemplate> adoptGRef(GstPadTemplate* ptr)
 
 template <> GstPadTemplate* refGPtr<GstPadTemplate>(GstPadTemplate* ptr)
 {
-    if (ptr) {
-        gst_object_ref(GST_OBJECT(ptr));
-        gst_object_sink(GST_OBJECT(ptr));
-    }
+    if (ptr)
+        webkitGstObjectRefSink(GST_OBJECT(ptr));
+
     return ptr;
 }
 
@@ -111,10 +108,8 @@ template <> GRefPtr<GstTask> adoptGRef(GstTask* ptr)
 
 template <> GstTask* refGPtr<GstTask>(GstTask* ptr)
 {
-    if (ptr) {
-        gst_object_ref(GST_OBJECT(ptr));
-        gst_object_sink(GST_OBJECT(ptr));
-    }
+    if (ptr)
+        webkitGstObjectRefSink(GST_OBJECT(ptr));
 
     return ptr;
 }
diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.cpp b/Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.cpp
index 45363422a..fa088df2a 100644
--- a/Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.cpp
@@ -19,7 +19,7 @@
 
 #include "config.h"
 #include "GStreamerGWorld.h"
-#if ENABLE(VIDEO) && USE(GSTREAMER)
+#if ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 
 #include "GRefPtrGStreamer.h"
 #include <gst/gst.h>
@@ -216,4 +216,4 @@ void GStreamerGWorld::setWindowOverlay(GstMessage* message)
 }
 
 }
-#endif // USE(GSTREAMER)
+#endif // ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.h b/Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.h
index 74ca84cdb..e7862dea5 100644
--- a/Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.h
+++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerGWorld.h
@@ -20,7 +20,7 @@
 
 #ifndef GStreamerGWorld_h
 #define GStreamerGWorld_h
-#if ENABLE(VIDEO) && USE(GSTREAMER)
+#if ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 
 #include "GOwnPtr.h"
 #include "PlatformVideoWindow.h"
@@ -65,5 +65,5 @@ private:
 };
 
 }
-#endif // USE(GSTREAMER)
+#endif // ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 #endif
diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.cpp b/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.cpp
new file mode 100644
index 000000000..d4238c1e5
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2012 Igalia, S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#include "GStreamerVersioning.h"
+
+void webkitGstObjectRefSink(GstObject* gstObject)
+{
+#ifdef GST_API_VERSION_1
+    gst_object_ref_sink(gstObject);
+#else
+    gst_object_ref(gstObject);
+    gst_object_sink(gstObject);
+#endif
+}
+
+GstCaps* webkitGstElementGetPadCaps(GstElement* element, const char* direction)
+{
+    GstPad* pad = gst_element_get_static_pad(element, direction);
+    if (!pad)
+        return 0;
+
+    GstCaps* caps;
+#ifdef GST_API_VERSION_1
+    caps = gst_pad_get_current_caps(pad);
+    if (!caps)
+        caps = gst_pad_query_caps(pad, 0);
+#else
+    caps = GST_PAD_CAPS(pad);
+#endif
+    gst_object_unref(GST_OBJECT(pad));
+    return caps;
+}
diff --git a/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.h b/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.h
new file mode 100644
index 000000000..faadc2667
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gstreamer/GStreamerVersioning.h
@@ -0,0 +1,28 @@
+/*
+ * Copyright (C) 2012 Igalia, S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#ifndef GStreamerVersioning_h
+#define GStreamerVersioning_h
+
+#include <gst/gst.h>
+
+void webkitGstObjectRefSink(GstObject*);
+GstCaps* webkitGstElementGetPadCaps(GstElement*, const char*);
+
+#endif // GStreamerVersioning_h
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
index fd90fa9a6..03066dc97 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
@@ -30,8 +30,8 @@
 #include "Document.h"
 #include "Frame.h"
 #include "FrameView.h"
-#include "GRefPtrGStreamer.h"
 #include "GStreamerGWorld.h"
+#include "GStreamerVersioning.h"
 #include "GraphicsContext.h"
 #include "GraphicsTypes.h"
 #include "ImageGStreamer.h"
@@ -46,12 +46,17 @@
 #include "WebKitWebSourceGStreamer.h"
 #include <GOwnPtr.h>
 #include <gst/gst.h>
-#include <gst/interfaces/streamvolume.h>
 #include <gst/video/video.h>
 #include <limits>
 #include <math.h>
 #include <wtf/text/CString.h>
 
+#ifdef GST_API_VERSION_1
+#include <gst/audio/streamvolume.h>
+#else
+#include <gst/interfaces/streamvolume.h>
+#endif
+
 // GstPlayFlags flags from playbin2. It is the policy of GStreamer to
 // not publicly expose element-specific enums. That's why this
 // GstPlayFlags enum has been copied here.
@@ -67,6 +72,12 @@ typedef enum {
     GST_PLAY_FLAG_BUFFERING     = 0x000000100
 } GstPlayFlags;
 
+#ifdef GST_API_VERSION_1
+static const char* gPlaybinName = "playbin";
+#else
+static const char* gPlaybinName = "playbin2";
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -186,7 +197,7 @@ bool MediaPlayerPrivateGStreamer::isAvailable()
     if (!doGstInit())
         return false;
 
-    GstElementFactory* factory = gst_element_factory_find("playbin2");
+    GstElementFactory* factory = gst_element_factory_find(gPlaybinName);
     if (factory) {
         gst_object_unref(GST_OBJECT(factory));
         return true;
@@ -250,11 +261,6 @@ MediaPlayerPrivateGStreamer::~MediaPlayerPrivateGStreamer()
         m_mediaLocations = 0;
     }
 
-    if (m_source) {
-        gst_object_unref(m_source);
-        m_source = 0;
-    }
-
     if (m_videoSinkBin) {
         gst_object_unref(m_videoSinkBin);
         m_videoSinkBin = 0;
@@ -400,7 +406,12 @@ float MediaPlayerPrivateGStreamer::duration() const
     GstFormat timeFormat = GST_FORMAT_TIME;
     gint64 timeLength = 0;
 
-    if (!gst_element_query_duration(m_playBin, &timeFormat, &timeLength) || timeFormat != GST_FORMAT_TIME || static_cast<guint64>(timeLength) == GST_CLOCK_TIME_NONE) {
+#ifdef GST_API_VERSION_1
+    bool failure = !gst_element_query_duration(m_playBin, timeFormat, &timeLength) || static_cast<guint64>(timeLength) == GST_CLOCK_TIME_NONE;
+#else
+    bool failure = !gst_element_query_duration(m_playBin, &timeFormat, &timeLength) || timeFormat != GST_FORMAT_TIME || static_cast<guint64>(timeLength) == GST_CLOCK_TIME_NONE;
+#endif
+    if (failure) {
         LOG_VERBOSE(Media, "Time duration query failed.");
         return numeric_limits<float>::infinity();
     }
@@ -489,12 +500,10 @@ IntSize MediaPlayerPrivateGStreamer::naturalSize() const
     if (!hasVideo())
         return IntSize();
 
-    GRefPtr<GstPad> pad = adoptGRef(gst_element_get_static_pad(m_webkitVideoSink, "sink"));
-    if (!pad)
+    GstCaps* caps = webkitGstElementGetPadCaps(m_webkitVideoSink, "sink");
+    if (!caps)
         return IntSize();
 
-    guint64 width = 0, height = 0;
-    GstCaps* caps = GST_PAD_CAPS(pad.get());
     int pixelAspectRatioNumerator, pixelAspectRatioDenominator;
     int displayWidth, displayHeight, displayAspectRatioGCD;
     int originalWidth = 0, originalHeight = 0;
@@ -506,11 +515,23 @@ IntSize MediaPlayerPrivateGStreamer::naturalSize() const
 
     // Get the video PAR and original size, if this fails the
     // video-sink has likely not yet negotiated its caps.
+#ifdef GST_API_VERSION_1
+    GstVideoInfo info;
+    if (!gst_video_info_from_caps(&info, caps))
+        return IntSize();
+
+    originalWidth = GST_VIDEO_INFO_WIDTH(&info);
+    originalHeight = GST_VIDEO_INFO_HEIGHT(&info);
+    pixelAspectRatioNumerator = GST_VIDEO_INFO_PAR_N(&info);
+    pixelAspectRatioDenominator = GST_VIDEO_INFO_PAR_D(&info);
+#else
+    // Get the video PAR and original size.
     if (!GST_IS_CAPS(caps) || !gst_caps_is_fixed(caps)
         || !gst_video_format_parse_caps(caps, 0, &originalWidth, &originalHeight)
         || !gst_video_parse_caps_pixel_aspect_ratio(caps, &pixelAspectRatioNumerator,
                                                     &pixelAspectRatioDenominator))
         return IntSize();
+#endif
 
     LOG_VERBOSE(Media, "Original video size: %dx%d", originalWidth, originalHeight);
     LOG_VERBOSE(Media, "Pixel aspect ratio: %d/%d", pixelAspectRatioNumerator, pixelAspectRatioDenominator);
@@ -525,6 +546,7 @@ IntSize MediaPlayerPrivateGStreamer::naturalSize() const
     displayHeight /= displayAspectRatioGCD;
 
     // Apply DAR to original video size. This is the same behavior as in xvimagesink's setcaps function.
+    guint64 width = 0, height = 0;
     if (!(originalHeight % displayHeight)) {
         LOG_VERBOSE(Media, "Keeping video original height");
         width = gst_util_uint64_scale_int(originalHeight, displayWidth, displayHeight);
@@ -929,27 +951,42 @@ unsigned MediaPlayerPrivateGStreamer::totalBytes() const
 
     GstFormat fmt = GST_FORMAT_BYTES;
     gint64 length = 0;
-    if (gst_element_query_duration(m_source, &fmt, &length)) {
+#ifdef GST_API_VERSION_1
+    if (gst_element_query_duration(m_source.get(), fmt, &length)) {
+#else
+    if (gst_element_query_duration(m_source.get(), &fmt, &length)) {
+#endif
         LOG_VERBOSE(Media, "totalBytes %" G_GINT64_FORMAT, length);
         return static_cast<unsigned>(length);
     }
 
     // Fall back to querying the source pads manually.
     // See also https://bugzilla.gnome.org/show_bug.cgi?id=638749
-    GstIterator* iter = gst_element_iterate_src_pads(m_source);
+    GstIterator* iter = gst_element_iterate_src_pads(m_source.get());
     bool done = false;
     while (!done) {
+#ifdef GST_API_VERSION_1
+        GValue item = {0, };
+        switch (gst_iterator_next(iter, &item)) {
+        case GST_ITERATOR_OK: {
+            GstPad* pad = static_cast<GstPad*>(g_value_get_object(&item));
+            gint64 padLength = 0;
+            if (gst_pad_query_duration(pad, fmt, &padLength) && padLength > length)
+                length = padLength;
+            break;
+        }
+#else
         gpointer data;
 
         switch (gst_iterator_next(iter, &data)) {
         case GST_ITERATOR_OK: {
             GRefPtr<GstPad> pad = adoptGRef(GST_PAD_CAST(data));
             gint64 padLength = 0;
-            if (gst_pad_query_duration(pad.get(), &fmt, &padLength)
-                && padLength > length)
+            if (gst_pad_query_duration(pad.get(), &fmt, &padLength) && padLength > length)
                 length = padLength;
             break;
         }
+#endif
         case GST_ITERATOR_RESYNC:
             gst_iterator_resync(iter);
             break;
@@ -959,7 +996,12 @@ unsigned MediaPlayerPrivateGStreamer::totalBytes() const
             done = true;
             break;
         }
+
+#ifdef GST_API_VERSION_1
+        g_value_unset(&item);
+#endif
     }
+
     gst_iterator_free(iter);
 
     LOG_VERBOSE(Media, "totalBytes %" G_GINT64_FORMAT, length);
@@ -988,7 +1030,7 @@ unsigned MediaPlayerPrivateGStreamer::audioDecodedByteCount() const
     GstQuery* query = gst_query_new_position(GST_FORMAT_BYTES);
     gint64 position = 0;
 
-    if (m_webkitAudioSink && gst_element_query(m_webkitAudioSink, query))
+    if (m_webkitAudioSink && gst_element_query(m_webkitAudioSink.get(), query))
         gst_query_parse_position(query, 0, &position);
 
     gst_query_unref(query);
@@ -1012,30 +1054,23 @@ void MediaPlayerPrivateGStreamer::updateAudioSink()
     if (!m_playBin)
         return;
 
-    GRefPtr<GstElement> element;
     GstElement* sinkPtr = 0;
 
     g_object_get(m_playBin, "audio-sink", &sinkPtr, NULL);
-    element = adoptGRef(sinkPtr);
+    m_webkitAudioSink = adoptGRef(sinkPtr);
 
-    gst_object_replace(reinterpret_cast<GstObject**>(&m_webkitAudioSink),
-                       reinterpret_cast<GstObject*>(element.get()));
 }
 
 
 void MediaPlayerPrivateGStreamer::sourceChanged()
 {
-    GRefPtr<GstElement> element;
     GstElement* srcPtr = 0;
 
     g_object_get(m_playBin, "source", &srcPtr, NULL);
-    element = adoptGRef(srcPtr);
-
-    gst_object_replace(reinterpret_cast<GstObject**>(&m_source),
-                       reinterpret_cast<GstObject*>(element.get()));
+    m_source = adoptGRef(srcPtr);
 
-    if (WEBKIT_IS_WEB_SRC(element.get()))
-        webKitWebSrcSetMediaPlayer(WEBKIT_WEB_SRC(element.get()), m_player);
+    if (WEBKIT_IS_WEB_SRC(m_source.get()))
+        webKitWebSrcSetMediaPlayer(WEBKIT_WEB_SRC(m_source.get()), m_player);
 }
 
 void MediaPlayerPrivateGStreamer::cancelLoad()
@@ -1536,6 +1571,12 @@ static HashSet<String> mimeTypeCache()
                     cached = true;
                 }
 
+                if (g_str_equal(name, "audio/x-flac")) {
+                    cache.add(String("audio/flac"));
+                    cache.add(String("audio/x-flac"));
+                    cached = true;
+                }
+
                 if (g_str_equal(name, "audio/mpeg")) {
                     cache.add(String(name));
                     cache.add(String("audio/x-mpeg"));
@@ -1644,8 +1685,10 @@ bool MediaPlayerPrivateGStreamer::supportsFullscreen() const
 PlatformMedia MediaPlayerPrivateGStreamer::platformMedia() const
 {
     PlatformMedia p;
+#ifndef GST_API_VERSION_1
     p.type = PlatformMedia::GStreamerGWorldType;
     p.media.gstreamerGWorld = m_gstGWorld.get();
+#endif
     return p;
 }
 
@@ -1671,9 +1714,11 @@ void MediaPlayerPrivateGStreamer::setPreload(MediaPlayer::Preload preload)
 void MediaPlayerPrivateGStreamer::createGSTPlayBin()
 {
     ASSERT(!m_playBin);
-    m_playBin = gst_element_factory_make("playbin2", "play");
+    m_playBin = gst_element_factory_make(gPlaybinName, "play");
 
+#ifndef GST_API_VERSION_1
     m_gstGWorld = GStreamerGWorld::createGWorld(m_playBin);
+#endif
 
     GstBus* bus = gst_pipeline_get_bus(GST_PIPELINE(m_playBin));
     gst_bus_add_signal_watch(bus);
@@ -1692,7 +1737,10 @@ void MediaPlayerPrivateGStreamer::createGSTPlayBin()
 
     g_signal_connect(m_webkitVideoSink, "repaint-requested", G_CALLBACK(mediaPlayerPrivateRepaintCallback), this);
 
+
+#ifndef GST_API_VERSION_1
     m_videoSinkBin = gst_bin_new("sink");
+
     GstElement* videoTee = gst_element_factory_make("tee", "videoTee");
     GstElement* queue = gst_element_factory_make("queue", 0);
 
@@ -1710,6 +1758,7 @@ void MediaPlayerPrivateGStreamer::createGSTPlayBin()
     GRefPtr<GstPad> srcPad = adoptGRef(gst_element_get_request_pad(videoTee, "src%d"));
     GRefPtr<GstPad> sinkPad = adoptGRef(gst_element_get_static_pad(queue, "sink"));
     gst_pad_link(srcPad.get(), sinkPad.get());
+#endif
 
     GstElement* actualVideoSink = 0;
     m_fpsSink = gst_element_factory_make("fpsdisplaysink", "sink");
@@ -1728,7 +1777,9 @@ void MediaPlayerPrivateGStreamer::createGSTPlayBin()
 
             if (g_object_class_find_property(G_OBJECT_GET_CLASS(m_fpsSink), "video-sink")) {
                 g_object_set(m_fpsSink, "video-sink", m_webkitVideoSink, NULL);
+#ifndef GST_API_VERSION_1
                 gst_bin_add(GST_BIN(m_videoSinkBin), m_fpsSink);
+#endif
                 actualVideoSink = m_fpsSink;
             } else
                 m_fpsSink = 0;
@@ -1737,12 +1788,15 @@ void MediaPlayerPrivateGStreamer::createGSTPlayBin()
     }
 
     if (!m_fpsSink) {
+#ifndef GST_API_VERSION_1
         gst_bin_add(GST_BIN(m_videoSinkBin), m_webkitVideoSink);
+#endif
         actualVideoSink = m_webkitVideoSink;
     }
 
     ASSERT(actualVideoSink);
 
+#ifndef GST_API_VERSION_1
     // Faster elements linking.
     gst_element_link_pads_full(queue, "src", actualVideoSink, "sink", GST_PAD_LINK_CHECK_NOTHING);
 
@@ -1752,10 +1806,13 @@ void MediaPlayerPrivateGStreamer::createGSTPlayBin()
 
     // Set the bin as video sink of playbin.
     g_object_set(m_playBin, "video-sink", m_videoSinkBin, NULL);
+#else
+    g_object_set(m_playBin, "video-sink", actualVideoSink, NULL);
+#endif
 
-    pad = adoptGRef(gst_element_get_static_pad(m_webkitVideoSink, "sink"));
-    if (pad)
-        g_signal_connect(pad.get(), "notify::caps", G_CALLBACK(mediaPlayerPrivateVideoSinkCapsChangedCallback), this);
+    GRefPtr<GstPad> videoSinkPad = adoptGRef(gst_element_get_static_pad(m_webkitVideoSink, "sink"));
+    if (videoSinkPad)
+        g_signal_connect(videoSinkPad.get(), "notify::caps", G_CALLBACK(mediaPlayerPrivateVideoSinkCapsChangedCallback), this);
 
 }
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
index b08881483..1b0ff26e6 100644
--- a/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
+++ b/Source/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.h
@@ -24,12 +24,13 @@
 #define MediaPlayerPrivateGStreamer_h
 #if ENABLE(VIDEO) && USE(GSTREAMER)
 
-#include <wtf/Forward.h>
+#include "GRefPtrGStreamer.h"
 #include "MediaPlayerPrivate.h"
 #include "Timer.h"
 
 #include <glib.h>
 #include <gst/gst.h>
+#include <wtf/Forward.h>
 
 typedef struct _WebKitVideoSink WebKitVideoSink;
 typedef struct _GstBuffer GstBuffer;
@@ -154,7 +155,7 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             GstElement* m_webkitVideoSink;
             GstElement* m_videoSinkBin;
             GstElement* m_fpsSink;
-            GstElement* m_source;
+            GRefPtr<GstElement> m_source;
             float m_seekTime;
             bool m_changingRate;
             float m_endTime;
@@ -180,14 +181,16 @@ class MediaPlayerPrivateGStreamer : public MediaPlayerPrivateInterface {
             MediaPlayer::Preload m_preload;
             bool m_delayingLoad;
             bool m_mediaDurationKnown;
+#ifndef GST_API_VERSION_1
             RefPtr<GStreamerGWorld> m_gstGWorld;
+#endif
             guint m_volumeTimerHandler;
             guint m_muteTimerHandler;
             bool m_hasVideo;
             bool m_hasAudio;
             guint m_audioTimerHandler;
             guint m_videoTimerHandler;
-            GstElement* m_webkitAudioSink;
+            GRefPtr<GstElement> m_webkitAudioSink;
     };
 }
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindow.h b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindow.h
index 1d36c1ec5..2f8d365ff 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindow.h
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindow.h
@@ -19,7 +19,7 @@
 
 #ifndef PlatformVideoWindow_h
 #define PlatformVideoWindow_h
-#if ENABLE(VIDEO) && USE(GSTREAMER)
+#if ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 
 #include "Widget.h"
 #include <wtf/PassRefPtr.h>
@@ -61,5 +61,5 @@ class PlatformVideoWindow : public RefCounted<PlatformVideoWindow> {
     };
 }
 
-#endif // USE(GSTREAMER)
+#endif // USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 #endif
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp
index 009771675..4a3d10d8a 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp
@@ -19,7 +19,7 @@
 
 #include "config.h"
 #include "PlatformVideoWindow.h"
-#if USE(GSTREAMER)
+#if USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 
 #include "NotImplemented.h"
 
@@ -39,4 +39,4 @@ void PlatformVideoWindow::prepareForOverlay(GstMessage*)
 {
 }
 
-#endif // USE(GSTREAMER)
+#endif // USE(GSTREAMER) && !defined(GST_API_VERSION_1)
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp
index ee688c540..b83881112 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp
@@ -19,7 +19,7 @@
 
 #include "config.h"
 #include "PlatformVideoWindow.h"
-#if ENABLE(VIDEO) && USE(GSTREAMER)
+#if ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 
 #include <gtk/gtk.h>
 
@@ -65,5 +65,5 @@ PlatformVideoWindow::~PlatformVideoWindow()
 void PlatformVideoWindow::prepareForOverlay(GstMessage*)
 {
 }
-#endif // USE(GSTREAMER)
+#endif // ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowMac.mm b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowMac.mm
index e98cf9bc8..952fb7f61 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowMac.mm
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowMac.mm
@@ -20,7 +20,7 @@
 #include "config.h"
 #include "PlatformVideoWindow.h"
 
-#if USE(GSTREAMER)
+#if USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 
 #include <gst/gst.h>
 
@@ -46,4 +46,4 @@ void PlatformVideoWindow::prepareForOverlay(GstMessage* message)
     }
 }
 
-#endif // USE(GSTREAMER)
+#endif // USE(GSTREAMER) && !defined(GST_API_VERSION_1)
diff --git a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
index 06a792505..506a59d1f 100644
--- a/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/PlatformVideoWindowQt.cpp
@@ -19,6 +19,7 @@
 
 #include "config.h"
 #include "PlatformVideoWindow.h"
+#if ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
 
 #include "HTMLVideoElement.h"
 #include "PlatformVideoWindowPrivate.h"
@@ -150,3 +151,4 @@ PlatformVideoWindow::~PlatformVideoWindow()
 void PlatformVideoWindow::prepareForOverlay(GstMessage*)
 {
 }
+#endif // ENABLE(VIDEO) && USE(GSTREAMER) && !defined(GST_API_VERSION_1)
diff --git a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
index 2fc00581a..2a0af0c86 100644
--- a/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
+++ b/Source/WebCore/platform/graphics/gstreamer/WebKitWebSourceGStreamer.cpp
@@ -580,7 +580,7 @@ static gboolean webKitWebSrcSetUri(GstURIHandler* handler, const gchar* uri, GEr
 
     KURL url(KURL(), uri);
 
-    if (!url.isValid() || !url.protocolInHTTPFamily()) {
+    if (!url.isValid() || !url.protocolIsInHTTPFamily()) {
         g_set_error(error, GST_URI_ERROR, GST_URI_ERROR_BAD_URI, "Invalid URI '%s'", uri);
         return FALSE;
     }
@@ -624,7 +624,7 @@ static gboolean webKitWebSrcSetUri(GstURIHandler* handler, const gchar* uri)
 
     KURL url(KURL(), uri);
 
-    if (!url.isValid() || !url.protocolInHTTPFamily()) {
+    if (!url.isValid() || !url.protocolIsInHTTPFamily()) {
         GST_ERROR_OBJECT(src, "Invalid URI '%s'", uri);
         return FALSE;
     }
diff --git a/Source/WebCore/platform/graphics/gtk/GLContextGtk.cpp b/Source/WebCore/platform/graphics/gtk/GLContextGtk.cpp
new file mode 100644
index 000000000..6b2461a03
--- /dev/null
+++ b/Source/WebCore/platform/graphics/gtk/GLContextGtk.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2012 Igalia, S.L.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "GLContext.h"
+
+#include <gdk/gdk.h>
+#include <gdk/gdkx.h>
+#include <gtk/gtk.h>
+
+namespace WebCore {
+
+typedef HashMap<GtkWidget*, OwnPtr<GLContext> > WindowContextMap;
+static WindowContextMap& windowContextsMap()
+{
+    DEFINE_STATIC_LOCAL(WindowContextMap, windowContexts, ());
+    return windowContexts;
+}
+
+static void shutdownGLContext(GtkWidget* widget, void*)
+{
+    WindowContextMap& windowContexts = windowContextsMap();
+    WindowContextMap::iterator i = windowContexts.find(widget);
+    if (i != windowContexts.end())
+        windowContexts.remove(i);
+}
+
+GLContext* GLContext::getContextForWidget(GtkWidget* widget)
+{
+    ASSERT(widget);
+
+    WindowContextMap& windowContexts = windowContextsMap();
+    WindowContextMap::iterator i = windowContextsMap().find(widget);
+    if (i != windowContexts.end())
+        return i->second.get();
+
+    // It's important that this context doesn't hang around after the window
+    // is unmapped, so we make sure to clean it up once that happens.
+    if (!g_signal_handler_find(widget, G_SIGNAL_MATCH_FUNC, 0, 0, 0, reinterpret_cast<void*>(shutdownGLContext), 0))
+        g_signal_connect(widget, "unmap", G_CALLBACK(shutdownGLContext), 0);
+
+    // If this GDK window doesn't have its own native window then, we don't want
+    // to use it for rendering, since we'll be drawing over some other widget's area.
+    GdkWindow* gdkWindow = gtk_widget_get_window(widget);
+    GLContext* context = gdkWindow && gdk_window_has_native(gdkWindow) ?  createContext(GDK_WINDOW_XID(gdkWindow)) : createContext(0);
+
+    if (!context)
+        return 0;
+
+    windowContexts.set(widget, adoptPtr(context));
+    return context;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/gtk/WindowGLContext.h b/Source/WebCore/platform/graphics/gtk/WindowGLContext.h
deleted file mode 100644
index 962356835..000000000
--- a/Source/WebCore/platform/graphics/gtk/WindowGLContext.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) 2012 Igalia S.L.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Lesser General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Lesser General Public License for more details.
- *
- *  You should have received a copy of the GNU Lesser General Public
- *  License along with this library; if not, write to the Free
- *  Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA 02110-1301 USA
- */
-
-#ifndef WindowGLContext_h
-#define WindowGLContext_h
-
-#include <wtf/Noncopyable.h>
-#include <wtf/PassOwnPtr.h>
-
-#if defined(XP_UNIX)
-typedef struct __GLXcontextRec* GLXContext;
-typedef struct _XDisplay Display;
-#endif
-
-namespace WebCore {
-
-class WindowGLContext {
-    WTF_MAKE_NONCOPYABLE(WindowGLContext);
-public:
-    static PassOwnPtr<WindowGLContext> createContextWithGdkWindow(GdkWindow*);
-    virtual ~WindowGLContext();
-    void startDrawing();
-    void finishDrawing();
-
-private:
-    WindowGLContext(GdkWindow*);
-    GdkWindow* m_window;
-
-#if defined(XP_UNIX)
-    GLXContext m_context;
-    Display* m_display;
-    bool m_needToCloseDisplay;
-#endif
-};
-
-}
-
-#endif // WindowGLContext_h
diff --git a/Source/WebCore/platform/graphics/gtk/WindowGLContextGLX.cpp b/Source/WebCore/platform/graphics/gtk/WindowGLContextGLX.cpp
deleted file mode 100644
index c16a4f41b..000000000
--- a/Source/WebCore/platform/graphics/gtk/WindowGLContextGLX.cpp
+++ /dev/null
@@ -1,85 +0,0 @@
-/*
- * Copyright (C) 2012 Igalia, S.L.
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Lesser General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Lesser General Public License for more details.
- *
- *  You should have received a copy of the GNU Lesser General Public
- *  License along with this library; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- */
-
-#include "config.h"
-#include "WindowGLContext.h"
-
-#include <GL/glx.h>
-#include <gdk/gdk.h>
-#include <gdk/gdkx.h>
-#include <wtf/OwnPtr.h>
-
-namespace WebCore {
-
-PassOwnPtr<WindowGLContext> WindowGLContext::createContextWithGdkWindow(GdkWindow* window)
-{
-    OwnPtr<WindowGLContext> context = adoptPtr(new WindowGLContext(window));
-    if (!context->m_context)
-        return nullptr;
-    return context.release();
-}
-
-WindowGLContext::WindowGLContext(GdkWindow* window)
-    : m_window(window)
-    , m_context(0)
-    , m_display(0)
-    , m_needToCloseDisplay(0)
-{
-    GdkDisplay* gdkDisplay = gdk_window_get_display(m_window);
-    if (gdkDisplay)
-        m_display = GDK_DISPLAY_XDISPLAY(gdkDisplay);
-    else {
-        m_display = XOpenDisplay(0);
-        m_needToCloseDisplay = true;
-    }
-
-    XWindowAttributes attributes;
-    if (!XGetWindowAttributes(m_display, GDK_WINDOW_XID(m_window), &attributes))
-        return;
-
-    XVisualInfo visualInfo;
-    visualInfo.visualid = XVisualIDFromVisual(attributes.visual);
-
-    int numReturned = 0;
-    XVisualInfo* visualInfoList = XGetVisualInfo(m_display, VisualIDMask, &visualInfo, &numReturned);
-    m_context = glXCreateContext(m_display, visualInfoList, 0, True);
-    XFree(visualInfoList);
-}
-
-WindowGLContext::~WindowGLContext()
-{
-    if (!m_context)
-        return;
-    glXMakeCurrent(m_display, None, None);
-    glXDestroyContext(m_display, m_context);
-
-    if (m_needToCloseDisplay)
-        XCloseDisplay(m_display);
-}
-
-void WindowGLContext::startDrawing()
-{
-    glXMakeCurrent(m_display, GDK_WINDOW_XID(m_window), m_context);
-}
-
-void WindowGLContext::finishDrawing()
-{
-    glXSwapBuffers(m_display, GDK_WINDOW_XID(m_window));
-}
-
-} // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp b/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp
index 29c061238..5002fdf6f 100644
--- a/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp
+++ b/Source/WebCore/platform/graphics/harfbuzz/HarfBuzzShaperBase.cpp
@@ -42,8 +42,12 @@ namespace WebCore {
 
 HarfBuzzShaperBase::HarfBuzzShaperBase(const Font* font, const TextRun& run)
     : m_font(font)
+    , m_normalizedBufferLength(0)
     , m_run(run)
     , m_wordSpacingAdjustment(font->wordSpacing())
+    , m_padding(0)
+    , m_padPerWordBreak(0)
+    , m_padError(0)
     , m_letterSpacing(font->letterSpacing())
 {
 }
@@ -64,7 +68,7 @@ static void normalizeSpacesAndMirrorChars(const UChar* source, UChar* destinatio
         else if (normalizeMode == HarfBuzzShaperBase::NormalizeMirrorChars)
             character = u_charMirror(character);
         U16_APPEND(destination, position, length, character, error);
-        ASSERT(!error);
+        ASSERT_UNUSED(error, !error);
         position = nextPosition;
     }
 }
diff --git a/Source/WebCore/platform/graphics/mac/DisplayRefreshMonitorMac.cpp b/Source/WebCore/platform/graphics/mac/DisplayRefreshMonitorMac.cpp
index b0838e153..edf630892 100644
--- a/Source/WebCore/platform/graphics/mac/DisplayRefreshMonitorMac.cpp
+++ b/Source/WebCore/platform/graphics/mac/DisplayRefreshMonitorMac.cpp
@@ -48,13 +48,13 @@ static CVReturn displayLinkCallback(CVDisplayLinkRef, const CVTimeStamp* now, co
  
 DisplayRefreshMonitor::~DisplayRefreshMonitor()
 {
-    cancelCallOnMainThread(DisplayRefreshMonitor::refreshDisplayOnMainThread, this);
-    
     if (m_displayLink) {
         CVDisplayLinkStop(m_displayLink);
         CVDisplayLinkRelease(m_displayLink);
         m_displayLink = 0;
     }
+
+    cancelCallOnMainThread(DisplayRefreshMonitor::refreshDisplayOnMainThread, this);
 }
 
 bool DisplayRefreshMonitor::requestRefreshCallback()
diff --git a/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm b/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
index 54c03f879..8f4a9193e 100644
--- a/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
+++ b/Source/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
@@ -57,7 +57,7 @@ const float smallCapsFontSizeMultiplier = 0.7f;
 static bool fontHasVerticalGlyphs(CTFontRef ctFont)
 {
     // The check doesn't look neat but this is what AppKit does for vertical writing...
-    RetainPtr<CFArrayRef> tableTags(AdoptCF, CTFontCopyAvailableTables(ctFont, kCTFontTableOptionExcludeSynthetic));
+    RetainPtr<CFArrayRef> tableTags(AdoptCF, CTFontCopyAvailableTables(ctFont, kCTFontTableOptionNoOptions));
     CFIndex numTables = CFArrayGetCount(tableTags.get());
     for (CFIndex index = 0; index < numTables; ++index) {
         CTFontTableTag tag = (CTFontTableTag)(uintptr_t)CFArrayGetValueAtIndex(tableTags.get(), index);
@@ -72,7 +72,6 @@ static bool initFontData(SimpleFontData* fontData)
     if (!fontData->platformData().cgFont())
         return false;
 
-
     return true;
 }
 
diff --git a/Source/WebCore/platform/graphics/mac/WebLayer.mm b/Source/WebCore/platform/graphics/mac/WebLayer.mm
index 277104148..1dbd72b37 100644
--- a/Source/WebCore/platform/graphics/mac/WebLayer.mm
+++ b/Source/WebCore/platform/graphics/mac/WebLayer.mm
@@ -35,6 +35,7 @@
 #import <objc/objc-runtime.h>
 #import <QuartzCore/QuartzCore.h>
 #import <wtf/UnusedParam.h>
+#import "WebCoreSystemInterface.h"
 
 @interface CALayer(WebCoreCALayerPrivate)
 - (void)reloadValueForKeyPath:(NSString *)keyPath;
@@ -76,9 +77,25 @@ void drawLayerContents(CGContextRef context, CALayer *layer, WebCore::PlatformCA
     
     // It's important to get the clip from the context, because it may be significantly
     // smaller than the layer bounds (e.g. tiled layers)
-    CGRect clipBounds = CGContextGetClipBoundingBox(context);
+    FloatRect clipBounds = CGContextGetClipBoundingBox(context);
+
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    __block GraphicsContext* ctx = &graphicsContext;
+
+    wkCALayerEnumerateRectsBeingDrawnWithBlock(layer, context, ^(CGRect rect){
+        FloatRect rectBeingDrawn(rect);
+        rectBeingDrawn.intersect(clipBounds);
+        
+        GraphicsContextStateSaver stateSaver(*ctx);
+        ctx->clip(rectBeingDrawn);
+        
+        layerContents->platformCALayerPaintContents(*ctx, enclosingIntRect(rectBeingDrawn));
+    });
+
+#else
     IntRect clip(enclosingIntRect(clipBounds));
     layerContents->platformCALayerPaintContents(graphicsContext, clip);
+#endif
 
     [NSGraphicsContext restoreGraphicsState];
 
@@ -194,14 +211,14 @@ void drawLayerContents(CGContextRef context, CALayer *layer, WebCore::PlatformCA
     CGRect aBounds = [self bounds];
     CGPoint aPos = [self position];
 
-    NSString* selfString = [NSString stringWithFormat:@"%@<%@ 0x%08x> \"%@\" bounds(%.1f, %.1f, %.1f, %.1f) pos(%.1f, %.1f), sublayers=%d masking=%d",
+    NSString* selfString = [NSString stringWithFormat:@"%@<%@ 0x%p> \"%@\" bounds(%.1f, %.1f, %.1f, %.1f) pos(%.1f, %.1f), sublayers=%lu masking=%d",
             inPrefix,
             [self class],
             self,
             [self name],
             aBounds.origin.x, aBounds.origin.y, aBounds.size.width, aBounds.size.height, 
             aPos.x, aPos.y,
-            [[self sublayers] count],
+            static_cast<unsigned long>([[self sublayers] count]),
             [self masksToBounds]];
     
     NSMutableString* curDesc = [NSMutableString stringWithString:selfString];
diff --git a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
index b6410f61c..596b2fa3f 100644
--- a/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/Extensions3DOpenGL.cpp
@@ -98,6 +98,9 @@ bool Extensions3DOpenGL::supports(const String& name)
     if (name == "GL_OES_standard_derivatives")
         return true;
 
+    if (name == "GL_EXT_texture_filter_anisotropic")
+        return m_availableExtensions.contains("GL_EXT_texture_filter_anisotropic");
+
     return m_availableExtensions.contains(name);
 }
 
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
index 8c002facc..7c477786e 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
@@ -135,7 +135,12 @@ void GraphicsContext3D::resolveMultisamplingIfNecessary(const IntRect& rect)
 {
     ::glBindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, m_multisampleFBO);
     ::glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, m_fbo);
-    ::glBlitFramebufferEXT(rect.x(), rect.y(), rect.maxX(), rect.maxY(), rect.x(), rect.y(), rect.maxX(), rect.maxY(), GL_COLOR_BUFFER_BIT, GL_LINEAR);
+
+    IntRect resolveRect = rect;
+    if (rect.isEmpty())
+        resolveRect = IntRect(0, 0, m_currentWidth, m_currentHeight);
+
+    ::glBlitFramebufferEXT(resolveRect.x(), resolveRect.y(), resolveRect.maxX(), resolveRect.maxY(), resolveRect.x(), resolveRect.y(), resolveRect.maxX(), resolveRect.maxY(), GL_COLOR_BUFFER_BIT, GL_LINEAR);
 }
 
 void GraphicsContext3D::renderbufferStorage(GC3Denum target, GC3Denum internalformat, GC3Dsizei width, GC3Dsizei height)
diff --git a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
index 03d4a32cc..9123ed0b2 100644
--- a/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
+++ b/Source/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGLCommon.cpp
@@ -168,7 +168,7 @@ void GraphicsContext3D::prepareTexture()
 
     makeContextCurrent();
     if (m_attrs.antialias)
-        resolveMultisamplingIfNecessary(IntRect(0, 0, m_currentWidth, m_currentHeight));
+        resolveMultisamplingIfNecessary();
 
     ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
     ::glActiveTexture(GL_TEXTURE0);
@@ -191,7 +191,7 @@ void GraphicsContext3D::readRenderingResults(unsigned char *pixels, int pixelsSi
 
     bool mustRestoreFBO = false;
     if (m_attrs.antialias) {
-        resolveMultisamplingIfNecessary(IntRect(0, 0, m_currentWidth, m_currentHeight));
+        resolveMultisamplingIfNecessary();
         ::glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
         mustRestoreFBO = true;
     } else {
@@ -907,7 +907,7 @@ void GraphicsContext3D::uniform1f(GC3Dint location, GC3Dfloat v0)
     ::glUniform1f(location, v0);
 }
 
-void GraphicsContext3D::uniform1fv(GC3Dint location, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniform1fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
 {
     makeContextCurrent();
     ::glUniform1fv(location, size, array);
@@ -919,7 +919,7 @@ void GraphicsContext3D::uniform2f(GC3Dint location, GC3Dfloat v0, GC3Dfloat v1)
     ::glUniform2f(location, v0, v1);
 }
 
-void GraphicsContext3D::uniform2fv(GC3Dint location, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniform2fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
 {
     // FIXME: length needs to be a multiple of 2.
     makeContextCurrent();
@@ -932,7 +932,7 @@ void GraphicsContext3D::uniform3f(GC3Dint location, GC3Dfloat v0, GC3Dfloat v1,
     ::glUniform3f(location, v0, v1, v2);
 }
 
-void GraphicsContext3D::uniform3fv(GC3Dint location, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniform3fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
 {
     // FIXME: length needs to be a multiple of 3.
     makeContextCurrent();
@@ -945,7 +945,7 @@ void GraphicsContext3D::uniform4f(GC3Dint location, GC3Dfloat v0, GC3Dfloat v1,
     ::glUniform4f(location, v0, v1, v2, v3);
 }
 
-void GraphicsContext3D::uniform4fv(GC3Dint location, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniform4fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
 {
     // FIXME: length needs to be a multiple of 4.
     makeContextCurrent();
@@ -958,7 +958,7 @@ void GraphicsContext3D::uniform1i(GC3Dint location, GC3Dint v0)
     ::glUniform1i(location, v0);
 }
 
-void GraphicsContext3D::uniform1iv(GC3Dint location, GC3Dint* array, GC3Dsizei size)
+void GraphicsContext3D::uniform1iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
 {
     makeContextCurrent();
     ::glUniform1iv(location, size, array);
@@ -970,7 +970,7 @@ void GraphicsContext3D::uniform2i(GC3Dint location, GC3Dint v0, GC3Dint v1)
     ::glUniform2i(location, v0, v1);
 }
 
-void GraphicsContext3D::uniform2iv(GC3Dint location, GC3Dint* array, GC3Dsizei size)
+void GraphicsContext3D::uniform2iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
 {
     // FIXME: length needs to be a multiple of 2.
     makeContextCurrent();
@@ -983,7 +983,7 @@ void GraphicsContext3D::uniform3i(GC3Dint location, GC3Dint v0, GC3Dint v1, GC3D
     ::glUniform3i(location, v0, v1, v2);
 }
 
-void GraphicsContext3D::uniform3iv(GC3Dint location, GC3Dint* array, GC3Dsizei size)
+void GraphicsContext3D::uniform3iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
 {
     // FIXME: length needs to be a multiple of 3.
     makeContextCurrent();
@@ -996,28 +996,28 @@ void GraphicsContext3D::uniform4i(GC3Dint location, GC3Dint v0, GC3Dint v1, GC3D
     ::glUniform4i(location, v0, v1, v2, v3);
 }
 
-void GraphicsContext3D::uniform4iv(GC3Dint location, GC3Dint* array, GC3Dsizei size)
+void GraphicsContext3D::uniform4iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
 {
     // FIXME: length needs to be a multiple of 4.
     makeContextCurrent();
     ::glUniform4iv(location, size, array);
 }
 
-void GraphicsContext3D::uniformMatrix2fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniformMatrix2fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* array)
 {
     // FIXME: length needs to be a multiple of 4.
     makeContextCurrent();
     ::glUniformMatrix2fv(location, size, transpose, array);
 }
 
-void GraphicsContext3D::uniformMatrix3fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniformMatrix3fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* array)
 {
     // FIXME: length needs to be a multiple of 9.
     makeContextCurrent();
     ::glUniformMatrix3fv(location, size, transpose, array);
 }
 
-void GraphicsContext3D::uniformMatrix4fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniformMatrix4fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* array)
 {
     // FIXME: length needs to be a multiple of 16.
     makeContextCurrent();
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
index 80591e9c4..7005785c0 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
@@ -1087,7 +1087,7 @@ void GraphicsContext3D::uniform1f(GC3Dint location, GC3Dfloat v0)
     glUniform1f(location, v0);
 }
 
-void GraphicsContext3D::uniform1fv(GC3Dint location, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniform1fv(GC3Dint location, GGC3Dsizei size, C3Dfloat* array)
 {
     makeContextCurrent();
     glUniform1fv(location, size, array);
@@ -1099,7 +1099,7 @@ void GraphicsContext3D::uniform2f(GC3Dint location, GC3Dfloat v0, GC3Dfloat v1)
     glUniform2f(location, v0, v1);
 }
 
-void GraphicsContext3D::uniform2fv(GC3Dint location, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniform2fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
 {
     makeContextCurrent();
     glUniform2fv(location, size, array);
@@ -1111,7 +1111,7 @@ void GraphicsContext3D::uniform3f(GC3Dint location, GC3Dfloat v0, GC3Dfloat v1,
     glUniform3f(location, v0, v1, v2);
 }
 
-void GraphicsContext3D::uniform3fv(GC3Dint location, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniform3fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
 {
     makeContextCurrent();
     glUniform3fv(location, size, array);
@@ -1123,7 +1123,7 @@ void GraphicsContext3D::uniform4f(GC3Dint location, GC3Dfloat v0, GC3Dfloat v1,
     glUniform4f(location, v0, v1, v2, v3);
 }
 
-void GraphicsContext3D::uniform4fv(GC3Dint location, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniform4fv(GC3Dint location, GC3Dsizei size, GC3Dfloat* array)
 {
     makeContextCurrent();
     glUniform4fv(location, size, array);
@@ -1135,7 +1135,7 @@ void GraphicsContext3D::uniform1i(GC3Dint location, GC3Dint v0)
     glUniform1i(location, v0);
 }
 
-void GraphicsContext3D::uniform1iv(GC3Dint location, GC3Dint* array, GC3Dsizei size)
+void GraphicsContext3D::uniform1iv(GC3Dint location, GGC3Dsizei size, C3Dint* array)
 {
     makeContextCurrent();
     glUniform1iv(location, size, array);
@@ -1147,7 +1147,7 @@ void GraphicsContext3D::uniform2i(GC3Dint location, GC3Dint v0, GC3Dint v1)
     glUniform2i(location, v0, v1);
 }
 
-void GraphicsContext3D::uniform2iv(GC3Dint location, GC3Dint* array, GC3Dsizei size)
+void GraphicsContext3D::uniform2iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
 {
     makeContextCurrent();
     glUniform2iv(location, size, array);
@@ -1159,7 +1159,7 @@ void GraphicsContext3D::uniform3i(GC3Dint location, GC3Dint v0, GC3Dint v1, GC3D
     glUniform3i(location, v0, v1, v2);
 }
 
-void GraphicsContext3D::uniform3iv(GC3Dint location, GC3Dint* array, GC3Dsizei size)
+void GraphicsContext3D::uniform3iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
 {
     makeContextCurrent();
     glUniform3iv(location, size, array);
@@ -1171,25 +1171,25 @@ void GraphicsContext3D::uniform4i(GC3Dint location, GC3Dint v0, GC3Dint v1, GC3D
     glUniform4i(location, v0, v1, v2, v3);
 }
 
-void GraphicsContext3D::uniform4iv(GC3Dint location, GC3Dint* array, GC3Dsizei size)
+void GraphicsContext3D::uniform4iv(GC3Dint location, GC3Dsizei size, GC3Dint* array)
 {
     makeContextCurrent();
     glUniform4iv(location, size, array);
 }
 
-void GraphicsContext3D::uniformMatrix2fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniformMatrix2fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* array)
 {
     makeContextCurrent();
     glUniformMatrix2fv(location, size, transpose, array);
 }
 
-void GraphicsContext3D::uniformMatrix3fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniformMatrix3fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* array)
 {
     makeContextCurrent();
     glUniformMatrix3fv(location, size, transpose, array);
 }
 
-void GraphicsContext3D::uniformMatrix4fv(GC3Dint location, GC3Dboolean transpose, GC3Dfloat* array, GC3Dsizei size)
+void GraphicsContext3D::uniformMatrix4fv(GC3Dint location, GC3Dsizei size, GC3Dboolean transpose, GC3Dfloat* array)
 {
     makeContextCurrent();
     glUniformMatrix4fv(location, size, transpose, array);
diff --git a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index d07d732b4..aa49e2ddf 100644
--- a/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -1068,12 +1068,14 @@ void GraphicsContext::beginPlatformTransparencyLayer(float opacity)
     w = device->width();
     h = device->height();
 
-    QRectF clip = m_data->clipBoundingRect();
-    QRectF deviceClip = p->transform().mapRect(clip);
-    x = int(qBound(qreal(0), deviceClip.x(), (qreal)w));
-    y = int(qBound(qreal(0), deviceClip.y(), (qreal)h));
-    w = int(qBound(qreal(0), deviceClip.width(), (qreal)w) + 2);
-    h = int(qBound(qreal(0), deviceClip.height(), (qreal)h) + 2);
+    if (p->hasClipping()) {
+        QRectF clip = m_data->clipBoundingRect();
+        QRectF deviceClip = p->transform().mapRect(clip);
+        x = int(qBound(qreal(0), deviceClip.x(), (qreal)w));
+        y = int(qBound(qreal(0), deviceClip.y(), (qreal)h));
+        w = int(qBound(qreal(0), deviceClip.width(), (qreal)w) + 2);
+        h = int(qBound(qreal(0), deviceClip.height(), (qreal)h) + 2);
+    }
 
     QPixmap emptyAlphaMask;
     m_data->layers.push(new TransparencyLayer(p, QRect(x, y, w, h), opacity, emptyAlphaMask));
diff --git a/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp b/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
index 15f89b7ae..44f860af2 100644
--- a/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/ImageBufferQt.cpp
@@ -109,11 +109,6 @@ ImageBuffer::~ImageBuffer()
 {
 }
 
-size_t ImageBuffer::dataSize() const
-{
-    return m_size.width() * m_size.height() * 4;
-}
-
 GraphicsContext* ImageBuffer::context() const
 {
     ASSERT(m_data.m_painter->isActive());
diff --git a/Source/WebCore/platform/graphics/qt/TransformationMatrixQt.cpp b/Source/WebCore/platform/graphics/qt/TransformationMatrixQt.cpp
index 6a5735b3d..7ff432b17 100644
--- a/Source/WebCore/platform/graphics/qt/TransformationMatrixQt.cpp
+++ b/Source/WebCore/platform/graphics/qt/TransformationMatrixQt.cpp
@@ -50,6 +50,22 @@ TransformationMatrix::TransformationMatrix(const QTransform& transform)
               transform.m31(), transform.m32(), 0, transform.m33());
 }
 
+TransformationMatrix::operator QMatrix4x4() const
+{
+    return QMatrix4x4(m11(), m12(), m13(), m14(),
+                      m21(), m22(), m23(), m24(),
+                      m31(), m32(), m33(), m34(),
+                      m41(), m42(), m43(), m44());
+}
+
+TransformationMatrix::TransformationMatrix(const QMatrix4x4& matrix)
+{
+    setMatrix(matrix(0, 0), matrix(1, 0), matrix(2, 0), matrix(3, 0),
+              matrix(0, 1), matrix(1, 1), matrix(2, 1), matrix(3, 1),
+              matrix(0, 2), matrix(1, 2), matrix(2, 2), matrix(3, 2),
+              matrix(0, 3), matrix(1, 3), matrix(2, 3), matrix(3, 3));
+}
+
 }
 
 // vim: ts=4 sw=4 et
diff --git a/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp b/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
index e0b52a318..0d379a42a 100644
--- a/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
@@ -169,11 +169,6 @@ GraphicsContext* ImageBuffer::context() const
     return m_context.get();
 }
 
-size_t ImageBuffer::dataSize() const
-{
-    return m_size.width() * m_size.height() * 4;
-}
-
 PassRefPtr<Image> ImageBuffer::copyImage(BackingStoreCopy copyBehavior) const
 {
     return BitmapImageSingleFrameSkia::create(*m_data.m_platformContext.bitmap(), copyBehavior == CopyBackingStore);
diff --git a/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.cpp b/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.cpp
index 21facaadb..5a4f1534c 100644
--- a/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.cpp
@@ -147,7 +147,7 @@ static inline bool paintIsOpaque(const SkPaint& paint, const SkBitmap* bitmap =
     return true;
 }
 
-void OpaqueRegionSkia::didDrawRect(const PlatformContextSkia* context, const AffineTransform& transform, const SkRect& fillRect, const SkPaint& paint, const SkBitmap* bitmap)
+void OpaqueRegionSkia::didDrawRect(PlatformContextSkia* context, const AffineTransform& transform, const SkRect& fillRect, const SkPaint& paint, const SkBitmap* bitmap)
 {
     // Any stroking may put alpha in pixels even if the filling part does not.
     if (paint.getStyle() != SkPaint::kFill_Style) {
@@ -169,7 +169,7 @@ void OpaqueRegionSkia::didDrawRect(const PlatformContextSkia* context, const Aff
     didDraw(context, transform, fillRect, paint, opaque, fillsBounds);
 }
 
-void OpaqueRegionSkia::didDrawPath(const PlatformContextSkia* context, const AffineTransform& transform, const SkPath& path, const SkPaint& paint)
+void OpaqueRegionSkia::didDrawPath(PlatformContextSkia* context, const AffineTransform& transform, const SkPath& path, const SkPaint& paint)
 {
     SkRect rect;
     if (path.isRect(&rect)) {
@@ -188,7 +188,7 @@ void OpaqueRegionSkia::didDrawPath(const PlatformContextSkia* context, const Aff
     }
 }
 
-void OpaqueRegionSkia::didDrawPoints(const PlatformContextSkia* context, const AffineTransform& transform, SkCanvas::PointMode mode, int numPoints, const SkPoint points[], const SkPaint& paint)
+void OpaqueRegionSkia::didDrawPoints(PlatformContextSkia* context, const AffineTransform& transform, SkCanvas::PointMode mode, int numPoints, const SkPoint points[], const SkPaint& paint)
 {
     if (!numPoints)
         return;
@@ -217,7 +217,7 @@ void OpaqueRegionSkia::didDrawPoints(const PlatformContextSkia* context, const A
     }
 }
 
-void OpaqueRegionSkia::didDrawBounded(const PlatformContextSkia* context, const AffineTransform& transform, const SkRect& bounds, const SkPaint& paint)
+void OpaqueRegionSkia::didDrawBounded(PlatformContextSkia* context, const AffineTransform& transform, const SkRect& bounds, const SkPaint& paint)
 {
     bool opaque = paintIsOpaque(paint);
     bool fillsBounds = false;
@@ -231,10 +231,13 @@ void OpaqueRegionSkia::didDrawBounded(const PlatformContextSkia* context, const
     }
 }
 
-void OpaqueRegionSkia::didDraw(const PlatformContextSkia* context, const AffineTransform& transform, const SkRect& rect, const SkPaint& paint, bool drawsOpaque, bool fillsBounds)
+void OpaqueRegionSkia::didDraw(PlatformContextSkia* context, const AffineTransform& transform, const SkRect& rect, const SkPaint& paint, bool drawsOpaque, bool fillsBounds)
 {
     SkRect targetRect = rect;
 
+    bool xfersOpaque = xfermodeIsOpaque(paint, drawsOpaque);
+    bool preservesOpaque = xfermodePreservesOpaque(paint, drawsOpaque);
+
     // Apply the transform to device coordinate space.
     SkMatrix canvasTransform = context->canvas()->getTotalMatrix();
     if (!canvasTransform.mapRect(&targetRect))
@@ -249,17 +252,33 @@ void OpaqueRegionSkia::didDraw(const PlatformContextSkia* context, const AffineT
         if (!targetRect.intersect(SkIntToScalar(deviceClip.fLeft), SkIntToScalar(deviceClip.fTop), SkIntToScalar(deviceClip.fRight), SkIntToScalar(deviceClip.fBottom)))
             return;
     }
-    if (!context->clippedToImage().isOpaque())
-        fillsBounds = false;
+
+    // Apply any layers that we are drawing into.
+    for (SkCanvas::LayerIter it(context->canvas(), false); !it.done(); it.next()) {
+        // Apply the layer's clip (which is in device space)
+        const SkRegion& deviceLayerClip = it.clip();
+        if (deviceLayerClip.isEmpty() || !deviceLayerClip.isRect())
+            fillsBounds = false;
+        else {
+            SkIRect clipBounds = it.clip().getBounds();
+            if (!targetRect.intersect(SkIntToScalar(clipBounds.fLeft), SkIntToScalar(clipBounds.fTop), SkIntToScalar(clipBounds.fRight), SkIntToScalar(clipBounds.fBottom)))
+                return;
+        }
+
+        // Make sure the paint stays opaque through the layer.
+        bool drawsOpaque = paintIsOpaque(it.paint());
+        xfersOpaque = xfersOpaque && xfermodeIsOpaque(it.paint(), drawsOpaque);
+        preservesOpaque = preservesOpaque && xfermodePreservesOpaque(it.paint(), drawsOpaque);
+    }
 
     // Apply the transform to the tracking space.
     SkMatrix canvasToTargetTransform = transform;
     if (!canvasToTargetTransform.mapRect(&targetRect))
         fillsBounds = false;
 
-    if (fillsBounds && xfermodeIsOpaque(paint, drawsOpaque))
+    if (fillsBounds && xfersOpaque)
         markRectAsOpaque(targetRect);
-    else if (SkRect::Intersects(targetRect, m_opaqueRect) && !xfermodePreservesOpaque(paint, drawsOpaque))
+    else if (SkRect::Intersects(targetRect, m_opaqueRect) && !preservesOpaque)
         markRectAsNonOpaque(targetRect);
 }
 
@@ -339,4 +358,5 @@ void OpaqueRegionSkia::markRectAsNonOpaque(const SkRect& rect)
         m_opaqueRect = vertical;
 }
 
+
 } // namespace WebCore
diff --git a/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.h b/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.h
index 45b069004..431c6ec19 100644
--- a/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.h
+++ b/Source/WebCore/platform/graphics/skia/OpaqueRegionSkia.h
@@ -53,13 +53,15 @@ public:
     // The resulting opaque region as a single rect.
     IntRect asRect() const;
 
-    void didDrawRect(const PlatformContextSkia*, const AffineTransform&, const SkRect&, const SkPaint&, const SkBitmap*);
-    void didDrawPath(const PlatformContextSkia*, const AffineTransform&, const SkPath&, const SkPaint&);
-    void didDrawPoints(const PlatformContextSkia*, const AffineTransform&, SkCanvas::PointMode, int numPoints, const SkPoint[], const SkPaint&);
-    void didDrawBounded(const PlatformContextSkia*, const AffineTransform&, const SkRect&, const SkPaint&);
+    // FIXME: make all the PlatformContextSkia* into a const pointer when Skia fixes LayerIter's SkCanvas*.
+
+    void didDrawRect(PlatformContextSkia*, const AffineTransform&, const SkRect&, const SkPaint&, const SkBitmap*);
+    void didDrawPath(PlatformContextSkia*, const AffineTransform&, const SkPath&, const SkPaint&);
+    void didDrawPoints(PlatformContextSkia*, const AffineTransform&, SkCanvas::PointMode, int numPoints, const SkPoint[], const SkPaint&);
+    void didDrawBounded(PlatformContextSkia*, const AffineTransform&, const SkRect&, const SkPaint&);
 
 private:
-    void didDraw(const PlatformContextSkia*, const AffineTransform&, const SkRect&, const SkPaint&, bool drawsOpaque, bool fillsBounds);
+    void didDraw(PlatformContextSkia*, const AffineTransform&, const SkRect&, const SkPaint&, bool drawsOpaque, bool fillsBounds);
     void didDrawUnbounded(const SkPaint&, bool drawsOpaque);
     void markRectAsOpaque(const SkRect&);
     void markRectAsNonOpaque(const SkRect&);
diff --git a/Source/WebCore/platform/graphics/skia/PatternSkia.cpp b/Source/WebCore/platform/graphics/skia/PatternSkia.cpp
index cd6a6676e..cc91c63da 100644
--- a/Source/WebCore/platform/graphics/skia/PatternSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/PatternSkia.cpp
@@ -38,12 +38,18 @@
 #include "SkColorShader.h"
 #include "SkShader.h"
 
+#include <v8.h>
+
 namespace WebCore {
 
 void Pattern::platformDestroy()
 {
     SkSafeUnref(m_pattern);
     m_pattern = 0;
+    if (m_externalMemoryAllocated) {
+        v8::V8::AdjustAmountOfExternalAllocatedMemory(-m_externalMemoryAllocated);
+        m_externalMemoryAllocated = 0;
+    }
 }
 
 PlatformPatternPtr Pattern::platformPattern(const AffineTransform& patternTransform)
@@ -89,6 +95,9 @@ PlatformPatternPtr Pattern::platformPattern(const AffineTransform& patternTransf
         SkCanvas canvas(bm2);
         canvas.drawBitmap(image->bitmap(), 0, 0);
         m_pattern = SkShader::CreateBitmapShader(bm2, tileModeX, tileModeY);
+
+        m_externalMemoryAllocated = bm2.getSafeSize();
+        v8::V8::AdjustAmountOfExternalAllocatedMemory(m_externalMemoryAllocated);
     }
     m_pattern->setLocalMatrix(m_patternSpaceTransformation);
     return m_pattern;
diff --git a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index 3a677e2b0..7ee90cadd 100644
--- a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -241,7 +241,7 @@ void PlatformContextSkia::beginLayerClippedToImage(const FloatRect& rect,
 
     canvas()->clipRect(bounds);
 
-    if (imageBuffer->size().isEmpty())
+    if (imageBuffer->internalSize().isEmpty())
         return;
 
     canvas()->saveLayerAlpha(&bounds, 255,
@@ -267,11 +267,6 @@ void PlatformContextSkia::clipPathAntiAliased(const SkPath& clipPath)
     canvas()->clipPath(clipPath, SkRegion::kIntersect_Op, true);
 }
 
-const SkBitmap& PlatformContextSkia::clippedToImage() const
-{
-    return m_state->m_imageBufferClip;
-}
-
 void PlatformContextSkia::restore()
 {
     if (!m_state->m_imageBufferClip.empty()) {
diff --git a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.h b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.h
index b306450cb..8d7a2e684 100644
--- a/Source/WebCore/platform/graphics/skia/PlatformContextSkia.h
+++ b/Source/WebCore/platform/graphics/skia/PlatformContextSkia.h
@@ -100,8 +100,6 @@ public:
     // NOTE: |imageBuffer| may be deleted before the |restore| is invoked.
     void beginLayerClippedToImage(const FloatRect&, const ImageBuffer*);
     void clipPathAntiAliased(const SkPath&);
-    // If non-empty, the layer is clipped to the bitmap.
-    const SkBitmap& clippedToImage() const;
 
     // Sets up the common flags on a paint for antialiasing, effects, etc.
     // This is implicitly called by setupPaintFill and setupPaintStroke, but
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapper.h b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
index af2d59e7f..4c07cab63 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapper.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapper.h
@@ -20,8 +20,12 @@
 #ifndef TextureMapper_h
 #define TextureMapper_h
 
+#if PLATFORM(QT)
+#include <qglobal.h>
+#endif
+
 #if USE(ACCELERATED_COMPOSITING)
-#if (defined(QT_OPENGL_LIB))
+#if defined(QT_OPENGL_LIB) || (QT_VERSION >= QT_VERSION_CHECK(5, 0, 0))
     #if defined(QT_OPENGL_ES_2) && !defined(TEXMAP_OPENGL_ES_2)
         #define TEXMAP_OPENGL_ES_2
     #endif
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
index 746a1d89b..80cf9fa67 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.cpp
@@ -223,42 +223,6 @@ struct TextureMapperGLData {
     RefPtr<BitmapTexture> currentSurface;
 };
 
-class BitmapTextureGL : public BitmapTexture {
-public:
-    virtual void destroy();
-    virtual IntSize size() const;
-    virtual bool isValid() const;
-    virtual void didReset();
-    void bind();
-    void initializeStencil();
-    ~BitmapTextureGL() { destroy(); }
-    virtual uint32_t id() const { return m_id; }
-    inline FloatSize relativeSize() const { return m_relativeSize; }
-    void setTextureMapper(TextureMapperGL* texmap) { m_textureMapper = texmap; }
-    void updateContents(Image*, const IntRect&, const IntRect&, PixelFormat);
-    void updateContents(const void*, const IntRect&);
-
-private:
-    GLuint m_id;
-    FloatSize m_relativeSize;
-    IntSize m_textureSize;
-    IntRect m_dirtyRect;
-    GLuint m_fbo;
-    GLuint m_rbo;
-    bool m_surfaceNeedsReset;
-    TextureMapperGL* m_textureMapper;
-    BitmapTextureGL()
-        : m_id(0)
-        , m_fbo(0)
-        , m_rbo(0)
-        , m_surfaceNeedsReset(true)
-        , m_textureMapper(0)
-    {
-    }
-
-    friend class TextureMapperGL;
-};
-
 void TextureMapperGLData::initializeStencil()
 {
     if (currentSurface) {
@@ -354,15 +318,11 @@ void TextureMapperGL::drawTexture(const BitmapTexture& texture, const FloatRect&
 
 void TextureMapperGL::drawTexture(uint32_t texture, Flags flags, const FloatSize& relativeSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture)
 {
+    RefPtr<TextureMapperShaderProgram> shaderInfo;
     if (maskTexture)
-        drawTextureWithMaskAndOpacity(texture, flags, relativeSize, targetRect, modelViewMatrix, opacity, maskTexture);
+        shaderInfo = data().sharedGLData().textureMapperShaderManager.getShaderProgram<TextureMapperShaderProgramOpacityAndMask>();
     else
-        drawTextureSimple(texture, flags, relativeSize, targetRect, modelViewMatrix, opacity, maskTexture);
-}
-
-void TextureMapperGL::drawTextureWithMaskAndOpacity(uint32_t texture, Flags flags, const FloatSize& relativeSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture* maskTexture)
-{
-    RefPtr<TextureMapperShaderProgramOpacityAndMask> shaderInfo = data().sharedGLData().textureMapperShaderManager.getShaderProgram<TextureMapperShaderProgramOpacityAndMask>();
+        shaderInfo = data().sharedGLData().textureMapperShaderManager.getShaderProgram<TextureMapperShaderProgramSimple>();
 
     GL_CMD(glUseProgram(shaderInfo->id()))
     GL_CMD(glEnableVertexAttribArray(shaderInfo->vertexAttrib()))
@@ -392,63 +352,10 @@ void TextureMapperGL::drawTextureWithMaskAndOpacity(uint32_t texture, Flags flag
     GL_CMD(glUniformMatrix4fv(shaderInfo->matrixVariable(), 1, GL_FALSE, m4))
     GL_CMD(glUniformMatrix4fv(shaderInfo->sourceMatrixVariable(), 1, GL_FALSE, m4src))
     GL_CMD(glUniform1i(shaderInfo->sourceTextureVariable(), 0))
-    GL_CMD(glUniform1f(shaderInfo->opacityVariable(), opacity))
-
-    if (maskTexture->isValid()) {
-        const BitmapTextureGL* maskTextureGL = static_cast<const BitmapTextureGL*>(maskTexture);
-        GL_CMD(glActiveTexture(GL_TEXTURE1))
-        GL_CMD(glBindTexture(GL_TEXTURE_2D, maskTextureGL->id()))
-        const GLfloat m4mask[] = {maskTextureGL->relativeSize().width(), 0, 0, 0,
-                                         0, maskTextureGL->relativeSize().height(), 0, 0,
-                                         0, 0, 1, 0,
-                                         0, 0, 0, 1};
-        GL_CMD(glUniformMatrix4fv(shaderInfo->maskMatrixVariable(), 1, GL_FALSE, m4mask));
-        GL_CMD(glUniform1i(shaderInfo->maskTextureVariable(), 1))
-        GL_CMD(glActiveTexture(GL_TEXTURE0))
-    }
-
-    GL_CMD(glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA))
-    GL_CMD(glEnable(GL_BLEND))
-
-    GL_CMD(glDrawArrays(GL_TRIANGLE_FAN, 0, 4))
-    GL_CMD(glDisableVertexAttribArray(shaderInfo->vertexAttrib()))
-}
-
-void TextureMapperGL::drawTextureSimple(uint32_t texture, Flags flags, const FloatSize& relativeSize, const FloatRect& targetRect, const TransformationMatrix& modelViewMatrix, float opacity, const BitmapTexture*)
-{
-    RefPtr<TextureMapperShaderProgramSimple> shaderInfo = data().sharedGLData().textureMapperShaderManager.getShaderProgram<TextureMapperShaderProgramSimple>();
-
-    GL_CMD(glUseProgram(shaderInfo->id()))
-    GL_CMD(glEnableVertexAttribArray(shaderInfo->vertexAttrib()))
-    GL_CMD(glActiveTexture(GL_TEXTURE0))
-    GL_CMD(glBindTexture(GL_TEXTURE_2D, texture))
-    GL_CMD(glBindBuffer(GL_ARRAY_BUFFER, 0))
-    const GLfloat unitRect[] = {0, 0, 1, 0, 1, 1, 0, 1};
-    GL_CMD(glVertexAttribPointer(shaderInfo->vertexAttrib(), 2, GL_FLOAT, GL_FALSE, 0, unitRect))
-
-    TransformationMatrix matrix = TransformationMatrix(data().projectionMatrix).multiply(modelViewMatrix).multiply(TransformationMatrix(
-            targetRect.width(), 0, 0, 0,
-            0, targetRect.height(), 0, 0,
-            0, 0, 1, 0,
-            targetRect.x(), targetRect.y(), 0, 1));
 
-    const GLfloat m4[] = {
-        matrix.m11(), matrix.m12(), matrix.m13(), matrix.m14(),
-        matrix.m21(), matrix.m22(), matrix.m23(), matrix.m24(),
-        matrix.m31(), matrix.m32(), matrix.m33(), matrix.m34(),
-        matrix.m41(), matrix.m42(), matrix.m43(), matrix.m44()
-    };
-    const GLfloat m4src[] = {relativeSize.width(), 0, 0, 0,
-                                     0, relativeSize.height() * ((flags & ShouldFlipTexture) ? -1 : 1), 0, 0,
-                                     0, 0, 1, 0,
-                                     0, (flags & ShouldFlipTexture) ? relativeSize.height() : 0, 0, 1};
-
-    GL_CMD(glUniformMatrix4fv(shaderInfo->matrixVariable(), 1, GL_FALSE, m4))
-    GL_CMD(glUniformMatrix4fv(shaderInfo->sourceMatrixVariable(), 1, GL_FALSE, m4src))
-    GL_CMD(glUniform1i(shaderInfo->sourceTextureVariable(), 0))
-    GL_CMD(glUniform1f(shaderInfo->opacityVariable(), opacity))
+    shaderInfo->prepare(opacity, maskTexture);
 
-    bool needsBlending = (flags & SupportsBlending) || opacity < 0.99;
+    bool needsBlending = (flags & SupportsBlending) || opacity < 0.99 || maskTexture;
 
     if (needsBlending) {
         GL_CMD(glBlendFunc(GL_ONE, GL_ONE_MINUS_SRC_ALPHA))
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
index 3e598904b..9e474015b 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperGL.h
@@ -24,6 +24,7 @@
 
 #include "FloatQuad.h"
 #include "IntSize.h"
+#include "OpenGLShims.h"
 #include "TextureMapper.h"
 #include "TransformationMatrix.h"
 
@@ -31,6 +32,7 @@ namespace WebCore {
 
 class TextureMapperGLData;
 class GraphicsContext;
+class TextureMapperShaderProgram;
 
 // An OpenGL-ES2 implementation of TextureMapper.
 class TextureMapperGL : public TextureMapper {
@@ -48,8 +50,6 @@ public:
     // reimps from TextureMapper
     virtual void drawTexture(const BitmapTexture&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
     virtual void drawTexture(uint32_t texture, Flags, const FloatSize&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
-    virtual void drawTextureWithMaskAndOpacity(uint32_t texture, Flags, const FloatSize&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
-    virtual void drawTextureSimple(uint32_t texture, Flags, const FloatSize&, const FloatRect&, const TransformationMatrix&, float opacity, const BitmapTexture* maskTexture);
     virtual void bindSurface(BitmapTexture* surface);
     virtual void beginClip(const TransformationMatrix&, const FloatRect&);
     virtual void beginPainting();
@@ -73,6 +73,42 @@ private:
     friend class BitmapTextureGL;
 };
 
+class BitmapTextureGL : public BitmapTexture {
+public:
+    virtual void destroy();
+    virtual IntSize size() const;
+    virtual bool isValid() const;
+    virtual void didReset();
+    void bind();
+    void initializeStencil();
+    ~BitmapTextureGL() { destroy(); }
+    virtual uint32_t id() const { return m_id; }
+    inline FloatSize relativeSize() const { return m_relativeSize; }
+    void setTextureMapper(TextureMapperGL* texmap) { m_textureMapper = texmap; }
+    void updateContents(Image*, const IntRect&, const IntRect&, PixelFormat);
+    void updateContents(const void*, const IntRect&);
+
+private:
+    GLuint m_id;
+    FloatSize m_relativeSize;
+    IntSize m_textureSize;
+    IntRect m_dirtyRect;
+    GLuint m_fbo;
+    GLuint m_rbo;
+    bool m_surfaceNeedsReset;
+    TextureMapperGL* m_textureMapper;
+    BitmapTextureGL()
+        : m_id(0)
+        , m_fbo(0)
+        , m_rbo(0)
+        , m_surfaceNeedsReset(true)
+        , m_textureMapper(0)
+    {
+    }
+
+    friend class TextureMapperGL;
+};
+
 // An offscreen buffer to be rendered by software.
 static inline int nextPowerOfTwo(int num)
 {
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
index 0b363a33a..22e67df5b 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperImageBuffer.h
@@ -32,7 +32,7 @@ public:
     static PassRefPtr<BitmapTexture> create() { return adoptRef(new BitmapTextureImageBuffer); }
     ~BitmapTextureImageBuffer() { destroy(); }
     virtual void destroy() { m_image.clear(); }
-    virtual IntSize size() const { return m_image->size(); }
+    virtual IntSize size() const { return m_image->internalSize(); }
     virtual void didReset();
     virtual bool isValid() const { return m_image; }
     inline GraphicsContext* graphicsContext() { return m_image ? m_image->context() : 0; }
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
index 3eb34d16e..9e52ca2b1 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.cpp
@@ -22,6 +22,8 @@
 
 #if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
 
+#include "TextureMapperGL.h"
+
 namespace WebCore {
 
 #ifndef TEXMAP_OPENGL_ES_2
@@ -144,16 +146,21 @@ TextureMapperShaderProgramSimple::TextureMapperShaderProgramSimple()
     getUniformLocation(m_opacityVariable, "Opacity");
 }
 
-const char* TextureMapperShaderProgramSimple::vertexShaderSource()
+const char* TextureMapperShaderProgramSimple::vertexShaderSource() const
 {
     return vertexShaderSourceSimple;
 }
 
-const char* TextureMapperShaderProgramSimple::fragmentShaderSource()
+const char* TextureMapperShaderProgramSimple::fragmentShaderSource() const
 {
     return fragmentShaderSourceSimple;
 }
 
+void TextureMapperShaderProgramSimple::prepare(float opacity, const BitmapTexture* maskTexture)
+{
+    glUniform1f(m_opacityVariable, opacity);
+}
+
 PassRefPtr<TextureMapperShaderProgramOpacityAndMask> TextureMapperShaderProgramOpacityAndMask::create()
 {
     return adoptRef(new TextureMapperShaderProgramOpacityAndMask());
@@ -170,16 +177,34 @@ TextureMapperShaderProgramOpacityAndMask::TextureMapperShaderProgramOpacityAndMa
     getUniformLocation(m_opacityVariable, "Opacity");
 }
 
-const char* TextureMapperShaderProgramOpacityAndMask::vertexShaderSource()
+const char* TextureMapperShaderProgramOpacityAndMask::vertexShaderSource() const
 {
     return vertexShaderSourceOpacityAndMask;
 }
 
-const char* TextureMapperShaderProgramOpacityAndMask::fragmentShaderSource()
+const char* TextureMapperShaderProgramOpacityAndMask::fragmentShaderSource() const
 {
     return fragmentShaderSourceOpacityAndMask;
 }
 
+void TextureMapperShaderProgramOpacityAndMask::prepare(float opacity, const BitmapTexture* maskTexture)
+{
+    glUniform1f(m_opacityVariable, opacity);
+    if (!maskTexture || !maskTexture->isValid())
+        return;
+
+    const BitmapTextureGL* maskTextureGL = static_cast<const BitmapTextureGL*>(maskTexture);
+    glActiveTexture(GL_TEXTURE1);
+    glBindTexture(GL_TEXTURE_2D, maskTextureGL->id());
+    const GLfloat m4mask[] = {maskTextureGL->relativeSize().width(), 0, 0, 0,
+                                     0, maskTextureGL->relativeSize().height(), 0, 0,
+                                     0, 0, 1, 0,
+                                     0, 0, 0, 1};
+    glUniformMatrix4fv(m_maskMatrixVariable, 1, GL_FALSE, m4mask);
+    glUniform1i(m_maskTextureVariable, 1);
+    glActiveTexture(GL_TEXTURE0);
+}
+
 TextureMapperShaderManager::TextureMapperShaderManager()
 {
     ASSERT(initializeOpenGLShims());
diff --git a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
index 53aeaaacc..4502e7e3a 100644
--- a/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
+++ b/Source/WebCore/platform/graphics/texmap/TextureMapperShaderManager.h
@@ -35,6 +35,7 @@ namespace WebCore {
 
 typedef void* ShaderType;
 
+class BitmapTexture;
 class TextureMapperShaderManager;
 
 class TextureMapperShaderProgram : public RefCounted<TextureMapperShaderProgram> {
@@ -51,57 +52,53 @@ public:
         return &type;
     }
 
+    virtual void prepare(float opacity, const BitmapTexture*) { }
+    GLint matrixVariable() const { return m_matrixVariable; }
+    GLint sourceMatrixVariable() const { return m_sourceMatrixVariable; }
+    GLint sourceTextureVariable() const { return m_sourceTextureVariable; }
+    GLint opacityVariable() const { return m_opacityVariable; }
+
 protected:
     void getUniformLocation(GLint& var, const char* name);
     void initializeProgram();
-    virtual const char* vertexShaderSource() = 0;
-    virtual const char* fragmentShaderSource() = 0;
+    virtual const char* vertexShaderSource() const = 0;
+    virtual const char* fragmentShaderSource() const = 0;
 
     GLuint m_id;
     GLuint m_vertexAttrib;
     GLuint m_vertexShader;
     GLuint m_fragmentShader;
+    GLint m_matrixVariable;
+    GLint m_sourceMatrixVariable;
+    GLint m_sourceTextureVariable;
+    GLint m_opacityVariable;
 };
 
 class TextureMapperShaderProgramSimple : public TextureMapperShaderProgram {
 public:
     static PassRefPtr<TextureMapperShaderProgramSimple> create();
-    GLint matrixVariable() { return m_matrixVariable; }
-    GLint sourceMatrixVariable() { return m_sourceMatrixVariable; }
-    GLint sourceTextureVariable() { return m_sourceTextureVariable; }
-    GLint opacityVariable() { return m_opacityVariable; }
+    virtual void prepare(float opacity, const BitmapTexture*);
 
 private:
-    virtual const char* vertexShaderSource();
-    virtual const char* fragmentShaderSource();
+    virtual const char* vertexShaderSource() const;
+    virtual const char* fragmentShaderSource() const;
     TextureMapperShaderProgramSimple();
-    GLint m_matrixVariable;
-    GLint m_sourceMatrixVariable;
-    GLint m_sourceTextureVariable;
-    GLint m_opacityVariable;
 };
 
 class TextureMapperShaderProgramOpacityAndMask : public TextureMapperShaderProgram {
 public:
     static PassRefPtr<TextureMapperShaderProgramOpacityAndMask> create();
-    GLint sourceMatrixVariable() { return m_sourceMatrixVariable; }
-    GLint matrixVariable() { return m_matrixVariable; }
-    GLint maskMatrixVariable() { return m_maskMatrixVariable; }
-    GLint sourceTextureVariable() { return m_sourceTextureVariable; }
-    GLint maskTextureVariable() { return m_maskTextureVariable; }
-    GLint opacityVariable() { return m_opacityVariable; }
+    virtual void prepare(float opacity, const BitmapTexture*);
+    GLint maskMatrixVariable() const { return m_maskMatrixVariable; }
+    GLint maskTextureVariable() const { return m_maskTextureVariable; }
 
 private:
     static int m_classID;
-    virtual const char* vertexShaderSource();
-    virtual const char* fragmentShaderSource();
+    virtual const char* vertexShaderSource() const;
+    virtual const char* fragmentShaderSource() const;
     TextureMapperShaderProgramOpacityAndMask();
-    GLint m_sourceMatrixVariable;
-    GLint m_matrixVariable;
     GLint m_maskMatrixVariable;
-    GLint m_sourceTextureVariable;
     GLint m_maskTextureVariable;
-    GLint m_opacityVariable;
 };
 
 class TextureMapperShaderManager {
diff --git a/Source/WebCore/platform/graphics/transforms/TransformState.cpp b/Source/WebCore/platform/graphics/transforms/TransformState.cpp
index f094c608d..a8fb8f32d 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformState.cpp
+++ b/Source/WebCore/platform/graphics/transforms/TransformState.cpp
@@ -49,7 +49,7 @@ TransformState& TransformState::operator=(const TransformState& other)
     return *this;
 }
 
-void TransformState::move(int x, int y, TransformAccumulation accumulate)
+void TransformState::move(LayoutUnit x, LayoutUnit y, TransformAccumulation accumulate)
 {
     if (m_accumulatingTransform && m_accumulatedTransform) {
         // If we're accumulating into an existing transform, apply the translation.
diff --git a/Source/WebCore/platform/graphics/transforms/TransformState.h b/Source/WebCore/platform/graphics/transforms/TransformState.h
index 7236010b2..c25d26619 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformState.h
+++ b/Source/WebCore/platform/graphics/transforms/TransformState.h
@@ -30,6 +30,7 @@
 #include "FloatPoint.h"
 #include "FloatQuad.h"
 #include "IntSize.h"
+#include "LayoutTypes.h"
 #include "TransformationMatrix.h"
 #include <wtf/OwnPtr.h>
 
@@ -74,12 +75,12 @@ public:
     
     void setQuad(const FloatQuad& quad) { m_lastPlanarQuad = quad; }
     
-    void move(const IntSize& s, TransformAccumulation accumulate = FlattenTransform)
+    void move(const LayoutSize& s, TransformAccumulation accumulate = FlattenTransform)
     {
         move(s.width(), s.height(), accumulate);
     }
     
-    void move(int x, int y, TransformAccumulation = FlattenTransform);
+    void move(LayoutUnit x, LayoutUnit y, TransformAccumulation = FlattenTransform);
     void applyTransform(const AffineTransform& transformFromContainer, TransformAccumulation = FlattenTransform);
     void applyTransform(const TransformationMatrix& transformFromContainer, TransformAccumulation = FlattenTransform);
     void flatten();
diff --git a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
index c21f6c1b7..1cf96f842 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
+++ b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.cpp
@@ -28,6 +28,7 @@
 #include "TransformationMatrix.h"
 
 #include "AffineTransform.h"
+#include "FractionalLayoutRect.h"
 #include "FloatPoint3D.h"
 #include "FloatRect.h"
 #include "FloatQuad.h"
@@ -587,10 +588,10 @@ FloatQuad TransformationMatrix::projectQuad(const FloatQuad& q) const
 static float clampEdgeValue(float f)
 {
     ASSERT(!isnan(f));
-    return min<float>(max<float>(f, -numeric_limits<int>::max() / 2), numeric_limits<int>::max() / 2);
+    return min<float>(max<float>(f, -numeric_limits<LayoutUnit>::max() / 2), numeric_limits<LayoutUnit>::max() / 2);
 }
 
-IntRect TransformationMatrix::clampedBoundsOfProjectedQuad(const FloatQuad& q) const
+LayoutRect TransformationMatrix::clampedBoundsOfProjectedQuad(const FloatQuad& q) const
 {
     FloatRect mappedQuadBounds = projectQuad(q).boundingBox();
 
@@ -599,18 +600,18 @@ IntRect TransformationMatrix::clampedBoundsOfProjectedQuad(const FloatQuad& q) c
 
     float right;
     if (isinf(mappedQuadBounds.x()) && isinf(mappedQuadBounds.width()))
-        right = numeric_limits<int>::max() / 2;
+        right = numeric_limits<LayoutUnit>::max() / 2;
     else
         right = clampEdgeValue(ceilf(mappedQuadBounds.maxX()));
 
     float bottom;
     if (isinf(mappedQuadBounds.y()) && isinf(mappedQuadBounds.height()))
-        bottom = numeric_limits<int>::max() / 2;
+        bottom = numeric_limits<LayoutUnit>::max() / 2;
     else
         bottom = clampEdgeValue(ceilf(mappedQuadBounds.maxY()));
     
-    return IntRect(clampToInteger(left), clampToInteger(top), 
-                   clampToInteger(right - left), clampToInteger(bottom - top));
+    return LayoutRect(clampToLayoutUnit(left), clampToLayoutUnit(top), 
+                      clampToLayoutUnit(right - left), clampToLayoutUnit(bottom - top));
 }
 
 FloatPoint TransformationMatrix::mapPoint(const FloatPoint& p) const
@@ -640,6 +641,11 @@ IntRect TransformationMatrix::mapRect(const IntRect &rect) const
     return enclosingIntRect(mapRect(FloatRect(rect)));
 }
 
+FractionalLayoutRect TransformationMatrix::mapRect(const FractionalLayoutRect& r) const
+{
+    return enclosingFractionalLayoutRect(mapRect(FloatRect(r)));
+}
+
 FloatRect TransformationMatrix::mapRect(const FloatRect& r) const
 {
     if (isIdentityOrTranslation()) {
diff --git a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
index a98d70e03..5b5dad520 100644
--- a/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
+++ b/Source/WebCore/platform/graphics/transforms/TransformationMatrix.h
@@ -28,6 +28,7 @@
 
 #include "FloatPoint.h"
 #include "IntPoint.h"
+#include "LayoutTypes.h"
 #include <string.h> //for memcpy
 #include <wtf/FastAllocBase.h>
 
@@ -41,6 +42,7 @@ typedef struct CGAffineTransform CGAffineTransform;
 #elif PLATFORM(OPENVG)
 #include "VGUtils.h"
 #elif PLATFORM(QT)
+#include <QMatrix4x4>
 #include <QTransform>
 #elif USE(SKIA)
 #include <SkMatrix.h>
@@ -60,6 +62,7 @@ namespace WebCore {
 
 class AffineTransform;
 class IntRect;
+class FractionalLayoutRect;
 class FloatPoint3D;
 class FloatRect;
 class FloatQuad;
@@ -82,6 +85,7 @@ public:
 
 #if PLATFORM(QT)
     TransformationMatrix(const QTransform&);
+    TransformationMatrix(const QMatrix4x4&);
 #endif
 
     void setMatrix(double a, double b, double c, double d, double e, double f)
@@ -146,6 +150,7 @@ public:
     // Rounds the resulting mapped rectangle out. This is helpful for bounding
     // box computations but may not be what is wanted in other contexts.
     IntRect mapRect(const IntRect&) const;
+    FractionalLayoutRect mapRect(const FractionalLayoutRect&) const;
 
     // If the matrix has 3D components, the z component of the result is
     // dropped, effectively projecting the quad into the z=0 plane
@@ -161,7 +166,7 @@ public:
     FloatQuad projectQuad(const FloatQuad&) const;
     // Projects the four corners of the quad and takes a bounding box,
     // while sanitizing values created when the w component is negative.
-    IntRect clampedBoundsOfProjectedQuad(const FloatQuad&) const;
+    LayoutRect clampedBoundsOfProjectedQuad(const FloatQuad&) const;
 
     double m11() const { return m_matrix[0][0]; }
     void setM11(double f) { m_matrix[0][0] = f; }
@@ -328,6 +333,7 @@ public:
     operator VGMatrix() const;
 #elif PLATFORM(QT)
     operator QTransform() const;
+    operator QMatrix4x4() const;
 #elif USE(SKIA)
     operator SkMatrix() const;
 #elif PLATFORM(WX) && USE(WXGC)
diff --git a/Source/WebCore/platform/graphics/win/QTDecompressionSession.h b/Source/WebCore/platform/graphics/win/QTDecompressionSession.h
index 67b663588..98964b270 100644
--- a/Source/WebCore/platform/graphics/win/QTDecompressionSession.h
+++ b/Source/WebCore/platform/graphics/win/QTDecompressionSession.h
@@ -34,7 +34,7 @@
 
 #include "QTPixelBuffer.h"
 
-#include <WTF/PassOwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 class QTDecompressionSessionClient;
 typedef struct OpaqueICMDecompressionSession*  ICMDecompressionSessionRef;
diff --git a/Source/WebCore/platform/graphics/win/QTMovie.h b/Source/WebCore/platform/graphics/win/QTMovie.h
index 38b3473b1..3ab05065a 100644
--- a/Source/WebCore/platform/graphics/win/QTMovie.h
+++ b/Source/WebCore/platform/graphics/win/QTMovie.h
@@ -27,7 +27,8 @@
 #define QTMovie_h
 
 #include "QTTrack.h"
-#include <WTF/Vector.h>
+#include <wtf/Vector.h>
+#include <wtf/unicode/Unicode.h>
 
 #ifdef QTMOVIEWIN_EXPORTS
 #define QTMOVIEWIN_API __declspec(dllexport)
diff --git a/Source/WebCore/platform/graphics/win/QTMovieGWorld.h b/Source/WebCore/platform/graphics/win/QTMovieGWorld.h
index 495fe25f9..4f34c2cfc 100644
--- a/Source/WebCore/platform/graphics/win/QTMovieGWorld.h
+++ b/Source/WebCore/platform/graphics/win/QTMovieGWorld.h
@@ -28,9 +28,8 @@
 
 
 #include "QTMovie.h"
-#include <Unicode.h>
-#include <WTF/RefCounted.h>
-#include <WTF/RefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
 #include <windows.h>
 
 #ifdef QTMOVIEWIN_EXPORTS
diff --git a/Source/WebCore/platform/graphics/win/QTMovieTask.h b/Source/WebCore/platform/graphics/win/QTMovieTask.h
index e394d6ec9..93e221065 100644
--- a/Source/WebCore/platform/graphics/win/QTMovieTask.h
+++ b/Source/WebCore/platform/graphics/win/QTMovieTask.h
@@ -26,7 +26,7 @@
 #ifndef QTMovieTask_h
 #define QTMovieTask_h
 
-#include <WTF/HashSet.h>
+#include <wtf/HashSet.h>
 
 #ifdef QTMOVIEWIN_EXPORTS
 #define QTMOVIEWIN_API __declspec(dllexport)
diff --git a/Source/WebCore/platform/graphics/win/QTMovieVisualContext.h b/Source/WebCore/platform/graphics/win/QTMovieVisualContext.h
index 8410208e1..a813e3c6f 100644
--- a/Source/WebCore/platform/graphics/win/QTMovieVisualContext.h
+++ b/Source/WebCore/platform/graphics/win/QTMovieVisualContext.h
@@ -35,8 +35,8 @@
 #include "QTMovie.h"
 #include "QTMovieTask.h"
 #include "QTPixelBuffer.h"
-#include <WTF/OwnPtr.h>
-#include <WTF/RefCounted.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/RefCounted.h>
 
 typedef const struct __CFDictionary* CFDictionaryRef;
 typedef struct OpaqueQTVisualContext*   QTVisualContextRef;
diff --git a/Source/WebCore/platform/graphics/win/QTTrack.h b/Source/WebCore/platform/graphics/win/QTTrack.h
index bda56448d..516a4f22d 100644
--- a/Source/WebCore/platform/graphics/win/QTTrack.h
+++ b/Source/WebCore/platform/graphics/win/QTTrack.h
@@ -26,12 +26,10 @@
 #ifndef QTTrack_h
 #define QTTrack_h
 
-#include <Unicode.h>
 #include <windows.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
-// We must include this after <Unicode.h>, or the definition of OSErr will change:
 #include <CoreGraphics/CGAffineTransform.h>
 
 #ifdef QTMOVIEWIN_EXPORTS
diff --git a/Source/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp b/Source/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
index 606956763..b70782b82 100644
--- a/Source/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
+++ b/Source/WebCore/platform/graphics/win/SimpleFontDataCairoWin.cpp
@@ -34,6 +34,7 @@
 #include "Font.h"
 #include "FontCache.h"
 #include "FontDescription.h"
+#include "HWndDC.h"
 #include <cairo.h>
 #include <cairo-win32.h>
 #include <mlang.h>
@@ -55,27 +56,30 @@ void SimpleFontData::platformInit()
         m_fontMetrics.reset();
         m_avgCharWidth = 0;
         m_maxCharWidth = 0;
+        m_isSystemFont = false;
+        m_scriptCache = 0;
+        m_scriptFontProperties = 0;
         return;
     }
 
-    HDC hdc = GetDC(0);
-    SaveDC(hdc);
+    HWndDC dc(0);
+    SaveDC(dc);
 
     cairo_scaled_font_t* scaledFont = m_platformData.scaledFont();
     const double metricsMultiplier = cairo_win32_scaled_font_get_metrics_factor(scaledFont) * m_platformData.size();
 
-    cairo_win32_scaled_font_select_font(scaledFont, hdc);
+    cairo_win32_scaled_font_select_font(scaledFont, dc);
 
     TEXTMETRIC textMetrics;
-    GetTextMetrics(hdc, &textMetrics);
+    GetTextMetrics(dc, &textMetrics);
     float ascent = textMetrics.tmAscent * metricsMultiplier;
     float descent = textMetrics.tmDescent * metricsMultiplier;
     float xHeight = ascent * 0.56f; // Best guess for xHeight for non-Truetype fonts.
     float lineGap = textMetrics.tmExternalLeading * metricsMultiplier;
 
-    int faceLength = ::GetTextFace(hdc, 0, 0);
+    int faceLength = ::GetTextFace(dc, 0, 0);
     Vector<WCHAR> faceName(faceLength);
-    ::GetTextFace(hdc, faceLength, faceName.data());
+    ::GetTextFace(dc, faceLength, faceName.data());
     m_isSystemFont = !wcscmp(faceName.data(), L"Lucida Grande");
  
     ascent = ascentConsideringMacAscentHack(faceName.data(), ascent, descent);
@@ -87,21 +91,17 @@ void SimpleFontData::platformInit()
     m_avgCharWidth = textMetrics.tmAveCharWidth * metricsMultiplier;
     m_maxCharWidth = textMetrics.tmMaxCharWidth * metricsMultiplier;
 
-    OUTLINETEXTMETRIC metrics;
-    if (GetOutlineTextMetrics(hdc, sizeof(metrics), &metrics) > 0) {
-        // This is a TrueType font.  We might be able to get an accurate xHeight
-        GLYPHMETRICS gm;
-        MAT2 mat = { 1, 0, 0, 1 };
-        DWORD len = GetGlyphOutline(hdc, 'x', GGO_METRICS, &gm, 0, 0, &mat);
-        if (len != GDI_ERROR && gm.gmptGlyphOrigin.y > 0)
-            xHeight = gm.gmptGlyphOrigin.y * metricsMultiplier;
-    }
+    cairo_text_extents_t extents;
+    cairo_scaled_font_text_extents(scaledFont, "x", &extents);
+    xHeight = -extents.y_bearing;
 
     m_fontMetrics.setXHeight(xHeight);
     cairo_win32_scaled_font_done_font(scaledFont);
 
-    RestoreDC(hdc, -1);
-    ReleaseDC(0, hdc);
+    m_scriptCache = 0;
+    m_scriptFontProperties = 0;
+
+    RestoreDC(dc, -1);
 }
 
 FloatRect SimpleFontData::platformBoundsForGlyph(Glyph glyph) const
@@ -120,19 +120,18 @@ float SimpleFontData::platformWidthForGlyph(Glyph glyph) const
     if (!m_platformData.size())
         return 0;
 
-    HDC hdc = GetDC(0);
-    SaveDC(hdc);
+    HWndDC dc(0);
+    SaveDC(dc);
 
     cairo_scaled_font_t* scaledFont = m_platformData.scaledFont();
-    cairo_win32_scaled_font_select_font(scaledFont, hdc);
+    cairo_win32_scaled_font_select_font(scaledFont, dc);
 
     int width;
-    GetCharWidthI(hdc, glyph, 1, 0, &width);
+    GetCharWidthI(dc, glyph, 1, 0, &width);
 
     cairo_win32_scaled_font_done_font(scaledFont);
 
-    RestoreDC(hdc, -1);
-    ReleaseDC(0, hdc);
+    RestoreDC(dc, -1);
 
     const double metricsMultiplier = cairo_win32_scaled_font_get_metrics_factor(scaledFont) * m_platformData.size();
     return width * metricsMultiplier;
diff --git a/Source/WebCore/platform/graphics/wince/ImageBufferWinCE.cpp b/Source/WebCore/platform/graphics/wince/ImageBufferWinCE.cpp
index 0d4e0ba60..bdbe62db9 100644
--- a/Source/WebCore/platform/graphics/wince/ImageBufferWinCE.cpp
+++ b/Source/WebCore/platform/graphics/wince/ImageBufferWinCE.cpp
@@ -88,11 +88,6 @@ ImageBuffer::~ImageBuffer()
 {
 }
 
-size_t ImageBuffer::dataSize() const
-{
-    return m_size.width() * m_size.height() * 4;
-}
-
 GraphicsContext* ImageBuffer::context() const
 {
     return m_context.get();
diff --git a/Source/WebCore/platform/graphics/wx/ImageBufferWx.cpp b/Source/WebCore/platform/graphics/wx/ImageBufferWx.cpp
index 2dbb1961d..800bc8709 100644
--- a/Source/WebCore/platform/graphics/wx/ImageBufferWx.cpp
+++ b/Source/WebCore/platform/graphics/wx/ImageBufferWx.cpp
@@ -48,12 +48,6 @@ ImageBuffer::~ImageBuffer()
 {
 }
 
-size_t ImageBuffer::dataSize() const
-{
-    notImplemented();
-    return 0;
-}
-
 GraphicsContext* ImageBuffer::context() const
 {
     notImplemented();
diff --git a/Source/WebCore/platform/gtk/ClipboardGtk.cpp b/Source/WebCore/platform/gtk/ClipboardGtk.cpp
index b20216760..b22adf4a4 100644
--- a/Source/WebCore/platform/gtk/ClipboardGtk.cpp
+++ b/Source/WebCore/platform/gtk/ClipboardGtk.cpp
@@ -18,7 +18,6 @@
 #include "ClipboardGtk.h"
 
 #include "CachedImage.h"
-#include "DOMStringList.h"
 #include "DragData.h"
 #include "Editor.h"
 #include "Element.h"
@@ -143,13 +142,8 @@ void ClipboardGtk::clearAllData()
         PasteboardHelper::defaultPasteboardHelper()->writeClipboardContents(m_clipboard);
 }
 
-String ClipboardGtk::getData(const String& typeString, bool& success) const
+String ClipboardGtk::getData(const String& typeString) const
 {
-    success = true; // According to http://www.whatwg.org/specs/web-apps/current-work/multipage/dnd.html
-    // "The getData(format) method must return the data that is associated with the type format converted
-    // to ASCII lowercase, if any, and must return the empty string otherwise." Since success == false 
-    // results in an 'undefined' return value, we always want to return success == true. This parameter
-    // should eventually be removed.
     if (policy() != ClipboardReadable || !m_dataObject)
         return String();
 
@@ -190,33 +184,33 @@ bool ClipboardGtk::setData(const String& typeString, const String& data)
     return success;
 }
 
-PassRefPtr<DOMStringList> ClipboardGtk::types() const
+HashSet<String> ClipboardGtk::types() const
 {
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
-        return DOMStringList::create();
+        return HashSet<String>();
 
     if (m_clipboard)
         PasteboardHelper::defaultPasteboardHelper()->getClipboardContents(m_clipboard);
 
-    RefPtr<DOMStringList> types = DOMStringList::create();
+    HashSet<String> types;
     if (m_dataObject->hasText()) {
-        types->append("text/plain");
-        types->append("Text");
-        types->append("text");
+        types.add("text/plain");
+        types.add("Text");
+        types.add("text");
     }
 
     if (m_dataObject->hasMarkup())
-        types->append("text/html");
+        types.add("text/html");
 
     if (m_dataObject->hasURIList()) {
-        types->append("text/uri-list");
-        types->append("URL");
+        types.add("text/uri-list");
+        types.add("URL");
     }
 
     if (m_dataObject->hasFilenames())
-        types->append("Files");
+        types.add("Files");
 
-    return types.release();
+    return types;
 }
 
 PassRefPtr<FileList> ClipboardGtk::files() const
diff --git a/Source/WebCore/platform/gtk/ClipboardGtk.h b/Source/WebCore/platform/gtk/ClipboardGtk.h
index b72e1c81b..9af53e5f5 100644
--- a/Source/WebCore/platform/gtk/ClipboardGtk.h
+++ b/Source/WebCore/platform/gtk/ClipboardGtk.h
@@ -54,10 +54,10 @@ namespace WebCore {
 
         void clearData(const String&);
         void clearAllData();
-        String getData(const String&, bool&) const;
+        String getData(const String&) const;
         bool setData(const String&, const String&);
 
-        virtual PassRefPtr<DOMStringList> types() const;
+        virtual HashSet<String> types() const;
         virtual PassRefPtr<FileList> files() const;
 
         void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/gtk/RunLoopGtk.cpp b/Source/WebCore/platform/gtk/RunLoopGtk.cpp
index 929a7b98e..e6ee6c0f5 100644
--- a/Source/WebCore/platform/gtk/RunLoopGtk.cpp
+++ b/Source/WebCore/platform/gtk/RunLoopGtk.cpp
@@ -27,43 +27,74 @@
 #include "config.h"
 #include "RunLoop.h"
 
+#include <gdk/gdk.h>
 #include <glib.h>
 
 namespace WebCore {
 
 RunLoop::RunLoop()
 {
+    // g_main_context_default() doesn't add an extra reference.
     m_runLoopContext = g_main_context_default();
     ASSERT(m_runLoopContext);
-    m_runLoopMain = g_main_loop_new(m_runLoopContext, FALSE);
-    ASSERT(m_runLoopMain);
+    GRefPtr<GMainLoop> innermostLoop = adoptGRef(g_main_loop_new(m_runLoopContext.get(), FALSE));
+    ASSERT(innermostLoop);
+    m_runLoopMainLoops.append(innermostLoop);
 }
 
 RunLoop::~RunLoop()
 {
-    if (m_runLoopMain) {
-        if (g_main_loop_is_running(m_runLoopMain))
-            g_main_loop_quit(m_runLoopMain);
-        g_main_loop_unref(m_runLoopMain);
+    for (int i = m_runLoopMainLoops.size() - 1; i >= 0; --i) {
+        if (!g_main_loop_is_running(m_runLoopMainLoops[i].get()))
+            continue;
+        g_main_loop_quit(m_runLoopMainLoops[i].get());
     }
-
-    if (m_runLoopContext)
-        g_main_context_unref(m_runLoopContext);
 }
 
 void RunLoop::run()
 {
-    g_main_loop_run(RunLoop::main()->mainLoop());
+    RunLoop* mainRunLoop = RunLoop::main();
+    GMainLoop* innermostLoop = mainRunLoop->innermostLoop();
+    if (!g_main_loop_is_running(innermostLoop)) {
+        g_main_loop_run(innermostLoop);
+        return;
+    }
+
+    // Create and run a nested loop if the innermost one was already running.
+    GMainLoop* nestedMainLoop = g_main_loop_new(0, FALSE);
+    mainRunLoop->pushNestedMainLoop(nestedMainLoop);
+    g_main_loop_run(nestedMainLoop);
+    mainRunLoop->popNestedMainLoop();
+}
+
+GMainLoop* RunLoop::innermostLoop()
+{
+    // The innermost main loop should always be there.
+    ASSERT(!m_runLoopMainLoops.isEmpty());
+    return m_runLoopMainLoops[0].get();
+}
+
+void RunLoop::pushNestedMainLoop(GMainLoop* nestedLoop)
+{
+    // The innermost main loop should always be there.
+    ASSERT(!m_runLoopMainLoops.isEmpty());
+    m_runLoopMainLoops.append(adoptGRef(nestedLoop));
 }
 
-GMainLoop* RunLoop::mainLoop()
+void RunLoop::popNestedMainLoop()
 {
-    return m_runLoopMain;
+    // The innermost main loop should always be there.
+    ASSERT(!m_runLoopMainLoops.isEmpty());
+    m_runLoopMainLoops.removeLast();
 }
 
 void RunLoop::stop()
 {
-    g_main_loop_quit(m_runLoopMain);
+    // The innermost main loop should always be there.
+    ASSERT(!m_runLoopMainLoops.isEmpty());
+    GRefPtr<GMainLoop> lastMainLoop = m_runLoopMainLoops.last();
+    if (g_main_loop_is_running(lastMainLoop.get()))
+        g_main_loop_quit(lastMainLoop.get());
 }
 
 gboolean RunLoop::queueWork(RunLoop* runLoop)
@@ -77,9 +108,9 @@ void RunLoop::wakeUp()
     GRefPtr<GSource> source = adoptGRef(g_idle_source_new());
     g_source_set_priority(source.get(), G_PRIORITY_DEFAULT);
     g_source_set_callback(source.get(), reinterpret_cast<GSourceFunc>(&RunLoop::queueWork), this, 0);
-    g_source_attach(source.get(), m_runLoopContext);
+    g_source_attach(source.get(), m_runLoopContext.get());
 
-    g_main_context_wakeup(m_runLoopContext);
+    g_main_context_wakeup(m_runLoopContext.get());
 }
 
 RunLoop::TimerBase::TimerBase(RunLoop* runLoop)
@@ -117,7 +148,7 @@ void RunLoop::TimerBase::start(double fireInterval, bool repeat)
     m_timerSource = adoptGRef(g_timeout_source_new(static_cast<guint>(fireInterval * 1000)));
     m_isRepeating = repeat;
     g_source_set_callback(m_timerSource.get(), reinterpret_cast<GSourceFunc>(&RunLoop::TimerBase::timerFiredCallback), this, 0);
-    g_source_attach(m_timerSource.get(), m_runLoop->m_runLoopContext);
+    g_source_attach(m_timerSource.get(), m_runLoop->m_runLoopContext.get());
 }
 
 void RunLoop::TimerBase::stop()
diff --git a/Source/WebCore/platform/gtk/ScrollbarThemeGtk.cpp b/Source/WebCore/platform/gtk/ScrollbarThemeGtk.cpp
index e99364f2a..94e3fd76f 100644
--- a/Source/WebCore/platform/gtk/ScrollbarThemeGtk.cpp
+++ b/Source/WebCore/platform/gtk/ScrollbarThemeGtk.cpp
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-static HashSet<Scrollbar*>* gScrollbars;
+static HashSet<ScrollbarThemeClient*>* gScrollbars;
 
 ScrollbarTheme* ScrollbarTheme::nativeTheme()
 {
@@ -45,14 +45,14 @@ ScrollbarThemeGtk::~ScrollbarThemeGtk()
 {
 }
 
-void ScrollbarThemeGtk::registerScrollbar(Scrollbar* scrollbar)
+void ScrollbarThemeGtk::registerScrollbar(ScrollbarThemeClient* scrollbar)
 {
     if (!gScrollbars)
-        gScrollbars = new HashSet<Scrollbar*>;
+        gScrollbars = new HashSet<ScrollbarThemeClient*>;
     gScrollbars->add(scrollbar);
 }
 
-void ScrollbarThemeGtk::unregisterScrollbar(Scrollbar* scrollbar)
+void ScrollbarThemeGtk::unregisterScrollbar(ScrollbarThemeClient* scrollbar)
 {
     gScrollbars->remove(scrollbar);
     if (gScrollbars->isEmpty()) {
@@ -69,9 +69,9 @@ void ScrollbarThemeGtk::updateScrollbarsFrameThickness()
     // Update the thickness of every interior frame scrollbar widget. The
     // platform-independent scrollbar them code isn't yet smart enough to get
     // this information when it paints.
-    HashSet<Scrollbar*>::iterator end = gScrollbars->end();
-    for (HashSet<Scrollbar*>::iterator it = gScrollbars->begin(); it != end; ++it) {
-        Scrollbar* scrollbar = (*it);
+    HashSet<ScrollbarThemeClient*>::iterator end = gScrollbars->end();
+    for (HashSet<ScrollbarThemeClient*>::iterator it = gScrollbars->begin(); it != end; ++it) {
+        ScrollbarThemeClient* scrollbar = (*it);
 
         // Top-level scrollbar i.e. scrollbars who have a parent ScrollView
         // with no parent are native, and thus do not need to be resized.
@@ -86,14 +86,14 @@ void ScrollbarThemeGtk::updateScrollbarsFrameThickness()
     }
 }
 
-bool ScrollbarThemeGtk::hasThumb(Scrollbar* scrollbar)
+bool ScrollbarThemeGtk::hasThumb(ScrollbarThemeClient* scrollbar)
 {
     // This method is just called as a paint-time optimization to see if
     // painting the thumb can be skipped.  We don't have to be exact here.
     return thumbLength(scrollbar) > 0;
 }
 
-IntRect ScrollbarThemeGtk::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+IntRect ScrollbarThemeGtk::backButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool)
 {
     if (part == BackButtonEndPart && !m_hasBackButtonEndPart)
         return IntRect();
@@ -114,7 +114,7 @@ IntRect ScrollbarThemeGtk::backButtonRect(Scrollbar* scrollbar, ScrollbarPart pa
     return IntRect(x, scrollbar->y() + scrollbar->height() - m_troughBorderWidth - (2 * size.height()), size.width(), size.height());
 }
 
-IntRect ScrollbarThemeGtk::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+IntRect ScrollbarThemeGtk::forwardButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool)
 {
     if (part == ForwardButtonStartPart && !m_hasForwardButtonStartPart)
         return IntRect();
@@ -140,7 +140,7 @@ IntRect ScrollbarThemeGtk::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart
     return IntRect(x, scrollbar->y() + m_troughBorderWidth + size.height(), size.width(), size.height());
 }
 
-IntRect ScrollbarThemeGtk::trackRect(Scrollbar* scrollbar, bool)
+IntRect ScrollbarThemeGtk::trackRect(ScrollbarThemeClient* scrollbar, bool)
 {
     // The padding along the thumb movement axis includes the trough border
     // plus the size of stepper spacing (the space between the stepper and
@@ -180,7 +180,7 @@ IntRect ScrollbarThemeGtk::trackRect(Scrollbar* scrollbar, bool)
                    thickness, scrollbar->height() - (2 * movementAxisPadding) - buttonsWidth);
 }
 
-IntRect ScrollbarThemeGtk::thumbRect(Scrollbar* scrollbar, const IntRect& unconstrainedTrackRect)
+IntRect ScrollbarThemeGtk::thumbRect(ScrollbarThemeClient* scrollbar, const IntRect& unconstrainedTrackRect)
 {
     IntRect trackRect = constrainTrackRectToTrackPieces(scrollbar, unconstrainedTrackRect);
     int thumbPos = thumbPosition(scrollbar);
@@ -191,7 +191,7 @@ IntRect ScrollbarThemeGtk::thumbRect(Scrollbar* scrollbar, const IntRect& uncons
     return IntRect(trackRect.x() + (trackRect.width() - m_thumbFatness) / 2, trackRect.y() + thumbPos, m_thumbFatness, thumbLength(scrollbar));
 }
 
-bool ScrollbarThemeGtk::paint(Scrollbar* scrollbar, GraphicsContext* graphicsContext, const IntRect& damageRect)
+bool ScrollbarThemeGtk::paint(ScrollbarThemeClient* scrollbar, GraphicsContext* graphicsContext, const IntRect& damageRect)
 {
     if (graphicsContext->paintingDisabled())
         return false;
@@ -260,7 +260,7 @@ bool ScrollbarThemeGtk::paint(Scrollbar* scrollbar, GraphicsContext* graphicsCon
     return true;
 }
 
-bool ScrollbarThemeGtk::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& event)
+bool ScrollbarThemeGtk::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& event)
 {
     return (event.shiftKey() && event.button() == LeftButton) || (event.button() == MiddleButton);
 }
@@ -270,7 +270,7 @@ int ScrollbarThemeGtk::scrollbarThickness(ScrollbarControlSize)
     return m_thumbFatness + (m_troughBorderWidth * 2);
 }
 
-IntSize ScrollbarThemeGtk::buttonSize(Scrollbar* scrollbar)
+IntSize ScrollbarThemeGtk::buttonSize(ScrollbarThemeClient* scrollbar)
 {
     if (scrollbar->orientation() == VerticalScrollbar)
         return IntSize(m_thumbFatness, m_stepperSize);
@@ -279,7 +279,7 @@ IntSize ScrollbarThemeGtk::buttonSize(Scrollbar* scrollbar)
     return IntSize(m_stepperSize, m_thumbFatness);
 }
 
-int ScrollbarThemeGtk::minimumThumbLength(Scrollbar* scrollbar)
+int ScrollbarThemeGtk::minimumThumbLength(ScrollbarThemeClient* scrollbar)
 {
     return m_minThumbLength;
 }
diff --git a/Source/WebCore/platform/gtk/ScrollbarThemeGtk.h b/Source/WebCore/platform/gtk/ScrollbarThemeGtk.h
index 45e093b1e..e73df2855 100644
--- a/Source/WebCore/platform/gtk/ScrollbarThemeGtk.h
+++ b/Source/WebCore/platform/gtk/ScrollbarThemeGtk.h
@@ -37,29 +37,29 @@ public:
     ScrollbarThemeGtk();
     virtual ~ScrollbarThemeGtk();
 
-    virtual bool hasButtons(Scrollbar*) { return true; }
-    virtual bool hasThumb(Scrollbar*);
-    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool);
-    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool);
-    virtual IntRect trackRect(Scrollbar*, bool);
-    IntRect thumbRect(Scrollbar*, const IntRect& unconstrainedTrackRect);
-    bool paint(Scrollbar*, GraphicsContext*, const IntRect& damageRect);
-    void paintScrollbarBackground(GraphicsContext*, Scrollbar*);
-    void paintTrackBackground(GraphicsContext*, Scrollbar*, const IntRect&);
-    void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
-    virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-    virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
+    virtual bool hasButtons(ScrollbarThemeClient*) { return true; }
+    virtual bool hasThumb(ScrollbarThemeClient*);
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool);
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool);
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool);
+    IntRect thumbRect(ScrollbarThemeClient*, const IntRect& unconstrainedTrackRect);
+    bool paint(ScrollbarThemeClient*, GraphicsContext*, const IntRect& damageRect);
+    void paintScrollbarBackground(GraphicsContext*, ScrollbarThemeClient*);
+    void paintTrackBackground(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+    void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+    virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+    virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
     virtual int scrollbarThickness(ScrollbarControlSize);
-    virtual IntSize buttonSize(Scrollbar*);
-    virtual int minimumThumbLength(Scrollbar*);
+    virtual IntSize buttonSize(ScrollbarThemeClient*);
+    virtual int minimumThumbLength(ScrollbarThemeClient*);
 
     // TODO: These are the default GTK+ values. At some point we should pull these from the theme itself.
     virtual double initialAutoscrollTimerDelay() { return 0.20; }
     virtual double autoscrollTimerDelay() { return 0.02; }
     void updateThemeProperties();
     void updateScrollbarsFrameThickness();
-    void registerScrollbar(Scrollbar*);
-    void unregisterScrollbar(Scrollbar*);
+    void registerScrollbar(ScrollbarThemeClient*);
+    void unregisterScrollbar(ScrollbarThemeClient*);
 
 protected:
 #ifndef GTK_API_VERSION_2
diff --git a/Source/WebCore/platform/gtk/ScrollbarThemeGtk2.cpp b/Source/WebCore/platform/gtk/ScrollbarThemeGtk2.cpp
index 729bd124d..866bb8a1d 100644
--- a/Source/WebCore/platform/gtk/ScrollbarThemeGtk2.cpp
+++ b/Source/WebCore/platform/gtk/ScrollbarThemeGtk2.cpp
@@ -66,13 +66,13 @@ void ScrollbarThemeGtk::updateThemeProperties()
     updateScrollbarsFrameThickness();
 }
 
-static GtkWidget* getWidgetForScrollbar(Scrollbar* scrollbar)
+static GtkWidget* getWidgetForScrollbar(ScrollbarThemeClient* scrollbar)
 {
     RenderThemeGtk* theme = static_cast<RenderThemeGtk*>(RenderTheme::defaultTheme().get());
     return scrollbar->orientation() == VerticalScrollbar ? theme->gtkVScrollbar() : theme->gtkHScrollbar();
 }
 
-void ScrollbarThemeGtk::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeGtk::paintTrackBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     // Paint the track background. If the trough-under-steppers property is true, this
     // should be the full size of the scrollbar, but if is false, it should only be the
@@ -87,7 +87,7 @@ void ScrollbarThemeGtk::paintTrackBackground(GraphicsContext* context, Scrollbar
                               GTK_STATE_ACTIVE, GTK_SHADOW_IN, "trough");
 }
 
-void ScrollbarThemeGtk::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
+void ScrollbarThemeGtk::paintScrollbarBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar)
 {
     IntRect fullScrollbarRect = IntRect(scrollbar->x(), scrollbar->y(), scrollbar->width(), scrollbar->height());
 
@@ -96,7 +96,7 @@ void ScrollbarThemeGtk::paintScrollbarBackground(GraphicsContext* context, Scrol
                               GTK_STATE_NORMAL, GTK_SHADOW_IN, "scrolled_window");
 }
 
-void ScrollbarThemeGtk::paintThumb(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeGtk::paintThumb(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     GtkWidget* widget = getWidgetForScrollbar(scrollbar);
     gboolean activateSlider;
@@ -129,7 +129,7 @@ void ScrollbarThemeGtk::paintThumb(GraphicsContext* context, Scrollbar* scrollba
     widgetContext.gtkPaintSlider(sliderRect, widget, stateType, shadowType, "slider", orientation);
 }
 
-void ScrollbarThemeGtk::paintButton(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+void ScrollbarThemeGtk::paintButton(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
     // The buttons will be disabled if the thumb is as the appropriate extreme.
     GtkShadowType shadowType = GTK_SHADOW_OUT;
diff --git a/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp b/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp
index 4c33e66db..9749c543f 100644
--- a/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp
+++ b/Source/WebCore/platform/gtk/ScrollbarThemeGtk3.cpp
@@ -72,7 +72,7 @@ static void applyScrollbarStyleContextClasses(GtkStyleContext* context, Scrollba
     gtk_style_context_add_class(context, orientation == VerticalScrollbar ?  GTK_STYLE_CLASS_VERTICAL : GTK_STYLE_CLASS_HORIZONTAL);
 }
 
-void ScrollbarThemeGtk::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeGtk::paintTrackBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     // Paint the track background. If the trough-under-steppers property is true, this
     // should be the full size of the scrollbar, but if is false, it should only be the
@@ -94,7 +94,7 @@ void ScrollbarThemeGtk::paintTrackBackground(GraphicsContext* context, Scrollbar
     gtk_style_context_restore(m_context);
 }
 
-void ScrollbarThemeGtk::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
+void ScrollbarThemeGtk::paintScrollbarBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar)
 {
     gtk_style_context_save(m_context);
 
@@ -105,7 +105,7 @@ void ScrollbarThemeGtk::paintScrollbarBackground(GraphicsContext* context, Scrol
     gtk_style_context_restore(m_context);
 }
 
-void ScrollbarThemeGtk::paintThumb(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeGtk::paintThumb(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     gtk_style_context_save(m_context);
 
@@ -126,7 +126,7 @@ void ScrollbarThemeGtk::paintThumb(GraphicsContext* context, Scrollbar* scrollba
     gtk_style_context_restore(m_context);
 }
 
-void ScrollbarThemeGtk::paintButton(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+void ScrollbarThemeGtk::paintButton(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
     gtk_style_context_save(m_context);
 
diff --git a/Source/WebCore/platform/image-decoders/ImageDecoder.cpp b/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
index 34caf0abe..d9e969092 100644
--- a/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/ImageDecoder.cpp
@@ -31,7 +31,9 @@
 #include "ICOImageDecoder.h"
 #include "JPEGImageDecoder.h"
 #include "PNGImageDecoder.h"
+#if USE(WEBP)
 #include "WEBPImageDecoder.h"
+#endif
 #include "SharedBuffer.h"
 
 using namespace std;
diff --git a/Source/WebCore/platform/image-decoders/ImageDecoder.h b/Source/WebCore/platform/image-decoders/ImageDecoder.h
index 9d9b34f60..20122fffb 100644
--- a/Source/WebCore/platform/image-decoders/ImageDecoder.h
+++ b/Source/WebCore/platform/image-decoders/ImageDecoder.h
@@ -64,7 +64,7 @@ namespace WebCore {
             DisposeOverwritePrevious  // Clear frame to previous framebuffer
                                       // contents
         };
-#if USE(SKIA) || PLATFORM(QT)
+#if USE(SKIA) || (PLATFORM(QT) && USE(QT_IMAGE_DECODER))
         typedef uint32_t PixelData;
 #else
         typedef unsigned PixelData;
@@ -140,7 +140,7 @@ namespace WebCore {
         {
 #if USE(SKIA)
             return m_bitmap.bitmap().getAddr32(x, y);
-#elif PLATFORM(QT)
+#elif PLATFORM(QT) && USE(QT_IMAGE_DECODER)
             m_image = m_pixmap.toImage();
             m_pixmap = QPixmap();
             return reinterpret_cast_ptr<QRgb*>(m_image.scanLine(y)) + x;
@@ -149,7 +149,7 @@ namespace WebCore {
 #endif
         }
 
-#if PLATFORM(QT)
+#if PLATFORM(QT) && USE(QT_IMAGE_DECODER)
         void setPixmap(const QPixmap& pixmap);
 #endif
 
@@ -190,7 +190,7 @@ namespace WebCore {
 #if PLATFORM(CHROMIUM) && OS(DARWIN)
         ColorProfile m_colorProfile;
 #endif
-#elif PLATFORM(QT)
+#elif PLATFORM(QT) && USE(QT_IMAGE_DECODER)
         mutable QPixmap m_pixmap;
         mutable QImage m_image;
         bool m_hasAlpha;
diff --git a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
index f0fbe44ac..d9910c92b 100644
--- a/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
@@ -103,7 +103,11 @@ void init_source(j_decompress_ptr jd);
 boolean fill_input_buffer(j_decompress_ptr jd);
 void skip_input_data(j_decompress_ptr jd, long num_bytes);
 void term_source(j_decompress_ptr jd);
+#if PLATFORM(QT)
+void error_exit(j_common_ptr) NO_RETURN;
+#else
 void error_exit(j_common_ptr cinfo);
+#endif
 
 // Implementation of a JPEG src object that understands our state machine
 struct decoder_source_mgr {
@@ -243,6 +247,14 @@ public:
             case JCS_YCbCr:
                 // libjpeg can convert GRAYSCALE and YCbCr image pixels to RGB.
                 m_info.out_color_space = rgbOutputColorSpace();
+#if defined(TURBO_JPEG_RGB_SWIZZLE)
+                if (m_info.saw_JFIF_marker)
+                    break;
+                // FIXME: Swizzle decoding does not support Adobe transform=0
+                // images (yet), so revert to using JSC_RGB in that case.
+                if (m_info.saw_Adobe_marker && !m_info.Adobe_transform)
+                    m_info.out_color_space = JCS_RGB;
+#endif
                 break;
             case JCS_CMYK:
             case JCS_YCCK:
@@ -489,7 +501,9 @@ bool JPEGImageDecoder::outputScanlines()
         if (!buffer.setSize(scaledSize().width(), scaledSize().height()))
             return setFailed();
         buffer.setStatus(ImageFrame::FramePartial);
-        buffer.setHasAlpha(false);
+        // The buffer is transparent outside the decoded area while the image is
+        // loading. The completed image will be marked fully opaque in jpegComplete().
+        buffer.setHasAlpha(true);
         buffer.setColorProfile(m_colorProfile);
 
         // For JPEGs, the frame always fills the entire image.
@@ -557,7 +571,9 @@ void JPEGImageDecoder::jpegComplete()
 
     // Hand back an appropriately sized buffer, even if the image ended up being
     // empty.
-    m_frameBufferCache[0].setStatus(ImageFrame::FrameComplete);
+    ImageFrame& buffer = m_frameBufferCache[0];
+    buffer.setStatus(ImageFrame::FrameComplete);
+    buffer.setHasAlpha(false);
 }
 
 void JPEGImageDecoder::decode(bool onlySize)
diff --git a/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp b/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
index c50ebe957..bcca47401 100644
--- a/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
+++ b/Source/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
@@ -64,6 +64,9 @@ const double cInverseGamma = 0.45455;
 const unsigned long cMaxPNGSize = 1000000UL;
 
 // Called if the decoding of the image fails.
+#if PLATFORM(QT)
+static void PNGAPI decodingFailed(png_structp, png_const_charp) NO_RETURN;
+#endif
 static void PNGAPI decodingFailed(png_structp png, png_const_charp)
 {
     longjmp(JMPBUF(png), 1);
diff --git a/Source/WebCore/platform/image-decoders/qt/ImageFrameQt.cpp b/Source/WebCore/platform/image-decoders/qt/ImageFrameQt.cpp
index 1ead9a9ac..999ac2903 100644
--- a/Source/WebCore/platform/image-decoders/qt/ImageFrameQt.cpp
+++ b/Source/WebCore/platform/image-decoders/qt/ImageFrameQt.cpp
@@ -30,11 +30,10 @@
 
 #include "NotImplemented.h"
 
-#include <QPixmap>
-#include <stdio.h>
-
 namespace WebCore {
 
+#if USE(QT_IMAGE_DECODER)
+
 ImageFrame::ImageFrame()
     : m_hasAlpha(false) 
     , m_size()
@@ -154,4 +153,21 @@ int ImageFrame::height() const
     return m_size.height();
 }
 
+#else
+
+QPixmap* ImageFrame::asNewNativeImage() const
+{
+    QImage::Format fmt;
+    if (m_hasAlpha)
+        fmt = m_premultiplyAlpha ?  QImage::Format_ARGB32_Premultiplied : QImage::Format_ARGB32;
+    else
+        fmt = QImage::Format_RGB32;
+
+    QImage img(reinterpret_cast<uchar*>(m_bytes), m_size.width(), m_size.height(), sizeof(PixelData) * m_size.width(), fmt);
+
+    return new QPixmap(QPixmap::fromImage(img));
+}
+
+#endif // USE(QT_IMAGE_DECODER)
+
 }
diff --git a/Source/WebCore/platform/mac/ClipboardMac.h b/Source/WebCore/platform/mac/ClipboardMac.h
index a84f289dc..7f6ad85a7 100644
--- a/Source/WebCore/platform/mac/ClipboardMac.h
+++ b/Source/WebCore/platform/mac/ClipboardMac.h
@@ -31,7 +31,6 @@
 #include <wtf/RetainPtr.h>
 
 OBJC_CLASS NSImage;
-OBJC_CLASS NSPasteboard;
 
 namespace WebCore {
 
@@ -50,13 +49,13 @@ public:
     
     void clearData(const String& type);
     void clearAllData();
-    String getData(const String& type, bool& success) const;
+    String getData(const String& type) const;
     bool setData(const String& type, const String& data);
     
     virtual bool hasData();
     
     // extensions beyond IE's API
-    virtual PassRefPtr<DOMStringList> types() const;
+    virtual HashSet<String> types() const;
     virtual PassRefPtr<FileList> files() const;
 
     void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/mac/ClipboardMac.mm b/Source/WebCore/platform/mac/ClipboardMac.mm
index 88eefcb53..a4933f335 100644
--- a/Source/WebCore/platform/mac/ClipboardMac.mm
+++ b/Source/WebCore/platform/mac/ClipboardMac.mm
@@ -27,7 +27,6 @@
 #import "ClipboardMac.h"
 
 #import "DOMElementInternal.h"
-#import "DOMStringList.h"
 #import "DragClient.h"
 #import "DragController.h"
 #import "DragData.h"
@@ -112,15 +111,15 @@ static String utiTypeFromCocoaType(const String& type)
     return String();
 }
 
-static void addHTMLClipboardTypesForCocoaType(DOMStringList* resultTypes, const String& cocoaType, const String& pasteboardName)
+static void addHTMLClipboardTypesForCocoaType(HashSet<String>& resultTypes, const String& cocoaType, const String& pasteboardName)
 {
     // UTI may not do these right, so make sure we get the right, predictable result
     if (cocoaType == String(NSStringPboardType)) {
-        resultTypes->append("text/plain");
+        resultTypes.add("text/plain");
         return;
     }
     if (cocoaType == String(NSURLPboardType)) {
-        resultTypes->append("text/uri-list");
+        resultTypes.add("text/uri-list");
         return;
     }
     if (cocoaType == String(NSFilenamesPboardType)) {
@@ -132,18 +131,18 @@ static void addHTMLClipboardTypesForCocoaType(DOMStringList* resultTypes, const
         if (!fileList.isEmpty()) {
             // It is unknown if NSFilenamesPboardType always implies NSURLPboardType in Cocoa,
             // but NSFilenamesPboardType should imply both 'text/uri-list' and 'Files'
-            resultTypes->append("text/uri-list");
-            resultTypes->append("Files");
+            resultTypes.add("text/uri-list");
+            resultTypes.add("Files");
         }
         return;
     }
     String utiType = utiTypeFromCocoaType(cocoaType);
     if (!utiType.isEmpty()) {
-        resultTypes->append(utiType);
+        resultTypes.add(utiType);
         return;
     }
     // No mapping, just pass the whole string though
-    resultTypes->append(cocoaType);
+    resultTypes.add(cocoaType);
 }
 
 void ClipboardMac::clearData(const String& type)
@@ -212,9 +211,8 @@ static Vector<String> absoluteURLsFromPasteboard(const String& pasteboardName, b
     return Vector<String>();
 }
 
-String ClipboardMac::getData(const String& type, bool& success) const
+String ClipboardMac::getData(const String& type) const
 {
-    success = false;
     if (policy() != ClipboardReadable)
         return String();
 
@@ -236,7 +234,6 @@ String ClipboardMac::getData(const String& type, bool& success) const
     // Enforce changeCount ourselves for security.  We check after reading instead of before to be
     // sure it doesn't change between our testing the change count and accessing the data.
     if (!cocoaValue.isEmpty() && m_changeCount == platformStrategies()->pasteboardStrategy()->changeCount(m_pasteboardName)) {
-        success = true;
         return cocoaValue;
     }
 
@@ -284,10 +281,10 @@ bool ClipboardMac::setData(const String &type, const String &data)
     return false;
 }
 
-PassRefPtr<DOMStringList> ClipboardMac::types() const
+HashSet<String> ClipboardMac::types() const
 {
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
-        return DOMStringList::create();
+        return HashSet<String>();
 
     Vector<String> types;
     platformStrategies()->pasteboardStrategy()->getTypes(types, m_pasteboardName);
@@ -295,19 +292,19 @@ PassRefPtr<DOMStringList> ClipboardMac::types() const
     // Enforce changeCount ourselves for security.  We check after reading instead of before to be
     // sure it doesn't change between our testing the change count and accessing the data.
     if (m_changeCount != platformStrategies()->pasteboardStrategy()->changeCount(m_pasteboardName))
-        return DOMStringList::create();
+        return HashSet<String>();
 
-    RefPtr<DOMStringList> result = DOMStringList::create();
+    HashSet<String> result;
     // FIXME: This loop could be split into two stages. One which adds all the HTML5 specified types
     // and a second which adds all the extra types from the cocoa clipboard (which is Mac-only behavior).
     for (size_t i = 0; i < types.size(); i++) {
         if (types[i] == "NeXT plain ascii pasteboard type")
             continue;   // skip this ancient type that gets auto-supplied by some system conversion
 
-        addHTMLClipboardTypesForCocoaType(result.get(), types[i], m_pasteboardName);
+        addHTMLClipboardTypesForCocoaType(result, types[i], m_pasteboardName);
     }
 
-    return result.release();
+    return result;
 }
 
 // FIXME: We could cache the computed fileList if necessary
diff --git a/Source/WebCore/platform/mac/FileSystemMac.mm b/Source/WebCore/platform/mac/FileSystemMac.mm
index f01b7a468..efb7d452e 100644
--- a/Source/WebCore/platform/mac/FileSystemMac.mm
+++ b/Source/WebCore/platform/mac/FileSystemMac.mm
@@ -30,6 +30,9 @@
 #import "FileSystem.h"
 
 #import "PlatformString.h"
+//#import "WebCoreNSStringExtras.h"
+#import "WebCoreNSURLExtras.h"
+#import "WebCoreSystemInterface.h"
 #import <wtf/RetainPtr.h>
 #import <wtf/text/CString.h>
 
@@ -65,6 +68,47 @@ String openTemporaryFile(const String& prefix, PlatformFileHandle& platformFileH
     return String::fromUTF8(temporaryFilePath.data());
 }
 
+typedef struct MetaDataInfo
+{
+    String URLString;
+    String referrer;
+    String path;
+} MetaDataInfo;
+
+static void* setMetaData(void* context)
+{
+    MetaDataInfo *info = (MetaDataInfo *)context;
+    wkSetMetadataURL((NSString *)info->URLString, (NSString *)info->referrer, (NSString *)fileSystemRepresentation(info->path).data());
+    
+    delete info;
+    
+    return 0;
+}
+
+void setMetadataURL(String& URLString, const String& referrer, const String& path)
+{
+    NSURL *URL = URLWithUserTypedString(URLString, nil);
+    if (URL)
+        URLString = userVisibleString(URLByRemovingUserInfo(URL));
+    
+    // Spawn a background thread for WKSetMetadataURL because this function will not return until mds has
+    // journaled the data we're're trying to set. Depending on what other I/O is going on, it can take some
+    // time. 
+    pthread_t tid;
+    pthread_attr_t attr;
+    pthread_attr_init(&attr);
+    pthread_attr_setdetachstate(&attr, PTHREAD_CREATE_DETACHED);
+    
+    MetaDataInfo *info = new MetaDataInfo;
+    
+    info->URLString = URLString;
+    info->referrer = referrer;
+    info->path = path;
+    
+    pthread_create(&tid, &attr, setMetaData, info);
+    pthread_attr_destroy(&attr);
+}
+
 #if !PLATFORM(IOS)
 bool canExcludeFromBackup()
 {
diff --git a/Source/WebCore/platform/mac/HTMLConverter.mm b/Source/WebCore/platform/mac/HTMLConverter.mm
index 5ce5446eb..47d5fe058 100644
--- a/Source/WebCore/platform/mac/HTMLConverter.mm
+++ b/Source/WebCore/platform/mac/HTMLConverter.mm
@@ -818,7 +818,7 @@ static inline NSShadow *_shadowForShadowStyle(NSString *shadowStyle)
         NSUInteger textLength = [_attrStr length];
         NSTextAttachment *attachment = [[NSTextAttachment alloc] initWithFileWrapper:fileWrapper];
         NSTextAttachmentCell *cell;
-        NSString *string = [[NSString alloc] initWithFormat:(needsParagraph ? @"%C\n" : @"%C"), NSAttachmentCharacter];
+        NSString *string = [[NSString alloc] initWithFormat:(needsParagraph ? @"%C\n" : @"%C"), static_cast<unichar>(NSAttachmentCharacter)];
         NSRange rangeToReplace = NSMakeRange(textLength, 0);
         NSDictionary *attrs;
         if (fileWrapper) {
diff --git a/Source/WebCore/platform/mac/KURLMac.mm b/Source/WebCore/platform/mac/KURLMac.mm
index a5d15f5ea..c69d7acce 100644
--- a/Source/WebCore/platform/mac/KURLMac.mm
+++ b/Source/WebCore/platform/mac/KURLMac.mm
@@ -31,6 +31,8 @@
 
 namespace WebCore {
 
+#if !USE(WTFURL)
+
 typedef Vector<char, 512> CharBuffer;
 extern CFURLRef createCFURLFromBuffer(const CharBuffer& buffer);
 
@@ -69,4 +71,20 @@ CFURLRef KURL::createCFURL() const
     return createCFURLFromBuffer(buffer);
 }
 
+#else
+
+KURL::KURL(NSURL *)
+{
+    // FIXME: Add WTFURL Implementation.
+    invalidate();
+}
+
+KURL::operator NSURL *() const
+{
+    // FIXME: Add WTFURL Implementation.
+    return nil;
+}
+
+#endif
+
 }
diff --git a/Source/WebCore/platform/mac/LocalizedStringsMac.mm b/Source/WebCore/platform/mac/LocalizedStringsMac.cpp
index 9d738afae..8cabe86d4 100644
--- a/Source/WebCore/platform/mac/LocalizedStringsMac.mm
+++ b/Source/WebCore/platform/mac/LocalizedStringsMac.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2011 Apple Inc. All rights reserved.
+ * Copyright (C) 2011, 2012 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,32 +23,37 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#import "config.h"
-#import "LocalizedStrings.h"
+#include "config.h"
+#include "LocalizedStrings.h"
 
-#import <wtf/Assertions.h>
-#import <wtf/MainThread.h>
-#import <wtf/RetainPtr.h>
-#import <wtf/text/WTFString.h>
+#include <CoreFoundation/CFBundle.h>
+#include <wtf/Assertions.h>
+#include <wtf/MainThread.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
 String localizedString(const char* key)
 {
-    static NSBundle *bundle = [NSBundle bundleWithIdentifier:@"com.apple.WebCore"];
+    static CFBundleRef bundle = CFBundleGetBundleWithIdentifier(CFSTR("com.apple.WebCore"));
 
 #if !PLATFORM(IOS)
     // Can be called on a dispatch queue when initializing strings on iOS.
     // See LoadWebLocalizedStrings and <rdar://problem/7902473>.
     ASSERT(isMainThread());
 #endif
-    
-    RetainPtr<CFStringRef> keyString(AdoptCF, CFStringCreateWithCStringNoCopy(NULL, key, kCFStringEncodingUTF8, kCFAllocatorNull));
-    NSString *notFound = @"localized string not found";
-    NSString *result = [bundle localizedStringForKey:(NSString *)keyString.get() value:notFound table:nil];
 
-    ASSERT_WITH_MESSAGE(result != notFound, "could not find localizable string %s in bundle", key);
-    return result;
+    RetainPtr<CFStringRef> keyString(AdoptCF, CFStringCreateWithCStringNoCopy(0, key, kCFStringEncodingUTF8, kCFAllocatorNull));
+    CFStringRef notFound = CFSTR("localized string not found");
+    RetainPtr<CFStringRef> result;
+    if (bundle) {
+        result.adoptCF(CFBundleCopyLocalizedString(bundle, keyString.get(), notFound, 0));
+        ASSERT_WITH_MESSAGE(result.get() != notFound, "could not find localizable string %s in bundle", key);
+    } else
+        result = notFound;
+
+    return String(result.get());
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/mac/PlatformPasteboardMac.mm b/Source/WebCore/platform/mac/PlatformPasteboardMac.mm
index d03df24b5..d6a47e6f7 100644
--- a/Source/WebCore/platform/mac/PlatformPasteboardMac.mm
+++ b/Source/WebCore/platform/mac/PlatformPasteboardMac.mm
@@ -45,7 +45,10 @@ void PlatformPasteboard::getTypes(Vector<String>& types)
 
 PassRefPtr<SharedBuffer> PlatformPasteboard::bufferForType(const String& pasteboardType)
 {
-    return SharedBuffer::wrapNSData([[[m_pasteboard.get() dataForType:pasteboardType] copy] autorelease]);
+    NSData *data = [m_pasteboard.get() dataForType:pasteboardType];
+    if (!data)
+        return 0;
+    return SharedBuffer::wrapNSData([[data copy] autorelease]);
 }
 
 void PlatformPasteboard::getPathnamesForType(Vector<String>& pathnames, const String& pasteboardType)
diff --git a/Source/WebCore/platform/mac/RunLoopMac.mm b/Source/WebCore/platform/mac/RunLoopMac.mm
index 46fa4c2cb..717dd8dac 100644
--- a/Source/WebCore/platform/mac/RunLoopMac.mm
+++ b/Source/WebCore/platform/mac/RunLoopMac.mm
@@ -116,7 +116,7 @@ void RunLoop::stop()
     ASSERT(m_runLoop == CFRunLoopGetCurrent());
     
     if (m_runLoop == main()->m_runLoop && m_nestingLevel == 1) {
-        [NSApp stop:nil];
+        [[NSApplication sharedApplication] stop:nil];
         NSEvent *event = [NSEvent otherEventWithType:NSApplicationDefined
                                             location:NSMakePoint(0, 0)
                                        modifierFlags:0
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.h b/Source/WebCore/platform/mac/ScrollAnimatorMac.h
index 3720feb74..4ea6904a5 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.h
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.h
@@ -86,6 +86,8 @@ private:
     virtual bool handleWheelEvent(const PlatformWheelEvent&) OVERRIDE;
 #endif
 
+    virtual void handleWheelEventPhase(PlatformWheelEventPhase) OVERRIDE;
+
     virtual void cancelAnimations();
     virtual void setIsActive();
     
@@ -103,6 +105,7 @@ private:
     virtual void contentAreaDidHide() const;
     void didBeginScrollGesture() const;
     void didEndScrollGesture() const;
+    void mayBeginScrollGesture() const;
 
     virtual void didAddVerticalScrollbar(Scrollbar*);
     virtual void willRemoveVerticalScrollbar(Scrollbar*);
diff --git a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
index 5bcc77549..78b71b01e 100644
--- a/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
+++ b/Source/WebCore/platform/mac/ScrollAnimatorMac.mm
@@ -779,6 +779,17 @@ void ScrollAnimatorMac::didEndScrollGesture() const
         [m_scrollbarPainterController.get() endScrollGesture];
 }
 
+void ScrollAnimatorMac::mayBeginScrollGesture() const
+{
+    if (!scrollableArea()->isOnActivePage())
+        return;
+    if (!isScrollbarOverlayAPIAvailable())
+        return;
+
+    [m_scrollbarPainterController.get() beginScrollGesture];
+    [m_scrollbarPainterController.get() contentAreaScrolled];
+}
+
 void ScrollAnimatorMac::didAddVerticalScrollbar(Scrollbar* scrollbar)
 {
     if (!isScrollbarOverlayAPIAvailable())
@@ -889,6 +900,16 @@ void ScrollAnimatorMac::cancelAnimations()
     }
 }
 
+void ScrollAnimatorMac::handleWheelEventPhase(PlatformWheelEventPhase phase)
+{
+    if (phase == PlatformWheelEventPhaseBegan)
+        didBeginScrollGesture();
+    else if (phase == PlatformWheelEventPhaseEnded || phase == PlatformWheelEventPhaseCancelled)
+        didEndScrollGesture();
+    else if (phase == PlatformWheelEventPhaseMayBegin)
+        mayBeginScrollGesture();
+}
+
 #if ENABLE(RUBBER_BANDING)
 bool ScrollAnimatorMac::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
 {
@@ -911,12 +932,8 @@ bool ScrollAnimatorMac::handleWheelEvent(const PlatformWheelEvent& wheelEvent)
 
     bool didHandleEvent = m_scrollElasticityController.handleWheelEvent(wheelEvent);
 
-    if (didHandleEvent) {
-        if (wheelEvent.phase() == PlatformWheelEventPhaseBegan)
-            didBeginScrollGesture();
-        else if (wheelEvent.phase() == PlatformWheelEventPhaseEnded)
-            didEndScrollGesture();
-    }
+    if (didHandleEvent)
+        handleWheelEventPhase(wheelEvent.phase());
 
     return didHandleEvent;
 }
diff --git a/Source/WebCore/platform/mac/ScrollbarThemeMac.h b/Source/WebCore/platform/mac/ScrollbarThemeMac.h
index 13d44c23d..d14da6db2 100644
--- a/Source/WebCore/platform/mac/ScrollbarThemeMac.h
+++ b/Source/WebCore/platform/mac/ScrollbarThemeMac.h
@@ -39,46 +39,46 @@ public:
 
     void preferencesChanged();
 
-    virtual void updateEnabledState(Scrollbar*);
+    virtual void updateEnabledState(ScrollbarThemeClient*);
 
 #if !PLATFORM(CHROMIUM)
-    virtual bool paint(Scrollbar*, GraphicsContext* context, const IntRect& damageRect);
+    virtual bool paint(ScrollbarThemeClient*, GraphicsContext*, const IntRect& damageRect);
 #endif
 
     virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
     
     virtual bool supportsControlTints() const { return true; }
     virtual bool usesOverlayScrollbars() const;
-    virtual void updateScrollbarOverlayStyle(Scrollbar*);
+    virtual void updateScrollbarOverlayStyle(ScrollbarThemeClient*);
 
     virtual double initialAutoscrollTimerDelay();
     virtual double autoscrollTimerDelay();
 
     virtual ScrollbarButtonsPlacement buttonsPlacement() const;
 
-    virtual void registerScrollbar(Scrollbar*);
-    virtual void unregisterScrollbar(Scrollbar*);
+    virtual void registerScrollbar(ScrollbarThemeClient*);
+    virtual void unregisterScrollbar(ScrollbarThemeClient*);
 
-    void setNewPainterForScrollbar(Scrollbar*, ScrollbarPainter);
-    ScrollbarPainter painterForScrollbar(Scrollbar*);
+    void setNewPainterForScrollbar(ScrollbarThemeClient*, ScrollbarPainter);
+    ScrollbarPainter painterForScrollbar(ScrollbarThemeClient*);
 
     static bool isCurrentlyDrawingIntoLayer();
     static void setIsCurrentlyDrawingIntoLayer(bool);
 
 protected:
-    virtual bool hasButtons(Scrollbar*);
-    virtual bool hasThumb(Scrollbar*);
+    virtual bool hasButtons(ScrollbarThemeClient*);
+    virtual bool hasThumb(ScrollbarThemeClient*);
 
-    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect trackRect(Scrollbar*, bool painting = false);
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false);
 
     virtual int maxOverlapBetweenPages() { return 40; }
 
-    virtual int minimumThumbLength(Scrollbar*);
+    virtual int minimumThumbLength(ScrollbarThemeClient*);
     
-    virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
-    virtual bool shouldDragDocumentInsteadOfThumb(Scrollbar*, const PlatformMouseEvent&);
+    virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
+    virtual bool shouldDragDocumentInsteadOfThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
     int scrollbarPartToHIPressedState(ScrollbarPart);
 
 #if !PLATFORM(CHROMIUM) && USE(ACCELERATED_COMPOSITING) && ENABLE(RUBBER_BANDING)
diff --git a/Source/WebCore/platform/mac/ScrollbarThemeMac.mm b/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
index cc7482457..e47468bd5 100644
--- a/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
+++ b/Source/WebCore/platform/mac/ScrollbarThemeMac.mm
@@ -50,7 +50,7 @@ using namespace WebCore;
 
 namespace WebCore {
 
-typedef HashMap<Scrollbar*, RetainPtr<ScrollbarPainter> > ScrollbarPainterMap;
+typedef HashMap<ScrollbarThemeClient*, RetainPtr<ScrollbarPainter> > ScrollbarPainterMap;
 
 static ScrollbarPainterMap* scrollbarMap()
 {
@@ -162,7 +162,7 @@ static void updateArrowPlacement()
     }
 }
 
-void ScrollbarThemeMac::registerScrollbar(Scrollbar* scrollbar)
+void ScrollbarThemeMac::registerScrollbar(ScrollbarThemeClient* scrollbar)
 {
     if (isScrollbarOverlayAPIAvailable()) {
         bool isHorizontal = scrollbar->orientation() == HorizontalScrollbar;
@@ -175,19 +175,19 @@ void ScrollbarThemeMac::registerScrollbar(Scrollbar* scrollbar)
     }
 }
 
-void ScrollbarThemeMac::unregisterScrollbar(Scrollbar* scrollbar)
+void ScrollbarThemeMac::unregisterScrollbar(ScrollbarThemeClient* scrollbar)
 {
     scrollbarMap()->remove(scrollbar);
 }
 
-void ScrollbarThemeMac::setNewPainterForScrollbar(Scrollbar* scrollbar, ScrollbarPainter newPainter)
+void ScrollbarThemeMac::setNewPainterForScrollbar(ScrollbarThemeClient* scrollbar, ScrollbarPainter newPainter)
 {
     scrollbarMap()->set(scrollbar, newPainter);
     updateEnabledState(scrollbar);
     updateScrollbarOverlayStyle(scrollbar);
 }
 
-ScrollbarPainter ScrollbarThemeMac::painterForScrollbar(Scrollbar* scrollbar)
+ScrollbarPainter ScrollbarThemeMac::painterForScrollbar(ScrollbarThemeClient* scrollbar)
 {
     return scrollbarMap()->get(scrollbar).get();
 }
@@ -248,10 +248,10 @@ bool ScrollbarThemeMac::usesOverlayScrollbars() const
         return false;
 }
 
-void ScrollbarThemeMac::updateScrollbarOverlayStyle(Scrollbar* scrollbar)
+void ScrollbarThemeMac::updateScrollbarOverlayStyle(ScrollbarThemeClient* scrollbar)
 {
     ScrollbarPainter painter = painterForScrollbar(scrollbar);
-    switch (scrollbar->scrollableArea()->scrollbarOverlayStyle()) {
+    switch (scrollbar->scrollbarOverlayStyle()) {
     case ScrollbarOverlayStyleDefault:
         [painter setKnobStyle:NSScrollerKnobStyleDefault];
         break;
@@ -279,7 +279,7 @@ ScrollbarButtonsPlacement ScrollbarThemeMac::buttonsPlacement() const
     return gButtonPlacement;
 }
 
-bool ScrollbarThemeMac::hasButtons(Scrollbar* scrollbar)
+bool ScrollbarThemeMac::hasButtons(ScrollbarThemeClient* scrollbar)
 {
     return scrollbar->enabled() && buttonsPlacement() != ScrollbarButtonsNone
              && (scrollbar->orientation() == HorizontalScrollbar
@@ -287,7 +287,7 @@ bool ScrollbarThemeMac::hasButtons(Scrollbar* scrollbar)
              : scrollbar->height()) >= 2 * (cRealButtonLength[scrollbar->controlSize()] - cButtonHitInset[scrollbar->controlSize()]);
 }
 
-bool ScrollbarThemeMac::hasThumb(Scrollbar* scrollbar)
+bool ScrollbarThemeMac::hasThumb(ScrollbarThemeClient* scrollbar)
 {
     int minLengthForThumb;
     if (isScrollbarOverlayAPIAvailable()) {
@@ -319,7 +319,7 @@ static IntRect buttonRepaintRect(const IntRect& buttonRect, ScrollbarOrientation
     return paintRect;
 }
 
-IntRect ScrollbarThemeMac::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool painting)
+IntRect ScrollbarThemeMac::backButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool painting)
 {
     IntRect result;
     
@@ -353,7 +353,7 @@ IntRect ScrollbarThemeMac::backButtonRect(Scrollbar* scrollbar, ScrollbarPart pa
     return result;
 }
 
-IntRect ScrollbarThemeMac::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool painting)
+IntRect ScrollbarThemeMac::forwardButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool painting)
 {
     IntRect result;
     
@@ -393,7 +393,7 @@ IntRect ScrollbarThemeMac::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart
     return result;
 }
 
-IntRect ScrollbarThemeMac::trackRect(Scrollbar* scrollbar, bool painting)
+IntRect ScrollbarThemeMac::trackRect(ScrollbarThemeClient* scrollbar, bool painting)
 {
     if (painting || !hasButtons(scrollbar))
         return scrollbar->frameRect();
@@ -430,7 +430,7 @@ IntRect ScrollbarThemeMac::trackRect(Scrollbar* scrollbar, bool painting)
     return IntRect(scrollbar->x(), scrollbar->y() + startWidth, thickness, scrollbar->height() - totalWidth);
 }
 
-int ScrollbarThemeMac::minimumThumbLength(Scrollbar* scrollbar)
+int ScrollbarThemeMac::minimumThumbLength(ScrollbarThemeClient* scrollbar)
 {
     if (isScrollbarOverlayAPIAvailable())
         return [scrollbarMap()->get(scrollbar).get() knobMinLength];
@@ -438,7 +438,7 @@ int ScrollbarThemeMac::minimumThumbLength(Scrollbar* scrollbar)
         return cThumbMinLength[scrollbar->controlSize()];
 }
 
-bool ScrollbarThemeMac::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
+bool ScrollbarThemeMac::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& evt)
 {
     if (evt.button() != LeftButton)
         return false;
@@ -447,7 +447,7 @@ bool ScrollbarThemeMac::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent
     return evt.altKey();
 }
 
-bool ScrollbarThemeMac::shouldDragDocumentInsteadOfThumb(Scrollbar*, const PlatformMouseEvent& event)
+bool ScrollbarThemeMac::shouldDragDocumentInsteadOfThumb(ScrollbarThemeClient*, const PlatformMouseEvent& event)
 {
     return event.altKey();
 }
@@ -470,7 +470,7 @@ int ScrollbarThemeMac::scrollbarPartToHIPressedState(ScrollbarPart part)
     }
 }
 
-void ScrollbarThemeMac::updateEnabledState(Scrollbar* scrollbar)
+void ScrollbarThemeMac::updateEnabledState(ScrollbarThemeClient* scrollbar)
 {
     if (isScrollbarOverlayAPIAvailable())
         [scrollbarMap()->get(scrollbar).get() setEnabled:scrollbar->enabled()];
@@ -499,7 +499,7 @@ static void scrollbarPainterPaint(ScrollbarPainter scrollbarPainter, bool enable
 }
 
 #if !PLATFORM(CHROMIUM)
-bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, const IntRect& damageRect)
+bool ScrollbarThemeMac::paint(ScrollbarThemeClient* scrollbar, GraphicsContext* context, const IntRect& damageRect)
 {
     if (isScrollbarOverlayAPIAvailable()) {
         float value = 0;
@@ -570,7 +570,7 @@ bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, co
     if (!scrollbar->enabled())
         trackInfo.enableState = kThemeTrackDisabled;
     else
-        trackInfo.enableState = scrollbar->scrollableArea()->isActive() ? kThemeTrackActive : kThemeTrackInactive;
+        trackInfo.enableState = scrollbar->isScrollableAreaActive() ? kThemeTrackActive : kThemeTrackInactive;
 
     if (hasThumb(scrollbar))
         trackInfo.attributes |= kThemeTrackShowThumb;
@@ -589,7 +589,7 @@ bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, co
         IntRect bufferRect(scrollbar->frameRect());
         bufferRect.intersect(damageRect);
         
-        OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(bufferRect.size());
+        OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(bufferRect.size(), 1);
         if (!imageBuffer)
             return true;
 
diff --git a/Source/WebCore/platform/mac/SoftLinking.h b/Source/WebCore/platform/mac/SoftLinking.h
index d43c3034e..e61bb7ad4 100644
--- a/Source/WebCore/platform/mac/SoftLinking.h
+++ b/Source/WebCore/platform/mac/SoftLinking.h
@@ -52,6 +52,13 @@
         return frameworkLibrary; \
     }
 
+#define SOFT_LINK_PRIVATE_FRAMEWORK_OPTIONAL(framework) \
+    static void* framework##Library() \
+    { \
+        static void* frameworkLibrary = dlopen("/System/Library/PrivateFrameworks/" #framework ".framework/" #framework, RTLD_NOW); \
+        return frameworkLibrary; \
+    }
+
 #define SOFT_LINK_FRAMEWORK_IN_CORESERVICES_UMBRELLA(framework) \
     static void* framework##Library() \
     { \
diff --git a/Source/WebCore/platform/mac/WebCoreFullScreenWindow.h b/Source/WebCore/platform/mac/WebCoreFullScreenWindow.h
new file mode 100644
index 000000000..214e673a7
--- /dev/null
+++ b/Source/WebCore/platform/mac/WebCoreFullScreenWindow.h
@@ -0,0 +1,32 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebCoreFullScreenWindow_h
+#define WebCoreFullScreenWindow_h
+
+@interface WebCoreFullScreenWindow : NSWindow
+@end
+
+#endif // WebCoreFullScreenWindow_h
diff --git a/Source/WebCore/platform/mac/WebCoreFullScreenWindow.mm b/Source/WebCore/platform/mac/WebCoreFullScreenWindow.mm
new file mode 100644
index 000000000..b62483b30
--- /dev/null
+++ b/Source/WebCore/platform/mac/WebCoreFullScreenWindow.mm
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "WebCoreFullScreenWindow.h"
+
+@implementation WebCoreFullScreenWindow
+
+- (id)initWithContentRect:(NSRect)contentRect styleMask:(NSUInteger)aStyle backing:(NSBackingStoreType)bufferingType defer:(BOOL)flag
+{
+    self = [super initWithContentRect:contentRect styleMask:aStyle backing:bufferingType defer:flag];
+    if (!self)
+        return nil;
+    [self setOpaque:NO];
+    [self setBackgroundColor:[NSColor clearColor]];
+    [self setIgnoresMouseEvents:NO];
+    [self setAcceptsMouseMovedEvents:YES];
+    [self setReleasedWhenClosed:NO];
+    [self setHasShadow:NO];
+#ifndef BUILDING_ON_LEOPARD
+    [self setMovable:NO];
+#else
+    [self setMovableByWindowBackground:NO];
+#endif
+
+    return self;
+}
+
+- (BOOL)canBecomeKeyWindow
+{
+    return YES;
+}
+
+- (void)keyDown:(NSEvent *)theEvent
+{
+    if ([[theEvent charactersIgnoringModifiers] isEqual:@"\e"]) // Esacpe key-code
+        [self cancelOperation:self];
+    else [super keyDown:theEvent];
+}
+
+- (void)cancelOperation:(id)sender
+{
+    [[self windowController] cancelOperation:sender];
+}
+@end
+
diff --git a/Source/WebCore/platform/mac/WebCoreNSStringExtras.h b/Source/WebCore/platform/mac/WebCoreNSStringExtras.h
index b91c95b7c..a2a0e9316 100644
--- a/Source/WebCore/platform/mac/WebCoreNSStringExtras.h
+++ b/Source/WebCore/platform/mac/WebCoreNSStringExtras.h
@@ -40,9 +40,10 @@ extern "C" {
 #endif
 
 BOOL stringIsCaseInsensitiveEqualToString(NSString *first, NSString *second);
-BOOL hasCaseInsensitiveSuffix(NSString *string, NSString *suffix);
-BOOL hasCaseInsensitiveSubstring(NSString *string, NSString *substring);
-NSString *filenameByFixingIllegalCharacters(NSString *string);
+BOOL hasCaseInsensitiveSuffix(NSString *, NSString *suffix);
+BOOL hasCaseInsensitivePrefix(NSString *, NSString *prefix);
+BOOL hasCaseInsensitiveSubstring(NSString *, NSString *substring);
+NSString *filenameByFixingIllegalCharacters(NSString *);
 #if !PLATFORM(IOS)
 CFStringEncoding stringEncodingForResource(Handle resource);
 #endif
diff --git a/Source/WebCore/platform/mac/WebCoreNSStringExtras.mm b/Source/WebCore/platform/mac/WebCoreNSStringExtras.mm
index 81655ede1..38211c169 100644
--- a/Source/WebCore/platform/mac/WebCoreNSStringExtras.mm
+++ b/Source/WebCore/platform/mac/WebCoreNSStringExtras.mm
@@ -41,6 +41,11 @@ BOOL hasCaseInsensitiveSuffix(NSString *string, NSString *suffix)
     return [string rangeOfString:suffix options:(NSCaseInsensitiveSearch | NSBackwardsSearch | NSAnchoredSearch)].location != NSNotFound;
 }
 
+BOOL hasCaseInsensitivePrefix(NSString *string, NSString *prefix)
+{
+    return [string rangeOfString:prefix options:(NSCaseInsensitiveSearch | NSAnchoredSearch)].location != NSNotFound;
+}
+
 BOOL hasCaseInsensitiveSubstring(NSString *string, NSString *substring)
 {
     return [string rangeOfString:substring options:NSCaseInsensitiveSearch].location != NSNotFound;
diff --git a/Source/WebCore/platform/mac/WebCoreNSURLExtras.h b/Source/WebCore/platform/mac/WebCoreNSURLExtras.h
new file mode 100644
index 000000000..b8cbfdacd
--- /dev/null
+++ b/Source/WebCore/platform/mac/WebCoreNSURLExtras.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2005, 2007, 2012 Apple, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <objc/objc.h>
+
+#ifdef __OBJC__
+@class NSString;
+@class NSURL;
+#else
+OBJC_CLASS(NSString);
+OBJC_CLASS(NSURL);
+#endif
+
+namespace WebCore {
+
+NSString *userVisibleString(NSURL *);
+NSURL *URLWithUserTypedString(NSString *, NSURL *);
+NSURL *URLByRemovingUserInfo(NSURL *);
+BOOL hostNameNeedsDecodingWithRange(NSString *, NSRange);
+BOOL hostNameNeedsEncodingWithRange(NSString *, NSRange);
+NSString *decodeHostNameWithRange(NSString *, NSRange);
+NSString *encodeHostNameWithRange(NSString *, NSRange);
+NSString *decodeHostName(NSString *);
+NSString *encodeHostName(NSString *);
+NSURL *URLByTruncatingOneCharacterBeforeComponent(NSURL *, CFURLComponentType);
+NSURL *URLWithData(NSData *, NSURL *baseURL);
+NSData *originalURLData(NSURL *);
+NSData *dataForURLComponentType(NSURL *, CFURLComponentType);
+BOOL isUserVisibleURL(NSString *);
+    
+} // namespace WebCore
diff --git a/Source/WebCore/platform/mac/WebCoreNSURLExtras.mm b/Source/WebCore/platform/mac/WebCoreNSURLExtras.mm
new file mode 100644
index 000000000..b0751875f
--- /dev/null
+++ b/Source/WebCore/platform/mac/WebCoreNSURLExtras.mm
@@ -0,0 +1,880 @@
+/*
+ * Copyright (C) 2005, 2007 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "config.h"
+#import "WebCoreObjCExtras.h"
+#import "WebCoreNSStringExtras.h"
+#import "WebCoreNSURLExtras.h"
+#import "WebCoreSystemInterface.h"
+#import <wtf/RetainPtr.h>
+#import <wtf/Vector.h>
+#import <unicode/uchar.h>
+#import <unicode/uidna.h>
+#import <unicode/uscript.h>
+
+// Needs to be big enough to hold an IDN-encoded name.
+// For host names bigger than this, we won't do IDN encoding, which is almost certainly OK.
+#define HOST_NAME_BUFFER_LENGTH 2048
+#define URL_BYTES_BUFFER_LENGTH 2048
+
+typedef void (* StringRangeApplierFunction)(NSString *string, NSRange range, void *context);
+
+static pthread_once_t IDNScriptWhiteListFileRead = PTHREAD_ONCE_INIT;
+static uint32_t IDNScriptWhiteList[(USCRIPT_CODE_LIMIT + 31) / 32];
+
+namespace WebCore {
+
+static inline BOOL isLookalikeCharacter(int charCode)
+{
+    // This function treats the following as unsafe, lookalike characters:
+    // any non-printable character, any character considered as whitespace that isn't already converted to a space by ICU, 
+    // and any ignorable character.
+    
+    // We also considered the characters in Mozilla's blacklist (http://kb.mozillazine.org/Network.IDN.blacklist_chars), 
+    // and included all of these characters that ICU can encode.
+    
+    if (!u_isprint(charCode) || u_isUWhiteSpace(charCode) || u_hasBinaryProperty(charCode, UCHAR_DEFAULT_IGNORABLE_CODE_POINT))
+        return YES;
+    
+    switch (charCode) {
+        case 0x00ED: /* LATIN SMALL LETTER I WITH ACUTE */
+        case 0x01C3: /* LATIN LETTER RETROFLEX CLICK */
+        case 0x0251: /* LATIN SMALL LETTER ALPHA */
+        case 0x0261: /* LATIN SMALL LETTER SCRIPT G */
+        case 0x0337: /* COMBINING SHORT SOLIDUS OVERLAY */
+        case 0x0338: /* COMBINING LONG SOLIDUS OVERLAY */
+        case 0x05B4: /* HEBREW POINT HIRIQ */
+        case 0x05BC: /* HEBREW POINT DAGESH OR MAPIQ */
+        case 0x05C3: /* HEBREW PUNCTUATION SOF PASUQ */
+        case 0x05F4: /* HEBREW PUNCTUATION GERSHAYIM */
+        case 0x0660: /* ARABIC INDIC DIGIT ZERO */
+        case 0x06D4: /* ARABIC FULL STOP */
+        case 0x06F0: /* EXTENDED ARABIC INDIC DIGIT ZERO */
+        case 0x2027: /* HYPHENATION POINT */
+        case 0x2039: /* SINGLE LEFT-POINTING ANGLE QUOTATION MARK */
+        case 0x203A: /* SINGLE RIGHT-POINTING ANGLE QUOTATION MARK */
+        case 0x2044: /* FRACTION SLASH */
+        case 0x2215: /* DIVISION SLASH */
+        case 0x2216: /* SET MINUS */
+        case 0x233F: /* APL FUNCTIONAL SYMBOL SLASH BAR */
+        case 0x23AE: /* INTEGRAL EXTENSION */
+        case 0x244A: /* OCR DOUBLE BACKSLASH */
+        case 0x2571: /* BOX DRAWINGS LIGHT DIAGONAL UPPER RIGHT TO LOWER LEFT */
+        case 0x2572: /* BOX DRAWINGS LIGHT DIAGONAL UPPER LEFT TO LOWER RIGHT */
+        case 0x29F8: /* BIG SOLIDUS */
+        case 0x29f6: /* SOLIDUS WITH OVERBAR */
+        case 0x2AFB: /* TRIPLE SOLIDUS BINARY RELATION */
+        case 0x2AFD: /* DOUBLE SOLIDUS OPERATOR */
+        case 0x3008: /* LEFT ANGLE BRACKET */
+        case 0x3014: /* LEFT TORTOISE SHELL BRACKET */
+        case 0x3015: /* RIGHT TORTOISE SHELL BRACKET */
+        case 0x3033: /* VERTICAL KANA REPEAT MARK UPPER HALF */
+        case 0x3035: /* VERTICAL KANA REPEAT MARK LOWER HALF */
+        case 0x321D: /* PARENTHESIZED KOREAN CHARACTER OJEON */
+        case 0x321E: /* PARENTHESIZED KOREAN CHARACTER O HU */
+        case 0x33DF: /* SQUARE A OVER M */
+        case 0xFE14: /* PRESENTATION FORM FOR VERTICAL SEMICOLON */
+        case 0xFE15: /* PRESENTATION FORM FOR VERTICAL EXCLAMATION MARK */
+        case 0xFE3F: /* PRESENTATION FORM FOR VERTICAL LEFT ANGLE BRACKET */
+        case 0xFE5D: /* SMALL LEFT TORTOISE SHELL BRACKET */
+        case 0xFE5E: /* SMALL RIGHT TORTOISE SHELL BRACKET */
+            return YES;
+        default:
+            return NO;
+    }
+}
+
+static BOOL readIDNScriptWhiteListFile(NSString *filename)
+{
+    if (!filename)
+        return NO;
+
+    FILE *file = fopen([filename fileSystemRepresentation], "r");
+    if (!file)
+        return NO;
+    
+    // Read a word at a time.
+    // Allow comments, starting with # character to the end of the line.
+    while (1) {
+        // Skip a comment if present.
+        if (fscanf(file, " #%*[^\n\r]%*[\n\r]") == EOF)
+            break;
+        
+        // Read a script name if present.
+        char word[33];
+        int result = fscanf(file, " %32[^# \t\n\r]%*[^# \t\n\r] ", word);
+        if (result == EOF)
+            break;
+        
+        if (result == 1) {
+            // Got a word, map to script code and put it into the array.
+            int32_t script = u_getPropertyValueEnum(UCHAR_SCRIPT, word);
+            if (script >= 0 && script < USCRIPT_CODE_LIMIT) {
+                size_t index = script / 32;
+                uint32_t mask = 1 << (script % 32);
+                IDNScriptWhiteList[index] |= mask;
+            }
+        }
+    }
+    fclose(file);
+    return YES;
+}
+
+static void readIDNScriptWhiteList(void)
+{
+    // Read white list from library.
+    NSArray *dirs = NSSearchPathForDirectoriesInDomains(NSLibraryDirectory, NSAllDomainsMask, YES);
+    int numDirs = [dirs count];
+    for (int i = 0; i < numDirs; i++) {
+        if (readIDNScriptWhiteListFile([[dirs objectAtIndex:i] stringByAppendingPathComponent:@"IDNScriptWhiteList.txt"]))
+            return;
+    }
+    
+    // Fall back on white list inside bundle.
+    NSBundle *bundle = [NSBundle bundleWithIdentifier:@"com.apple.WebKit"];
+    
+    if (!readIDNScriptWhiteListFile([bundle pathForResource:@"IDNScriptWhiteList" ofType:@"txt"]))
+        CRASH();
+}
+
+static BOOL allCharactersInIDNScriptWhiteList(const UChar *buffer, int32_t length)
+{
+    pthread_once(&IDNScriptWhiteListFileRead, readIDNScriptWhiteList);
+    
+    int32_t i = 0;
+    while (i < length) {
+        UChar32 c;
+        U16_NEXT(buffer, i, length, c)
+        UErrorCode error = U_ZERO_ERROR;
+        UScriptCode script = uscript_getScript(c, &error);
+        if (error != U_ZERO_ERROR) {
+            LOG_ERROR("got ICU error while trying to look at scripts: %d", error);
+            return NO;
+        }
+        if (script < 0) {
+            LOG_ERROR("got negative number for script code from ICU: %d", script);
+            return NO;
+        }
+        if (script >= USCRIPT_CODE_LIMIT)
+            return NO;
+
+        size_t index = script / 32;
+        uint32_t mask = 1 << (script % 32);
+        if (!(IDNScriptWhiteList[index] & mask))
+            return NO;
+        
+        if (isLookalikeCharacter(c))
+            return NO;
+    }
+    return YES;
+}
+
+static BOOL allCharactersAllowedByTLDRules(const UChar* buffer, int32_t length)
+{
+    // Skip trailing dot for root domain.
+    if (buffer[length - 1] == '.')
+        length--;
+    
+    if (length > 3 && buffer[length - 3] == '.'
+        && buffer[length - 2] == 0x0440 // CYRILLIC SMALL LETTER ER
+        && buffer[length - 1] == 0x0444) // CYRILLIC SMALL LETTER EF
+    {
+        // Rules defined by <http://www.cctld.ru/ru/docs/rulesrf.php>. This code only checks requirements that matter for presentation purposes.
+        for (int32_t i = length - 4; i; --i) {
+            UChar ch = buffer[i];
+            
+            // Only modern Russian letters, digits and dashes are allowed.
+            if ((ch >= 0x0430 && ch <= 0x044f) || ch == 0x0451|| (ch >= '0' && ch <= '9') || ch == '-')
+                continue;
+            
+            // Only check top level domain. Lower level registrars may have different rules.
+            if (ch == '.')
+                break;
+            
+            return NO;
+        }
+        return YES;
+    }
+    
+    // Not a known top level domain with special rules.
+    return NO;
+}
+
+// Return value of nil means no mapping is necessary.
+// If makeString is NO, then return value is either nil or self to indicate mapping is necessary.
+// If makeString is YES, then return value is either nil or the mapped string.
+static NSString *mapHostNameWithRange(NSString *string, NSRange range, BOOL encode, BOOL makeString)
+{
+    if (range.length > HOST_NAME_BUFFER_LENGTH)
+        return nil;
+    
+    if (![string length])
+        return nil;
+    
+    UChar sourceBuffer[HOST_NAME_BUFFER_LENGTH];
+    UChar destinationBuffer[HOST_NAME_BUFFER_LENGTH];
+    
+    if (encode && [string rangeOfString:@"%" options:NSLiteralSearch range:range].location != NSNotFound) {
+        NSString *substring = [string substringWithRange:range];
+        substring = WebCoreCFAutorelease(CFURLCreateStringByReplacingPercentEscapes(NULL, (CFStringRef)substring, CFSTR("")));
+        if (substring) {
+            string = substring;
+            range = NSMakeRange(0, [string length]);
+        }
+    }
+    
+    int length = range.length;
+    [string getCharacters:sourceBuffer range:range];
+    
+    UErrorCode error = U_ZERO_ERROR;
+    int32_t numCharactersConverted = (encode ? uidna_IDNToASCII : uidna_IDNToUnicode)(sourceBuffer, length, destinationBuffer, HOST_NAME_BUFFER_LENGTH, UIDNA_ALLOW_UNASSIGNED, NULL, &error);
+    if (error != U_ZERO_ERROR)
+        return nil;
+    
+    if (numCharactersConverted == length && !memcmp(sourceBuffer, destinationBuffer, length * sizeof(UChar)))
+        return nil;
+    
+    if (!encode && !allCharactersInIDNScriptWhiteList(destinationBuffer, numCharactersConverted) && !allCharactersAllowedByTLDRules(destinationBuffer, numCharactersConverted))
+        return nil;
+    
+    return makeString ? (NSString *)[NSString stringWithCharacters:destinationBuffer length:numCharactersConverted] : string;
+}
+
+BOOL hostNameNeedsDecodingWithRange(NSString *string, NSRange range)
+{
+     return mapHostNameWithRange(string, range, NO, NO) != nil;
+}
+ 
+BOOL hostNameNeedsEncodingWithRange(NSString *string, NSRange range)
+{
+     return mapHostNameWithRange(string, range, YES,  NO) != nil;
+}
+
+NSString *decodeHostNameWithRange(NSString *string, NSRange range)
+{
+    return mapHostNameWithRange(string, range, NO, YES);
+}
+
+NSString *encodeHostNameWithRange(NSString *string, NSRange range)
+{
+    return mapHostNameWithRange(string, range, YES, YES);
+}
+
+NSString *decodeHostName(NSString *string)
+{
+    NSString *name = mapHostNameWithRange(string, NSMakeRange(0, [string length]), NO, YES);
+    return !name ? string : name;
+}
+
+NSString *encodeHostName(NSString *string)
+{
+    NSString *name =  mapHostNameWithRange(string, NSMakeRange(0, [string length]), YES, YES);
+    return !name ? string : name;
+}
+
+static void collectRangesThatNeedMapping(NSString *string, NSRange range, void *context, BOOL encode)
+{
+    BOOL needsMapping = encode ? hostNameNeedsEncodingWithRange(string, range) : hostNameNeedsDecodingWithRange(string, range);
+    if (!needsMapping)
+        return;
+    
+    NSMutableArray **array = (NSMutableArray **)context;
+    if (!*array)
+        *array = [[NSMutableArray alloc] init];
+    
+    [*array addObject:[NSValue valueWithRange:range]];
+}
+
+static void collectRangesThatNeedEncoding(NSString *string, NSRange range, void *context)
+{
+    return collectRangesThatNeedMapping(string, range, context, YES);
+}
+
+static void collectRangesThatNeedDecoding(NSString *string, NSRange range, void *context)
+{
+    return collectRangesThatNeedMapping(string, range, context, NO);
+}
+
+static inline NSCharacterSet *retain(NSCharacterSet *charset)
+{
+    CFRetain(charset);
+    return charset;
+}
+
+static void applyHostNameFunctionToMailToURLString(NSString *string, StringRangeApplierFunction f, void *context)
+{
+    // In a mailto: URL, host names come after a '@' character and end with a '>' or ',' or '?' character.
+    // Skip quoted strings so that characters in them don't confuse us.
+    // When we find a '?' character, we are past the part of the URL that contains host names.
+    
+    static NSCharacterSet *hostNameOrStringStartCharacters = retain([NSCharacterSet characterSetWithCharactersInString:@"\"@?"]);
+    static NSCharacterSet *hostNameEndCharacters = retain([NSCharacterSet characterSetWithCharactersInString:@">,?"]);
+    static NSCharacterSet *quotedStringCharacters = retain([NSCharacterSet characterSetWithCharactersInString:@"\"\\"]);
+    
+    unsigned stringLength = [string length];
+    NSRange remaining = NSMakeRange(0, stringLength);
+    
+    while (1) {
+        // Find start of host name or of quoted string.
+        NSRange hostNameOrStringStart = [string rangeOfCharacterFromSet:hostNameOrStringStartCharacters options:0 range:remaining];
+        if (hostNameOrStringStart.location == NSNotFound)
+            return;
+
+        unichar c = [string characterAtIndex:hostNameOrStringStart.location];
+        remaining.location = NSMaxRange(hostNameOrStringStart);
+        remaining.length = stringLength - remaining.location;
+        
+        if (c == '?')
+            return;
+        
+        if (c == '@') {
+            // Find end of host name.
+            unsigned hostNameStart = remaining.location;
+            NSRange hostNameEnd = [string rangeOfCharacterFromSet:hostNameEndCharacters options:0 range:remaining];
+            BOOL done;
+            if (hostNameEnd.location == NSNotFound) {
+                hostNameEnd.location = stringLength;
+                done = YES;
+            } else {
+                remaining.location = hostNameEnd.location;
+                remaining.length = stringLength - remaining.location;
+                done = NO;
+            }
+            
+            // Process host name range.
+            f(string, NSMakeRange(hostNameStart, hostNameEnd.location - hostNameStart), context);
+            
+            if (done)
+                return;
+        } else {
+            // Skip quoted string.
+            ASSERT(c == '"');
+            while (1) {
+                NSRange escapedCharacterOrStringEnd = [string rangeOfCharacterFromSet:quotedStringCharacters options:0 range:remaining];
+                if (escapedCharacterOrStringEnd.location == NSNotFound)
+                    return;
+
+                c = [string characterAtIndex:escapedCharacterOrStringEnd.location];
+                remaining.location = NSMaxRange(escapedCharacterOrStringEnd);
+                remaining.length = stringLength - remaining.location;
+                
+                // If we are the end of the string, then break from the string loop back to the host name loop.
+                if (c == '"')
+                    break;
+                
+                // Skip escaped character.
+                ASSERT(c == '\\');
+                if (!remaining.length)
+                    return;
+
+                remaining.location += 1;
+                remaining.length -= 1;
+            }
+        }
+    }
+}
+
+static void applyHostNameFunctionToURLString(NSString *string, StringRangeApplierFunction f, void *context)
+{
+    // Find hostnames. Too bad we can't use any real URL-parsing code to do this,
+    // but we have to do it before doing all the %-escaping, and this is the only
+    // code we have that parses mailto URLs anyway.
+    
+    // Maybe we should implement this using a character buffer instead?
+    
+    if (hasCaseInsensitivePrefix(string, @"mailto:")) {
+        applyHostNameFunctionToMailToURLString(string, f, context);
+        return;
+    }
+    
+    // Find the host name in a hierarchical URL.
+    // It comes after a "://" sequence, with scheme characters preceding.
+    // If ends with the end of the string or a ":", "/", or a "?".
+    // If there is a "@" character, the host part is just the part after the "@".
+    NSRange separatorRange = [string rangeOfString:@"://"];
+    if (separatorRange.location == NSNotFound)
+        return;
+    
+    // Check that all characters before the :// are valid scheme characters.
+    static NSCharacterSet *nonSchemeCharacters = retain([[NSCharacterSet characterSetWithCharactersInString:@"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+-."] invertedSet]);
+    if ([string rangeOfCharacterFromSet:nonSchemeCharacters options:0 range:NSMakeRange(0, separatorRange.location)].location != NSNotFound)
+        return;
+    
+    unsigned stringLength = [string length];
+    
+    static NSCharacterSet *hostTerminators = retain([NSCharacterSet characterSetWithCharactersInString:@":/?#"]);
+    
+    // Start after the separator.
+    unsigned authorityStart = NSMaxRange(separatorRange);
+    
+    // Find terminating character.
+    NSRange hostNameTerminator = [string rangeOfCharacterFromSet:hostTerminators options:0 range:NSMakeRange(authorityStart, stringLength - authorityStart)];
+    unsigned hostNameEnd = hostNameTerminator.location == NSNotFound ? stringLength : hostNameTerminator.location;
+    
+    // Find "@" for the start of the host name.
+    NSRange userInfoTerminator = [string rangeOfString:@"@" options:0 range:NSMakeRange(authorityStart, hostNameEnd - authorityStart)];
+    unsigned hostNameStart = userInfoTerminator.location == NSNotFound ? authorityStart : NSMaxRange(userInfoTerminator);
+    
+    f(string, NSMakeRange(hostNameStart, hostNameEnd - hostNameStart), context);
+}
+
+static NSString *mapHostNames(NSString *string, BOOL encode)
+{
+    // Generally, we want to optimize for the case where there is one host name that does not need mapping.
+    
+    if (encode && [string canBeConvertedToEncoding:NSASCIIStringEncoding])
+        return string;
+    
+    // Make a list of ranges that actually need mapping.
+    NSMutableArray *hostNameRanges = nil;
+    StringRangeApplierFunction f = encode ? collectRangesThatNeedEncoding : collectRangesThatNeedDecoding;
+    applyHostNameFunctionToURLString(string, f, &hostNameRanges);
+    if (!hostNameRanges)
+        return string;
+    
+    // Do the mapping.
+    NSMutableString *mutableCopy = [string mutableCopy];
+    unsigned i = [hostNameRanges count];
+    while (i--) {
+        NSRange hostNameRange = [[hostNameRanges objectAtIndex:i] rangeValue];
+        NSString *mappedHostName = encode ? encodeHostNameWithRange(string, hostNameRange) : decodeHostNameWithRange(string, hostNameRange);
+        [mutableCopy replaceCharactersInRange:hostNameRange withString:mappedHostName];
+    }
+    [hostNameRanges release];
+    return [mutableCopy autorelease];
+}
+
+static BOOL isHexDigit(char c)
+{
+    return (c >= '0' && c <= '9') || (c >= 'A' && c <= 'F') || (c >= 'a' && c <= 'f');
+}
+
+static char hexDigit(int i)
+{
+    if (i < 0 || i > 16)
+        return '0';
+
+    return (i >= 10) ? i - 10 + 'A' : i += '0'; 
+}
+
+static int hexDigitValue(char c)
+{
+    if (c >= '0' && c <= '9')
+        return c - '0';
+
+    if (c >= 'A' && c <= 'F')
+        return c - 'A' + 10;
+
+    if (c >= 'a' && c <= 'f')
+        return c - 'a' + 10;
+
+    LOG_ERROR("illegal hex digit");
+    return 0;
+}
+
+static NSString *stringByTrimmingWhitespace(NSString *string)
+{
+    NSMutableString *trimmed = [[string mutableCopy] autorelease];
+    CFStringTrimWhitespace((CFMutableStringRef)trimmed);
+    return trimmed;
+}
+
+NSURL *URLByTruncatingOneCharacterBeforeComponent(NSURL *URL, CFURLComponentType component)
+{
+    if (!URL)
+        return nil;
+    
+    CFRange fragRg = CFURLGetByteRangeForComponent((CFURLRef)URL, component, NULL);
+    if (fragRg.location == kCFNotFound)
+        return URL;
+    
+    UInt8 *urlBytes, buffer[2048];
+    CFIndex numBytes = CFURLGetBytes((CFURLRef)URL, buffer, 2048);
+    if (numBytes == -1) {
+        numBytes = CFURLGetBytes((CFURLRef)URL, NULL, 0);
+        urlBytes = static_cast<UInt8*>(malloc(numBytes));
+        CFURLGetBytes((CFURLRef)URL, urlBytes, numBytes);
+    } else
+        urlBytes = buffer;
+        
+    NSURL *result = (NSURL *)CFMakeCollectable(CFURLCreateWithBytes(NULL, urlBytes, fragRg.location - 1, kCFStringEncodingUTF8, NULL));
+    if (!result)
+        result = (NSURL *)CFMakeCollectable(CFURLCreateWithBytes(NULL, urlBytes, fragRg.location - 1, kCFStringEncodingISOLatin1, NULL));
+        
+    if (urlBytes != buffer)
+        free(urlBytes);
+    return result ? [result autorelease] : URL;
+}
+
+static NSURL *URLByRemovingResourceSpecifier(NSURL *URL)
+{
+    return URLByTruncatingOneCharacterBeforeComponent(URL, kCFURLComponentResourceSpecifier);
+}
+
+NSURL *URLWithData(NSData *data, NSURL *baseURL)
+{
+    if (!data)
+        return nil;
+    
+    NSURL *result = nil;
+    size_t length = [data length];
+    if (length > 0) {
+        // work around <rdar://4470771>: CFURLCreateAbsoluteURLWithBytes(.., TRUE) doesn't remove non-path components.
+        baseURL = URLByRemovingResourceSpecifier(baseURL);
+        
+        const UInt8 *bytes = static_cast<const UInt8*>([data bytes]);
+        
+        // CFURLCreateAbsoluteURLWithBytes would complain to console if we passed a path to it.
+        if (bytes[0] == '/' && !baseURL)
+            return nil;
+        
+        // NOTE: We use UTF-8 here since this encoding is used when computing strings when returning URL components
+        // (e.g calls to NSURL -path). However, this function is not tolerant of illegal UTF-8 sequences, which
+        // could either be a malformed string or bytes in a different encoding, like shift-jis, so we fall back
+        // onto using ISO Latin 1 in those cases.
+        result = WebCoreCFAutorelease(CFURLCreateAbsoluteURLWithBytes(NULL, bytes, length, kCFStringEncodingUTF8, (CFURLRef)baseURL, YES));
+        if (!result)
+            result = WebCoreCFAutorelease(CFURLCreateAbsoluteURLWithBytes(NULL, bytes, length, kCFStringEncodingISOLatin1, (CFURLRef)baseURL, YES));
+    } else
+            result = [NSURL URLWithString:@""];
+                
+    return result;
+}
+
+NSURL *URLWithUserTypedString(NSString *string, NSURL *URL)
+{
+    if (!string)
+        return nil;
+
+    string = mapHostNames(stringByTrimmingWhitespace(string), YES);
+    
+    NSData *userTypedData = [string dataUsingEncoding:NSUTF8StringEncoding];
+    ASSERT(userTypedData);
+    
+    const UInt8* inBytes = static_cast<const UInt8 *>([userTypedData bytes]);
+    int inLength = [userTypedData length];
+    if (!inLength)
+        return [NSURL URLWithString:@""];
+    
+    char* outBytes = static_cast<char *>(malloc(inLength * 3)); // large enough to %-escape every character
+    char* p = outBytes;
+    int outLength = 0;
+    for (int i = 0; i < inLength; i++) {
+        UInt8 c = inBytes[i];
+        if (c <= 0x20 || c >= 0x7f) {
+            *p++ = '%';
+            *p++ = hexDigit(c >> 4);
+            *p++ = hexDigit(c & 0xf);
+            outLength += 3;
+        } else {
+            *p++ = c;
+            outLength++;
+        }
+    }
+    
+    NSData *data = [NSData dataWithBytesNoCopy:outBytes length:outLength]; // adopts outBytes
+    return URLWithData(data, URL);
+}
+
+static BOOL hasQuestionMarkOnlyQueryString(NSURL *URL)
+{
+    CFRange rangeWithSeparators;
+    CFURLGetByteRangeForComponent((CFURLRef)URL, kCFURLComponentQuery, &rangeWithSeparators);
+    if (rangeWithSeparators.location != kCFNotFound && rangeWithSeparators.length == 1)
+        return YES;
+
+    return NO;
+}
+
+#define completeURL (CFURLComponentType)-1
+
+NSData *dataForURLComponentType(NSURL *URL, CFURLComponentType componentType)
+{
+    static int URLComponentTypeBufferLength = 2048;
+    
+    UInt8 staticAllBytesBuffer[URLComponentTypeBufferLength];
+    UInt8 *allBytesBuffer = staticAllBytesBuffer;
+    
+    CFIndex bytesFilled = CFURLGetBytes((CFURLRef)URL, allBytesBuffer, URLComponentTypeBufferLength);
+    if (bytesFilled == -1) {
+        CFIndex bytesToAllocate = CFURLGetBytes((CFURLRef)URL, NULL, 0);
+        allBytesBuffer = static_cast<UInt8 *>(malloc(bytesToAllocate));
+        bytesFilled = CFURLGetBytes((CFURLRef)URL, allBytesBuffer, bytesToAllocate);
+    }
+    
+    CFRange range;
+    if (componentType != completeURL) {
+        range = CFURLGetByteRangeForComponent((CFURLRef)URL, componentType, NULL);
+        if (range.location == kCFNotFound)
+            return nil;
+    } else {
+        range.location = 0;
+        range.length = bytesFilled;
+    }
+    
+    NSData *componentData = [NSData dataWithBytes:allBytesBuffer + range.location length:range.length]; 
+    
+    const unsigned char *bytes = static_cast<const unsigned char *>([componentData bytes]);
+    NSMutableData *resultData = [NSMutableData data];
+    // NOTE: add leading '?' to query strings non-zero length query strings.
+    // NOTE: retain question-mark only query strings.
+    if (componentType == kCFURLComponentQuery) {
+        if (range.length > 0 || hasQuestionMarkOnlyQueryString(URL))
+            [resultData appendBytes:"?" length:1];    
+    }
+    for (int i = 0; i < range.length; i++) {
+        unsigned char c = bytes[i];
+        if (c <= 0x20 || c >= 0x7f) {
+            char escaped[3];
+            escaped[0] = '%';
+            escaped[1] = hexDigit(c >> 4);
+            escaped[2] = hexDigit(c & 0xf);
+            [resultData appendBytes:escaped length:3];    
+        } else {
+            char b[1];
+            b[0] = c;
+            [resultData appendBytes:b length:1];    
+        }               
+    }
+    
+    if (staticAllBytesBuffer != allBytesBuffer)
+        free(allBytesBuffer);
+    
+    return resultData;
+}
+
+static NSURL *URLByRemovingComponentAndSubsequentCharacter(NSURL *URL, CFURLComponentType component)
+{
+    CFRange range = CFURLGetByteRangeForComponent((CFURLRef)URL, component, 0);
+    if (range.location == kCFNotFound)
+        return URL;
+    
+    // Remove one subsequent character.
+    range.length++;
+    
+    UInt8* urlBytes;
+    UInt8 buffer[2048];
+    CFIndex numBytes = CFURLGetBytes((CFURLRef)URL, buffer, 2048);
+    if (numBytes == -1) {
+        numBytes = CFURLGetBytes((CFURLRef)URL, NULL, 0);
+        urlBytes = static_cast<UInt8*>(malloc(numBytes));
+        CFURLGetBytes((CFURLRef)URL, urlBytes, numBytes);
+    } else
+        urlBytes = buffer;
+        
+    if (numBytes < range.location)
+        return URL;
+    if (numBytes < range.location + range.length)
+        range.length = numBytes - range.location;
+        
+    memmove(urlBytes + range.location, urlBytes + range.location + range.length, numBytes - range.location + range.length);
+    
+    NSURL *result = (NSURL *)CFMakeCollectable(CFURLCreateWithBytes(NULL, urlBytes, numBytes - range.length, kCFStringEncodingUTF8, NULL));
+    if (!result)
+        result = (NSURL *)CFMakeCollectable(CFURLCreateWithBytes(NULL, urlBytes, numBytes - range.length, kCFStringEncodingISOLatin1, NULL));
+            
+    if (urlBytes != buffer)
+        free(urlBytes);
+                
+    return result ? [result autorelease] : URL;
+}
+
+NSURL *URLByRemovingUserInfo(NSURL *URL)
+{
+    return URLByRemovingComponentAndSubsequentCharacter(URL, kCFURLComponentUserInfo);
+}
+
+NSData *originalURLData(NSURL *URL)
+{
+    UInt8 *buffer = (UInt8 *)malloc(URL_BYTES_BUFFER_LENGTH);
+    CFIndex bytesFilled = CFURLGetBytes((CFURLRef)URL, buffer, URL_BYTES_BUFFER_LENGTH);
+    if (bytesFilled == -1) {
+        CFIndex bytesToAllocate = CFURLGetBytes((CFURLRef)URL, NULL, 0);
+        buffer = (UInt8 *)realloc(buffer, bytesToAllocate);
+        bytesFilled = CFURLGetBytes((CFURLRef)URL, buffer, bytesToAllocate);
+        ASSERT(bytesFilled == bytesToAllocate);
+    }
+    
+    // buffer is adopted by the NSData
+    NSData *data = [NSData dataWithBytesNoCopy:buffer length:bytesFilled freeWhenDone:YES];
+    
+    NSURL *baseURL = (NSURL *)CFURLGetBaseURL((CFURLRef)URL);
+    if (baseURL)
+        return originalURLData(URLWithData(data, baseURL));
+    return data;
+}
+
+static CFStringRef createStringWithEscapedUnsafeCharacters(CFStringRef string)
+{
+    CFIndex length = CFStringGetLength(string);
+    Vector<UChar, 2048> sourceBuffer(length);
+    CFStringGetCharacters(string, CFRangeMake(0, length), sourceBuffer.data());
+    
+    Vector<UChar, 2048> outBuffer;
+    
+    CFIndex i = 0;
+    while (i < length) {
+        UChar32 c;
+        U16_NEXT(sourceBuffer, i, length, c)
+        
+        if (isLookalikeCharacter(c)) {
+            uint8_t utf8Buffer[4];
+            CFIndex offset = 0;
+            UBool failure = false;
+            U8_APPEND(utf8Buffer, offset, 4, c, failure)
+            ASSERT(!failure);
+            
+            for (CFIndex j = 0; j < offset; ++j) {
+                outBuffer.append('%');
+                outBuffer.append(hexDigit(utf8Buffer[j] >> 4));
+                outBuffer.append(hexDigit(utf8Buffer[j] & 0xf));
+            }
+        } else {
+            UChar utf16Buffer[2];
+            CFIndex offset = 0;
+            UBool failure = false;
+            U16_APPEND(utf16Buffer, offset, 2, c, failure)
+            ASSERT(!failure);
+            for (CFIndex j = 0; j < offset; ++j)
+                outBuffer.append(utf16Buffer[j]);
+        }
+    }
+    
+    return CFStringCreateWithCharacters(NULL, outBuffer.data(), outBuffer.size());
+}
+
+NSString *userVisibleString(NSURL *URL)
+{
+    NSData *data = originalURLData(URL);
+    const unsigned char *before = static_cast<const unsigned char*>([data bytes]);
+    int length = [data length];
+    
+    bool needsHostNameDecoding = false;
+    
+    const unsigned char *p = before;
+    int bufferLength = (length * 3) + 1;
+    char *after = static_cast<char *>(malloc(bufferLength)); // large enough to %-escape every character
+    char *q = after;
+    for (int i = 0; i < length; i++) {
+        unsigned char c = p[i];
+        // unescape escape sequences that indicate bytes greater than 0x7f
+        if (c == '%' && (i + 1 < length && isHexDigit(p[i + 1])) && i + 2 < length && isHexDigit(p[i + 2])) {
+            unsigned char u = (hexDigitValue(p[i + 1]) << 4) | hexDigitValue(p[i + 2]);
+            if (u > 0x7f) {
+                // unescape
+                *q++ = u;
+            } else {
+                // do not unescape
+                *q++ = p[i];
+                *q++ = p[i + 1];
+                *q++ = p[i + 2];
+            }
+            i += 2;
+        } else {
+            *q++ = c;
+            
+            // Check for "xn--" in an efficient, non-case-sensitive, way.
+            if (c == '-' && i >= 3 && !needsHostNameDecoding && (q[-4] | 0x20) == 'x' && (q[-3] | 0x20) == 'n' && q[-2] == '-')
+                needsHostNameDecoding = true;
+        }
+    }
+    *q = '\0';
+    
+    // Check string to see if it can be converted to display using UTF-8  
+    NSString *result = [NSString stringWithUTF8String:after];
+    if (!result) {
+        // Could not convert to UTF-8.
+        // Convert characters greater than 0x7f to escape sequences.
+        // Shift current string to the end of the buffer
+        // then we will copy back bytes to the start of the buffer 
+        // as we convert.
+        int afterlength = q - after;
+        char *p = after + bufferLength - afterlength - 1;
+        memmove(p, after, afterlength + 1); // copies trailing '\0'
+        char *q = after;
+        while (*p) {
+            unsigned char c = *p;
+            if (c > 0x7f) {
+                *q++ = '%';
+                *q++ = hexDigit(c >> 4);
+                *q++ = hexDigit(c & 0xf);
+            } else
+                *q++ = *p;
+            p++;
+        }
+        *q = '\0';
+        result = [NSString stringWithUTF8String:after];
+    }
+    
+    free(after);
+    
+    result = mapHostNames(result, !needsHostNameDecoding);
+    result = [result precomposedStringWithCanonicalMapping];
+    return WebCoreCFAutorelease(createStringWithEscapedUnsafeCharacters((CFStringRef)result));
+}
+
+BOOL isUserVisibleURL(NSString *string)
+{
+    BOOL valid = YES;
+    // get buffer
+    
+    char static_buffer[1024];
+    const char *p;
+    BOOL success = CFStringGetCString((CFStringRef)string, static_buffer, 1023, kCFStringEncodingUTF8);
+    p = success ? static_buffer : [string UTF8String];
+    
+    int length = strlen(p);
+    
+    // check for characters <= 0x20 or >=0x7f, %-escape sequences of %7f, and xn--, these
+    // are the things that will lead _web_userVisibleString to actually change things.
+    for (int i = 0; i < length; i++) {
+        unsigned char c = p[i];
+        // escape control characters, space, and delete
+        if (c <= 0x20 || c == 0x7f) {
+            valid = NO;
+            break;
+        } else if (c == '%' && (i + 1 < length && isHexDigit(p[i + 1])) && i + 2 < length && isHexDigit(p[i + 2])) {
+            unsigned char u = (hexDigitValue(p[i + 1]) << 4) | hexDigitValue(p[i + 2]);
+            if (u > 0x7f) {
+                valid = NO;
+                break;
+            }
+            i += 2;
+        } else {
+            // Check for "xn--" in an efficient, non-case-sensitive, way.
+            if (c == '-' && i >= 3 && (p[i - 3] | 0x20) == 'x' && (p[i - 2] | 0x20) == 'n' && p[i - 1] == '-') {
+                valid = NO;
+                break;
+            }
+        }
+    }
+    
+    return valid;
+}
+
+} // namespace WebCore
diff --git a/Source/WebCore/platform/mac/WebCoreObjCExtras.h b/Source/WebCore/platform/mac/WebCoreObjCExtras.h
index 7e699a5d1..62383898d 100644
--- a/Source/WebCore/platform/mac/WebCoreObjCExtras.h
+++ b/Source/WebCore/platform/mac/WebCoreObjCExtras.h
@@ -32,6 +32,18 @@
 extern "C" {
 #endif
 
+// Use WebCFAutorelease to return an object made by a CoreFoundation
+// "create" or "copy" function as an autoreleased and garbage collected
+// object. CF objects need to be "made collectable" for autorelease to work
+// properly under GC.
+static inline id WebCoreCFAutorelease(CFTypeRef obj)
+{
+    if (obj)
+        CFMakeCollectable(obj);
+    [(id)obj autorelease];
+    return (id)obj;
+}
+
 void WebCoreObjCFinalizeOnMainThread(Class cls);
 
 // The 'Class' that should be passed in here is the class of the
diff --git a/Source/WebCore/platform/mac/WebCoreSystemInterface.h b/Source/WebCore/platform/mac/WebCoreSystemInterface.h
index e632e2a9a..b2afadd12 100644
--- a/Source/WebCore/platform/mac/WebCoreSystemInterface.h
+++ b/Source/WebCore/platform/mac/WebCoreSystemInterface.h
@@ -78,6 +78,7 @@ typedef const struct _CFURLRequest* CFURLRequestRef;
 #endif
 
 OBJC_CLASS AVAsset;
+OBJC_CLASS CALayer;
 OBJC_CLASS NSArray;
 OBJC_CLASS NSButtonCell;
 OBJC_CLASS NSControl;
@@ -106,6 +107,10 @@ extern "C" {
 // In alphabetical order.
 
 extern void (*wkAdvanceDefaultButtonPulseAnimation)(NSButtonCell *);
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+extern void (*wkCALayerEnumerateRectsBeingDrawnWithBlock)(CALayer *, CGContextRef, void (^block)(CGRect rect));
+#endif
+
 extern BOOL (*wkCGContextGetShouldSmoothFonts)(CGContextRef);
 typedef enum {
     wkPatternTilingNoDistortion,
@@ -287,7 +292,8 @@ extern CFArrayRef (*wkCFURLRequestCopyHTTPRequestBodyParts)(CFURLRequestRef);
 extern void (*wkCFURLRequestSetHTTPRequestBodyParts)(CFMutableURLRequestRef, CFArrayRef bodyParts);
 extern void (*wkSetRequestStorageSession)(CFURLStorageSessionRef, CFMutableURLRequestRef);
 #endif
-
+extern void (*wkSetMetadataURL)(NSString *urlString, NSString *referrer, NSString *path);
+    
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
 #import <dispatch/dispatch.h>
 
diff --git a/Source/WebCore/platform/mac/WebCoreSystemInterface.mm b/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
index a046a892b..4cce2afb0 100644
--- a/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
+++ b/Source/WebCore/platform/mac/WebCoreSystemInterface.mm
@@ -28,6 +28,9 @@
 #import <Foundation/Foundation.h>
 
 void (*wkAdvanceDefaultButtonPulseAnimation)(NSButtonCell *);
+#if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+void (*wkCALayerEnumerateRectsBeingDrawnWithBlock)(CALayer *, CGContextRef context, void (^block)(CGRect rect));
+#endif
 BOOL (*wkCGContextGetShouldSmoothFonts)(CGContextRef);
 void (*wkCGContextResetClip)(CGContextRef);
 CGPatternRef (*wkCGPatternCreateWithImageAndTransform)(CGImageRef, CGAffineTransform, int);
@@ -173,6 +176,7 @@ CFURLRef (*wkGetCFURLResponseURL)(CFURLResponseRef);
 CFHTTPMessageRef (*wkGetCFURLResponseHTTPResponse)(CFURLResponseRef);
 CFStringRef (*wkCopyCFURLResponseSuggestedFilename)(CFURLResponseRef);
 void (*wkSetCFURLResponseMIMEType)(CFURLResponseRef, CFStringRef mimeType);
+void (*wkSetMetadataURL)(NSString *urlString, NSString *referrer, NSString *path);
 
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
 dispatch_source_t (*wkCreateVMPressureDispatchOnMainQueue)(void);
diff --git a/Source/WebCore/platform/mock/ScrollbarThemeMock.cpp b/Source/WebCore/platform/mock/ScrollbarThemeMock.cpp
index 5d2bc3ec0..6de91ccb8 100644
--- a/Source/WebCore/platform/mock/ScrollbarThemeMock.cpp
+++ b/Source/WebCore/platform/mock/ScrollbarThemeMock.cpp
@@ -32,7 +32,7 @@ namespace WebCore {
 
 static int cScrollbarThickness[] = { 15, 11 };
 
-IntRect ScrollbarThemeMock::trackRect(Scrollbar* scrollbar, bool)
+IntRect ScrollbarThemeMock::trackRect(ScrollbarThemeClient* scrollbar, bool)
 {
     return scrollbar->frameRect();
 }
@@ -42,12 +42,12 @@ int ScrollbarThemeMock::scrollbarThickness(ScrollbarControlSize controlSize)
     return cScrollbarThickness[controlSize];
 }
 
-void ScrollbarThemeMock::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& trackRect)
+void ScrollbarThemeMock::paintTrackBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& trackRect)
 {
     context->fillRect(trackRect, scrollbar->enabled() ? Color::lightGray : Color(0xFFE0E0E0), ColorSpaceDeviceRGB);
 }
 
-void ScrollbarThemeMock::paintThumb(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& thumbRect)
+void ScrollbarThemeMock::paintThumb(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& thumbRect)
 {
     if (scrollbar->enabled())
         context->fillRect(thumbRect, Color::darkGray, ColorSpaceDeviceRGB);
diff --git a/Source/WebCore/platform/mock/ScrollbarThemeMock.h b/Source/WebCore/platform/mock/ScrollbarThemeMock.h
index e2548422a..6333841ab 100644
--- a/Source/WebCore/platform/mock/ScrollbarThemeMock.h
+++ b/Source/WebCore/platform/mock/ScrollbarThemeMock.h
@@ -36,15 +36,15 @@ public:
     virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
 
 protected:
-    virtual bool hasButtons(Scrollbar*) { return false; }
-    virtual bool hasThumb(Scrollbar*) { return true; }
+    virtual bool hasButtons(ScrollbarThemeClient*) { return false; }
+    virtual bool hasThumb(ScrollbarThemeClient*) { return true; }
 
-    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool /*painting*/ = false) { return IntRect(); }
-    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool /*painting*/ = false) { return IntRect(); }
-    virtual IntRect trackRect(Scrollbar*, bool painting = false);
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool /*painting*/ = false) { return IntRect(); }
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool /*painting*/ = false) { return IntRect(); }
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false);
     
-    virtual void paintTrackBackground(GraphicsContext*, Scrollbar*, const IntRect&);
-    virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
+    virtual void paintTrackBackground(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+    virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
     
 private:
     virtual bool isMockTheme() const { return true; }
diff --git a/Source/WebCore/platform/network/BlobRegistry.h b/Source/WebCore/platform/network/BlobRegistry.h
index 7e64233d2..5284a9b0d 100644
--- a/Source/WebCore/platform/network/BlobRegistry.h
+++ b/Source/WebCore/platform/network/BlobRegistry.h
@@ -59,7 +59,6 @@ public:
     virtual void registerBlobURL(const KURL&, const KURL& srcURL) = 0;
 
     virtual void unregisterBlobURL(const KURL&) = 0;
-    virtual PassRefPtr<ResourceHandle> createResourceHandle(const ResourceRequest&, ResourceHandleClient*) = 0;
     virtual bool loadResourceSynchronously(const ResourceRequest&, ResourceError&, ResourceResponse&, Vector<char>& data) = 0;
 
 protected:
diff --git a/Source/WebCore/platform/network/BlobRegistryImpl.cpp b/Source/WebCore/platform/network/BlobRegistryImpl.cpp
index 83517f10e..59a9a9c60 100644
--- a/Source/WebCore/platform/network/BlobRegistryImpl.cpp
+++ b/Source/WebCore/platform/network/BlobRegistryImpl.cpp
@@ -52,6 +52,26 @@ BlobRegistry& blobRegistry()
     DEFINE_STATIC_LOCAL(BlobRegistryImpl, instance, ());
     return instance;
 }
+
+static PassRefPtr<ResourceHandle> createResourceHandle(const ResourceRequest& request, ResourceHandleClient* client)
+{
+    return static_cast<BlobRegistryImpl&>(blobRegistry()).createResourceHandle(request, client);
+}
+
+static void registerBlobResourceHandleConstructor()
+{
+    static bool didRegister = false;
+    if (!didRegister) {
+        ResourceHandle::registerBuiltinConstructor("blob", createResourceHandle);
+        didRegister = true;
+    }
+}
+
+#else
+
+static void registerBlobResourceHandleConstructor()
+{
+}
 #endif
 
 bool BlobRegistryImpl::shouldLoadResource(const ResourceRequest& request) const
@@ -125,6 +145,7 @@ void BlobRegistryImpl::appendStorageItems(BlobStorageData* blobStorageData, cons
 void BlobRegistryImpl::registerBlobURL(const KURL& url, PassOwnPtr<BlobData> blobData)
 {
     ASSERT(isMainThread());
+    registerBlobResourceHandleConstructor();
 
     RefPtr<BlobStorageData> blobStorageData = BlobStorageData::create(blobData->contentType(), blobData->contentDisposition());
 
@@ -154,6 +175,7 @@ void BlobRegistryImpl::registerBlobURL(const KURL& url, PassOwnPtr<BlobData> blo
 void BlobRegistryImpl::registerBlobURL(const KURL& url, const KURL& srcURL)
 {
     ASSERT(isMainThread());
+    registerBlobResourceHandleConstructor();
 
     RefPtr<BlobStorageData> src = m_blobs.get(srcURL.string());
     ASSERT(src);
diff --git a/Source/WebCore/platform/network/BlobRegistryImpl.h b/Source/WebCore/platform/network/BlobRegistryImpl.h
index f61666480..608da7f29 100644
--- a/Source/WebCore/platform/network/BlobRegistryImpl.h
+++ b/Source/WebCore/platform/network/BlobRegistryImpl.h
@@ -56,11 +56,12 @@ public:
     virtual void registerBlobURL(const KURL&, PassOwnPtr<BlobData>);
     virtual void registerBlobURL(const KURL&, const KURL& srcURL);
     virtual void unregisterBlobURL(const KURL&);
-    virtual PassRefPtr<ResourceHandle> createResourceHandle(const ResourceRequest&, ResourceHandleClient*);
     virtual bool loadResourceSynchronously(const ResourceRequest&, ResourceError&, ResourceResponse&, Vector<char>& data);
 
     PassRefPtr<BlobStorageData> getBlobDataFromURL(const KURL&) const;
 
+    PassRefPtr<ResourceHandle> createResourceHandle(const ResourceRequest&, ResourceHandleClient*);
+
 private:
     bool shouldLoadResource(const ResourceRequest& request) const;
     void appendStorageItems(BlobStorageData*, const BlobDataItemList&);
diff --git a/Source/WebCore/platform/network/BlobResourceHandle.cpp b/Source/WebCore/platform/network/BlobResourceHandle.cpp
index 2b94bdb52..e47b87983 100644
--- a/Source/WebCore/platform/network/BlobResourceHandle.cpp
+++ b/Source/WebCore/platform/network/BlobResourceHandle.cpp
@@ -35,21 +35,20 @@
 #include "BlobResourceHandle.h"
 
 #include "AsyncFileStream.h"
-#include "BlobRegistryImpl.h"
+#include "BlobStorageData.h"
 #include "FileStream.h"
 #include "FileSystem.h"
 #include "HTTPParsers.h"
 #include "KURL.h"
 #include "ResourceError.h"
-#include "ResourceLoader.h"
+#include "ResourceHandleClient.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
 #include <wtf/MainThread.h>
 
 namespace WebCore {
 
-static const unsigned bufferSize = 1024;
-static const int maxVectorLength = 0x7fffffff;
+static const unsigned bufferSize = 512 * 1024;
 static const long long positionNotSpecified = -1;
 
 static const int httpOK = 200;
@@ -65,10 +64,13 @@ static const char* httpNotFoundText = "Not Found";
 static const char* httpRequestedRangeNotSatisfiableText = "Requested Range Not Satisfiable";
 static const char* httpInternalErrorText = "Internal Server Error";
 
-static const int notFoundError = 1;
-static const int securityError = 2;
-static const int rangeError = 3;
-static const int notReadableError = 4;
+static const char* const webKitBlobResourceDomain = "WebKitBlobResource";
+enum {
+    notFoundError = 1,
+    securityError = 2,
+    rangeError = 3,
+    notReadableError = 4,
+};
 
 ///////////////////////////////////////////////////////////////////////////////
 // BlobResourceSynchronousLoader
@@ -100,9 +102,8 @@ BlobResourceSynchronousLoader::BlobResourceSynchronousLoader(ResourceError& erro
 void BlobResourceSynchronousLoader::didReceiveResponse(ResourceHandle* handle, const ResourceResponse& response)
 {
     // We cannot handle the size that is more than maximum integer.
-    const int intMaxForLength = 0x7fffffff;
-    if (response.expectedContentLength() > intMaxForLength) {
-        m_error = ResourceError(String(), notReadableError, response.url(), String());
+    if (response.expectedContentLength() > INT_MAX) {
+        m_error = ResourceError(webKitBlobResourceDomain, notReadableError, response.url(), "File is too large");
         return;
     }
 
@@ -229,6 +230,7 @@ void BlobResourceHandle::doStart()
     if (m_async)
         getSizeForNext();
     else {
+        RefPtr<BlobResourceHandle> protect(this); // getSizeForNext calls the client
         for (size_t i = 0; i < m_blobData->items().size() && !m_aborted && !m_errorCode; ++i)
             getSizeForNext();
         notifyResponse();
@@ -243,6 +245,7 @@ void BlobResourceHandle::getSizeForNext()
 
         // Start reading if in asynchronous mode.
         if (m_async) {
+            RefPtr<BlobResourceHandle> protect(this);
             notifyResponse();
             m_buffer.resize(bufferSize);
             readAsync();
@@ -327,6 +330,7 @@ void BlobResourceHandle::seek()
 int BlobResourceHandle::readSync(char* buf, int length)
 {
     ASSERT(!m_async);
+    RefPtr<BlobResourceHandle> protect(this);
 
     int offset = 0;
     int remaining = length;
@@ -446,6 +450,7 @@ void BlobResourceHandle::readAsync()
 void BlobResourceHandle::readDataAsync(const BlobDataItem& item)
 {
     ASSERT(m_async);
+    RefPtr<BlobResourceHandle> protect(this);
 
     long long bytesToRead = item.length - m_currentItemReadSize;
     if (bytesToRead > m_totalRemainingSize)
@@ -486,12 +491,18 @@ void BlobResourceHandle::didOpen(bool success)
 
 void BlobResourceHandle::didRead(int bytesRead)
 {
+    if (bytesRead < 0) {
+        failed(notReadableError);
+        return;
+    }
+
     consumeData(m_buffer.data(), bytesRead);
 }
 
 void BlobResourceHandle::consumeData(const char* data, int bytesRead)
 {
     ASSERT(m_async);
+    RefPtr<BlobResourceHandle> protect(this);
 
     m_totalRemainingSize -= bytesRead;
 
@@ -521,6 +532,7 @@ void BlobResourceHandle::consumeData(const char* data, int bytesRead)
 void BlobResourceHandle::failed(int errorCode)
 {
     ASSERT(m_async);
+    RefPtr<BlobResourceHandle> protect(this);
 
     // Notify the client.
     notifyFail(errorCode);
@@ -592,7 +604,7 @@ void BlobResourceHandle::notifyReceiveData(const char* data, int bytesRead)
 void BlobResourceHandle::notifyFail(int errorCode)
 {
     if (client())
-        client()->didFail(this, ResourceError(String(), errorCode, firstRequest().url(), String()));
+        client()->didFail(this, ResourceError(webKitBlobResourceDomain, errorCode, firstRequest().url(), String()));
 }
 
 static void doNotifyFinish(void* context)
diff --git a/Source/WebCore/platform/network/CredentialStorage.cpp b/Source/WebCore/platform/network/CredentialStorage.cpp
index 361c78477..f0984f885 100644
--- a/Source/WebCore/platform/network/CredentialStorage.cpp
+++ b/Source/WebCore/platform/network/CredentialStorage.cpp
@@ -85,7 +85,7 @@ static String protectionSpaceMapKeyFromURL(const KURL& url)
 
 void CredentialStorage::set(const Credential& credential, const ProtectionSpace& protectionSpace, const KURL& url)
 {
-    ASSERT(protectionSpace.isProxy() || url.protocolInHTTPFamily());
+    ASSERT(protectionSpace.isProxy() || url.protocolIsInHTTPFamily());
     ASSERT(protectionSpace.isProxy() || url.isValid());
 
     protectionSpaceToCredentialMap().set(protectionSpace, credential);
@@ -112,7 +112,7 @@ void CredentialStorage::remove(const ProtectionSpace& protectionSpace)
 
 static PathToDefaultProtectionSpaceMap::iterator findDefaultProtectionSpaceForURL(const KURL& url)
 {
-    ASSERT(url.protocolInHTTPFamily());
+    ASSERT(url.protocolIsInHTTPFamily());
     ASSERT(url.isValid());
 
     PathToDefaultProtectionSpaceMap& map = pathToDefaultProtectionSpaceMap();
@@ -141,7 +141,7 @@ static PathToDefaultProtectionSpaceMap::iterator findDefaultProtectionSpaceForUR
 
 bool CredentialStorage::set(const Credential& credential, const KURL& url)
 {
-    ASSERT(url.protocolInHTTPFamily());
+    ASSERT(url.protocolIsInHTTPFamily());
     ASSERT(url.isValid());
     PathToDefaultProtectionSpaceMap::iterator iter = findDefaultProtectionSpaceForURL(url);
     if (iter == pathToDefaultProtectionSpaceMap().end())
diff --git a/Source/WebCore/platform/network/ResourceHandle.cpp b/Source/WebCore/platform/network/ResourceHandle.cpp
index 4d943694e..6f2be27b0 100644
--- a/Source/WebCore/platform/network/ResourceHandle.cpp
+++ b/Source/WebCore/platform/network/ResourceHandle.cpp
@@ -33,12 +33,26 @@
 #include "ResourceHandleClient.h"
 #include "Timer.h"
 #include <algorithm>
+#include <wtf/MainThread.h>
 #include <wtf/text/CString.h>
 
 namespace WebCore {
 
 static bool shouldForceContentSniffing;
 
+typedef HashMap<AtomicString, ResourceHandle::BuiltinConstructor> BuiltinResourceHandleConstructorMap;
+static BuiltinResourceHandleConstructorMap& builtinResourceHandleConstructorMap()
+{
+    ASSERT(isMainThread());
+    DEFINE_STATIC_LOCAL(BuiltinResourceHandleConstructorMap, map, ());
+    return map;
+}
+
+void ResourceHandle::registerBuiltinConstructor(const AtomicString& protocol, ResourceHandle::BuiltinConstructor constructor)
+{
+    builtinResourceHandleConstructorMap().add(protocol, constructor);
+}
+
 ResourceHandle::ResourceHandle(const ResourceRequest& request, ResourceHandleClient* client, bool defersLoading, bool shouldContentSniff)
     : d(adoptPtr(new ResourceHandleInternal(this, request, client, defersLoading, shouldContentSniff && shouldContentSniffURL(request.url()))))
 {
@@ -55,13 +69,10 @@ ResourceHandle::ResourceHandle(const ResourceRequest& request, ResourceHandleCli
 
 PassRefPtr<ResourceHandle> ResourceHandle::create(NetworkingContext* context, const ResourceRequest& request, ResourceHandleClient* client, bool defersLoading, bool shouldContentSniff)
 {
-#if ENABLE(BLOB)
-    if (request.url().protocolIs("blob")) {
-        PassRefPtr<ResourceHandle> handle = blobRegistry().createResourceHandle(request, client);
-        if (handle)
-            return handle;
-    }
-#endif
+    BuiltinResourceHandleConstructorMap::iterator protocolMapItem = builtinResourceHandleConstructorMap().find(request.url().protocol());
+
+    if (protocolMapItem != builtinResourceHandleConstructorMap().end())
+        return protocolMapItem->second(request, client);
 
     RefPtr<ResourceHandle> newHandle(adoptRef(new ResourceHandle(request, client, defersLoading, shouldContentSniff)));
 
diff --git a/Source/WebCore/platform/network/ResourceHandle.h b/Source/WebCore/platform/network/ResourceHandle.h
index 1b1eacc73..8626e09e8 100644
--- a/Source/WebCore/platform/network/ResourceHandle.h
+++ b/Source/WebCore/platform/network/ResourceHandle.h
@@ -217,6 +217,9 @@ public:
     void handleDataArray(CFArrayRef dataArray);
 #endif
 
+    typedef PassRefPtr<ResourceHandle> (*BuiltinConstructor)(const ResourceRequest& request, ResourceHandleClient* client);
+    static void registerBuiltinConstructor(const AtomicString& protocol, BuiltinConstructor);
+
 protected:
     ResourceHandle(const ResourceRequest&, ResourceHandleClient*, bool defersLoading, bool shouldContentSniff);
 
diff --git a/Source/WebCore/platform/network/ResourceRequestBase.cpp b/Source/WebCore/platform/network/ResourceRequestBase.cpp
index e1e96c409..23ece24dc 100644
--- a/Source/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/Source/WebCore/platform/network/ResourceRequestBase.cpp
@@ -151,7 +151,7 @@ void ResourceRequestBase::setCachePolicy(ResourceRequestCachePolicy cachePolicy)
     
     m_cachePolicy = cachePolicy;
     
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -168,7 +168,7 @@ void ResourceRequestBase::setTimeoutInterval(double timeoutInterval)
     
     m_timeoutInterval = timeoutInterval; 
     
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -201,7 +201,7 @@ void ResourceRequestBase::setHTTPMethod(const String& httpMethod)
 
     m_httpMethod = httpMethod;
     
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -232,7 +232,7 @@ void ResourceRequestBase::setHTTPHeaderField(const AtomicString& name, const Str
     
     m_httpHeaderFields.set(name, value); 
     
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -247,7 +247,7 @@ void ResourceRequestBase::clearHTTPAuthorization()
 
     m_httpHeaderFields.remove("Authorization");
 
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -257,7 +257,7 @@ void ResourceRequestBase::clearHTTPReferrer()
 
     m_httpHeaderFields.remove("Referer");
 
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -267,7 +267,7 @@ void ResourceRequestBase::clearHTTPOrigin()
 
     m_httpHeaderFields.remove("Origin");
 
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -283,7 +283,7 @@ void ResourceRequestBase::setResponseContentDispositionEncodingFallbackArray(con
     if (!encoding3.isNull())
         m_responseContentDispositionEncodingFallbackArray.append(encoding3);
     
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -300,7 +300,7 @@ void ResourceRequestBase::setHTTPBody(PassRefPtr<FormData> httpBody)
     
     m_httpBody = httpBody; 
     
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 } 
 
@@ -317,7 +317,7 @@ void ResourceRequestBase::setAllowCookies(bool allowCookies)
     
     m_allowCookies = allowCookies;
     
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -334,7 +334,7 @@ void ResourceRequestBase::setPriority(ResourceLoadPriority priority)
 
     m_priority = priority;
 
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
@@ -345,7 +345,7 @@ void ResourceRequestBase::addHTTPHeaderField(const AtomicString& name, const Str
     if (!result.second)
         result.first->second += "," + value;
 
-    if (url().protocolInHTTPFamily())
+    if (url().protocolIsInHTTPFamily())
         m_platformRequestUpdated = false;
 }
 
diff --git a/Source/WebCore/platform/network/blackberry/CredentialBackingStore.cpp b/Source/WebCore/platform/network/blackberry/CredentialBackingStore.cpp
index acacc3789..e024c2775 100644
--- a/Source/WebCore/platform/network/blackberry/CredentialBackingStore.cpp
+++ b/Source/WebCore/platform/network/blackberry/CredentialBackingStore.cpp
@@ -22,15 +22,16 @@
 #include "CredentialBackingStore.h"
 
 #include "CredentialStorage.h"
+#include "FileSystem.h"
 #include "KURL.h"
 #include "NotImplemented.h"
 #include "ProtectionSpaceHash.h"
 #include "SQLiteStatement.h"
-#include <wtf/UnusedParam.h>
+#include <BlackBerryPlatformClient.h>
 
 #define HANDLE_SQL_EXEC_FAILURE(statement, returnValue, ...) \
     if (statement) { \
-        LOG_ERROR(__VAR_ARGS__); \
+        LOG_ERROR(__VA_ARGS__); \
         return returnValue; \
     }
 
@@ -39,17 +40,24 @@ namespace WebCore {
 CredentialBackingStore* CredentialBackingStore::instance()
 {
     static CredentialBackingStore* backingStore = 0;
-    if (!backingStore)
+    if (!backingStore) {
         backingStore = new CredentialBackingStore;
+        backingStore->open(pathByAppendingComponent(BlackBerry::Platform::Client::get()->getApplicationDataDirectory().c_str(), "/credentials.db"));
+    }
     return backingStore;
 }
 
 CredentialBackingStore::CredentialBackingStore()
-    : m_addStatement(0)
-    , m_updateStatement(0)
-    , m_hasStatement(0)
-    , m_getStatement(0)
-    , m_removeStatement(0)
+    : m_addLoginStatement(0)
+    , m_updateLoginStatement(0)
+    , m_hasLoginStatement(0)
+    , m_getLoginStatement(0)
+    , m_getLoginByURLStatement(0)
+    , m_removeLoginStatement(0)
+    , m_addNeverRememberStatement(0)
+    , m_hasNeverRememberStatement(0)
+    , m_getNeverRememberStatement(0)
+    , m_removeNeverRememberStatement(0)
 {
 }
 
@@ -71,69 +79,85 @@ bool CredentialBackingStore::open(const String& dbPath)
             false, "Failed to create table logins for login database");
 
         // Create index for table logins.
-        HANDLE_SQL_EXEC_FAILURE(!m_database.executeCommand("CREATE INDEX logins_signon ON logins (host)"),
+        HANDLE_SQL_EXEC_FAILURE(!m_database.executeCommand("CREATE INDEX logins_index ON logins (host)"),
             false, "Failed to create index for table logins");
-    } else { // Initiate CredentialStorage.
-        SQLiteStatement query(m_database, "SELECT origin_url, host, port, service_type, realm, auth_scheme, username, password FROM logins");
-        HANDLE_SQL_EXEC_FAILURE(query.prepare() != SQLResultOk,
-            false, "Failed to prepare query statement to initiate CredentialStorage");
-
-        int result = query.step();
-        while (result == SQLResultRow) {
-            String strUrl = query.getColumnText(1);
-            String strHost = query.getColumnText(2);
-            int intPort = query.getColumnInt(3);
-            ProtectionSpaceServerType serviceType = static_cast<ProtectionSpaceServerType>(query.getColumnInt(4));
-            String strRealm = query.getColumnText(5);
-            ProtectionSpaceAuthenticationScheme authScheme = static_cast<ProtectionSpaceAuthenticationScheme>(query.getColumnInt(6));
-            String strUserName = query.getColumnText(7);
-            String strPassword = decryptedString(query.getColumnText(8));
-
-            KURL url(ParsedURLString, strUrl);
-            ProtectionSpace protectionSpace(strHost, intPort, serviceType, strRealm, authScheme);
-            Credential credential(strUserName, strPassword, CredentialPersistencePermanent);
-            CredentialStorage::set(credential, protectionSpace, url);
-
-            result = query.step();
-        }
+    }
+
+    if (!m_database.tableExists("never_remember")) {
+        HANDLE_SQL_EXEC_FAILURE(!m_database.executeCommand("CREATE TABLE never_remember (origin_url VARCHAR NOT NULL, host VARCHAR NOT NULL, port INTEGER, service_type INTEGER NOT NULL, realm VARCHAR, auth_scheme INTEGER NOT NULL) "),
+            false, "Failed to create table never_remember for login database");
+
+        // Create index for table never_remember.
+        HANDLE_SQL_EXEC_FAILURE(!m_database.executeCommand("CREATE INDEX never_remember_index ON never_remember (host)"),
+            false, "Failed to create index for table never_remember");
     }
 
     // Prepare the statements.
-    m_addStatement = new SQLiteStatement(m_database, "INSERT OR REPLACE INTO logins (origin_url, host, port, service_type, realm, auth_scheme, username, password) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");
-    HANDLE_SQL_EXEC_FAILURE(m_addStatement->prepare() != SQLResultOk,
+    m_addLoginStatement = new SQLiteStatement(m_database, "INSERT OR REPLACE INTO logins (origin_url, host, port, service_type, realm, auth_scheme, username, password) VALUES (?, ?, ?, ?, ?, ?, ?, ?)");
+    HANDLE_SQL_EXEC_FAILURE(m_addLoginStatement->prepare() != SQLResultOk,
         false, "Failed to prepare addLogin statement");
 
-    m_updateStatement = new SQLiteStatement(m_database, "UPDATE logins SET username = ?, password = ? WHERE origin_url = ? AND host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
-    HANDLE_SQL_EXEC_FAILURE(m_updateStatement->prepare() != SQLResultOk,
+    m_updateLoginStatement = new SQLiteStatement(m_database, "UPDATE logins SET username = ?, password = ? WHERE origin_url = ? AND host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
+    HANDLE_SQL_EXEC_FAILURE(m_updateLoginStatement->prepare() != SQLResultOk,
         false, "Failed to prepare updateLogin statement");
 
-    m_hasStatement = new SQLiteStatement(m_database, "SELECT COUNT(*) FROM logins WHERE host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
-    HANDLE_SQL_EXEC_FAILURE(m_hasStatement->prepare() != SQLResultOk,
+    m_hasLoginStatement = new SQLiteStatement(m_database, "SELECT COUNT(*) FROM logins WHERE origin_url = ? AND host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
+    HANDLE_SQL_EXEC_FAILURE(m_hasLoginStatement->prepare() != SQLResultOk,
         false, "Failed to prepare hasLogin statement");
 
-    m_getStatement = new SQLiteStatement(m_database, "SELECT username, password FROM logins WHERE host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
-    HANDLE_SQL_EXEC_FAILURE(m_getStatement->prepare() != SQLResultOk,
+    m_getLoginStatement = new SQLiteStatement(m_database, "SELECT username, password FROM logins WHERE host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
+    HANDLE_SQL_EXEC_FAILURE(m_getLoginStatement->prepare() != SQLResultOk,
         false, "Failed to prepare getLogin statement");
 
-    m_removeStatement = new SQLiteStatement(m_database, "DELETE FROM logins WHERE host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
-    HANDLE_SQL_EXEC_FAILURE(m_removeStatement->prepare() != SQLResultOk,
+    m_getLoginByURLStatement = new SQLiteStatement(m_database, "SELECT username, password FROM logins WHERE origin_url = ?");
+    HANDLE_SQL_EXEC_FAILURE(m_getLoginByURLStatement->prepare() != SQLResultOk,
+        false, "Failed to prepare getLoginByURL statement");
+
+    m_removeLoginStatement = new SQLiteStatement(m_database, "DELETE FROM logins WHERE origin_url = ? AND host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
+    HANDLE_SQL_EXEC_FAILURE(m_removeLoginStatement->prepare() != SQLResultOk,
         false, "Failed to prepare removeLogin statement");
 
+    m_addNeverRememberStatement = new SQLiteStatement(m_database, "INSERT OR REPLACE INTO never_remember (origin_url, host, port, service_type, realm, auth_scheme) VALUES (?, ?, ?, ?, ?, ?)");
+    HANDLE_SQL_EXEC_FAILURE(m_addNeverRememberStatement->prepare() != SQLResultOk,
+        false, "Failed to prepare addNeverRemember statement");
+
+    m_hasNeverRememberStatement = new SQLiteStatement(m_database, "SELECT COUNT(*) FROM never_remember WHERE host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
+    HANDLE_SQL_EXEC_FAILURE(m_hasNeverRememberStatement->prepare() != SQLResultOk,
+        false, "Failed to prepare hasNeverRemember statement");
+
+    m_getNeverRememberStatement = new SQLiteStatement(m_database, "SELECT origin_url FROM never_remember WHERE host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
+    HANDLE_SQL_EXEC_FAILURE(m_getNeverRememberStatement->prepare() != SQLResultOk,
+        false, "Failed to prepare getNeverRemember statement");
+
+    m_removeNeverRememberStatement = new SQLiteStatement(m_database, "DELETE FROM never_remember WHERE host = ? AND port = ? AND service_type = ? AND realm = ? AND auth_scheme = ?");
+    HANDLE_SQL_EXEC_FAILURE(m_removeNeverRememberStatement->prepare() != SQLResultOk,
+        false, "Failed to prepare removeNeverRemember statement");
+
     return true;
 }
 
 void CredentialBackingStore::close()
 {
-    delete m_addStatement;
-    m_addStatement = 0;
-    delete m_updateStatement;
-    m_updateStatement = 0;
-    delete m_hasStatement;
-    m_hasStatement = 0;
-    delete m_getStatement;
-    m_getStatement = 0;
-    delete m_removeStatement;
-    m_removeStatement = 0;
+    delete m_addLoginStatement;
+    m_addLoginStatement = 0;
+    delete m_updateLoginStatement;
+    m_updateLoginStatement = 0;
+    delete m_hasLoginStatement;
+    m_hasLoginStatement = 0;
+    delete m_getLoginStatement;
+    m_getLoginStatement = 0;
+    delete m_getLoginByURLStatement;
+    m_getLoginByURLStatement = 0;
+    delete m_removeLoginStatement;
+    m_removeLoginStatement = 0;
+    delete m_addNeverRememberStatement;
+    m_addNeverRememberStatement = 0;
+    delete m_hasNeverRememberStatement;
+    m_hasNeverRememberStatement = 0;
+    delete m_getNeverRememberStatement;
+    m_getNeverRememberStatement = 0;
+    delete m_removeNeverRememberStatement;
+    m_removeNeverRememberStatement = 0;
 
     if (m_database.isOpen())
         m_database.close();
@@ -144,19 +168,20 @@ bool CredentialBackingStore::addLogin(const KURL& url, const ProtectionSpace& pr
     ASSERT(m_database.isOpen());
     ASSERT(m_database.tableExists("logins"));
 
-    if (!m_addStatement)
+    if (!m_addLoginStatement)
         return false;
 
-    m_addStatement->bindText(1, url.string());
-    m_addStatement->bindText(2, protectionSpace.host());
-    m_addStatement->bindInt(3, protectionSpace.port());
-    m_addStatement->bindInt(4, static_cast<int>(protectionSpace.serverType()));
-    m_addStatement->bindText(5, protectionSpace.realm());
-    m_addStatement->bindInt(6, static_cast<int>(protectionSpace.authenticationScheme()));
-    m_addStatement->bindText(7, credential.user());
-    m_addStatement->bindBlob(8, encryptedString(credential.password()));
-
-    int result = m_addStatement->step();
+    m_addLoginStatement->bindText(1, url.string());
+    m_addLoginStatement->bindText(2, protectionSpace.host());
+    m_addLoginStatement->bindInt(3, protectionSpace.port());
+    m_addLoginStatement->bindInt(4, static_cast<int>(protectionSpace.serverType()));
+    m_addLoginStatement->bindText(5, protectionSpace.realm());
+    m_addLoginStatement->bindInt(6, static_cast<int>(protectionSpace.authenticationScheme()));
+    m_addLoginStatement->bindText(7, credential.user());
+    m_addLoginStatement->bindBlob(8, encryptedString(credential.password()));
+
+    int result = m_addLoginStatement->step();
+    m_addLoginStatement->reset();
     HANDLE_SQL_EXEC_FAILURE(result != SQLResultDone, false,
         "Failed to add login info into table logins - %i", result);
 
@@ -168,44 +193,48 @@ bool CredentialBackingStore::updateLogin(const KURL& url, const ProtectionSpace&
     ASSERT(m_database.isOpen());
     ASSERT(m_database.tableExists("logins"));
 
-    if (!m_updateStatement)
+    if (!m_updateLoginStatement)
         return false;
 
-    m_updateStatement->bindText(1, url.string());
-    m_updateStatement->bindText(2, credential.user());
-    m_updateStatement->bindBlob(3, encryptedString(credential.password()));
-    m_updateStatement->bindText(4, protectionSpace.host());
-    m_updateStatement->bindInt(5, protectionSpace.port());
-    m_updateStatement->bindInt(6, static_cast<int>(protectionSpace.serverType()));
-    m_updateStatement->bindText(7, protectionSpace.realm());
-    m_updateStatement->bindInt(8, static_cast<int>(protectionSpace.authenticationScheme()));
-
-    int result = m_updateStatement->step();
+    m_updateLoginStatement->bindText(1, credential.user());
+    m_updateLoginStatement->bindBlob(2, encryptedString(credential.password()));
+    m_updateLoginStatement->bindText(3, url.string());
+    m_updateLoginStatement->bindText(4, protectionSpace.host());
+    m_updateLoginStatement->bindInt(5, protectionSpace.port());
+    m_updateLoginStatement->bindInt(6, static_cast<int>(protectionSpace.serverType()));
+    m_updateLoginStatement->bindText(7, protectionSpace.realm());
+    m_updateLoginStatement->bindInt(8, static_cast<int>(protectionSpace.authenticationScheme()));
+
+    int result = m_updateLoginStatement->step();
+    m_updateLoginStatement->reset();
     HANDLE_SQL_EXEC_FAILURE(result != SQLResultDone, false,
         "Failed to update login info in table logins - %i", result);
 
     return true;
 }
 
-bool CredentialBackingStore::hasLogin(const ProtectionSpace& protectionSpace)
+bool CredentialBackingStore::hasLogin(const KURL& url, const ProtectionSpace& protectionSpace)
 {
     ASSERT(m_database.isOpen());
     ASSERT(m_database.tableExists("logins"));
 
-    if (!m_hasStatement)
+    if (!m_hasLoginStatement)
         return false;
 
-    m_hasStatement->bindText(1, protectionSpace.host());
-    m_hasStatement->bindInt(2, protectionSpace.port());
-    m_hasStatement->bindInt(3, static_cast<int>(protectionSpace.serverType()));
-    m_hasStatement->bindText(4, protectionSpace.realm());
-    m_hasStatement->bindInt(5, static_cast<int>(protectionSpace.authenticationScheme()));
+    m_hasLoginStatement->bindText(1, url.string());
+    m_hasLoginStatement->bindText(2, protectionSpace.host());
+    m_hasLoginStatement->bindInt(3, protectionSpace.port());
+    m_hasLoginStatement->bindInt(4, static_cast<int>(protectionSpace.serverType()));
+    m_hasLoginStatement->bindText(5, protectionSpace.realm());
+    m_hasLoginStatement->bindInt(6, static_cast<int>(protectionSpace.authenticationScheme()));
 
-    int result = m_hasStatement->step();
+    int result = m_hasLoginStatement->step();
+    int numOfRow = m_hasLoginStatement->getColumnInt(0);
+    m_hasLoginStatement->reset();
     HANDLE_SQL_EXEC_FAILURE(result != SQLResultRow, false,
         "Failed to execute select login info from table logins in hasLogin - %i", result);
 
-    if (m_hasStatement->getColumnInt(0))
+    if (numOfRow)
         return true;
     return false;
 }
@@ -215,44 +244,162 @@ Credential CredentialBackingStore::getLogin(const ProtectionSpace& protectionSpa
     ASSERT(m_database.isOpen());
     ASSERT(m_database.tableExists("logins"));
 
-    if (!m_getStatement)
+    if (!m_getLoginStatement)
+        return Credential();
+
+    m_getLoginStatement->bindText(1, protectionSpace.host());
+    m_getLoginStatement->bindInt(2, protectionSpace.port());
+    m_getLoginStatement->bindInt(3, static_cast<int>(protectionSpace.serverType()));
+    m_getLoginStatement->bindText(4, protectionSpace.realm());
+    m_getLoginStatement->bindInt(5, static_cast<int>(protectionSpace.authenticationScheme()));
+
+    int result = m_getLoginStatement->step();
+    String username = m_getLoginStatement->getColumnText(0);
+    String password = m_getLoginStatement->getColumnBlobAsString(1);
+    m_getLoginStatement->reset();
+    HANDLE_SQL_EXEC_FAILURE(result != SQLResultRow, Credential(),
+        "Failed to execute select login info from table logins in getLogin - %i", result);
+
+    return Credential(username, decryptedString(password), CredentialPersistencePermanent);
+}
+
+Credential CredentialBackingStore::getLogin(const KURL& url)
+{
+    ASSERT(m_database.isOpen());
+    ASSERT(m_database.tableExists("logins"));
+
+    if (!m_getLoginByURLStatement)
         return Credential();
 
-    m_getStatement->bindText(1, protectionSpace.host());
-    m_getStatement->bindInt(2, protectionSpace.port());
-    m_getStatement->bindInt(3, static_cast<int>(protectionSpace.serverType()));
-    m_getStatement->bindText(4, protectionSpace.realm());
-    m_getStatement->bindInt(5, static_cast<int>(protectionSpace.authenticationScheme()));
+    m_getLoginByURLStatement->bindText(1, url.string());
 
-    int result = m_getStatement->step();
+    int result = m_getLoginByURLStatement->step();
+    String username = m_getLoginByURLStatement->getColumnText(0);
+    String password = m_getLoginByURLStatement->getColumnBlobAsString(1);
+    m_getLoginByURLStatement->reset();
     HANDLE_SQL_EXEC_FAILURE(result != SQLResultRow, Credential(),
         "Failed to execute select login info from table logins in getLogin - %i", result);
 
-    return Credential(m_getStatement->getColumnText(0), decryptedString(m_getStatement->getColumnText(1)), CredentialPersistencePermanent);
+    return Credential(username, decryptedString(password), CredentialPersistencePermanent);
 }
 
-bool CredentialBackingStore::removeLogin(const ProtectionSpace& protectionSpace)
+bool CredentialBackingStore::removeLogin(const KURL& url, const ProtectionSpace& protectionSpace)
 {
     ASSERT(m_database.isOpen());
     ASSERT(m_database.tableExists("logins"));
 
-    if (!m_removeStatement)
+    if (!m_removeLoginStatement)
         return false;
 
-    m_removeStatement->bindText(1, protectionSpace.host());
-    m_removeStatement->bindInt(2, protectionSpace.port());
-    m_removeStatement->bindInt(3, static_cast<int>(protectionSpace.serverType()));
-    m_removeStatement->bindText(4, protectionSpace.realm());
-    m_removeStatement->bindInt(5, static_cast<int>(protectionSpace.authenticationScheme()));
+    m_removeLoginStatement->bindText(1, url.string());
+    m_removeLoginStatement->bindText(2, protectionSpace.host());
+    m_removeLoginStatement->bindInt(3, protectionSpace.port());
+    m_removeLoginStatement->bindInt(4, static_cast<int>(protectionSpace.serverType()));
+    m_removeLoginStatement->bindText(5, protectionSpace.realm());
+    m_removeLoginStatement->bindInt(6, static_cast<int>(protectionSpace.authenticationScheme()));
 
-    int result = m_removeStatement->step();
+    int result = m_removeLoginStatement->step();
+    m_removeLoginStatement->reset();
     HANDLE_SQL_EXEC_FAILURE(result != SQLResultDone, false,
         "Failed to remove login info from table logins - %i", result);
 
     return true;
 }
 
-bool CredentialBackingStore::clear()
+bool CredentialBackingStore::addNeverRemember(const KURL& url, const ProtectionSpace& protectionSpace)
+{
+    ASSERT(m_database.isOpen());
+    ASSERT(m_database.tableExists("never_remember"));
+
+    if (!m_addNeverRememberStatement)
+        return false;
+
+    m_addNeverRememberStatement->bindText(1, url.string());
+    m_addNeverRememberStatement->bindText(2, protectionSpace.host());
+    m_addNeverRememberStatement->bindInt(3, protectionSpace.port());
+    m_addNeverRememberStatement->bindInt(4, static_cast<int>(protectionSpace.serverType()));
+    m_addNeverRememberStatement->bindText(5, protectionSpace.realm());
+    m_addNeverRememberStatement->bindInt(6, static_cast<int>(protectionSpace.authenticationScheme()));
+
+    int result = m_addNeverRememberStatement->step();
+    m_addNeverRememberStatement->reset();
+    HANDLE_SQL_EXEC_FAILURE(result != SQLResultDone, false,
+        "Failed to add naver saved item info into table never_remember - %i", result);
+
+    return true;
+}
+
+bool CredentialBackingStore::hasNeverRemember(const ProtectionSpace& protectionSpace)
+{
+    ASSERT(m_database.isOpen());
+    ASSERT(m_database.tableExists("never_remember"));
+
+    if (!m_hasNeverRememberStatement)
+        return false;
+
+    m_hasNeverRememberStatement->bindText(1, protectionSpace.host());
+    m_hasNeverRememberStatement->bindInt(2, protectionSpace.port());
+    m_hasNeverRememberStatement->bindInt(3, static_cast<int>(protectionSpace.serverType()));
+    m_hasNeverRememberStatement->bindText(4, protectionSpace.realm());
+    m_hasNeverRememberStatement->bindInt(5, static_cast<int>(protectionSpace.authenticationScheme()));
+
+    int result = m_hasNeverRememberStatement->step();
+    int numOfRow = m_hasNeverRememberStatement->getColumnInt(0);
+    m_hasNeverRememberStatement->reset();
+    HANDLE_SQL_EXEC_FAILURE(result != SQLResultRow, false,
+        "Failed to execute select to find naver saved site from table never_remember - %i", result);
+
+    if (numOfRow)
+        return true;
+    return false;
+}
+
+KURL CredentialBackingStore::getNeverRemember(const ProtectionSpace& protectionSpace)
+{
+    ASSERT(m_database.isOpen());
+    ASSERT(m_database.tableExists("never_remember"));
+
+    if (!m_getNeverRememberStatement)
+        return KURL();
+
+    m_getNeverRememberStatement->bindText(1, protectionSpace.host());
+    m_getNeverRememberStatement->bindInt(2, protectionSpace.port());
+    m_getNeverRememberStatement->bindInt(3, static_cast<int>(protectionSpace.serverType()));
+    m_getNeverRememberStatement->bindText(4, protectionSpace.realm());
+    m_getNeverRememberStatement->bindInt(5, static_cast<int>(protectionSpace.authenticationScheme()));
+
+    int result = m_getNeverRememberStatement->step();
+    String url = m_getNeverRememberStatement->getColumnText(0);
+    m_getNeverRememberStatement->reset();
+    HANDLE_SQL_EXEC_FAILURE(result != SQLResultRow, KURL(),
+        "Failed to execute select never saved site info from table never_remember in getNeverRemember - %i", result);
+
+    return KURL(ParsedURLString, url);
+}
+
+bool CredentialBackingStore::removeNeverRemember(const ProtectionSpace& protectionSpace)
+{
+    ASSERT(m_database.isOpen());
+    ASSERT(m_database.tableExists("never_remember"));
+
+    if (!m_removeNeverRememberStatement)
+        return false;
+
+    m_removeNeverRememberStatement->bindText(1, protectionSpace.host());
+    m_removeNeverRememberStatement->bindInt(2, protectionSpace.port());
+    m_removeNeverRememberStatement->bindInt(3, static_cast<int>(protectionSpace.serverType()));
+    m_removeNeverRememberStatement->bindText(4, protectionSpace.realm());
+    m_removeNeverRememberStatement->bindInt(5, static_cast<int>(protectionSpace.authenticationScheme()));
+
+    int result = m_removeNeverRememberStatement->step();
+    m_removeNeverRememberStatement->reset();
+    HANDLE_SQL_EXEC_FAILURE(result != SQLResultDone, false,
+        "Failed to remove never saved site from table never_remember - %i", result);
+
+    return true;
+}
+
+bool CredentialBackingStore::clearLogins()
 {
     ASSERT(m_database.isOpen());
     ASSERT(m_database.tableExists("logins"));
@@ -263,6 +410,17 @@ bool CredentialBackingStore::clear()
     return true;
 }
 
+bool CredentialBackingStore::clearNeverRemember()
+{
+    ASSERT(m_database.isOpen());
+    ASSERT(m_database.tableExists("never_remember"));
+
+    HANDLE_SQL_EXEC_FAILURE(!m_database.executeCommand("DELETE * FROM never_remember"),
+        false, "Failed to clear table never_remember");
+
+    return true;
+}
+
 String CredentialBackingStore::encryptedString(const String& plainText) const
 {
     // FIXME: Need encrypt plainText here
diff --git a/Source/WebCore/platform/network/blackberry/CredentialBackingStore.h b/Source/WebCore/platform/network/blackberry/CredentialBackingStore.h
index d12631065..fc12c6b66 100644
--- a/Source/WebCore/platform/network/blackberry/CredentialBackingStore.h
+++ b/Source/WebCore/platform/network/blackberry/CredentialBackingStore.h
@@ -37,10 +37,16 @@ public:
     void close();
     bool addLogin(const KURL&, const ProtectionSpace&, const Credential&);
     bool updateLogin(const KURL&, const ProtectionSpace&, const Credential&);
-    bool hasLogin(const ProtectionSpace&);
+    bool hasLogin(const KURL&, const ProtectionSpace&);
     Credential getLogin(const ProtectionSpace&);
-    bool removeLogin(const ProtectionSpace&);
-    bool clear();
+    Credential getLogin(const KURL&);
+    bool removeLogin(const KURL&, const ProtectionSpace&);
+    bool addNeverRemember(const KURL&, const ProtectionSpace&);
+    bool hasNeverRemember(const ProtectionSpace&);
+    KURL getNeverRemember(const ProtectionSpace&);
+    bool removeNeverRemember(const ProtectionSpace&);
+    bool clearLogins();
+    bool clearNeverRemember();
 
 private:
     CredentialBackingStore();
@@ -48,11 +54,16 @@ private:
     String decryptedString(const String& cipherText) const;
 
     SQLiteDatabase m_database;
-    SQLiteStatement* m_addStatement;
-    SQLiteStatement* m_updateStatement;
-    SQLiteStatement* m_hasStatement;
-    SQLiteStatement* m_getStatement;
-    SQLiteStatement* m_removeStatement;
+    SQLiteStatement* m_addLoginStatement;
+    SQLiteStatement* m_updateLoginStatement;
+    SQLiteStatement* m_hasLoginStatement;
+    SQLiteStatement* m_getLoginStatement;
+    SQLiteStatement* m_getLoginByURLStatement;
+    SQLiteStatement* m_removeLoginStatement;
+    SQLiteStatement* m_addNeverRememberStatement;
+    SQLiteStatement* m_hasNeverRememberStatement;
+    SQLiteStatement* m_getNeverRememberStatement;
+    SQLiteStatement* m_removeNeverRememberStatement;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/network/blackberry/NetworkJob.cpp b/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
index 29134757a..912b7e996 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
+++ b/Source/WebCore/platform/network/blackberry/NetworkJob.cpp
@@ -27,6 +27,7 @@
 #include "FrameLoaderClientBlackBerry.h"
 #include "HTTPParsers.h"
 #include "KURL.h"
+#include "MIMESniffing.h"
 #include "MIMETypeRegistry.h"
 #include "NetworkManager.h"
 #include "ResourceHandleClient.h"
@@ -107,6 +108,7 @@ NetworkJob::NetworkJob()
     , m_callingClient(false)
     , m_isXHR(false)
     , m_needsRetryAsFTPDirectory(false)
+    , m_isOverrideContentType(false)
     , m_extendedStatusCode(0)
     , m_redirectCount(0)
     , m_deferredData(*this)
@@ -151,8 +153,10 @@ bool NetworkJob::initialize(int playerId,
 
     // We don't need to explicitly call notifyHeaderReceived, as the Content-Type
     // will ultimately get parsed when sendResponseIfNeeded gets called.
-    if (!request.getOverrideContentType().empty())
+    if (!request.getOverrideContentType().empty()) {
         m_contentType = String(request.getOverrideContentType().c_str());
+        m_isOverrideContentType = true;
+    }
 
     // No need to create the streams for data and about.
     if (m_isData || m_isAbout)
@@ -382,6 +386,32 @@ void NetworkJob::handleNotifyDataReceived(const char* buf, size_t len)
     if (!buf || !len)
         return;
 
+    // The loadFile API sets the override content type,
+    // this will always be used as the content type and should not be overridden.
+    if (!m_dataReceived && !m_isOverrideContentType) {
+        bool shouldSniff = true;
+
+        // Don't bother sniffing the content type of a file that
+        // is on a file system if it has a MIME mappable file extension.
+        // The file extension is likely to be correct.
+        if (m_isFile) {
+            String urlFilename = m_response.url().lastPathComponent();
+            size_t pos = urlFilename.reverseFind('.');
+            if (pos != WTF::notFound) {
+                String extension = urlFilename.substring(pos + 1);
+                String mimeType = MIMETypeRegistry::getMIMETypeForExtension(extension);
+                if (!mimeType.isEmpty())
+                    shouldSniff = false;
+            }
+        }
+
+        if (shouldSniff) {
+            MIMESniffer sniffer = MIMESniffer(m_contentType.latin1().data(), MIMETypeRegistry::isSupportedImageResourceMIMEType(m_contentType));
+            if (const char* type = sniffer.sniff(buf, std::min(len, sniffer.dataSize())))
+                m_sniffedMimeType = String(type);
+        }
+    }
+
     m_dataReceived = true;
 
     // Protect against reentrancy.
@@ -583,11 +613,9 @@ void NetworkJob::sendResponseIfNeeded()
     // Get the MIME type that was set by the content sniffer
     // if there's no custom sniffer header, try to set it from the Content-Type header
     // if this fails, guess it from extension.
-    String mimeType;
+    String mimeType = m_sniffedMimeType;
     if (m_isFTP && m_isFTPDir)
         mimeType = "application/x-ftp-directory";
-    else
-        mimeType = m_response.httpHeaderField(BlackBerry::Platform::NetworkRequest::HEADER_RIM_SNIFFED_MIME_TYPE);
     if (mimeType.isNull())
         mimeType = extractMIMETypeFromMediaType(m_contentType);
     if (mimeType.isNull())
@@ -911,7 +939,6 @@ void NetworkJob::handleAbout()
         result.append(String(BlackBerry::Platform::WEBKITCREDITS));
         result.append(String("</body></html>"));
         handled = true;
-#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     } else if (aboutWhat.startsWith("cache?query=", false)) {
         BlackBerry::Platform::Client* client = BlackBerry::Platform::Client::get();
         ASSERT(client);
@@ -929,6 +956,7 @@ void NetworkJob::handleAbout()
         result.append(String(client->generateHtmlFragmentForCacheKeys().data()));
         result.append(String("</body></html>"));
         handled = true;
+#if !defined(PUBLIC_BUILD) || !PUBLIC_BUILD
     } else if (equalIgnoringCase(aboutWhat, "cache/disable")) {
         BlackBerry::Platform::Client* client = BlackBerry::Platform::Client::get();
         ASSERT(client);
@@ -941,6 +969,11 @@ void NetworkJob::handleAbout()
         client->setDiskCacheEnabled(true);
         result.append(String("<html><head><title>BlackBerry Browser Disk Cache</title></head><body>Http disk cache is enabled.</body></html>"));
         handled = true;
+    } else if (equalIgnoringCase(aboutWhat, "cookie")) {
+        result.append(String("<html><head><title>BlackBerry Browser cookie information</title></head><body>"));
+        result.append(cookieManager().generateHtmlFragmentForCookies());
+        result.append(String("</body></html>"));
+        handled = true;
     } else if (equalIgnoringCase(aboutWhat, "version")) {
         result.append(String("<html><meta name=\"viewport\" content=\"width=device-width, user-scalable=no\"></head><body>"));
         result.append(String(BlackBerry::Platform::BUILDTIME));
diff --git a/Source/WebCore/platform/network/blackberry/NetworkJob.h b/Source/WebCore/platform/network/blackberry/NetworkJob.h
index 447a6442e..a50059ab1 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkJob.h
+++ b/Source/WebCore/platform/network/blackberry/NetworkJob.h
@@ -158,6 +158,7 @@ private:
     OwnPtr<ResourceResponse> m_multipartResponse;
     Timer<NetworkJob> m_deleteJobTimer;
     String m_contentType;
+    String m_sniffedMimeType;
     String m_contentDisposition;
     BlackBerry::Platform::NetworkStreamFactory* m_streamFactory;
     bool m_isFile;
@@ -175,6 +176,7 @@ private:
     bool m_callingClient;
     bool m_isXHR; // FIXME - After 7.0, remove this. Only the Qt port reports HTTP error statuses as didFails, so we probably shouldn't.
     bool m_needsRetryAsFTPDirectory;
+    bool m_isOverrideContentType;
 
     // If an HTTP status code is received, m_extendedStatusCode and m_response.httpStatusCode will both be set to it.
     // If a platform error code is received, m_extendedStatusCode will be set to it and m_response.httpStatusCode will be set to 404.
diff --git a/Source/WebCore/platform/network/blackberry/NetworkManager.cpp b/Source/WebCore/platform/network/blackberry/NetworkManager.cpp
index 388d6d8fd..7c628f005 100644
--- a/Source/WebCore/platform/network/blackberry/NetworkManager.cpp
+++ b/Source/WebCore/platform/network/blackberry/NetworkManager.cpp
@@ -109,7 +109,7 @@ bool NetworkManager::startJob(int playerId, const String& pageGroupName, PassRef
 
         if (authType != BlackBerry::Platform::NetworkRequest::AuthNone)
             platformRequest.setCredentials(username.utf8().data(), password.utf8().data(), authType);
-    } else if (url.protocolInHTTPFamily()) {
+    } else if (url.protocolIsInHTTPFamily()) {
         // For URLs that match the paths of those previously challenged for HTTP Basic authentication,
         // try and reuse the credential preemptively, as allowed by RFC 2617.
         Credential credential = CredentialStorage::get(url);
@@ -122,9 +122,8 @@ bool NetworkManager::startJob(int playerId, const String& pageGroupName, PassRef
         // Prepare a cookie header if there are cookies related to this url.
         String cookiePairs = cookieManager().getCookie(url, WithHttpOnlyCookies);
         if (!cookiePairs.isEmpty()) {
-            // We encode the cookie header data using utf8 to support unicode characters.
-            // For more information, look at RFC5987 - 4.1 (http://tools.ietf.org/html/rfc5987#ref-ISO-8859-1).
-            platformRequest.setCookieData(cookiePairs.utf8().data());
+            // We need to check the encoding and encode the cookie header data using latin1 or utf8 to support unicode characters.
+            platformRequest.setCookieData(cookiePairs.containsOnlyLatin1() ? cookiePairs.latin1().data() : cookiePairs.utf8().data());
         }
     }
 
diff --git a/Source/WebCore/platform/network/blackberry/ResourceRequest.h b/Source/WebCore/platform/network/blackberry/ResourceRequest.h
index cd9760db4..7072eb1f3 100644
--- a/Source/WebCore/platform/network/blackberry/ResourceRequest.h
+++ b/Source/WebCore/platform/network/blackberry/ResourceRequest.h
@@ -118,6 +118,8 @@ public:
     TargetType targetType() const { return m_targetType; }
     void setTargetType(TargetType type) { m_targetType = type; }
 
+    static TargetType targetTypeFromMimeType(const String& mimeType);
+
 private:
     friend class ResourceRequestBase;
 
diff --git a/Source/WebCore/platform/network/blackberry/ResourceRequestBlackBerry.cpp b/Source/WebCore/platform/network/blackberry/ResourceRequestBlackBerry.cpp
index d86b88cf1..5b6792fa7 100644
--- a/Source/WebCore/platform/network/blackberry/ResourceRequestBlackBerry.cpp
+++ b/Source/WebCore/platform/network/blackberry/ResourceRequestBlackBerry.cpp
@@ -22,6 +22,7 @@
 #include "BlobRegistryImpl.h"
 #include <BlackBerryPlatformClient.h>
 #include <network/NetworkRequest.h>
+#include <wtf/HashMap.h>
 #include <wtf/text/CString.h>
 
 using BlackBerry::Platform::NetworkRequest;
@@ -84,6 +85,47 @@ static inline NetworkRequest::TargetType platformTargetTypeForRequest(const Reso
     }
 }
 
+typedef HashMap<String, ResourceRequest::TargetType> MimeTypeResourceRequestTypeMap;
+
+static const MimeTypeResourceRequestTypeMap& mimeTypeRequestTypeMap()
+{
+    static MimeTypeResourceRequestTypeMap* map = 0;
+    if (!map) {
+        map = new MimeTypeResourceRequestTypeMap;
+
+        if (map) {
+            // The list here should match extensionMap[] in MIMETypeRegistryBlackBerry.cpp
+            map->add(String("text/css"), ResourceRequest::TargetIsStyleSheet);
+            map->add(String("application/x-javascript"), ResourceRequest::TargetIsScript);
+            map->add(String("image/bmp"), ResourceRequest::TargetIsImage);
+            map->add(String("image/gif"), ResourceRequest::TargetIsImage);
+            map->add(String("image/x-icon"), ResourceRequest::TargetIsImage);
+            map->add(String("image/jpeg"), ResourceRequest::TargetIsImage);
+            map->add(String("image/png"), ResourceRequest::TargetIsImage);
+            map->add(String("image/x-portable-bitmap"), ResourceRequest::TargetIsImage);
+            map->add(String("image/x-portable-graymap"), ResourceRequest::TargetIsImage);
+            map->add(String("image/x-portable-pixmap"), ResourceRequest::TargetIsImage);
+            map->add(String("image/svg+xml"), ResourceRequest::TargetIsImage);
+            map->add(String("image/tiff"), ResourceRequest::TargetIsImage);
+            map->add(String("image/x-xbitmap"), ResourceRequest::TargetIsImage);
+            map->add(String("image/x-xpm"), ResourceRequest::TargetIsImage);
+        }
+    }
+
+    return *map;
+}
+
+ResourceRequest::TargetType ResourceRequest::targetTypeFromMimeType(const String& mimeType)
+{
+    const MimeTypeResourceRequestTypeMap& map = mimeTypeRequestTypeMap();
+
+    MimeTypeResourceRequestTypeMap::const_iterator iter = map.find(mimeType);
+    if (iter == map.end())
+        return ResourceRequest::TargetIsUnspecified;
+
+    return iter->second;
+}
+
 void ResourceRequest::initializePlatformRequest(NetworkRequest& platformRequest, bool isInitial) const
 {
     // If this is the initial load, skip the request body and headers.
diff --git a/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp b/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
index fbfb902c8..0f39eb0bd 100644
--- a/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
+++ b/Source/WebCore/platform/network/cf/ResourceHandleCFNet.cpp
@@ -460,7 +460,7 @@ static CFDictionaryRef createConnectionProperties(bool shouldUseCredentialStorag
 
 void ResourceHandle::createCFURLConnection(bool shouldUseCredentialStorage, bool shouldContentSniff)
 {
-    if ((!d->m_user.isEmpty() || !d->m_pass.isEmpty()) && !firstRequest().url().protocolInHTTPFamily()) {
+    if ((!d->m_user.isEmpty() || !d->m_pass.isEmpty()) && !firstRequest().url().protocolIsInHTTPFamily()) {
         // Credentials for ftp can only be passed in URL, the didReceiveAuthenticationChallenge delegate call won't be made.
         KURL urlWithCredentials(firstRequest().url());
         urlWithCredentials.setUser(d->m_user);
@@ -470,7 +470,7 @@ void ResourceHandle::createCFURLConnection(bool shouldUseCredentialStorage, bool
 
     // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
     // try and reuse the credential preemptively, as allowed by RFC 2617.
-    if (shouldUseCredentialStorage && firstRequest().url().protocolInHTTPFamily()) {
+    if (shouldUseCredentialStorage && firstRequest().url().protocolIsInHTTPFamily()) {
         if (d->m_user.isEmpty() && d->m_pass.isEmpty()) {
             // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
             // try and reuse the credential preemptively, as allowed by RFC 2617.
diff --git a/Source/WebCore/platform/network/mac/ResourceHandleMac.mm b/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
index 06a81c59a..594db8e91 100644
--- a/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
+++ b/Source/WebCore/platform/network/mac/ResourceHandleMac.mm
@@ -185,7 +185,7 @@ static bool shouldRelaxThirdPartyCookiePolicy(const KURL& url)
 void ResourceHandle::createNSURLConnection(id delegate, bool shouldUseCredentialStorage, bool shouldContentSniff)
 {
     // Credentials for ftp can only be passed in URL, the connection:didReceiveAuthenticationChallenge: delegate call won't be made.
-    if ((!d->m_user.isEmpty() || !d->m_pass.isEmpty()) && !firstRequest().url().protocolInHTTPFamily()) {
+    if ((!d->m_user.isEmpty() || !d->m_pass.isEmpty()) && !firstRequest().url().protocolIsInHTTPFamily()) {
         KURL urlWithCredentials(firstRequest().url());
         urlWithCredentials.setUser(d->m_user);
         urlWithCredentials.setPass(d->m_pass);
@@ -195,7 +195,7 @@ void ResourceHandle::createNSURLConnection(id delegate, bool shouldUseCredential
     if (shouldRelaxThirdPartyCookiePolicy(firstRequest().url()))
         firstRequest().setFirstPartyForCookies(firstRequest().url());
 
-    if (shouldUseCredentialStorage && firstRequest().url().protocolInHTTPFamily()) {
+    if (shouldUseCredentialStorage && firstRequest().url().protocolIsInHTTPFamily()) {
         if (d->m_user.isEmpty() && d->m_pass.isEmpty()) {
             // <rdar://problem/7174050> - For URLs that match the paths of those previously challenged for HTTP Basic authentication, 
             // try and reuse the credential preemptively, as allowed by RFC 2617.
diff --git a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index e7984c4dc..d30ffce92 100644
--- a/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -486,7 +486,7 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
     // The status code is equal to 0 for protocols not in the HTTP family.
     int statusCode = m_replyWrapper->reply()->attribute(QNetworkRequest::HttpStatusCodeAttribute).toInt();
 
-    if (url.protocolInHTTPFamily()) {
+    if (url.protocolIsInHTTPFamily()) {
         String suggestedFilename = filenameFromHTTPContentDisposition(QString::fromLatin1(m_replyWrapper->reply()->rawHeader("Content-Disposition")));
 
         if (!suggestedFilename.isEmpty())
diff --git a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index e671660ae..92c66e54c 100644
--- a/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -56,6 +56,7 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
+#include <wtf/gobject/GRefPtr.h>
 #include <wtf/text/CString.h>
 
 #if ENABLE(BLOB)
@@ -86,7 +87,7 @@ private:
     ResourceResponse& m_response;
     Vector<char>& m_data;
     bool m_finished;
-    GMainLoop* m_mainLoop;
+    GRefPtr<GMainLoop> m_mainLoop;
 };
 
 WebCoreSynchronousLoader::WebCoreSynchronousLoader(ResourceError& error, ResourceResponse& response, Vector<char>& data)
@@ -95,12 +96,11 @@ WebCoreSynchronousLoader::WebCoreSynchronousLoader(ResourceError& error, Resourc
     , m_data(data)
     , m_finished(false)
 {
-    m_mainLoop = g_main_loop_new(0, false);
+    m_mainLoop = adoptGRef(g_main_loop_new(0, false));
 }
 
 WebCoreSynchronousLoader::~WebCoreSynchronousLoader()
 {
-    g_main_loop_unref(m_mainLoop);
 }
 
 void WebCoreSynchronousLoader::didReceiveResponse(ResourceHandle*, const ResourceResponse& response)
@@ -115,7 +115,7 @@ void WebCoreSynchronousLoader::didReceiveData(ResourceHandle*, const char* data,
 
 void WebCoreSynchronousLoader::didFinishLoading(ResourceHandle*, double)
 {
-    g_main_loop_quit(m_mainLoop);
+    g_main_loop_quit(m_mainLoop.get());
     m_finished = true;
 }
 
@@ -128,7 +128,7 @@ void WebCoreSynchronousLoader::didFail(ResourceHandle* handle, const ResourceErr
 void WebCoreSynchronousLoader::run()
 {
     if (!m_finished)
-        g_main_loop_run(m_mainLoop);
+        g_main_loop_run(m_mainLoop.get());
 }
 
 static void cleanupSoupRequestOperation(ResourceHandle*, bool isDestroying);
diff --git a/Source/WebCore/platform/qt/ClipboardQt.cpp b/Source/WebCore/platform/qt/ClipboardQt.cpp
index 3d8bab1f6..6d2ab7229 100644
--- a/Source/WebCore/platform/qt/ClipboardQt.cpp
+++ b/Source/WebCore/platform/qt/ClipboardQt.cpp
@@ -30,7 +30,6 @@
 #include "ClipboardQt.h"
 
 #include "CachedImage.h"
-#include "DOMStringList.h"
 #include "DataTransferItemListQt.h"
 #include "Document.h"
 #include "DragData.h"
@@ -144,28 +143,21 @@ void ClipboardQt::clearAllData()
     m_writableData = 0;
 }
 
-String ClipboardQt::getData(const String& type, bool& success) const
+String ClipboardQt::getData(const String& type) const
 {
 
-    if (policy() != ClipboardReadable) {
-        success = false;
+    if (policy() != ClipboardReadable)
         return String();
-    }
 
-    if (isHtmlMimeType(type) && m_readableData->hasHtml()) {
-        success = true;
+    if (isHtmlMimeType(type) && m_readableData->hasHtml())
         return m_readableData->html();
-    }
 
-    if (isTextMimeType(type) && m_readableData->hasText()) {
-        success = true;
+    if (isTextMimeType(type) && m_readableData->hasText())
         return m_readableData->text();
-    }
 
     ASSERT(m_readableData);
     QByteArray rawData = m_readableData->data(type);
     QString data = QTextCodec::codecForName("UTF-16")->toUnicode(rawData);
-    success = !data.isEmpty();
     return data;
 }
 
@@ -190,17 +182,17 @@ bool ClipboardQt::setData(const String& type, const String& data)
 }
 
 // extensions beyond IE's API
-PassRefPtr<DOMStringList> ClipboardQt::types() const
+HashSet<String> ClipboardQt::types() const
 {
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
-        return DOMStringList::create();
+        return HashSet<String>();
 
     ASSERT(m_readableData);
-    RefPtr<DOMStringList> result = DOMStringList::create();
+    HashSet<String> result;
     QStringList formats = m_readableData->formats();
     for (int i = 0; i < formats.count(); ++i)
-        result->append(formats.at(i));
-    return result.release();
+        result.add(formats.at(i));
+    return result;
 }
 
 PassRefPtr<FileList> ClipboardQt::files() const
diff --git a/Source/WebCore/platform/qt/ClipboardQt.h b/Source/WebCore/platform/qt/ClipboardQt.h
index a840becf6..a03fa3b87 100644
--- a/Source/WebCore/platform/qt/ClipboardQt.h
+++ b/Source/WebCore/platform/qt/ClipboardQt.h
@@ -53,11 +53,11 @@ public:
 
     void clearData(const String& type);
     void clearAllData();
-    String getData(const String& type, bool& success) const;
+    String getData(const String& type) const;
     bool setData(const String& type, const String& data);
 
     // extensions beyond IE's API
-    virtual PassRefPtr<DOMStringList> types() const;
+    virtual HashSet<String> types() const;
     virtual PassRefPtr<FileList> files() const;
 
     void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/qt/QtStyleOptionWebComboBox.h b/Source/WebCore/platform/qt/QtStyleOptionWebComboBox.h
deleted file mode 100644
index dae16965a..000000000
--- a/Source/WebCore/platform/qt/QtStyleOptionWebComboBox.h
+++ /dev/null
@@ -1,58 +0,0 @@
-/*
- * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies).
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef QtStyleOptionWebComboBox_h
-#define QtStyleOptionWebComboBox_h
-
-#include "HTMLSelectElement.h"
-#include "RenderObject.h"
-#include "RenderThemeQt.h"
-
-#include <QStyleOption>
-
-namespace WebCore {
-
-class RenderObject;
-
-class QtStyleOptionWebComboBox : public QStyleOptionComboBox {
-public:
-    QtStyleOptionWebComboBox(RenderObject* o)
-        : QStyleOptionComboBox()
-        , m_multiple(checkMultiple(o))
-    {
-    }
-
-    bool multiple() const { return m_multiple; }
-
-private:
-    bool m_multiple;
-
-    bool checkMultiple(RenderObject* o)
-    {
-        if (RenderThemeQt::useMobileTheme())
-            return false;
-        HTMLSelectElement* select = o ? static_cast<HTMLSelectElement*>(o->node()) : 0;
-        return select ? select->multiple() : false;
-    }
-};
-
-}
-
-#endif // QtStyleOptionWebComboBox_h
diff --git a/Source/WebCore/platform/qt/RenderThemeQStyle.cpp b/Source/WebCore/platform/qt/RenderThemeQStyle.cpp
deleted file mode 100644
index 75859d8b4..000000000
--- a/Source/WebCore/platform/qt/RenderThemeQStyle.cpp
+++ /dev/null
@@ -1,812 +0,0 @@
-/*
- * This file is part of the WebKit project.
- *
- * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
- *
- * Copyright (C) 2006 Zack Rusin <zack@kde.org>
- *               2006 Dirk Mueller <mueller@kde.org>
- *               2006 Nikolas Zimmermann <zimmermann@kde.org>
- * Copyright (C) 2008 Holger Hans Peter Freyther
- *
- * All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "RenderThemeQStyle.h"
-
-#include "CSSFontSelector.h"
-#include "CSSStyleSelector.h"
-#include "CSSValueKeywords.h"
-#include "Chrome.h"
-#include "ChromeClient.h"
-#include "Color.h"
-#include "Document.h"
-#include "Font.h"
-#include "FontSelector.h"
-#include "GraphicsContext.h"
-#include "HTMLInputElement.h"
-#include "HTMLNames.h"
-#include "LocalizedStrings.h"
-#include "NotImplemented.h"
-#include "Page.h"
-#include "PaintInfo.h"
-#include "QWebPageClient.h"
-#include "QtStyleOptionWebComboBox.h"
-#include "RenderBox.h"
-#if ENABLE(PROGRESS_TAG)
-#include "RenderProgress.h"
-#endif
-#include "RenderSlider.h"
-#include "ScrollbarThemeQt.h"
-#include "SliderThumbElement.h"
-#include "UserAgentStyleSheets.h"
-
-#include <QApplication>
-#include <QColor>
-#include <QFile>
-#include <QFontMetrics>
-#include <QLineEdit>
-#include <QMacStyle>
-#include <QPainter>
-#ifndef QT_NO_STYLE_PLASTIQUE
-#include <QPlastiqueStyle>
-#endif
-#include <QPushButton>
-#include <QStyleFactory>
-#include <QStyleOptionButton>
-#include <QStyleOptionFrameV2>
-#if ENABLE(PROGRESS_TAG)
-#include <QStyleOptionProgressBarV2>
-#endif
-#include <QStyleOptionSlider>
-#include <QWidget>
-
-namespace WebCore {
-
-using namespace HTMLNames;
-
-inline static void initStyleOption(QWidget *widget, QStyleOption& option)
-{
-    if (widget)
-        option.initFrom(widget);
-    else {
-        /*
-          If a widget is not directly available for rendering, we fallback to default
-          value for an active widget.
-         */
-        option.state = QStyle::State_Active | QStyle::State_Enabled;
-    }
-}
-
-
-QSharedPointer<StylePainter> RenderThemeQStyle::getStylePainter(const PaintInfo& paintInfo)
-{
-    return QSharedPointer<StylePainter>(new StylePainterQStyle(this, paintInfo));
-}
-
-StylePainterQStyle::StylePainterQStyle(RenderThemeQStyle* theme, const PaintInfo& paintInfo)
-    : StylePainter(theme, paintInfo)
-{
-    init(paintInfo.context ? paintInfo.context : 0, theme->qStyle());
-}
-
-StylePainterQStyle::StylePainterQStyle(ScrollbarThemeQt* theme, GraphicsContext* context)
-    : StylePainter()
-{
-    init(context, theme->style());
-}
-
-void StylePainterQStyle::init(GraphicsContext* context, QStyle* themeStyle)
-{
-    painter = static_cast<QPainter*>(context->platformContext());
-    widget = 0;
-    QPaintDevice* dev = 0;
-    if (painter)
-        dev = painter->device();
-    if (dev && dev->devType() == QInternal::Widget)
-        widget = static_cast<QWidget*>(dev);
-    style = themeStyle;
-
-    StylePainter::init(context);
-}
-
-PassRefPtr<RenderTheme> RenderThemeQStyle::create(Page* page)
-{
-    return adoptRef(new RenderThemeQStyle(page));
-}
-
-RenderThemeQStyle::RenderThemeQStyle(Page* page)
-    : RenderThemeQt(page)
-#ifndef QT_NO_LINEEDIT
-    , m_lineEdit(0)
-#endif
-{
-    QPushButton button;
-    QFont defaultButtonFont = QApplication::font(&button);
-    m_buttonFontFamily = defaultButtonFont.family();
-#ifdef Q_WS_MAC
-    button.setAttribute(Qt::WA_MacSmallSize);
-    QFontInfo fontInfo(defaultButtonFont);
-    m_buttonFontPixelSize = fontInfo.pixelSize();
-#endif
-
-    m_fallbackStyle = QStyleFactory::create(QLatin1String("windows"));
-}
-
-RenderThemeQStyle::~RenderThemeQStyle()
-{
-    delete m_fallbackStyle;
-#ifndef QT_NO_LINEEDIT
-    delete m_lineEdit;
-#endif
-}
-
-
-// for some widget painting, we need to fallback to Windows style
-QStyle* RenderThemeQStyle::fallbackStyle() const
-{
-    return (m_fallbackStyle) ? m_fallbackStyle : QApplication::style();
-}
-
-QStyle* RenderThemeQStyle::qStyle() const
-{
-    if (m_page) {
-        QWebPageClient* pageClient = m_page->chrome()->client()->platformPageClient();
-
-        if (pageClient)
-            return pageClient->style();
-    }
-
-    return QApplication::style();
-}
-
-int RenderThemeQStyle::findFrameLineWidth(QStyle* style) const
-{
-#ifndef QT_NO_LINEEDIT
-    if (!m_lineEdit)
-        m_lineEdit = new QLineEdit();
-#endif
-
-    QStyleOptionFrameV2 opt;
-    QWidget* widget = 0;
-#ifndef QT_NO_LINEEDIT
-    widget = m_lineEdit;
-#endif
-    return style->pixelMetric(QStyle::PM_DefaultFrameWidth, &opt, widget);
-}
-
-QRect RenderThemeQStyle::inflateButtonRect(const QRect& originalRect) const
-{
-    QStyleOptionButton option;
-    option.state |= QStyle::State_Small;
-    option.rect = originalRect;
-
-    QRect layoutRect = qStyle()->subElementRect(QStyle::SE_PushButtonLayoutItem, &option, 0);
-    if (!layoutRect.isNull()) {
-        int paddingLeft = layoutRect.left() - originalRect.left();
-        int paddingRight = originalRect.right() - layoutRect.right();
-        int paddingTop = layoutRect.top() - originalRect.top();
-        int paddingBottom = originalRect.bottom() - layoutRect.bottom();
-
-        return originalRect.adjusted(-paddingLeft, -paddingTop, paddingRight, paddingBottom);
-    }
-    return originalRect;
-}
-
-void RenderThemeQStyle::computeSizeBasedOnStyle(RenderStyle* renderStyle) const
-{
-    QSize size(0, 0);
-    const QFontMetrics fm(renderStyle->font().font());
-    QStyle* style = qStyle();
-
-    switch (renderStyle->appearance()) {
-    case TextAreaPart:
-    case SearchFieldPart:
-    case TextFieldPart: {
-        int padding = findFrameLineWidth(style);
-        renderStyle->setPaddingLeft(Length(padding, Fixed));
-        renderStyle->setPaddingRight(Length(padding, Fixed));
-        renderStyle->setPaddingTop(Length(padding, Fixed));
-        renderStyle->setPaddingBottom(Length(padding, Fixed));
-        break;
-    }
-    default:
-        break;
-    }
-    // If the width and height are both specified, then we have nothing to do.
-    if (!renderStyle->width().isIntrinsicOrAuto() && !renderStyle->height().isAuto())
-        return;
-
-    switch (renderStyle->appearance()) {
-    case CheckboxPart: {
-        QStyleOption styleOption;
-        styleOption.state |= QStyle::State_Small;
-        int checkBoxWidth = style->pixelMetric(QStyle::PM_IndicatorWidth, &styleOption);
-        checkBoxWidth *= renderStyle->effectiveZoom();
-        size = QSize(checkBoxWidth, checkBoxWidth);
-        break;
-    }
-    case RadioPart: {
-        QStyleOption styleOption;
-        styleOption.state |= QStyle::State_Small;
-        int radioWidth = style->pixelMetric(QStyle::PM_ExclusiveIndicatorWidth, &styleOption);
-        radioWidth *= renderStyle->effectiveZoom();
-        size = QSize(radioWidth, radioWidth);
-        break;
-    }
-    case PushButtonPart:
-    case ButtonPart: {
-        QStyleOptionButton styleOption;
-        styleOption.state |= QStyle::State_Small;
-        QSize contentSize = fm.size(Qt::TextShowMnemonic, QString::fromLatin1("X"));
-        QSize pushButtonSize = style->sizeFromContents(QStyle::CT_PushButton,
-                                                       &styleOption, contentSize, 0);
-        styleOption.rect = QRect(0, 0, pushButtonSize.width(), pushButtonSize.height());
-        QRect layoutRect = style->subElementRect(QStyle::SE_PushButtonLayoutItem,
-                                                 &styleOption, 0);
-
-        // If the style supports layout rects we use that, and  compensate accordingly
-        // in paintButton() below.
-        if (!layoutRect.isNull())
-            size.setHeight(layoutRect.height());
-        else
-            size.setHeight(pushButtonSize.height());
-
-        break;
-    }
-    case MenulistPart: {
-        QStyleOptionComboBox styleOption;
-        styleOption.state |= QStyle::State_Small;
-        int contentHeight = qMax(fm.lineSpacing(), 14) + 2;
-        QSize menuListSize = style->sizeFromContents(QStyle::CT_ComboBox,
-                                                     &styleOption, QSize(0, contentHeight), 0);
-        size.setHeight(menuListSize.height());
-        break;
-    }
-    default:
-        break;
-    }
-
-    // FIXME: Check is flawed, since it doesn't take min-width/max-width into account.
-    if (renderStyle->width().isIntrinsicOrAuto() && size.width() > 0)
-        renderStyle->setMinWidth(Length(size.width(), Fixed));
-    if (renderStyle->height().isAuto() && size.height() > 0)
-        renderStyle->setMinHeight(Length(size.height(), Fixed));
-}
-
-
-
-void RenderThemeQStyle::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element*) const
-{
-    // Ditch the border.
-    style->resetBorder();
-
-#ifdef Q_WS_MAC
-    if (style->appearance() == PushButtonPart) {
-        // The Mac ports ignore the specified height for <input type="button"> elements
-        // unless a border and/or background CSS property is also specified.
-        style->setHeight(Length(Auto));
-    }
-#endif
-
-    FontDescription fontDescription = style->fontDescription();
-    fontDescription.setIsAbsoluteSize(true);
-
-#ifdef Q_WS_MAC // Use fixed font size and family on Mac (like Safari does)
-    fontDescription.setSpecifiedSize(m_buttonFontPixelSize);
-    fontDescription.setComputedSize(m_buttonFontPixelSize);
-#else
-    fontDescription.setSpecifiedSize(style->fontSize());
-    fontDescription.setComputedSize(style->fontSize());
-#endif
-
-    FontFamily fontFamily;
-    fontFamily.setFamily(m_buttonFontFamily);
-    fontDescription.setFamily(fontFamily);
-    style->setFontDescription(fontDescription);
-    style->font().update(selector->fontSelector());
-    style->setLineHeight(RenderStyle::initialLineHeight());
-    setButtonSize(style);
-    setButtonPadding(style);
-}
-
-void RenderThemeQStyle::setButtonPadding(RenderStyle* style) const
-{
-    QStyleOptionButton styleOption;
-    styleOption.state |= QStyle::State_Small;
-
-    // Fake a button rect here, since we're just computing deltas
-    QRect originalRect = QRect(0, 0, 100, 30);
-    styleOption.rect = originalRect;
-
-    // Default padding is based on the button margin pixel metric
-    int buttonMargin = qStyle()->pixelMetric(QStyle::PM_ButtonMargin, &styleOption, 0);
-    int paddingLeft = buttonMargin;
-    int paddingRight = buttonMargin;
-    int paddingTop = buttonMargin;
-    int paddingBottom = buttonMargin;
-
-    // Then check if the style uses layout margins
-    QRect layoutRect = qStyle()->subElementRect(QStyle::SE_PushButtonLayoutItem,
-                                                &styleOption, 0);
-    if (!layoutRect.isNull()) {
-        QRect contentsRect = qStyle()->subElementRect(QStyle::SE_PushButtonContents,
-                                                      &styleOption, 0);
-        paddingLeft = contentsRect.left() - layoutRect.left();
-        paddingRight = layoutRect.right() - contentsRect.right();
-        paddingTop = contentsRect.top() - layoutRect.top();
-
-        // Can't use this right now because we don't have the baseline to compensate
-        // paddingBottom = layoutRect.bottom() - contentsRect.bottom();
-    }
-    style->setPaddingLeft(Length(paddingLeft, Fixed));
-    style->setPaddingRight(Length(paddingRight, Fixed));
-    style->setPaddingTop(Length(paddingTop, Fixed));
-    style->setPaddingBottom(Length(paddingBottom, Fixed));
-}
-
-bool RenderThemeQStyle::paintButton(RenderObject* o, const PaintInfo& i, const IntRect& r)
-{
-    StylePainterQStyle p(this, i);
-    if (!p.isValid())
-       return true;
-
-    QStyleOptionButton option;
-    initStyleOption(p.widget, option);
-    option.rect = r;
-    option.state |= QStyle::State_Small;
-
-    ControlPart appearance = initializeCommonQStyleOptions(option, o);
-    if (appearance == PushButtonPart || appearance == ButtonPart) {
-        option.rect = inflateButtonRect(option.rect);
-        p.drawControl(QStyle::CE_PushButton, option);
-    } else if (appearance == RadioPart)
-       p.drawControl(QStyle::CE_RadioButton, option);
-    else if (appearance == CheckboxPart)
-       p.drawControl(QStyle::CE_CheckBox, option);
-
-    return false;
-}
-
-bool RenderThemeQStyle::paintTextField(RenderObject* o, const PaintInfo& i, const IntRect& r)
-{
-    StylePainterQStyle p(this, i);
-    if (!p.isValid())
-        return true;
-
-    QStyleOptionFrameV2 panel;
-    initStyleOption(p.widget, panel);
-    panel.rect = r;
-    panel.lineWidth = findFrameLineWidth(qStyle());
-    panel.state |= QStyle::State_Sunken;
-    panel.features = QStyleOptionFrameV2::None;
-
-    // Get the correct theme data for a text field
-    ControlPart appearance = initializeCommonQStyleOptions(panel, o);
-    if (appearance != TextFieldPart
-        && appearance != SearchFieldPart
-        && appearance != TextAreaPart
-        && appearance != ListboxPart)
-        return true;
-
-    // Now paint the text field.
-    p.drawPrimitive(QStyle::PE_PanelLineEdit, panel);
-    return false;
-}
-
-void RenderThemeQStyle::adjustTextAreaStyle(CSSStyleSelector* selector, RenderStyle* style, Element* element) const
-{
-    adjustTextFieldStyle(selector, style, element);
-}
-
-bool RenderThemeQStyle::paintTextArea(RenderObject* o, const PaintInfo& i, const IntRect& r)
-{
-    return paintTextField(o, i, r);
-}
-
-void RenderThemeQStyle::setPopupPadding(RenderStyle* style) const
-{
-    const int paddingLeft = 4;
-    const int paddingRight = style->width().isFixed() || style->width().isPercent() ? 5 : 8;
-
-    style->setPaddingLeft(Length(paddingLeft, Fixed));
-
-    QStyleOptionComboBox opt;
-    int w = qStyle()->pixelMetric(QStyle::PM_ButtonIconSize, &opt, 0);
-    style->setPaddingRight(Length(paddingRight + w, Fixed));
-
-    style->setPaddingTop(Length(2, Fixed));
-    style->setPaddingBottom(Length(2, Fixed));
-}
-
-
-bool RenderThemeQStyle::paintMenuList(RenderObject* o, const PaintInfo& i, const IntRect& r)
-{
-    StylePainterQStyle p(this, i);
-    if (!p.isValid())
-        return true;
-
-    QtStyleOptionWebComboBox opt(o);
-    initStyleOption(p.widget, opt);
-    initializeCommonQStyleOptions(opt, o);
-
-    IntRect rect = r;
-
-#if defined(Q_WS_MAC) && !defined(QT_NO_STYLE_MAC)
-    // QMacStyle makes the combo boxes a little bit smaller to leave space for the focus rect.
-    // Because of it, the combo button is drawn at a point to the left of where it was expect to be and may end up
-    // overlapped with the text. This will force QMacStyle to draw the combo box with the expected width.
-    if (qobject_cast<QMacStyle*>(p.style))
-        rect.inflateX(3);
-#endif
-
-    const QPoint topLeft = rect.location();
-    p.painter->translate(topLeft);
-    opt.rect.moveTo(QPoint(0, 0));
-    opt.rect.setSize(rect.size());
-
-    p.drawComplexControl(QStyle::CC_ComboBox, opt);
-    p.painter->translate(-topLeft);
-    return false;
-}
-
-void RenderThemeQStyle::adjustMenuListButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
-{
-    // WORKAROUND because html.css specifies -webkit-border-radius for <select> so we override it here
-    // see also http://bugs.webkit.org/show_bug.cgi?id=18399
-    style->resetBorderRadius();
-
-    RenderThemeQt::adjustMenuListButtonStyle(selector, style, e);
-}
-
-bool RenderThemeQStyle::paintMenuListButton(RenderObject* o, const PaintInfo& i,
-                                        const IntRect& r)
-{
-    StylePainterQStyle p(this, i);
-    if (!p.isValid())
-        return true;
-
-    QtStyleOptionWebComboBox option(o);
-    initStyleOption(p.widget, option);
-    initializeCommonQStyleOptions(option, o);
-    option.rect = r;
-
-    // for drawing the combo box arrow, rely only on the fallback style
-    p.style = fallbackStyle();
-    option.subControls = QStyle::SC_ComboBoxArrow;
-    p.drawComplexControl(QStyle::CC_ComboBox, option);
-
-    return false;
-}
-
-#if ENABLE(PROGRESS_TAG)
-double RenderThemeQStyle::animationDurationForProgressBar(RenderProgress* renderProgress) const
-{
-    if (renderProgress->position() >= 0)
-        return 0;
-
-    QStyleOptionProgressBarV2 option;
-    option.rect.setSize(renderProgress->size());
-    // FIXME: Until http://bugreports.qt.nokia.com/browse/QTBUG-9171 is fixed,
-    // we simulate one square animating across the progress bar.
-    return (option.rect.width() / qStyle()->pixelMetric(QStyle::PM_ProgressBarChunkWidth, &option)) * animationRepeatIntervalForProgressBar(renderProgress);
-}
-
-bool RenderThemeQStyle::paintProgressBar(RenderObject* o, const PaintInfo& pi, const IntRect& r)
-{
-    if (!o->isProgress())
-        return true;
-
-    StylePainterQStyle p(this, pi);
-    if (!p.isValid())
-       return true;
-
-    QStyleOptionProgressBarV2 option;
-    initStyleOption(p.widget, option);
-    initializeCommonQStyleOptions(option, o);
-
-    RenderProgress* renderProgress = toRenderProgress(o);
-    option.rect = r;
-    option.maximum = std::numeric_limits<int>::max();
-    option.minimum = 0;
-    option.progress = (renderProgress->position() * std::numeric_limits<int>::max());
-
-    const QPoint topLeft = r.location();
-    p.painter->translate(topLeft);
-    option.rect.moveTo(QPoint(0, 0));
-    option.rect.setSize(r.size());
-
-    if (option.progress < 0) {
-        // FIXME: Until http://bugreports.qt.nokia.com/browse/QTBUG-9171 is fixed,
-        // we simulate one square animating across the progress bar.
-        p.drawControl(QStyle::CE_ProgressBarGroove, option);
-        int chunkWidth = qStyle()->pixelMetric(QStyle::PM_ProgressBarChunkWidth, &option);
-        QColor color = (option.palette.highlight() == option.palette.background()) ? option.palette.color(QPalette::Active, QPalette::Highlight) : option.palette.color(QPalette::Highlight);
-        if (renderProgress->style()->direction() == RTL)
-            p.painter->fillRect(option.rect.right() - chunkWidth  - renderProgress->animationProgress() * option.rect.width(), 0, chunkWidth, option.rect.height(), color);
-        else
-            p.painter->fillRect(renderProgress->animationProgress() * option.rect.width(), 0, chunkWidth, option.rect.height(), color);
-    } else
-        p.drawControl(QStyle::CE_ProgressBar, option);
-
-    p.painter->translate(-topLeft);
-
-    return false;
-}
-#endif
-
-bool RenderThemeQStyle::paintSliderTrack(RenderObject* o, const PaintInfo& pi,
-                                     const IntRect& r)
-{
-    StylePainterQStyle p(this, pi);
-    if (!p.isValid())
-        return true;
-
-    const QPoint topLeft = r.location();
-    p.painter->translate(topLeft);
-
-    QStyleOptionSlider option;
-    initStyleOption(p.widget, option);
-    option.subControls = QStyle::SC_SliderGroove;
-    ControlPart appearance = initializeCommonQStyleOptions(option, o);
-    option.rect = r;
-    option.rect.moveTo(QPoint(0, 0));
-    if (appearance == SliderVerticalPart)
-        option.orientation = Qt::Vertical;
-    if (isPressed(o))
-        option.state |= QStyle::State_Sunken;
-
-    // some styles need this to show a highlight on one side of the groove
-    HTMLInputElement* slider = o->node()->toInputElement();
-    if (slider) {
-        option.upsideDown = (appearance == SliderHorizontalPart) && !o->style()->isLeftToRightDirection();
-        // Use the width as a multiplier in case the slider values are <= 1
-        const int width = r.width() > 0 ? r.width() : 100;
-        option.maximum = slider->maximum() * width;
-        option.minimum = slider->minimum() * width;
-        if (!option.upsideDown)
-            option.sliderPosition = slider->valueAsNumber() * width;
-        else
-            option.sliderPosition = option.minimum + option.maximum - slider->valueAsNumber() * width;
-    }
-
-    p.drawComplexControl(QStyle::CC_Slider, option);
-
-    if (option.state & QStyle::State_HasFocus) {
-        QStyleOptionFocusRect focusOption;
-        focusOption.rect = r;
-        p.drawPrimitive(QStyle::PE_FrameFocusRect, focusOption);
-    }
-    p.painter->translate(-topLeft);
-    return false;
-}
-
-void RenderThemeQStyle::adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
-{
-    style->setBoxShadow(nullptr);
-}
-
-bool RenderThemeQStyle::paintSliderThumb(RenderObject* o, const PaintInfo& pi,
-                                     const IntRect& r)
-{
-    StylePainterQStyle p(this, pi);
-    if (!p.isValid())
-        return true;
-
-    const QPoint topLeft = r.location();
-    p.painter->translate(topLeft);
-
-    QStyleOptionSlider option;
-    initStyleOption(p.widget, option);
-    option.subControls = QStyle::SC_SliderHandle;
-    ControlPart appearance = initializeCommonQStyleOptions(option, o);
-    option.rect = r;
-    option.rect.moveTo(QPoint(0, 0));
-    if (appearance == SliderThumbVerticalPart)
-        option.orientation = Qt::Vertical;
-    if (isPressed(o)) {
-        option.activeSubControls = QStyle::SC_SliderHandle;
-        option.state |= QStyle::State_Sunken;
-    }
-
-    p.drawComplexControl(QStyle::CC_Slider, option);
-    p.painter->translate(-topLeft);
-    return false;
-}
-
-void RenderThemeQStyle::adjustSliderThumbStyle(CSSStyleSelector* selector, RenderStyle* style, Element* element) const
-{
-    RenderTheme::adjustSliderThumbStyle(selector, style, element);
-    style->setBoxShadow(nullptr);
-}
-
-bool RenderThemeQStyle::paintSearchField(RenderObject* o, const PaintInfo& pi,
-                                     const IntRect& r)
-{
-    return paintTextField(o, pi, r);
-}
-
-void RenderThemeQStyle::adjustSearchFieldDecorationStyle(CSSStyleSelector* selector, RenderStyle* style,
-                                                     Element* e) const
-{
-    notImplemented();
-    RenderTheme::adjustSearchFieldDecorationStyle(selector, style, e);
-}
-
-bool RenderThemeQStyle::paintSearchFieldDecoration(RenderObject* o, const PaintInfo& pi,
-                                               const IntRect& r)
-{
-    notImplemented();
-    return RenderTheme::paintSearchFieldDecoration(o, pi, r);
-}
-
-void RenderThemeQStyle::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector* selector, RenderStyle* style,
-                                                            Element* e) const
-{
-    notImplemented();
-    RenderTheme::adjustSearchFieldResultsDecorationStyle(selector, style, e);
-}
-
-bool RenderThemeQStyle::paintSearchFieldResultsDecoration(RenderObject* o, const PaintInfo& pi,
-                                                      const IntRect& r)
-{
-    notImplemented();
-    return RenderTheme::paintSearchFieldResultsDecoration(o, pi, r);
-}
-
-#ifndef QT_NO_SPINBOX
-
-bool RenderThemeQStyle::paintInnerSpinButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& rect)
-{
-    StylePainterQStyle p(this, paintInfo);
-    if (!p.isValid())
-       return true;
-
-    QStyleOptionSpinBox option;
-    initStyleOption(p.widget, option);
-    option.subControls = QStyle::SC_SpinBoxUp | QStyle::SC_SpinBoxDown;
-    if (!isReadOnlyControl(o)) {
-        if (isEnabled(o))
-            option.stepEnabled = QAbstractSpinBox::StepUpEnabled | QAbstractSpinBox::StepDownEnabled;
-        if (isPressed(o)) {
-            option.state |= QStyle::State_Sunken;
-            if (isSpinUpButtonPartPressed(o))
-                option.activeSubControls = QStyle::SC_SpinBoxUp;
-            else
-                option.activeSubControls = QStyle::SC_SpinBoxDown;
-        }
-    }
-    // Render the spin buttons for LTR or RTL accordingly.
-    option.direction = o->style()->isLeftToRightDirection() ? Qt::LeftToRight : Qt::RightToLeft;
-
-    IntRect buttonRect = rect;
-    // Default to moving the buttons a little bit within the editor frame.
-    int inflateX = -2;
-    int inflateY = -2;
-#if defined(Q_WS_MAC) && !defined(QT_NO_STYLE_MAC)
-    // QMacStyle will position the aqua buttons flush to the right.
-    // This will move them more within the control for better style, a la
-    // Chromium look & feel.
-    if (qobject_cast<QMacStyle*>(p.style)) {
-        inflateX = -4;
-        // Render mini aqua spin buttons for QMacStyle to fit nicely into
-        // the editor area, like Chromium.
-        option.state |= QStyle::State_Mini;
-    }
-#endif
-#if !defined(QT_NO_STYLE_PLASTIQUE)
-    // QPlastiqueStyle looks best when the spin buttons are flush with the frame's edge.
-    if (qobject_cast<QPlastiqueStyle*>(p.style)) {
-        inflateX = 0;
-        inflateY = 0;
-    }
-#endif
-
-    buttonRect.inflateX(inflateX);
-    buttonRect.inflateY(inflateY);
-    option.rect = buttonRect;
-
-    p.drawComplexControl(QStyle::CC_SpinBox, option);
-    return false;
-}
-#endif
-
-ControlPart RenderThemeQStyle::initializeCommonQStyleOptions(QStyleOption& option, RenderObject* o) const
-{
-    // Default bits: no focus, no mouse over
-    option.state &= ~(QStyle::State_HasFocus | QStyle::State_MouseOver);
-
-    if (isReadOnlyControl(o))
-        // Readonly is supported on textfields.
-        option.state |= QStyle::State_ReadOnly;
-
-    option.direction = Qt::LeftToRight;
-
-    if (isHovered(o))
-        option.state |= QStyle::State_MouseOver;
-
-    setPaletteFromPageClientIfExists(option.palette);
-
-    if (!isEnabled(o)) {
-        option.palette.setCurrentColorGroup(QPalette::Disabled);
-        option.state &= ~QStyle::State_Enabled;
-    }
-
-    RenderStyle* style = o->style();
-    if (!style)
-        return NoControlPart;
-
-    ControlPart result = style->appearance();
-    if (supportsFocus(result) && isFocused(o)) {
-        option.state |= QStyle::State_HasFocus;
-        option.state |= QStyle::State_KeyboardFocusChange;
-    }
-
-    if (style->direction() == WebCore::RTL)
-        option.direction = Qt::RightToLeft;
-
-    switch (result) {
-    case PushButtonPart:
-    case SquareButtonPart:
-    case ButtonPart:
-    case ButtonBevelPart:
-    case ListItemPart:
-    case MenulistButtonPart:
-    case SearchFieldResultsButtonPart:
-    case SearchFieldCancelButtonPart: {
-        if (isPressed(o))
-            option.state |= QStyle::State_Sunken;
-        else if (result == PushButtonPart || result == ButtonPart)
-            option.state |= QStyle::State_Raised;
-        break;
-    }
-    case RadioPart:
-    case CheckboxPart:
-        option.state |= (isChecked(o) ? QStyle::State_On : QStyle::State_Off);
-    }
-
-    return result;
-}
-
-void RenderThemeQStyle::adjustSliderThumbSize(RenderStyle* style) const
-{
-    const ControlPart part = style->appearance();
-    if (part == SliderThumbHorizontalPart || part == SliderThumbVerticalPart) {
-        QStyleOptionSlider option;
-        if (part == SliderThumbVerticalPart)
-            option.orientation = Qt::Vertical;
-
-        QStyle* qstyle = qStyle();
-
-        int length = qstyle->pixelMetric(QStyle::PM_SliderLength, &option);
-        int thickness = qstyle->pixelMetric(QStyle::PM_SliderThickness, &option);
-        if (option.orientation == Qt::Vertical) {
-            style->setWidth(Length(thickness, Fixed));
-            style->setHeight(Length(length, Fixed));
-        } else {
-            style->setWidth(Length(length, Fixed));
-            style->setHeight(Length(thickness, Fixed));
-        }
-    } else
-        RenderThemeQt::adjustSliderThumbSize(style);
-}
-
-}
-
-// vim: ts=4 sw=4 et
diff --git a/Source/WebCore/platform/qt/RenderThemeQStyle.h b/Source/WebCore/platform/qt/RenderThemeQStyle.h
deleted file mode 100644
index 28b76f272..000000000
--- a/Source/WebCore/platform/qt/RenderThemeQStyle.h
+++ /dev/null
@@ -1,144 +0,0 @@
-/*
- * This file is part of the theme implementation for form controls in WebCore.
- *
- * Copyright (C) 2011 Nokia Corporation and/or its subsidiary(-ies).
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-#ifndef RenderThemeQStyle_h
-#define RenderThemeQStyle_h
-
-#include "RenderThemeQt.h"
-
-#include <QStyle>
-
-QT_BEGIN_NAMESPACE
-#ifndef QT_NO_LINEEDIT
-class QLineEdit;
-#endif
-class QPainter;
-class QWidget;
-QT_END_NAMESPACE
-
-namespace WebCore {
-
-class ScrollbarThemeQt;
-
-class RenderThemeQStyle : public RenderThemeQt {
-private:
-    RenderThemeQStyle(Page*);
-    virtual ~RenderThemeQStyle();
-
-public:
-    static PassRefPtr<RenderTheme> create(Page*);
-
-    virtual void adjustSliderThumbSize(RenderStyle*) const;
-
-    QStyle* qStyle() const;
-
-protected:
-    virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintButton(RenderObject*, const PaintInfo&, const IntRect&);
-
-    virtual bool paintTextField(RenderObject*, const PaintInfo&, const IntRect&);
-
-    virtual bool paintTextArea(RenderObject*, const PaintInfo&, const IntRect&);
-    virtual void adjustTextAreaStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-    virtual bool paintMenuList(RenderObject*, const PaintInfo&, const IntRect&);
-
-    virtual bool paintMenuListButton(RenderObject*, const PaintInfo&, const IntRect&);
-    virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-#if ENABLE(PROGRESS_TAG)
-    // Returns the duration of the animation for the progress bar.
-    virtual double animationDurationForProgressBar(RenderProgress*) const;
-    virtual bool paintProgressBar(RenderObject*, const PaintInfo&, const IntRect&);
-#endif
-
-    virtual bool paintSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
-    virtual void adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-    virtual bool paintSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
-    virtual void adjustSliderThumbStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-
-    virtual bool paintSearchField(RenderObject*, const PaintInfo&, const IntRect&);
-
-    virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldDecoration(RenderObject*, const PaintInfo&, const IntRect&);
-
-    virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const PaintInfo&, const IntRect&);
-
-#ifndef QT_NO_SPINBOX
-    virtual bool paintInnerSpinButton(RenderObject*, const PaintInfo&, const IntRect&);
-#endif
-
-protected:
-    virtual void computeSizeBasedOnStyle(RenderStyle*) const;
-
-    virtual QSharedPointer<StylePainter> getStylePainter(const PaintInfo&);
-
-    virtual QRect inflateButtonRect(const QRect& originalRect) const;
-
-    virtual void setPopupPadding(RenderStyle*) const;
-
-private:
-    ControlPart initializeCommonQStyleOptions(QStyleOption&, RenderObject*) const;
-
-    void setButtonPadding(RenderStyle*) const;
-
-    int findFrameLineWidth(QStyle*) const;
-
-    QStyle* fallbackStyle() const;
-
-#ifdef Q_OS_MAC
-    int m_buttonFontPixelSize;
-#endif
-
-    QStyle* m_fallbackStyle;
-#ifndef QT_NO_LINEEDIT
-    mutable QLineEdit* m_lineEdit;
-#endif
-};
-
-class StylePainterQStyle : public StylePainter {
-public:
-    explicit StylePainterQStyle(RenderThemeQStyle*, const PaintInfo&);
-    explicit StylePainterQStyle(ScrollbarThemeQt*, GraphicsContext*);
-
-    bool isValid() const { return style && StylePainter::isValid(); }
-
-    QWidget* widget;
-    QStyle* style;
-
-    void drawPrimitive(QStyle::PrimitiveElement pe, const QStyleOption& opt)
-    { style->drawPrimitive(pe, &opt, painter, widget); }
-    void drawControl(QStyle::ControlElement ce, const QStyleOption& opt)
-    { style->drawControl(ce, &opt, painter, widget); }
-    void drawComplexControl(QStyle::ComplexControl cc, const QStyleOptionComplex& opt)
-    { style->drawComplexControl(cc, &opt, painter, widget); }
-
-private:
-    void init(GraphicsContext*, QStyle*);
-
-    Q_DISABLE_COPY(StylePainterQStyle)
-};
-
-}
-
-#endif // RenderThemeQStyle_h
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.cpp b/Source/WebCore/platform/qt/RenderThemeQt.cpp
index 00b8b1c1b..83b0d82a2 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQt.cpp
@@ -54,6 +54,7 @@
 #include "RenderProgress.h"
 #endif
 #include "RenderTheme.h"
+#include "RenderThemeQtMobile.h"
 #include "ScrollbarTheme.h"
 #include "TimeRanges.h"
 #include "UserAgentStyleSheets.h"
@@ -82,6 +83,9 @@ static const float minSearchFieldResultsDecorationSize = 9;
 static const float maxSearchFieldResultsDecorationSize = 30;
 static const float defaultSearchFieldResultsButtonWidth = 18;
 
+static QtThemeFactoryFunction themeFactory;
+static ScrollbarTheme* scrollbarTheme;
+
 RenderThemeQt::RenderThemeQt(Page* page)
     : RenderTheme()
     , m_page(page)
@@ -89,13 +93,30 @@ RenderThemeQt::RenderThemeQt(Page* page)
     m_buttonFontFamily = QGuiApplication::font().family();
 }
 
-bool RenderThemeQt::useMobileTheme()
+void RenderThemeQt::setCustomTheme(QtThemeFactoryFunction factory, ScrollbarTheme* customScrollbarTheme)
 {
-#if HAVE(QSTYLE)
-    return !qgetenv("QT_WEBKIT_USE_MOBILE_THEME").isNull();
-#else
-    return true;
-#endif
+    themeFactory = factory;
+    scrollbarTheme = customScrollbarTheme;
+}
+
+ScrollbarTheme* RenderThemeQt::customScrollbarTheme()
+{
+    return scrollbarTheme;
+}
+
+static PassRefPtr<RenderTheme> createTheme(Page* page)
+{
+    if (themeFactory)
+        return themeFactory(page);
+    return RenderThemeQtMobile::create(page);
+}
+
+PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
+{
+    if (page)
+        return createTheme(page);
+    static RenderTheme* fallback = createTheme(0).leakRef();
+    return fallback;
 }
 
 // Remove this when SearchFieldPart is style-able in RenderTheme::isControlStyled()
@@ -116,7 +137,9 @@ String RenderThemeQt::extraDefaultStyleSheet()
 {
     StringBuilder result;
     result.append(RenderTheme::extraDefaultStyleSheet());
-    if (useMobileTheme()) {
+    // When no theme factory is provided we default to using our platform independent "Mobile Qt" theme,
+    // which requires the following stylesheets.
+    if (!themeFactory) {
         result.append(String(themeQtNoListboxesUserAgentStyleSheet, sizeof(themeQtNoListboxesUserAgentStyleSheet)));
         result.append(String(mobileThemeQtUserAgentStyleSheet, sizeof(mobileThemeQtUserAgentStyleSheet)));
     }
@@ -861,7 +884,7 @@ String RenderThemeQt::fileListNameForWidth(const Vector<String>& filenames, cons
         int n = filenames.size();
         string = QCoreApplication::translate("QWebPage", "%n file(s)",
                                              "number of chosen file",
-                                             QCoreApplication::CodecForTr, n);
+                                             QCoreApplication::DefaultCodec, n);
     }
 
     return string;
diff --git a/Source/WebCore/platform/qt/RenderThemeQt.h b/Source/WebCore/platform/qt/RenderThemeQt.h
index cdaaa98eb..83e729d88 100644
--- a/Source/WebCore/platform/qt/RenderThemeQt.h
+++ b/Source/WebCore/platform/qt/RenderThemeQt.h
@@ -40,13 +40,17 @@ class RenderProgress;
 class RenderStyle;
 class HTMLMediaElement;
 class StylePainter;
+class ScrollbarTheme;
+
+typedef PassRefPtr<RenderTheme> (*QtThemeFactoryFunction)(Page* page);
 
 class RenderThemeQt : public RenderTheme {
 
 public:
     RenderThemeQt(Page*);
 
-    static bool useMobileTheme();
+    static void setCustomTheme(QtThemeFactoryFunction, ScrollbarTheme* customScrollbarTheme);
+    static ScrollbarTheme* customScrollbarTheme();
 
     String extraDefaultStyleSheet();
 
diff --git a/Source/WebCore/platform/qt/RenderThemeQtMobile.cpp b/Source/WebCore/platform/qt/RenderThemeQtMobile.cpp
index c2f4228b0..201a1b206 100644
--- a/Source/WebCore/platform/qt/RenderThemeQtMobile.cpp
+++ b/Source/WebCore/platform/qt/RenderThemeQtMobile.cpp
@@ -41,10 +41,6 @@
 #if ENABLE(PROGRESS_TAG)
 #include "RenderProgress.h"
 #endif
-#if HAVE(QSTYLE)
-#include "RenderThemeQStyle.h"
-#endif
-
 #include <QColor>
 #include <QFile>
 #include <QFontMetrics>
@@ -550,23 +546,6 @@ PassRefPtr<RenderTheme> RenderThemeQtMobile::create(Page* page)
     return adoptRef(new RenderThemeQtMobile(page));
 }
 
-static PassRefPtr<RenderTheme> createTheme(Page* page)
-{
-#if HAVE(QSTYLE)
-    if (!RenderThemeQt::useMobileTheme())
-        return RenderThemeQStyle::create(page);
-#endif
-    return RenderThemeQtMobile::create(page);
-}
-
-PassRefPtr<RenderTheme> RenderTheme::themeForPage(Page* page)
-{
-    if (page)
-        return createTheme(page);
-    static RenderTheme* fallback = createTheme(0).leakRef();
-    return fallback;
-}
-
 RenderThemeQtMobile::RenderThemeQtMobile(Page* page)
     : RenderThemeQt(page)
 {
diff --git a/Source/WebCore/platform/qt/ScrollbarThemeQt.cpp b/Source/WebCore/platform/qt/ScrollbarThemeQt.cpp
index e3243ecfa..4f557665f 100644
--- a/Source/WebCore/platform/qt/ScrollbarThemeQt.cpp
+++ b/Source/WebCore/platform/qt/ScrollbarThemeQt.cpp
@@ -26,29 +26,9 @@
  */
 
 #include "config.h"
-
-#if !HAVE(QSTYLE)
 #include "ScrollbarTheme.h"
 
-#else
-#include "ScrollbarThemeQt.h"
-
-#include "GraphicsContext.h"
-#include "PlatformMouseEvent.h"
-#include "RenderThemeQStyle.h"
-#include "RenderThemeQtMobile.h"
-#include "ScrollView.h"
-#include "Scrollbar.h"
-
-#include <QApplication>
-#ifdef Q_WS_MAC
-#include <QMacStyle>
-#endif
-#include <QMenu>
-#include <QPainter>
-#include <QStyle>
-#include <QStyleOptionSlider>
-#endif // HAVE(QSTYLE)
+#include "RenderThemeQt.h"
 
 namespace WebCore {
 
@@ -57,219 +37,11 @@ ScrollbarTheme* ScrollbarTheme::nativeTheme()
     static ScrollbarTheme* theme = 0;
     if (theme)
         return theme;
-#if HAVE(QSTYLE)
-    if (!RenderThemeQt::useMobileTheme())
-        theme = new ScrollbarThemeQt();
-    else
-#endif
+    theme = RenderThemeQt::customScrollbarTheme();
+    if (!theme)
         theme = new ScrollbarTheme();
     return theme;
 }
 
-#if HAVE(QSTYLE)
-ScrollbarThemeQt::~ScrollbarThemeQt()
-{
-}
-
-static QStyle::SubControl scPart(const ScrollbarPart& part)
-{
-    switch (part) {
-    case NoPart:
-        return QStyle::SC_None;
-    case BackButtonStartPart:
-    case BackButtonEndPart:
-        return QStyle::SC_ScrollBarSubLine;
-    case BackTrackPart:
-        return QStyle::SC_ScrollBarSubPage;
-    case ThumbPart:
-        return QStyle::SC_ScrollBarSlider;
-    case ForwardTrackPart:
-        return QStyle::SC_ScrollBarAddPage;
-    case ForwardButtonStartPart:
-    case ForwardButtonEndPart:
-        return QStyle::SC_ScrollBarAddLine;
-    }
-
-    return QStyle::SC_None;
-}
-
-static ScrollbarPart scrollbarPart(const QStyle::SubControl& sc)
-{
-    switch (sc) {
-    case QStyle::SC_None:
-        return NoPart;
-    case QStyle::SC_ScrollBarSubLine:
-        return BackButtonStartPart;
-    case QStyle::SC_ScrollBarSubPage:
-        return BackTrackPart;
-    case QStyle::SC_ScrollBarSlider:
-        return ThumbPart;
-    case QStyle::SC_ScrollBarAddPage:
-        return ForwardTrackPart;
-    case QStyle::SC_ScrollBarAddLine:
-        return ForwardButtonStartPart;
-    }
-    return NoPart;
-}
-
-static QStyleOptionSlider* styleOptionSlider(Scrollbar* scrollbar, QWidget* widget = 0)
-{
-    static QStyleOptionSlider opt;
-    if (widget)
-        opt.initFrom(widget);
-    else
-        opt.state |= QStyle::State_Active;
-
-    opt.state &= ~QStyle::State_HasFocus;
-
-    opt.rect = scrollbar->frameRect();
-    if (scrollbar->enabled())
-        opt.state |= QStyle::State_Enabled;
-    if (scrollbar->controlSize() != RegularScrollbar)
-        opt.state |= QStyle::State_Mini;
-    opt.orientation = (scrollbar->orientation() == VerticalScrollbar) ? Qt::Vertical : Qt::Horizontal;
-
-    if (scrollbar->orientation() == HorizontalScrollbar)
-        opt.state |= QStyle::State_Horizontal;
-    else
-        opt.state &= ~QStyle::State_Horizontal;
-
-    opt.sliderValue = scrollbar->value();
-    opt.sliderPosition = opt.sliderValue;
-    opt.pageStep = scrollbar->pageStep();
-    opt.singleStep = scrollbar->lineStep();
-    opt.minimum = 0;
-    opt.maximum = qMax(0, scrollbar->maximum());
-    ScrollbarPart pressedPart = scrollbar->pressedPart();
-    ScrollbarPart hoveredPart = scrollbar->hoveredPart();
-    if (pressedPart != NoPart) {
-        opt.activeSubControls = scPart(scrollbar->pressedPart());
-        if (pressedPart == BackButtonStartPart || pressedPart == ForwardButtonStartPart
-            || pressedPart == BackButtonEndPart || pressedPart == ForwardButtonEndPart
-            || pressedPart == ThumbPart)
-            opt.state |= QStyle::State_Sunken;
-    } else
-        opt.activeSubControls = scPart(hoveredPart);
-    if (hoveredPart != NoPart)
-        opt.state |= QStyle::State_MouseOver;
-    return &opt;
-}
-
-bool ScrollbarThemeQt::paint(Scrollbar* scrollbar, GraphicsContext* graphicsContext, const IntRect& damageRect)
-{
-    if (graphicsContext->updatingControlTints()) {
-       scrollbar->invalidateRect(damageRect);
-       return false;
-    }
-
-    StylePainterQStyle p(this, graphicsContext);
-    if (!p.isValid())
-      return true;
-
-    p.painter->save();
-    QStyleOptionSlider* opt = styleOptionSlider(scrollbar, p.widget);
-
-    p.painter->setClipRect(opt->rect.intersected(damageRect), Qt::IntersectClip);
-
-#ifdef Q_WS_MAC
-    // FIXME: We also need to check the widget style but today ScrollbarTheme is not aware of the page so we
-    // can't get the widget.
-    if (qobject_cast<QMacStyle*>(style()))
-        p.drawComplexControl(QStyle::CC_ScrollBar, *opt);
-    else
-#endif
-    {
-        // The QStyle expects the background to be already filled.
-        p.painter->fillRect(opt->rect, opt->palette.background());
-
-        const QPoint topLeft = opt->rect.topLeft();
-        p.painter->translate(topLeft);
-        opt->rect.moveTo(QPoint(0, 0));
-        p.drawComplexControl(QStyle::CC_ScrollBar, *opt);
-        opt->rect.moveTo(topLeft);
-    }
-    p.painter->restore();
-
-    return true;
-}
-
-ScrollbarPart ScrollbarThemeQt::hitTest(Scrollbar* scrollbar, const PlatformMouseEvent& evt)
-{
-    QStyleOptionSlider* opt = styleOptionSlider(scrollbar);
-    const QPoint pos = scrollbar->convertFromContainingWindow(evt.position());
-    opt->rect.moveTo(QPoint(0, 0));
-    QStyle::SubControl sc = style()->hitTestComplexControl(QStyle::CC_ScrollBar, opt, pos, 0);
-    return scrollbarPart(sc);
-}
-
-bool ScrollbarThemeQt::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
-{
-    // Middle click centers slider thumb (if supported).
-    return style()->styleHint(QStyle::SH_ScrollBar_MiddleClickAbsolutePosition) && evt.button() == MiddleButton;
-}
-
-void ScrollbarThemeQt::invalidatePart(Scrollbar* scrollbar, ScrollbarPart)
-{
-    // FIXME: Do more precise invalidation.
-    scrollbar->invalidate();
-}
-
-int ScrollbarThemeQt::scrollbarThickness(ScrollbarControlSize controlSize)
-{
-    QStyleOptionSlider o;
-    o.orientation = Qt::Vertical;
-    o.state &= ~QStyle::State_Horizontal;
-    if (controlSize != RegularScrollbar)
-        o.state |= QStyle::State_Mini;
-    return style()->pixelMetric(QStyle::PM_ScrollBarExtent, &o, 0);
-}
-
-int ScrollbarThemeQt::thumbPosition(Scrollbar* scrollbar)
-{
-    if (scrollbar->enabled()) {
-        float pos = (float)scrollbar->currentPos() * (trackLength(scrollbar) - thumbLength(scrollbar)) / scrollbar->maximum();
-        return (pos < 1 && pos > 0) ? 1 : pos;
-    }
-    return 0;
-}
-
-int ScrollbarThemeQt::thumbLength(Scrollbar* scrollbar)
-{
-    QStyleOptionSlider* opt = styleOptionSlider(scrollbar);
-    IntRect thumb = style()->subControlRect(QStyle::CC_ScrollBar, opt, QStyle::SC_ScrollBarSlider, 0);
-    return scrollbar->orientation() == HorizontalScrollbar ? thumb.width() : thumb.height();
-}
-
-int ScrollbarThemeQt::trackPosition(Scrollbar* scrollbar)
-{
-    QStyleOptionSlider* opt = styleOptionSlider(scrollbar);
-    IntRect track = style()->subControlRect(QStyle::CC_ScrollBar, opt, QStyle::SC_ScrollBarGroove, 0);
-    return scrollbar->orientation() == HorizontalScrollbar ? track.x() - scrollbar->x() : track.y() - scrollbar->y();
-}
-
-int ScrollbarThemeQt::trackLength(Scrollbar* scrollbar)
-{
-    QStyleOptionSlider* opt = styleOptionSlider(scrollbar);
-    IntRect track = style()->subControlRect(QStyle::CC_ScrollBar, opt, QStyle::SC_ScrollBarGroove, 0);
-    return scrollbar->orientation() == HorizontalScrollbar ? track.width() : track.height();
-}
-
-void ScrollbarThemeQt::paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& rect)
-{
-    StylePainterQStyle p(this, context);
-    if (!p.isValid())
-        return;
-
-    QStyleOption option;
-    option.rect = rect;
-    p.drawPrimitive(QStyle::PE_PanelScrollAreaCorner, option);
-}
-
-QStyle* ScrollbarThemeQt::style() const
-{
-    return QApplication::style();
-}
-
-#endif // HAVE(QSTYLE)
 }
 
diff --git a/Source/WebCore/platform/sql/SQLiteStatement.cpp b/Source/WebCore/platform/sql/SQLiteStatement.cpp
index 18dd1e209..d308872d5 100644
--- a/Source/WebCore/platform/sql/SQLiteStatement.cpp
+++ b/Source/WebCore/platform/sql/SQLiteStatement.cpp
@@ -97,7 +97,7 @@ int SQLiteStatement::step()
     MutexLocker databaseLock(m_database.databaseMutex());
     if (m_database.isInterrupted())
         return SQLITE_INTERRUPT;
-    ASSERT(m_isPrepared);
+    //ASSERT(m_isPrepared);
 
     if (!m_statement)
         return SQLITE_OK;
diff --git a/Source/WebCore/platform/text/LineBreakIteratorPoolICU.h b/Source/WebCore/platform/text/LineBreakIteratorPoolICU.h
index d8e2ccbcd..7e4c2d8c5 100644
--- a/Source/WebCore/platform/text/LineBreakIteratorPoolICU.h
+++ b/Source/WebCore/platform/text/LineBreakIteratorPoolICU.h
@@ -61,7 +61,15 @@ public:
 
         if (!iterator) {
             UErrorCode openStatus = U_ZERO_ERROR;
-            iterator = ubrk_open(UBRK_LINE, locale.isEmpty() ? currentTextBreakLocaleID() : locale.string().utf8().data(), 0, 0, &openStatus);
+            bool localeIsEmpty = locale.isEmpty();
+            iterator = ubrk_open(UBRK_LINE, localeIsEmpty ? currentTextBreakLocaleID() : locale.string().utf8().data(), 0, 0, &openStatus);
+            // locale comes from a web page and it can be invalid, leading ICU
+            // to fail, in which case we fall back to the default locale.
+            if (!localeIsEmpty && U_FAILURE(openStatus)) {
+                openStatus = U_ZERO_ERROR;
+                iterator = ubrk_open(UBRK_LINE, currentTextBreakLocaleID(), 0, 0, &openStatus);
+            }
+                
             if (U_FAILURE(openStatus)) {
                 LOG_ERROR("ubrk_open failed with status %d", openStatus);
                 return 0;
diff --git a/Source/WebCore/platform/text/LocaleToScriptMappingICU.cpp b/Source/WebCore/platform/text/LocaleToScriptMappingICU.cpp
index 997707511..1710c7969 100644
--- a/Source/WebCore/platform/text/LocaleToScriptMappingICU.cpp
+++ b/Source/WebCore/platform/text/LocaleToScriptMappingICU.cpp
@@ -68,7 +68,7 @@ UScriptCode localeToScriptCodeForFontSelection(const String& locale)
     if (U_FAILURE(status))
         return USCRIPT_COMMON;
 
-    UScriptCode scriptCode;
+    UScriptCode scriptCode = USCRIPT_COMMON;
     uscript_getCode(script, &scriptCode, 1, &status);
     // Ignore error that multiple scripts could be returned, since we only want one script.
     if (U_FAILURE(status) && status != U_BUFFER_OVERFLOW_ERROR)
diff --git a/Source/WebCore/platform/text/LocalizedNumberICU.cpp b/Source/WebCore/platform/text/LocalizedNumberICU.cpp
index 03db4d546..76f7d2c32 100644
--- a/Source/WebCore/platform/text/LocalizedNumberICU.cpp
+++ b/Source/WebCore/platform/text/LocalizedNumberICU.cpp
@@ -29,107 +29,244 @@
  */
 
 #include "config.h"
-#include "LocalizedNumber.h"
+#include "LocalizedNumberICU.h"
 
-#include <limits>
-#include <unicode/numfmt.h>
-#include <unicode/parsepos.h>
-#include <wtf/MainThread.h>
-#include <wtf/MathExtras.h>
+#include "LocalizedNumber.h"
 #include <wtf/PassOwnPtr.h>
-#include <wtf/dtoa.h>
+#include <wtf/text/StringBuilder.h>
 
 using namespace icu;
-using namespace std;
 
 namespace WebCore {
 
-static PassOwnPtr<NumberFormat> createFormatterForCurrentLocale()
+ICULocale::ICULocale(const char* locale)
+    : m_locale(locale)
+    , m_numberFormat(0)
+    , m_didCreateDecimalFormat(false)
 {
-    UErrorCode status = U_ZERO_ERROR;
-    OwnPtr<NumberFormat> formatter = adoptPtr(NumberFormat::createInstance(status));
-    return U_SUCCESS(status) ? formatter.release() : nullptr;
 }
 
-static PassOwnPtr<NumberFormat> createFormatterForCurrentLocaleToDisplay()
+ICULocale::~ICULocale()
 {
-    OwnPtr<NumberFormat> formatter(createFormatterForCurrentLocale());
-    if (!formatter)
-        return nullptr;
+    unum_close(m_numberFormat);
+}
 
-    formatter->setGroupingUsed(FALSE);
-    return formatter.release();
+PassOwnPtr<ICULocale> ICULocale::create(const char* localeString)
+{
+    return adoptPtr(new ICULocale(localeString));
 }
 
-// This might return 0.
-static NumberFormat* numberFormatterForParsing()
+PassOwnPtr<ICULocale> ICULocale::createForCurrentLocale()
 {
-    ASSERT(isMainThread());
-    static NumberFormat* formatter = createFormatterForCurrentLocale().leakPtr();
-    return formatter;
+    return adoptPtr(new ICULocale(0));
 }
 
-// This might return 0.
-static NumberFormat* numberFormatterForDisplay()
+void ICULocale::setDecimalSymbol(unsigned index, UNumberFormatSymbol symbol)
 {
-    ASSERT(isMainThread());
-    static NumberFormat* formatter = createFormatterForCurrentLocaleToDisplay().leakPtr();
-    return formatter;
+    UErrorCode status = U_ZERO_ERROR;
+    int32_t bufferLength = unum_getSymbol(m_numberFormat, symbol, 0, 0, &status);
+    ASSERT(U_SUCCESS(status) || status == U_BUFFER_OVERFLOW_ERROR);
+    if (U_FAILURE(status) && status != U_BUFFER_OVERFLOW_ERROR)
+        return;
+    Vector<UChar> buffer(bufferLength);
+    status = U_ZERO_ERROR;
+    unum_getSymbol(m_numberFormat, symbol, buffer.data(), bufferLength, &status);
+    if (U_FAILURE(status))
+        return;
+    m_decimalSymbols[index] = String::adopt(buffer);
 }
 
-static double parseLocalizedNumber(const String& numberString)
+void ICULocale::setDecimalTextAttribute(String& destination, UNumberFormatTextAttribute tag)
 {
-    if (numberString.isEmpty())
-        return numeric_limits<double>::quiet_NaN();
-    NumberFormat* formatter = numberFormatterForParsing();
-    if (!formatter)
-        return numeric_limits<double>::quiet_NaN();
-    UnicodeString numberUnicodeString(numberString.characters(), numberString.length());
-    Formattable result;
-    ParsePosition position(0);
-    formatter->parse(numberUnicodeString, result, position);
-    if (position.getIndex() != numberUnicodeString.length())
-        return numeric_limits<double>::quiet_NaN();
     UErrorCode status = U_ZERO_ERROR;
-    double numericResult = result.getDouble(status);
-    return U_SUCCESS(status) ? numericResult : numeric_limits<double>::quiet_NaN();
+    int32_t bufferLength = unum_getTextAttribute(m_numberFormat, tag, 0, 0, &status);
+    ASSERT(U_SUCCESS(status) || status == U_BUFFER_OVERFLOW_ERROR);
+    if (U_FAILURE(status) && status != U_BUFFER_OVERFLOW_ERROR)
+        return;
+    Vector<UChar> buffer(bufferLength);
+    status = U_ZERO_ERROR;
+    unum_getTextAttribute(m_numberFormat, tag, buffer.data(), bufferLength, &status);
+    ASSERT(U_SUCCESS(status));
+    if (U_FAILURE(status))
+        return;
+    destination = String::adopt(buffer);
 }
 
-static String formatLocalizedNumber(double number, unsigned fractionDigits)
+void ICULocale::initializeDecimalFormat()
 {
-    NumberFormat* formatter = numberFormatterForDisplay();
-    if (!formatter)
-        return String();
-    UnicodeString result;
-    formatter->setMaximumFractionDigits(clampToInteger(fractionDigits));
-    formatter->format(number, result);
-    return String(result.getBuffer(), result.length());
+    if (m_didCreateDecimalFormat)
+        return;
+    m_didCreateDecimalFormat = true;
+    UErrorCode status = U_ZERO_ERROR;
+    m_numberFormat = unum_open(UNUM_DECIMAL, 0, 0, m_locale.data(), 0, &status);
+    if (!U_SUCCESS(status))
+        return;
+
+    setDecimalSymbol(0, UNUM_ZERO_DIGIT_SYMBOL);
+    setDecimalSymbol(1, UNUM_ONE_DIGIT_SYMBOL);
+    setDecimalSymbol(2, UNUM_TWO_DIGIT_SYMBOL);
+    setDecimalSymbol(3, UNUM_THREE_DIGIT_SYMBOL);
+    setDecimalSymbol(4, UNUM_FOUR_DIGIT_SYMBOL);
+    setDecimalSymbol(5, UNUM_FIVE_DIGIT_SYMBOL);
+    setDecimalSymbol(6, UNUM_SIX_DIGIT_SYMBOL);
+    setDecimalSymbol(7, UNUM_SEVEN_DIGIT_SYMBOL);
+    setDecimalSymbol(8, UNUM_EIGHT_DIGIT_SYMBOL);
+    setDecimalSymbol(9, UNUM_NINE_DIGIT_SYMBOL);
+    setDecimalSymbol(DecimalSeparatorIndex, UNUM_DECIMAL_SEPARATOR_SYMBOL);
+    setDecimalSymbol(GroupSeparatorIndex, UNUM_GROUPING_SEPARATOR_SYMBOL);
+    setDecimalTextAttribute(m_positivePrefix, UNUM_POSITIVE_PREFIX);
+    setDecimalTextAttribute(m_positiveSuffix, UNUM_POSITIVE_SUFFIX);
+    setDecimalTextAttribute(m_negativePrefix, UNUM_NEGATIVE_PREFIX);
+    setDecimalTextAttribute(m_negativeSuffix, UNUM_NEGATIVE_SUFFIX);
+    ASSERT(!m_positivePrefix.isEmpty() || !m_positiveSuffix.isEmpty() || !m_negativePrefix.isEmpty() || !m_negativeSuffix.isEmpty());
 }
 
-String convertToLocalizedNumber(const String& canonicalNumberString, unsigned fractionDigits)
+String ICULocale::convertToLocalizedNumber(const String& input)
+{
+    initializeDecimalFormat();
+    if (!m_numberFormat || input.isEmpty())
+        return input;
+
+    unsigned i = 0;
+    bool isNegative = false;
+    UnicodeString ustring;
+    StringBuilder builder;
+    builder.reserveCapacity(input.length());
+
+    if (input[0] == '-') {
+        ++i;
+        isNegative = true;
+        builder.append(m_negativePrefix);
+    } else
+        builder.append(m_positivePrefix);
+
+    for (; i < input.length(); ++i) {
+        switch (input[i]) {
+        case '0':
+        case '1':
+        case '2':
+        case '3':
+        case '4':
+        case '5':
+        case '6':
+        case '7':
+        case '8':
+        case '9':
+            builder.append(m_decimalSymbols[input[i] - '0']);
+            break;
+        case '.':
+            builder.append(m_decimalSymbols[DecimalSeparatorIndex]);
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    builder.append(isNegative ? m_negativeSuffix : m_positiveSuffix);
+
+    return builder.toString();
+}
+
+static bool matches(const String& text, unsigned position, const String& part)
 {
-    // FIXME: We should not do parse-then-format. It makes some
-    // problems such as removing leading zeros, changing trailing
-    // digits to zeros.
-    // FIXME: We should not use the fractionDigits argument.
+    if (part.isEmpty())
+        return true;
+    if (position + part.length() > text.length())
+        return false;
+    for (unsigned i = 0; i < part.length(); ++i) {
+        if (text[position + i] != part[i])
+            return false;
+    }
+    return true;
+}
+
+bool ICULocale::detectSignAndGetDigitRange(const String& input, bool& isNegative, unsigned& startIndex, unsigned& endIndex)
+{
+    startIndex = 0;
+    endIndex = input.length();
+    if (m_negativePrefix.isEmpty() && m_negativeSuffix.isEmpty()) {
+        if (input.startsWith(m_positivePrefix) && input.endsWith(m_positiveSuffix)) {
+            isNegative = false;
+            startIndex = m_positivePrefix.length();
+            endIndex -= m_positiveSuffix.length();
+        } else
+            isNegative = true;
+    } else {
+        if (input.startsWith(m_negativePrefix) && input.endsWith(m_negativeSuffix)) {
+            isNegative = true;
+            startIndex = m_negativePrefix.length();
+            endIndex -= m_negativeSuffix.length();
+        } else {
+            isNegative = false;
+            if (input.startsWith(m_positivePrefix) && input.endsWith(m_positiveSuffix)) {
+                startIndex = m_positivePrefix.length();
+                endIndex -= m_positiveSuffix.length();
+            } else
+                return false;
+        }
+    }
+    return true;
+}
+
+unsigned ICULocale::matchedDecimalSymbolIndex(const String& input, unsigned& position)
+{
+    for (unsigned symbolIndex = 0; symbolIndex < DecimalSymbolsSize; ++symbolIndex) {
+        if (m_decimalSymbols[symbolIndex].length() && matches(input, position, m_decimalSymbols[symbolIndex])) {
+            position += m_decimalSymbols[symbolIndex].length();
+            return symbolIndex;
+        }
+    }
+    return DecimalSymbolsSize;
+}
+
+String ICULocale::convertFromLocalizedNumber(const String& localized)
+{
+    initializeDecimalFormat();
+    String input = localized.stripWhiteSpace();
+    if (!m_numberFormat || input.isEmpty())
+        return input;
 
-    double doubleValue = canonicalNumberString.toDouble();
-    // The input string must be valid.
-    return formatLocalizedNumber(doubleValue, fractionDigits);
+    bool isNegative;
+    unsigned startIndex;
+    unsigned endIndex;
+    if (!detectSignAndGetDigitRange(input, isNegative, startIndex, endIndex)) {
+        // Input is broken. Returning an invalid number string.
+        return "*";
+    }
 
+    StringBuilder builder;
+    builder.reserveCapacity(input.length());
+    if (isNegative)
+        builder.append("-");
+    for (unsigned i = startIndex; i < endIndex;) {
+        unsigned symbolIndex = matchedDecimalSymbolIndex(input, i);
+        if (symbolIndex >= DecimalSymbolsSize)
+            return "*";
+        if (symbolIndex == DecimalSeparatorIndex)
+            builder.append('.');
+        else if (symbolIndex == GroupSeparatorIndex) {
+            // Ignore group separators.
+
+        } else
+            builder.append(static_cast<UChar>('0' + symbolIndex));
+    }
+    return builder.toString();
+}
+
+static ICULocale* currentLocale()
+{
+    static ICULocale* currentICULocale = ICULocale::createForCurrentLocale().leakPtr();
+    return currentICULocale;
+}
+
+String convertToLocalizedNumber(const String& canonicalNumberString, unsigned fractionDigits)
+{
+    return currentLocale()->convertToLocalizedNumber(canonicalNumberString);
 }
 
 String convertFromLocalizedNumber(const String& localizedNumberString)
 {
-    // FIXME: We should not do parse-then-format. It makes some
-    // problems such as removing leading zeros, changing trailing
-    // digits to zeros.
-
-    double doubleValue = parseLocalizedNumber(localizedNumberString);
-    if (!isfinite(doubleValue))
-        return localizedNumberString;
-    NumberToStringBuffer buffer;
-    return String(numberToString(doubleValue, buffer));
+    return currentLocale()->convertFromLocalizedNumber(localizedNumberString);
 }
 
 } // namespace WebCore
diff --git a/Source/WebCore/platform/text/LocalizedNumberICU.h b/Source/WebCore/platform/text/LocalizedNumberICU.h
new file mode 100644
index 000000000..fd85622cd
--- /dev/null
+++ b/Source/WebCore/platform/text/LocalizedNumberICU.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2012 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LocalizedNumberICU_h
+#define LocalizedNumberICU_h
+
+#include <unicode/unum.h>
+#include <wtf/Forward.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+// We should use this class only for LocalizedNumberICU.cpp and LocalizedNumberICUTest.cpp.
+class ICULocale {
+public:
+    static PassOwnPtr<ICULocale> create(const char* localeString);
+    static PassOwnPtr<ICULocale> createForCurrentLocale();
+    ~ICULocale();
+    String convertToLocalizedNumber(const String&);
+    String convertFromLocalizedNumber(const String&);
+
+private:
+    explicit ICULocale(const char*);
+    void setDecimalSymbol(unsigned index, UNumberFormatSymbol);
+    void setDecimalTextAttribute(String&, UNumberFormatTextAttribute);
+    void initializeDecimalFormat();
+
+    bool detectSignAndGetDigitRange(const String& input, bool& isNegative, unsigned& startIndex, unsigned& endIndex);
+    unsigned matchedDecimalSymbolIndex(const String& input, unsigned& position);
+
+    CString m_locale;
+    UNumberFormat* m_numberFormat;
+    enum {
+        // 0-9 for digits.
+        DecimalSeparatorIndex = 10,
+        GroupSeparatorIndex = 11,
+        DecimalSymbolsSize
+    };
+    String m_decimalSymbols[DecimalSymbolsSize];
+    String m_positivePrefix;
+    String m_positiveSuffix;
+    String m_negativePrefix;
+    String m_negativeSuffix;
+    bool m_didCreateDecimalFormat;
+};
+
+}
+#endif
diff --git a/Source/WebCore/platform/text/RegularExpression.cpp b/Source/WebCore/platform/text/RegularExpression.cpp
index bdc9f848d..3fbe3f866 100644
--- a/Source/WebCore/platform/text/RegularExpression.cpp
+++ b/Source/WebCore/platform/text/RegularExpression.cpp
@@ -100,20 +100,26 @@ int RegularExpression::match(const String& str, int startFrom, int* matchLength)
         return -1;
 
     int offsetVectorSize = (d->m_numSubpatterns + 1) * 2;
-    int* offsetVector;
-    Vector<int, 32> nonReturnedOvector;
+    unsigned* offsetVector;
+    Vector<unsigned, 32> nonReturnedOvector;
 
     nonReturnedOvector.resize(offsetVectorSize);
     offsetVector = nonReturnedOvector.data();
 
     ASSERT(offsetVector);
     for (unsigned j = 0, i = 0; i < d->m_numSubpatterns + 1; j += 2, i++)
-        offsetVector[j] = -1;
-
-    int result = JSC::Yarr::interpret(d->m_regExpByteCode.get(), JSC::UString(str.impl()), startFrom, str.length(), offsetVector);
-    ASSERT(result >= -1);
+        offsetVector[j] = JSC::Yarr::offsetNoMatch;
+
+    unsigned result;
+    if (str.length() <= INT_MAX)
+        result = JSC::Yarr::interpret(d->m_regExpByteCode.get(), JSC::UString(str.impl()), startFrom, str.length(), offsetVector);
+    else {
+        // This code can't handle unsigned offsets. Limit our processing to strings with offsets that 
+        // can be represented as ints.
+        result = JSC::Yarr::offsetNoMatch;
+    }
 
-    if (result < 0) {
+    if (result == JSC::Yarr::offsetNoMatch) {
         d->lastMatchLength = -1;
         return -1;
     }
diff --git a/Source/WebCore/platform/text/TextAllInOne.cpp b/Source/WebCore/platform/text/TextAllInOne.cpp
new file mode 100644
index 000000000..b0bc39432
--- /dev/null
+++ b/Source/WebCore/platform/text/TextAllInOne.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
+
+#include "TextBoundaries.cpp"
+#include "TextBreakIteratorICU.cpp"
+#include "TextCodec.cpp"
+#include "TextCodecICU.cpp"
+#include "TextCodecLatin1.cpp"
+#include "TextCodecUTF16.cpp"
+#include "TextCodecUTF8.cpp"
+#include "TextCodecUserDefined.cpp"
+#include "TextEncoding.cpp"
+#include "TextEncodingDetectorICU.cpp"
+#include "TextEncodingRegistry.cpp"
+#include "TextStream.cpp"
diff --git a/Source/WebCore/platform/text/TextBreakIteratorICU.cpp b/Source/WebCore/platform/text/TextBreakIteratorICU.cpp
index a591297e6..82471bd32 100644
--- a/Source/WebCore/platform/text/TextBreakIteratorICU.cpp
+++ b/Source/WebCore/platform/text/TextBreakIteratorICU.cpp
@@ -71,6 +71,8 @@ TextBreakIterator* wordBreakIterator(const UChar* string, int length)
 TextBreakIterator* acquireLineBreakIterator(const UChar* string, int length, const AtomicString& locale)
 {
     UBreakIterator* iterator = LineBreakIteratorPool::sharedPool().take(locale);
+    if (!iterator)
+        return 0;
 
     UErrorCode setTextStatus = U_ZERO_ERROR;
     ubrk_setText(iterator, string, length, &setTextStatus);
diff --git a/Source/WebCore/platform/text/UnicodeBidi.h b/Source/WebCore/platform/text/UnicodeBidi.h
index 08f054525..0b875e435 100644
--- a/Source/WebCore/platform/text/UnicodeBidi.h
+++ b/Source/WebCore/platform/text/UnicodeBidi.h
@@ -33,12 +33,18 @@ enum EUnicodeBidi {
     Embed,
     Override,
     Isolate,
-    Plaintext
+    Plaintext,
+    OverrideIsolate,
 }; 
 
 inline bool isIsolated(const EUnicodeBidi& unicodeBidi)
 {
-    return unicodeBidi == Isolate || unicodeBidi == Plaintext;
+    return unicodeBidi == Isolate || unicodeBidi == OverrideIsolate || unicodeBidi == Plaintext;
+}
+
+inline bool isOverride(EUnicodeBidi unicodeBidi)
+{
+    return unicodeBidi == Override || unicodeBidi == OverrideIsolate;
 }
 
 }
diff --git a/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp b/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
index 827e3588c..d61c01432 100644
--- a/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
+++ b/Source/WebCore/platform/win/ClipboardUtilitiesWin.cpp
@@ -208,7 +208,7 @@ HGLOBAL createGlobalData(const Vector<char>& vector)
     return globalData;
 }
 
-static String getFullCFHTML(IDataObject* data, bool& success)
+static String getFullCFHTML(IDataObject* data)
 {
     STGMEDIUM store;
     if (SUCCEEDED(data->GetData(htmlFormat(), &store))) {
@@ -218,10 +218,8 @@ static String getFullCFHTML(IDataObject* data, bool& success)
         String cfhtml(UTF8Encoding().decode(data, dataSize));
         GlobalUnlock(store.hGlobal);
         ReleaseStgMedium(&store);
-        success = true;
         return cfhtml;
     }
-    success = false;
     return String();
 }
 
@@ -447,27 +445,25 @@ void setFileContentData(IDataObject* dataObject, int size, void* dataBlob)
     dataObject->SetData(fileContentFormatZero(), &medium, TRUE);
 }
 
-String getURL(IDataObject* dataObject, DragData::FilenameConversionPolicy filenamePolicy, bool& success, String* title)
+String getURL(IDataObject* dataObject, DragData::FilenameConversionPolicy filenamePolicy, String* title)
 {
     STGMEDIUM store;
     String url;
-    success = false;
     if (getWebLocData(dataObject, url, title))
-        success = true;
-    else if (SUCCEEDED(dataObject->GetData(urlWFormat(), &store))) {
+        return url;
+
+    if (SUCCEEDED(dataObject->GetData(urlWFormat(), &store))) {
         // URL using Unicode
         UChar* data = static_cast<UChar*>(GlobalLock(store.hGlobal));
         url = extractURL(String(data), title);
         GlobalUnlock(store.hGlobal);
         ReleaseStgMedium(&store);
-        success = true;
     } else if (SUCCEEDED(dataObject->GetData(urlFormat(), &store))) {
         // URL using ASCII
         char* data = static_cast<char*>(GlobalLock(store.hGlobal));
         url = extractURL(String(data), title);
         GlobalUnlock(store.hGlobal);
         ReleaseStgMedium(&store);
-        success = true;
     }
 #if USE(CF)
     else if (filenamePolicy == DragData::ConvertFilenames) {
@@ -476,11 +472,8 @@ String getURL(IDataObject* dataObject, DragData::FilenameConversionPolicy filena
             wchar_t* data = static_cast<wchar_t*>(GlobalLock(store.hGlobal));
             if (data && data[0] && (PathFileExists(data) || PathIsUNC(data))) {
                 RetainPtr<CFStringRef> pathAsCFString(AdoptCF, CFStringCreateWithCharacters(kCFAllocatorDefault, (const UniChar*)data, wcslen(data)));
-                if (urlFromPath(pathAsCFString.get(), url)) {
-                    if (title)
-                        *title = url;
-                    success = true;
-                }
+                if (urlFromPath(pathAsCFString.get(), url) && title)
+                    *title = url;
             }
             GlobalUnlock(store.hGlobal);
             ReleaseStgMedium(&store);
@@ -489,11 +482,8 @@ String getURL(IDataObject* dataObject, DragData::FilenameConversionPolicy filena
             char* data = static_cast<char*>(GlobalLock(store.hGlobal));
             if (data && data[0] && (PathFileExistsA(data) || PathIsUNCA(data))) {
                 RetainPtr<CFStringRef> pathAsCFString(AdoptCF, CFStringCreateWithCString(kCFAllocatorDefault, data, kCFStringEncodingASCII));
-                if (urlFromPath(pathAsCFString.get(), url)) {
-                    if (title)
-                        *title = url;
-                    success = true;
-                }
+                if (urlFromPath(pathAsCFString.get(), url) && title)
+                    *title = url;
             }
             GlobalUnlock(store.hGlobal);
             ReleaseStgMedium(&store);
@@ -530,31 +520,27 @@ String getURL(const DragDataMap* data, DragData::FilenameConversionPolicy filena
     return url;
 }
 
-String getPlainText(IDataObject* dataObject, bool& success)
+String getPlainText(IDataObject* dataObject)
 {
     STGMEDIUM store;
     String text;
-    success = false;
     if (SUCCEEDED(dataObject->GetData(plainTextWFormat(), &store))) {
         // Unicode text
         UChar* data = static_cast<UChar*>(GlobalLock(store.hGlobal));
         text = String(data);
         GlobalUnlock(store.hGlobal);
         ReleaseStgMedium(&store);
-        success = true;
     } else if (SUCCEEDED(dataObject->GetData(plainTextFormat(), &store))) {
         // ASCII text
         char* data = static_cast<char*>(GlobalLock(store.hGlobal));
         text = String(data);
         GlobalUnlock(store.hGlobal);
         ReleaseStgMedium(&store);
-        success = true;
     } else {
         // FIXME: Originally, we called getURL() here because dragging and dropping files doesn't
         // populate the drag with text data. Per https://bugs.webkit.org/show_bug.cgi?id=38826, this
         // is undesirable, so maybe this line can be removed.
-        text = getURL(dataObject, DragData::DoNotConvertFilenames, success);
-        success = true;
+        text = getURL(dataObject, DragData::DoNotConvertFilenames);
     }
     return text;
 }
@@ -570,17 +556,15 @@ String getPlainText(const DragDataMap* data)
     return getURL(data, DragData::DoNotConvertFilenames);
 }
 
-String getTextHTML(IDataObject* data, bool& success)
+String getTextHTML(IDataObject* data)
 {
     STGMEDIUM store;
     String html;
-    success = false;
     if (SUCCEEDED(data->GetData(texthtmlFormat(), &store))) {
         UChar* data = static_cast<UChar*>(GlobalLock(store.hGlobal));
         html = String(data);
         GlobalUnlock(store.hGlobal);
         ReleaseStgMedium(&store);
-        success = true;
     }
     return html;
 }
@@ -592,10 +576,10 @@ String getTextHTML(const DragDataMap* data)
     return text;
 }
 
-String getCFHTML(IDataObject* data, bool& success)
+String getCFHTML(IDataObject* data)
 {
-    String cfhtml = getFullCFHTML(data, success);
-    if (success)
+    String cfhtml = getFullCFHTML(data);
+    if (!cfhtml.isEmpty())
         return extractMarkupFromCFHTML(cfhtml);
     return String();
 }
@@ -655,16 +639,15 @@ PassRefPtr<DocumentFragment> fragmentFromHTML(Document* doc, IDataObject* data)
     if (!doc || !data)
         return 0;
 
-    bool success = false;
-    String cfhtml = getFullCFHTML(data, success);
-    if (success) {
+    String cfhtml = getFullCFHTML(data);
+    if (!cfhtml.isEmpty()) {
         if (RefPtr<DocumentFragment> fragment = fragmentFromCFHTML(doc, cfhtml))
             return fragment.release();
     }
 
-    String html = getTextHTML(data, success);
+    String html = getTextHTML(data);
     String srcURL;
-    if (success)
+    if (!html.isEmpty())
         return createFragmentFromMarkup(doc, html, srcURL, FragmentScriptingNotAllowed);
 
     return 0;
diff --git a/Source/WebCore/platform/win/ClipboardUtilitiesWin.h b/Source/WebCore/platform/win/ClipboardUtilitiesWin.h
index 7501d56f1..e8d4755e3 100644
--- a/Source/WebCore/platform/win/ClipboardUtilitiesWin.h
+++ b/Source/WebCore/platform/win/ClipboardUtilitiesWin.h
@@ -67,13 +67,13 @@ PassRefPtr<DocumentFragment> fragmentFromHTML(Document*, IDataObject*);
 PassRefPtr<DocumentFragment> fragmentFromHTML(Document*, const DragDataMap*);
 PassRefPtr<DocumentFragment> fragmentFromCFHTML(Document*, const String& cfhtml);
 
-String getURL(IDataObject*, DragData::FilenameConversionPolicy, bool& success, String* title = 0);
+String getURL(IDataObject*, DragData::FilenameConversionPolicy, String* title = 0);
 String getURL(const DragDataMap*, DragData::FilenameConversionPolicy, String* title = 0);
-String getPlainText(IDataObject*, bool& success);
+String getPlainText(IDataObject*);
 String getPlainText(const DragDataMap*);
-String getTextHTML(IDataObject*, bool& success);
+String getTextHTML(IDataObject*);
 String getTextHTML(const DragDataMap*);
-String getCFHTML(IDataObject*, bool& success);
+String getCFHTML(IDataObject*);
 String getCFHTML(const DragDataMap*);
 
 void getClipboardData(IDataObject*, FORMATETC* fetc, Vector<String>& dataStrings);
diff --git a/Source/WebCore/platform/win/ClipboardWin.cpp b/Source/WebCore/platform/win/ClipboardWin.cpp
index 89cacb351..12cb8bf01 100644
--- a/Source/WebCore/platform/win/ClipboardWin.cpp
+++ b/Source/WebCore/platform/win/ClipboardWin.cpp
@@ -28,7 +28,6 @@
 
 #include "CachedImage.h"
 #include "ClipboardUtilitiesWin.h"
-#include "DOMStringList.h"
 #include "Document.h"
 #include "DragData.h"
 #include "Editor.h"
@@ -436,22 +435,21 @@ void ClipboardWin::clearAllData()
     m_dataObject = m_writableDataObject;
 }
 
-String ClipboardWin::getData(const String& type, bool& success) const
+String ClipboardWin::getData(const String& type) const
 {     
-    success = false;
     if (policy() != ClipboardReadable || (!m_dataObject && m_dragDataMap.isEmpty()))
         return "";
 
     ClipboardDataType dataType = clipboardTypeFromMIMEType(type);
     if (dataType == ClipboardDataTypeText)
-        return m_dataObject ? getPlainText(m_dataObject.get(), success) : getPlainText(&m_dragDataMap);
+        return m_dataObject ? getPlainText(m_dataObject.get()) : getPlainText(&m_dragDataMap);
     if (dataType == ClipboardDataTypeURL)
-        return m_dataObject ? getURL(m_dataObject.get(), DragData::DoNotConvertFilenames, success) : getURL(&m_dragDataMap, DragData::DoNotConvertFilenames);
+        return m_dataObject ? getURL(m_dataObject.get(), DragData::DoNotConvertFilenames) : getURL(&m_dragDataMap, DragData::DoNotConvertFilenames);
     else if (dataType == ClipboardDataTypeTextHTML) {
-        String data = m_dataObject ? getTextHTML(m_dataObject.get(), success) : getTextHTML(&m_dragDataMap);
-        if (success)
+        String data = m_dataObject ? getTextHTML(m_dataObject.get()) : getTextHTML(&m_dragDataMap);
+        if (!data.isEmpty())
             return data;
-        return m_dataObject ? getCFHTML(m_dataObject.get(), success) : getCFHTML(&m_dragDataMap);
+        return m_dataObject ? getCFHTML(m_dataObject.get()) : getCFHTML(&m_dragDataMap);
     }
     
     return "";
@@ -486,24 +484,24 @@ bool ClipboardWin::setData(const String& type, const String& data)
     return false;
 }
 
-static void addMimeTypesForFormat(DOMStringList* results, const FORMATETC& format)
+static void addMimeTypesForFormat(HashSet<String>& results, const FORMATETC& format)
 {
     // URL and Text are provided for compatibility with IE's model
     if (format.cfFormat == urlFormat()->cfFormat || format.cfFormat == urlWFormat()->cfFormat) {
-        results->append("URL");
-        results->append("text/uri-list");
+        results.add("URL");
+        results.add("text/uri-list");
     }
 
     if (format.cfFormat == plainTextWFormat()->cfFormat || format.cfFormat == plainTextFormat()->cfFormat) {
-        results->append("Text");
-        results->append("text/plain");
+        results.add("Text");
+        results.add("text/plain");
     }
 }
 
 // extensions beyond IE's API
-PassRefPtr<DOMStringList> ClipboardWin::types() const
+HashSet<String> ClipboardWin::types() const
 { 
-    RefPtr<DOMStringList> results = DOMStringList::create();
+    HashSet<String> results; 
     if (policy() != ClipboardReadable && policy() != ClipboardTypesReadable)
         return results;
 
@@ -523,16 +521,16 @@ PassRefPtr<DOMStringList> ClipboardWin::types() const
 
         // IEnumFORMATETC::Next returns S_FALSE if there are no more items.
         while (itr->Next(1, &data, 0) == S_OK)
-            addMimeTypesForFormat(results.get(), data);
+            addMimeTypesForFormat(results, data);
     } else {
         for (DragDataMap::const_iterator it = m_dragDataMap.begin(); it != m_dragDataMap.end(); ++it) {
             FORMATETC data;
             data.cfFormat = (*it).first;
-            addMimeTypesForFormat(results.get(), data);
+            addMimeTypesForFormat(results, data);
         }
     }
 
-    return results.release();
+    return results;
 }
 
 PassRefPtr<FileList> ClipboardWin::files() const
diff --git a/Source/WebCore/platform/win/ClipboardWin.h b/Source/WebCore/platform/win/ClipboardWin.h
index 8c22c0a35..d56ea1900 100644
--- a/Source/WebCore/platform/win/ClipboardWin.h
+++ b/Source/WebCore/platform/win/ClipboardWin.h
@@ -60,11 +60,11 @@ public:
 
     void clearData(const String& type);
     void clearAllData();
-    String getData(const String& type, bool& success) const;
+    String getData(const String& type) const;
     bool setData(const String& type, const String& data);
 
     // extensions beyond IE's API
-    virtual PassRefPtr<DOMStringList> types() const;
+    virtual HashSet<String> types() const;
     virtual PassRefPtr<FileList> files() const;
 
     void setDragImage(CachedImage*, const IntPoint&);
diff --git a/Source/WebCore/platform/win/DragDataWin.cpp b/Source/WebCore/platform/win/DragDataWin.cpp
index 9ab62b950..46a9073cb 100644
--- a/Source/WebCore/platform/win/DragDataWin.cpp
+++ b/Source/WebCore/platform/win/DragDataWin.cpp
@@ -101,8 +101,7 @@ void DragData::getDragFileContentData(int size, void* dataBlob)
 
 String DragData::asURL(Frame*, FilenameConversionPolicy filenamePolicy, String* title) const
 {
-    bool success;
-    return (m_platformDragData) ? getURL(m_platformDragData, filenamePolicy, success, title) : getURL(&m_dragDataMap, filenamePolicy, title);
+    return (m_platformDragData) ? getURL(m_platformDragData, filenamePolicy, title) : getURL(&m_dragDataMap, filenamePolicy, title);
 }
 
 bool DragData::containsFiles() const
@@ -155,8 +154,7 @@ bool DragData::containsPlainText() const
 
 String DragData::asPlainText(Frame*) const
 {
-    bool success;
-    return (m_platformDragData) ? getPlainText(m_platformDragData, success) : getPlainText(&m_dragDataMap);
+    return (m_platformDragData) ? getPlainText(m_platformDragData) : getPlainText(&m_dragDataMap);
 }
 
 bool DragData::containsColor() const
diff --git a/Source/WebCore/platform/win/ScrollbarThemeSafari.cpp b/Source/WebCore/platform/win/ScrollbarThemeSafari.cpp
index 343bbb280..1cc5385e1 100644
--- a/Source/WebCore/platform/win/ScrollbarThemeSafari.cpp
+++ b/Source/WebCore/platform/win/ScrollbarThemeSafari.cpp
@@ -104,14 +104,14 @@ int ScrollbarThemeSafari::scrollbarThickness(ScrollbarControlSize controlSize)
     return cScrollbarThickness[controlSize];
 }
 
-bool ScrollbarThemeSafari::hasButtons(Scrollbar* scrollbar)
+bool ScrollbarThemeSafari::hasButtons(ScrollbarThemeClient* scrollbar)
 {
     return scrollbar->enabled() && (scrollbar->orientation() == HorizontalScrollbar ? 
              scrollbar->width() : 
              scrollbar->height()) >= 2 * (cRealButtonLength[scrollbar->controlSize()] - cButtonHitInset[scrollbar->controlSize()]);
 }
 
-bool ScrollbarThemeSafari::hasThumb(Scrollbar* scrollbar)
+bool ScrollbarThemeSafari::hasThumb(ScrollbarThemeClient* scrollbar)
 {
     return scrollbar->enabled() && (scrollbar->orientation() == HorizontalScrollbar ? 
              scrollbar->width() : 
@@ -134,7 +134,7 @@ static IntRect buttonRepaintRect(const IntRect& buttonRect, ScrollbarOrientation
     return paintRect;
 }
 
-IntRect ScrollbarThemeSafari::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool painting)
+IntRect ScrollbarThemeSafari::backButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool painting)
 {
     IntRect result;
 
@@ -152,7 +152,7 @@ IntRect ScrollbarThemeSafari::backButtonRect(Scrollbar* scrollbar, ScrollbarPart
     return result;
 }
 
-IntRect ScrollbarThemeSafari::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool painting)
+IntRect ScrollbarThemeSafari::forwardButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool painting)
 {
     IntRect result;
     
@@ -181,7 +181,7 @@ static IntRect trackRepaintRect(const IntRect& trackRect, ScrollbarOrientation o
     return paintRect;
 }
 
-IntRect ScrollbarThemeSafari::trackRect(Scrollbar* scrollbar, bool painting)
+IntRect ScrollbarThemeSafari::trackRect(ScrollbarThemeClient* scrollbar, bool painting)
 {
     if (painting || !hasButtons(scrollbar))
         return scrollbar->frameRect();
@@ -193,36 +193,36 @@ IntRect ScrollbarThemeSafari::trackRect(Scrollbar* scrollbar, bool painting)
     return IntRect(scrollbar->x(), scrollbar->y() + cButtonLength[scrollbar->controlSize()], thickness, scrollbar->height() - 2 * cButtonLength[scrollbar->controlSize()]);
 }
 
-int ScrollbarThemeSafari::minimumThumbLength(Scrollbar* scrollbar)
+int ScrollbarThemeSafari::minimumThumbLength(ScrollbarThemeClient* scrollbar)
 {
     return cThumbMinLength[scrollbar->controlSize()];
 }
 
-bool ScrollbarThemeSafari::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
+bool ScrollbarThemeSafari::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& evt)
 {
     return evt.shiftKey() && evt.button() == LeftButton;
 }
 
-void ScrollbarThemeSafari::paintTrackBackground(GraphicsContext* graphicsContext, Scrollbar* scrollbar, const IntRect& trackRect)
+void ScrollbarThemeSafari::paintTrackBackground(GraphicsContext* graphicsContext, ScrollbarThemeClient* scrollbar, const IntRect& trackRect)
 {
     if (!SafariThemeLibrary())
         return;
     NSControlSize size = scrollbar->controlSize() == SmallScrollbar ? NSSmallControlSize : NSRegularControlSize;
     ThemeControlState state = 0;
-    if (scrollbar->scrollableArea()->isActive())
+    if (scrollbar->isScrollableAreaActive())
         state |= ActiveState;
     if (hasButtons(scrollbar))
         state |= EnabledState;
     paintThemePart(scrollbar->orientation() == VerticalScrollbar ? VScrollTrackPart : HScrollTrackPart, graphicsContext->platformContext(), trackRect, size, state); 
 }
 
-void ScrollbarThemeSafari::paintButton(GraphicsContext* graphicsContext, Scrollbar* scrollbar, const IntRect& buttonRect, ScrollbarPart part)
+void ScrollbarThemeSafari::paintButton(GraphicsContext* graphicsContext, ScrollbarThemeClient* scrollbar, const IntRect& buttonRect, ScrollbarPart part)
 {
     if (!SafariThemeLibrary())
         return;
     NSControlSize size = scrollbar->controlSize() == SmallScrollbar ? NSSmallControlSize : NSRegularControlSize;
     ThemeControlState state = 0;
-    if (scrollbar->scrollableArea()->isActive())
+    if (scrollbar->isScrollableAreaActive())
         state |= ActiveState;
     if (hasButtons(scrollbar))
         state |= EnabledState;
@@ -236,13 +236,13 @@ void ScrollbarThemeSafari::paintButton(GraphicsContext* graphicsContext, Scrollb
                        buttonRect, size, state);
 }
 
-void ScrollbarThemeSafari::paintThumb(GraphicsContext* graphicsContext, Scrollbar* scrollbar, const IntRect& thumbRect)
+void ScrollbarThemeSafari::paintThumb(GraphicsContext* graphicsContext, ScrollbarThemeClient* scrollbar, const IntRect& thumbRect)
 {
     if (!SafariThemeLibrary())
         return;
     NSControlSize size = scrollbar->controlSize() == SmallScrollbar ? NSSmallControlSize : NSRegularControlSize;
     ThemeControlState state = 0;
-    if (scrollbar->scrollableArea()->isActive())
+    if (scrollbar->isScrollableAreaActive())
         state |= ActiveState;
     if (hasThumb(scrollbar))
         state |= EnabledState;
diff --git a/Source/WebCore/platform/win/ScrollbarThemeSafari.h b/Source/WebCore/platform/win/ScrollbarThemeSafari.h
index f039379ea..f427b190f 100644
--- a/Source/WebCore/platform/win/ScrollbarThemeSafari.h
+++ b/Source/WebCore/platform/win/ScrollbarThemeSafari.h
@@ -41,20 +41,20 @@ public:
     virtual bool supportsControlTints() const { return true; }
 
 protected:
-    virtual bool hasButtons(Scrollbar*);
-    virtual bool hasThumb(Scrollbar*);
+    virtual bool hasButtons(ScrollbarThemeClient*);
+    virtual bool hasThumb(ScrollbarThemeClient*);
 
-    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect trackRect(Scrollbar*, bool painting = false);
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false);
 
-    virtual int minimumThumbLength(Scrollbar*);
+    virtual int minimumThumbLength(ScrollbarThemeClient*);
     
-    virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
+    virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
 
-    virtual void paintTrackBackground(GraphicsContext*, Scrollbar*, const IntRect&);
-    virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-    virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
+    virtual void paintTrackBackground(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+    virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+    virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
 };
 
 }
diff --git a/Source/WebCore/platform/win/ScrollbarThemeWin.cpp b/Source/WebCore/platform/win/ScrollbarThemeWin.cpp
index d36341068..5644297d7 100644
--- a/Source/WebCore/platform/win/ScrollbarThemeWin.cpp
+++ b/Source/WebCore/platform/win/ScrollbarThemeWin.cpp
@@ -130,12 +130,12 @@ bool ScrollbarThemeWin::invalidateOnMouseEnterExit()
     return runningVista;
 }
 
-bool ScrollbarThemeWin::hasThumb(Scrollbar* scrollbar)
+bool ScrollbarThemeWin::hasThumb(ScrollbarThemeClient* scrollbar)
 {
     return thumbLength(scrollbar) > 0;
 }
 
-IntRect ScrollbarThemeWin::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+IntRect ScrollbarThemeWin::backButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool)
 {
     // Windows just has single arrows.
     if (part == BackButtonEndPart)
@@ -154,7 +154,7 @@ IntRect ScrollbarThemeWin::backButtonRect(Scrollbar* scrollbar, ScrollbarPart pa
                    thickness, scrollbar->height() < 2 * thickness ? scrollbar->height() / 2 : thickness);
 }
 
-IntRect ScrollbarThemeWin::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+IntRect ScrollbarThemeWin::forwardButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool)
 {
     // Windows just has single arrows.
     if (part == ForwardButtonStartPart)
@@ -175,7 +175,7 @@ IntRect ScrollbarThemeWin::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart
     return IntRect(scrollbar->x(), scrollbar->y() + scrollbar->height() - h, thickness, h);
 }
 
-IntRect ScrollbarThemeWin::trackRect(Scrollbar* scrollbar, bool)
+IntRect ScrollbarThemeWin::trackRect(ScrollbarThemeClient* scrollbar, bool)
 {
     int thickness = scrollbarThickness();
     if (scrollbar->orientation() == HorizontalScrollbar) {
@@ -188,12 +188,12 @@ IntRect ScrollbarThemeWin::trackRect(Scrollbar* scrollbar, bool)
     return IntRect(scrollbar->x(), scrollbar->y() + thickness, thickness, scrollbar->height() - 2 * thickness);
 }
 
-bool ScrollbarThemeWin::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
+bool ScrollbarThemeWin::shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent& evt)
 {
     return evt.shiftKey() && evt.button() == LeftButton;
 }
 
-bool ScrollbarThemeWin::shouldSnapBackToDragOrigin(Scrollbar* scrollbar, const PlatformMouseEvent& evt)
+bool ScrollbarThemeWin::shouldSnapBackToDragOrigin(ScrollbarThemeClient* scrollbar, const PlatformMouseEvent& evt)
 {
     // Find the rect within which we shouldn't snap, by expanding the track rect
     // in both dimensions.
@@ -211,14 +211,14 @@ bool ScrollbarThemeWin::shouldSnapBackToDragOrigin(Scrollbar* scrollbar, const P
     return !rect.contains(mousePosition);
 }
 
-void ScrollbarThemeWin::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeWin::paintTrackBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     // Just assume a forward track part.  We only paint the track as a single piece when there is no thumb.
     if (!hasThumb(scrollbar))
         paintTrackPiece(context, scrollbar, rect, ForwardTrackPart);
 }
 
-void ScrollbarThemeWin::paintTrackPiece(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart partType)
+void ScrollbarThemeWin::paintTrackPiece(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart partType)
 {
     checkAndInitScrollbarTheme();
 
@@ -276,7 +276,7 @@ void ScrollbarThemeWin::paintTrackPiece(GraphicsContext* context, Scrollbar* scr
 #endif
 }
 
-void ScrollbarThemeWin::paintButton(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+void ScrollbarThemeWin::paintButton(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
     checkAndInitScrollbarTheme();
 
@@ -339,7 +339,7 @@ static IntRect gripperRect(int thickness, const IntRect& thumbRect)
                    gripperThickness, gripperThickness);
 }
 
-static void paintGripper(Scrollbar* scrollbar, HDC hdc, const IntRect& rect)
+static void paintGripper(ScrollbarThemeClient* scrollbar, HDC hdc, const IntRect& rect)
 {
     if (!scrollbarTheme)
         return;  // Classic look has no gripper.
@@ -358,7 +358,7 @@ static void paintGripper(Scrollbar* scrollbar, HDC hdc, const IntRect& rect)
     DrawThemeBackground(scrollbarTheme, hdc, scrollbar->orientation() == HorizontalScrollbar ? SP_GRIPPERHOR : SP_GRIPPERVERT, state, &themeRect, 0);
 }
 
-void ScrollbarThemeWin::paintThumb(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void ScrollbarThemeWin::paintThumb(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     checkAndInitScrollbarTheme();
 
diff --git a/Source/WebCore/platform/win/ScrollbarThemeWin.h b/Source/WebCore/platform/win/ScrollbarThemeWin.h
index cd2f176df..870240c16 100644
--- a/Source/WebCore/platform/win/ScrollbarThemeWin.h
+++ b/Source/WebCore/platform/win/ScrollbarThemeWin.h
@@ -42,20 +42,20 @@ public:
     virtual bool invalidateOnMouseEnterExit();
 
 protected:
-    virtual bool hasButtons(Scrollbar*) { return true; }
-    virtual bool hasThumb(Scrollbar*);
+    virtual bool hasButtons(ScrollbarThemeClient*) { return true; }
+    virtual bool hasThumb(ScrollbarThemeClient*);
 
-    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect trackRect(Scrollbar*, bool painting = false);
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false);
 
-    virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&);
-    virtual bool shouldSnapBackToDragOrigin(Scrollbar*, const PlatformMouseEvent&);
+    virtual bool shouldCenterOnThumb(ScrollbarThemeClient*, const PlatformMouseEvent&);
+    virtual bool shouldSnapBackToDragOrigin(ScrollbarThemeClient*, const PlatformMouseEvent&);
 
-    virtual void paintTrackBackground(GraphicsContext*, Scrollbar*, const IntRect&);
-    virtual void paintTrackPiece(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-    virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-    virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
+    virtual void paintTrackBackground(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+    virtual void paintTrackPiece(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+    virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+    virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
 };
 
 }
diff --git a/Source/WebCore/platform/wx/ClipboardWx.cpp b/Source/WebCore/platform/wx/ClipboardWx.cpp
index 161bce8aa..8a3a9c8a3 100644
--- a/Source/WebCore/platform/wx/ClipboardWx.cpp
+++ b/Source/WebCore/platform/wx/ClipboardWx.cpp
@@ -26,7 +26,6 @@
 #include "config.h"
 #include "ClipboardWx.h"
 
-#include "DOMStringList.h"
 #include "FileList.h"
 #include "HashTable.h"
 #include "IntPoint.h"
@@ -58,7 +57,7 @@ void ClipboardWx::clearAllData()
     Pasteboard::generalPasteboard()->clear();
 }
 
-String ClipboardWx::getData(const String& type, bool& success) const 
+String ClipboardWx::getData(const String& type) const 
 {
     notImplemented();
     return ""; 
@@ -71,10 +70,11 @@ bool ClipboardWx::setData(const String& type, const String& data)
 }
 
 // extensions beyond IE's API
-PassRefPtr<DOMStringList> ClipboardWx::types() const 
+HashSet<String> ClipboardWx::types() const 
 {
     notImplemented();
-    return DOMStringList::create();
+    HashSet<String> result;
+    return result;
 }
 
 PassRefPtr<FileList> ClipboardWx::files() const
diff --git a/Source/WebCore/platform/wx/ClipboardWx.h b/Source/WebCore/platform/wx/ClipboardWx.h
index f92726ae6..9e661d786 100644
--- a/Source/WebCore/platform/wx/ClipboardWx.h
+++ b/Source/WebCore/platform/wx/ClipboardWx.h
@@ -42,11 +42,11 @@ namespace WebCore {
 
         void clearData(const String& type);
         void clearAllData();
-        String getData(const String& type, bool& success) const;
+        String getData(const String& type) const;
         bool setData(const String& type, const String& data);
     
         // extensions beyond IE's API
-        virtual PassRefPtr<DOMStringList> types() const;
+        virtual HashSet<String> types() const;
         virtual PassRefPtr<FileList> files() const;
     
         IntPoint dragLocation() const;
diff --git a/Source/WebCore/platform/wx/ScrollbarThemeWx.cpp b/Source/WebCore/platform/wx/ScrollbarThemeWx.cpp
index c924978a5..badf31554 100644
--- a/Source/WebCore/platform/wx/ScrollbarThemeWx.cpp
+++ b/Source/WebCore/platform/wx/ScrollbarThemeWx.cpp
@@ -71,19 +71,19 @@ int ScrollbarThemeWx::scrollbarThickness(ScrollbarControlSize size)
     return thickness;
 }
 
-bool ScrollbarThemeWx::hasThumb(Scrollbar* scrollbar)
+bool ScrollbarThemeWx::hasThumb(ScrollbarThemeClient* scrollbar)
 {
     // This method is just called as a paint-time optimization to see if
     // painting the thumb can be skipped.  We don't have to be exact here.
     return thumbLength(scrollbar) > 0;
 }
 
-int ScrollbarThemeWx::minimumThumbLength(Scrollbar* scrollbar)
+int ScrollbarThemeWx::minimumThumbLength(ScrollbarThemeClient* scrollbar)
 {
     return 20;
 }
 
-IntSize ScrollbarThemeWx::buttonSize(Scrollbar*) 
+IntSize ScrollbarThemeWx::buttonSize(ScrollbarThemeClient*) 
 {
 #ifdef __WXMAC__
     return IntSize(20,20);
@@ -92,7 +92,7 @@ IntSize ScrollbarThemeWx::buttonSize(Scrollbar*)
 #endif
 }
 
-void ScrollbarThemeWx::splitTrack(Scrollbar* scrollbar, const IntRect& unconstrainedTrackRect, IntRect& beforeThumbRect, IntRect& thumbRect, IntRect& afterThumbRect)
+void ScrollbarThemeWx::splitTrack(ScrollbarThemeClient* scrollbar, const IntRect& unconstrainedTrackRect, IntRect& beforeThumbRect, IntRect& thumbRect, IntRect& afterThumbRect)
 {
     ScrollbarThemeComposite::splitTrack(scrollbar, unconstrainedTrackRect, beforeThumbRect, thumbRect, afterThumbRect);
 #ifdef __WXMAC__
@@ -109,7 +109,7 @@ void ScrollbarThemeWx::splitTrack(Scrollbar* scrollbar, const IntRect& unconstra
 #endif
 }
 
-IntRect ScrollbarThemeWx::backButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+IntRect ScrollbarThemeWx::backButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool)
 {
     // FIXME: Handling this case is needed when there are two sets of arrow buttons
     // on Mac, one at the top and one at the bottom.
@@ -130,7 +130,7 @@ IntRect ScrollbarThemeWx::backButtonRect(Scrollbar* scrollbar, ScrollbarPart par
     return IntRect(x, y, size.width(), size.height());
 }
 
-IntRect ScrollbarThemeWx::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart part, bool)
+IntRect ScrollbarThemeWx::forwardButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart part, bool)
 {
     // FIXME: Handling this case is needed when there are two sets of arrow buttons
     // on Mac, one at the top and one at the bottom.
@@ -155,7 +155,7 @@ IntRect ScrollbarThemeWx::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart
     return IntRect(x, y, size.width(), size.height());
 }
 
-IntRect ScrollbarThemeWx::trackRect(Scrollbar* scrollbar, bool)
+IntRect ScrollbarThemeWx::trackRect(ScrollbarThemeClient* scrollbar, bool)
 {
     IntSize bs = buttonSize(scrollbar);
     int trackStart = 0;
@@ -179,11 +179,11 @@ IntRect ScrollbarThemeWx::trackRect(Scrollbar* scrollbar, bool)
     return IntRect(scrollbar->x(), scrollbar->y() + trackStart, thickness, scrollbar->height() - 2 * bs.height());
 }
 
-bool ScrollbarThemeWx::paint(Scrollbar* scrollbar, GraphicsContext* context, const IntRect& rect)
+bool ScrollbarThemeWx::paint(ScrollbarThemeClient* scrollbar, GraphicsContext* context, const IntRect& rect)
 {
     wxOrientation orientation = (scrollbar->orientation() == HorizontalScrollbar) ? wxHORIZONTAL : wxVERTICAL;
     int flags = 0;
-    if (scrollbar->scrollableArea()->isActive())
+    if (scrollbar->isScrollableAreaActive())
         flags |= wxCONTROL_FOCUSED;
     
     if (!scrollbar->enabled())
diff --git a/Source/WebCore/platform/wx/ScrollbarThemeWx.h b/Source/WebCore/platform/wx/ScrollbarThemeWx.h
index 75ab175a3..372aaf966 100644
--- a/Source/WebCore/platform/wx/ScrollbarThemeWx.h
+++ b/Source/WebCore/platform/wx/ScrollbarThemeWx.h
@@ -35,21 +35,21 @@ class ScrollbarThemeWx : public ScrollbarThemeComposite {
 public:
     virtual ~ScrollbarThemeWx();
     virtual int scrollbarThickness(ScrollbarControlSize = RegularScrollbar);
-    virtual bool paint(Scrollbar*, GraphicsContext*, const IntRect&);
+    virtual bool paint(ScrollbarThemeClient*, GraphicsContext*, const IntRect&);
     
 protected:
-    virtual bool hasButtons(Scrollbar*) { return true; }
-    virtual bool hasThumb(Scrollbar*);
+    virtual bool hasButtons(ScrollbarThemeClient*) { return true; }
+    virtual bool hasThumb(ScrollbarThemeClient*);
 
-    virtual IntSize buttonSize(Scrollbar*);
+    virtual IntSize buttonSize(ScrollbarThemeClient*);
 
-    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect trackRect(Scrollbar*, bool painting = false);
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false);
 
-    virtual void splitTrack(Scrollbar*, const IntRect& track, IntRect& startTrack, IntRect& thumb, IntRect& endTrack);
+    virtual void splitTrack(ScrollbarThemeClient*, const IntRect& track, IntRect& startTrack, IntRect& thumb, IntRect& endTrack);
     
-    virtual int minimumThumbLength(Scrollbar*);
+    virtual int minimumThumbLength(ScrollbarThemeClient*);
 };
 
 }
diff --git a/Source/WebCore/plugins/gtk/PluginViewGtk.cpp b/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
index 3ef203f54..c568a4b92 100644
--- a/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
+++ b/Source/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -884,7 +884,11 @@ bool PluginView::platformStart()
         } else
             setPlatformWidget(gtk_xtbin_new(pageClient, 0));
 #else
+#if OS(WINDOWS) && !defined(GTK_API_VERSION_2)
+        setPlatformWidget(0);
+#else
         setPlatformWidget(gtk_socket_new());
+#endif
         gtk_container_add(GTK_CONTAINER(pageClient), platformPluginWidget());
 #endif
     } else {
diff --git a/Source/WebCore/plugins/npapi-sandbox.h b/Source/WebCore/plugins/npapi-sandbox.h
new file mode 100644
index 000000000..651fdad16
--- /dev/null
+++ b/Source/WebCore/plugins/npapi-sandbox.h
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2012 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*!
+ * @header WebKit Mac Sandbox
+ *
+ * This header provides an *EXPERIMENTAL* API for NPAPI plug-ins that wish
+ * to reduce their runtime privileges. When entering the sandbox, adopting
+ * plug-ins specify a whitelist of files they wish to have available for
+ * reading and writing. Plug-ins that need to have access to arbitrary files,
+ * such as to enable user-initiated file uploads or downloads, can invoke
+ * native Cocoa APIs, which will automatically grant permissions to the plug-in.
+ *
+ *
+ * Security characteristics
+ *
+ * Sandboxed plug-in's local file access is restricted to the union of:
+ *
+ * 1. The file whitelist specified by the plug-in when entering the sandbox.
+ * 2. Any files obtained at runtime through the secure Open and Save dialogs.
+ * 3. Any files that were open before entering the sandbox.
+ *
+ * Implementation may additionally choose to restrict the creation of IPC
+ * channels or the use of other security-sensitive system resources, such as
+ * the ability to spawn additional processes. However, any such resources
+ * acquired before entry into the sandbox are guaranteed to remain available
+ * within it. For example, plug-ins are free to spawn a trusted broker process
+ * before entering the sandbox and to establish an IPC channel with it. The
+ * channel will remain available within the sandbox even if the implementation
+ * is highly restrictive and allows neither process creation nor IPC channel
+ * establishment.
+ */
+
+
+#ifndef npapi_sandbox_h
+#define npapi_sandbox_h
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*!
+ * @constant WKNVSandboxFunctions
+ * Use this constant with NPN_GetValue to get a pointer to WKNSandboxFunctions
+ * structure, which contains pointers to sandboxing functions.
+ */
+#define WKNVSandboxFunctions 74659
+
+/*!
+ * Version of WKNSandboxFunctions structure that is returned by NPN_GetValue.
+ */
+#define WKNVSandboxFunctionsVersionCurrent 1
+
+/*!
+ * @function WKN_EnterSandbox
+ * Requests that the plug-in instance be placed in a sandbox.
+ *
+ * @param readOnlyPaths
+ * NULL-terminated C array of paths to files and directories that the plug-in
+ * wishes to have available in the sandbox for read-only access. Any
+ * directories in this array will automatically extend the sandbox to encompass
+ * all their files and subdirectories, meaning that they will be available
+ * through OS level file access functions for reading.
+ *
+ * @param readWritePaths
+ * NULL-terminated C array of paths to files and directories that the plug-in
+ * wishes to have available in the sandbox for both reading and writing.
+ * Typically, this array will include paths to the plug-in's local caches, a
+ * directory for temporary files, and any configuration files which are not
+ * security sensitive, in that they are not consulted when determining the
+ * lists of paths to pass to this function during plug-in instantiation.
+ * Any directories in this array will automatically extend the sandbox to
+ * encompass all their files and subdirectories, meaning that they will be
+ * available through OS level file access functions for reading and writing.
+ *
+ * @result
+ * Places the plug-in instance in a sandbox. The sandbox allows read-only access
+ * to paths specified by `readOnlyPaths` and read-write access to
+ * `readWritePaths`. If the same path appears in both `readOnlyPaths` and
+ * `readWritePaths`, access to that path will be read-only. No other filesystem
+ * access is available except as expressly permitted by the user through
+ * NSOpenPanel and NSSavePanel invocations.  Returns NPERR_NO_ERROR when the
+ * navigator has successfully placed the plug-in in a sandbox and
+ * NPERR_GENERIC_ERROR if the the plug-in instance was already placed in a sandbox
+ * with a prior call to this function. If entering sandbox fails for any other reason,
+ * the process is terminated.
+ * Note that either or both `readOnlyPaths` and `readWritePaths` may be NULL.
+ *
+ * @discussion
+ * This function should be called as early as possible during plug-in
+ * instantiation and ALWAYS before any untrusted code has run. Generally, the
+ * only things that the plug-in should do before entering the sandbox are to
+ * determine the paths to pass in as `readOnlyPaths` and `readWritePaths`, and
+ * to establish any IPC channels to be used from the sandbox. In cases where
+ * the plug-in must parse its configuration files to determine any needed local
+ * resources (such as files to preload), it should do so and then immediately
+ * call this function. If configuration files do not influence the paths that
+ * the plug-in will pass as part of `readOnlyPaths` and `readWritePaths`, the
+ * plug-in should enter the sandbox first and only then process configuration
+ * files and deal with normal startup tasks.
+ *
+ * Very close attention must be paid to weeding out security-sensitive files
+ * from the `readWritePaths` list. If the plug-in instance reads a configuration
+ * file at startup to determine which additional files it will place in the
+ * `readWritePaths` list to this call, then that configuration file MUST NOT be
+ * in the `readWritePaths` itself. Otherwise, should the plug-in become
+ * compromised, it can trivially escape its sandbox the next time it is
+ * instantiated by writing arbitrary paths (or just "/") into this writable
+ * configuration file.
+ *
+ * Note that after a plug-in instance enters the sandbox, any native calls that
+ * it makes which refer to arbitrary paths on disk  will only work if the paths are
+ * available within the sandbox, either statically through `readOnlyPaths` and
+ * `readWritePaths`, or dynamically through Cocoa APIs.
+ * However, NPAPI calls (such as e.g. NPN_PostURL with the file parameter set to TRUE)
+ * can access files that navigator policies allow, which is usually an entirely
+ * different set for remote and for local Web pages.
+ */
+typedef NPError (*WKN_EnterSandboxProcPtr)(const char *readOnlyPaths[], const char *readWritePaths[]);
+
+/*!
+ * @function WKN_FileStopAccessing
+ * Requests that the navigator revoke the plug-in's access to the given path.
+ *
+ * @param path
+ * Required. A path that was previously returned from NSOpenPanel or NSSavePanel.
+ *
+ * @result
+ * Returns  NPERR_NO_ERROR, or NPERR_GENERIC_ERROR if the requesting plug-in
+ * instance is not in a sandbox.
+ *
+ * @discussion
+ * Whenever file access is provided to a plug-in instance through a
+ * Cocoa API, navigator should be notfied when it is no longer needed.
+ * This will cause subsequent open(2) calls on any of the revoked files to fail,
+ * but by design no attempt is made to invalidate existing file descriptors.
+ * plug-in writers are strongly encouraged to keep files open for as short a period
+ * of time as possible, and to always call this function when objects representing
+ * the returned files go out of scope or are otherwise destroyed.
+ */
+typedef NPError (*WKN_FileStopAccessingProcPtr)(const char* path);
+
+typedef struct _WKNSandboxFunctions {
+    uint16_t size;
+    uint16_t version;
+    
+    WKN_EnterSandboxProcPtr enterSandbox;
+    WKN_FileStopAccessingProcPtr fileStopAccessing;
+} WKNSandboxFunctions;
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif // npapi_sandbox_h
diff --git a/Source/WebCore/rendering/FilterEffectObserver.h b/Source/WebCore/rendering/FilterEffectObserver.h
index 92c60637a..7573497ce 100644
--- a/Source/WebCore/rendering/FilterEffectObserver.h
+++ b/Source/WebCore/rendering/FilterEffectObserver.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/rendering/FilterEffectRenderer.cpp b/Source/WebCore/rendering/FilterEffectRenderer.cpp
index 7d9873151..af5ecaf27 100644
--- a/Source/WebCore/rendering/FilterEffectRenderer.cpp
+++ b/Source/WebCore/rendering/FilterEffectRenderer.cpp
@@ -322,7 +322,8 @@ void FilterEffectRenderer::prepare()
     // source image sizes set. We just need to attach the graphic
     // buffer if we have not yet done so.
     if (!m_graphicsBufferAttached) {
-        setSourceImage(ImageBuffer::create(IntSize(m_sourceDrawingRegion.width(), m_sourceDrawingRegion.height()), ColorSpaceDeviceRGB, renderingMode()));
+        IntSize logicalSize(m_sourceDrawingRegion.width(), m_sourceDrawingRegion.height());
+        setSourceImage(ImageBuffer::create(logicalSize, 1, ColorSpaceDeviceRGB, renderingMode()));
         m_graphicsBufferAttached = true;
     }
     m_sourceGraphic->clearResult();
diff --git a/Source/WebCore/rendering/HitTestResult.h b/Source/WebCore/rendering/HitTestResult.h
index 90a156e5c..152278c4d 100644
--- a/Source/WebCore/rendering/HitTestResult.h
+++ b/Source/WebCore/rendering/HitTestResult.h
@@ -57,6 +57,7 @@ public:
     Node* innerNode() const { return m_innerNode.get(); }
     Node* innerNonSharedNode() const { return m_innerNonSharedNode.get(); }
     LayoutPoint point() const { return m_point; }
+    IntPoint roundedPoint() const { return roundedIntPoint(m_point); }
     LayoutPoint localPoint() const { return m_localPoint; }
     Element* URLElement() const { return m_innerURLElement.get(); }
     Scrollbar* scrollbar() const { return m_scrollbar.get(); }
diff --git a/Source/WebCore/rendering/InlineBox.cpp b/Source/WebCore/rendering/InlineBox.cpp
index 2873664b2..7eceba404 100644
--- a/Source/WebCore/rendering/InlineBox.cpp
+++ b/Source/WebCore/rendering/InlineBox.cpp
@@ -213,11 +213,6 @@ void InlineBox::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset, Layo
     if (!paintInfo.shouldPaintWithinRoot(renderer()) || (paintInfo.phase != PaintPhaseForeground && paintInfo.phase != PaintPhaseSelection))
         return;
 
-    if (Frame* frame = renderer()->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(renderer(), paintInfo.rect);
-    }
-
     LayoutPoint childPoint = paintOffset;
     if (parent()->renderer()->style()->isFlippedBlocksWritingMode()) // Faster than calling containingBlock().
         childPoint = renderer()->containingBlock()->flipForWritingModeForChild(toRenderBox(renderer()), childPoint);
@@ -299,7 +294,23 @@ InlineBox* InlineBox::prevLeafChild() const
         leaf = parent()->prevLeafChild();
     return leaf;
 }
-    
+
+InlineBox* InlineBox::nextLeafChildIgnoringLineBreak() const
+{
+    InlineBox* leaf = nextLeafChild();
+    if (leaf && leaf->isLineBreak())
+        return 0;
+    return leaf;
+}
+
+InlineBox* InlineBox::prevLeafChildIgnoringLineBreak() const
+{
+    InlineBox* leaf = prevLeafChild();
+    if (leaf && leaf->isLineBreak())
+        return 0;
+    return leaf;
+}
+
 RenderObject::SelectionState InlineBox::selectionState()
 {
     return renderer()->selectionState();
@@ -354,14 +365,14 @@ FloatPoint InlineBox::flipForWritingMode(const FloatPoint& point)
     return root()->block()->flipForWritingMode(point);
 }
 
-void InlineBox::flipForWritingMode(IntRect& rect)
+void InlineBox::flipForWritingMode(LayoutRect& rect)
 {
     if (!renderer()->style()->isFlippedBlocksWritingMode())
         return;
     root()->block()->flipForWritingMode(rect);
 }
 
-IntPoint InlineBox::flipForWritingMode(const IntPoint& point)
+LayoutPoint InlineBox::flipForWritingMode(const LayoutPoint& point)
 {
     if (!renderer()->style()->isFlippedBlocksWritingMode())
         return point;
diff --git a/Source/WebCore/rendering/InlineBox.h b/Source/WebCore/rendering/InlineBox.h
index 326f9c9bb..196c230fd 100644
--- a/Source/WebCore/rendering/InlineBox.h
+++ b/Source/WebCore/rendering/InlineBox.h
@@ -200,7 +200,13 @@ public:
     
     InlineBox* nextLeafChild() const;
     InlineBox* prevLeafChild() const;
-        
+
+    // Helper functions for editing and hit-testing code.
+    // FIXME: These two functions should be moved to RenderedPosition once the code to convert between
+    // Position and inline box, offset pair is moved to RenderedPosition.
+    InlineBox* nextLeafChildIgnoringLineBreak() const;
+    InlineBox* prevLeafChildIgnoringLineBreak() const;
+
     RenderObject* renderer() const { return m_renderer; }
 
     InlineFlowBox* parent() const
@@ -311,8 +317,8 @@ public:
     FloatPoint locationIncludingFlipping();
     void flipForWritingMode(FloatRect&);
     FloatPoint flipForWritingMode(const FloatPoint&);
-    void flipForWritingMode(IntRect&);
-    IntPoint flipForWritingMode(const IntPoint&);
+    void flipForWritingMode(LayoutRect&);
+    LayoutPoint flipForWritingMode(const LayoutPoint&);
 
     bool knownToHaveNoOverflow() const { return m_knownToHaveNoOverflow; }
     void clearKnownToHaveNoOverflow();
@@ -358,7 +364,7 @@ public:
 protected:
     mutable bool m_determinedIfNextOnLineExists : 1;
     mutable bool m_nextOnLineExists : 1;
-    signed m_expansion : 11; // for justified text
+    signed m_expansion : 12; // for justified text
 
 #ifndef NDEBUG
 private:
diff --git a/Source/WebCore/rendering/InlineFlowBox.cpp b/Source/WebCore/rendering/InlineFlowBox.cpp
index f799a1ae1..bf84a0a03 100644
--- a/Source/WebCore/rendering/InlineFlowBox.cpp
+++ b/Source/WebCore/rendering/InlineFlowBox.cpp
@@ -56,9 +56,9 @@ InlineFlowBox::~InlineFlowBox()
 
 #endif
 
-int InlineFlowBox::getFlowSpacingLogicalWidth()
+LayoutUnit InlineFlowBox::getFlowSpacingLogicalWidth()
 {
-    int totWidth = marginBorderPaddingLogicalLeft() + marginBorderPaddingLogicalRight();
+    LayoutUnit totWidth = marginBorderPaddingLogicalLeft() + marginBorderPaddingLogicalRight();
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
         if (curr->isInlineFlowBox())
             totWidth += toInlineFlowBox(curr)->getFlowSpacingLogicalWidth();
@@ -397,8 +397,8 @@ float InlineFlowBox::placeBoxesInInlineDirection(float logicalLeft, bool& needsW
             } else if (!curr->renderer()->isListMarker() || toRenderListMarker(curr->renderer())->isInside()) {
                 // The box can have a different writing-mode than the overall line, so this is a bit complicated.
                 // Just get all the physical margin and overflow values by hand based off |isVertical|.
-                int logicalLeftMargin = isHorizontal() ? curr->boxModelObject()->marginLeft() : curr->boxModelObject()->marginTop();
-                int logicalRightMargin = isHorizontal() ? curr->boxModelObject()->marginRight() : curr->boxModelObject()->marginBottom();
+                LayoutUnit logicalLeftMargin = isHorizontal() ? curr->boxModelObject()->marginLeft() : curr->boxModelObject()->marginTop();
+                LayoutUnit logicalRightMargin = isHorizontal() ? curr->boxModelObject()->marginRight() : curr->boxModelObject()->marginBottom();
                 
                 logicalLeft += logicalLeftMargin;
                 curr->setLogicalLeft(logicalLeft);
@@ -700,10 +700,10 @@ void InlineFlowBox::placeBoxesInBlockDirection(LayoutUnit top, LayoutUnit maxHei
                 lineTop = pixelSnappedLogicalTop();
                 lineTopIncludingMargins = lineTop;
             } else {
-                lineTop = min(lineTop, pixelSnappedLogicalTop());
+                lineTop = min<LayoutUnit>(lineTop, pixelSnappedLogicalTop());
                 lineTopIncludingMargins = min(lineTop, lineTopIncludingMargins);
             }
-            lineBottom = max(lineBottom, pixelSnappedLogicalBottom());
+            lineBottom = max<LayoutUnit>(lineBottom, pixelSnappedLogicalBottom());
             lineBottomIncludingMargins = max(lineBottom, lineBottomIncludingMargins);
         }
         
@@ -1118,8 +1118,8 @@ void InlineFlowBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, c
         }
         LayoutUnit stripX = rect.x() - (isHorizontal() ? logicalOffsetOnLine : zeroLayoutUnit);
         LayoutUnit stripY = rect.y() - (isHorizontal() ? zeroLayoutUnit : logicalOffsetOnLine);
-        LayoutUnit stripWidth = isHorizontal() ? totalLogicalWidth : width();
-        LayoutUnit stripHeight = isHorizontal() ? height() : totalLogicalWidth;
+        LayoutUnit stripWidth = isHorizontal() ? totalLogicalWidth : static_cast<LayoutUnit>(width());
+        LayoutUnit stripHeight = isHorizontal() ? static_cast<LayoutUnit>(height()) : totalLogicalWidth;
 
         GraphicsContextStateSaver stateSaver(*paintInfo.context);
         paintInfo.context->clip(LayoutRect(rect.x(), rect.y(), width(), height()));
diff --git a/Source/WebCore/rendering/InlineFlowBox.h b/Source/WebCore/rendering/InlineFlowBox.h
index 500de7ed9..a81af717b 100644
--- a/Source/WebCore/rendering/InlineFlowBox.h
+++ b/Source/WebCore/rendering/InlineFlowBox.h
@@ -119,8 +119,8 @@ public:
     virtual RenderLineBoxList* rendererLineBoxes() const;
 
     // logicalLeft = left in a horizontal line and top in a vertical line.
-    int marginBorderPaddingLogicalLeft() const { return marginLogicalLeft() + borderLogicalLeft() + paddingLogicalLeft(); }
-    int marginBorderPaddingLogicalRight() const { return marginLogicalRight() + borderLogicalRight() + paddingLogicalRight(); }
+    LayoutUnit marginBorderPaddingLogicalLeft() const { return marginLogicalLeft() + borderLogicalLeft() + paddingLogicalLeft(); }
+    LayoutUnit marginBorderPaddingLogicalRight() const { return marginLogicalRight() + borderLogicalRight() + paddingLogicalRight(); }
     LayoutUnit marginLogicalLeft() const
     {
         if (!includeLogicalLeftEdge())
@@ -168,7 +168,7 @@ public:
 
     // Helper functions used during line construction and placement.
     void determineSpacingForFlowBoxes(bool lastLine, bool isLogicallyLastRunWrapped, RenderObject* logicallyLastRunRenderer);
-    int getFlowSpacingLogicalWidth();
+    LayoutUnit getFlowSpacingLogicalWidth();
     float placeBoxesInInlineDirection(float logicalLeft, bool& needsWordSpacing, GlyphOverflowAndFallbackFontsMap&);
     void computeLogicalBoxHeights(RootInlineBox*, LayoutUnit& maxPositionTop, LayoutUnit& maxPositionBottom,
                                   LayoutUnit& maxAscent, LayoutUnit& maxDescent, bool& setMaxAscent, bool& setMaxDescent,
@@ -207,8 +207,8 @@ public:
     { 
         return m_overflow ? m_overflow->layoutOverflowRect() : enclosingLayoutRect(frameRectIncludingLineHeight(lineTop, lineBottom));
     }
-    LayoutUnit logicalLeftLayoutOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->minXLayoutOverflow() : m_overflow->minYLayoutOverflow()) : logicalLeft(); }
-    LayoutUnit logicalRightLayoutOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->maxXLayoutOverflow() : m_overflow->maxYLayoutOverflow()) : ceilf(logicalRight()); }
+    LayoutUnit logicalLeftLayoutOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->minXLayoutOverflow() : m_overflow->minYLayoutOverflow()) : static_cast<LayoutUnit>(logicalLeft()); }
+    LayoutUnit logicalRightLayoutOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->maxXLayoutOverflow() : m_overflow->maxYLayoutOverflow()) : static_cast<LayoutUnit>(ceilf(logicalRight())); }
     LayoutUnit logicalTopLayoutOverflow(LayoutUnit lineTop) const
     {
         if (m_overflow)
@@ -233,8 +233,8 @@ public:
     { 
         return m_overflow ? m_overflow->visualOverflowRect() : enclosingLayoutRect(frameRectIncludingLineHeight(lineTop, lineBottom));
     }
-    LayoutUnit logicalLeftVisualOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->minXVisualOverflow() : m_overflow->minYVisualOverflow()) : logicalLeft(); }
-    LayoutUnit logicalRightVisualOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->maxXVisualOverflow() : m_overflow->maxYVisualOverflow()) : ceilf(logicalRight()); }
+    LayoutUnit logicalLeftVisualOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->minXVisualOverflow() : m_overflow->minYVisualOverflow()) : static_cast<LayoutUnit>(logicalLeft()); }
+    LayoutUnit logicalRightVisualOverflow() const { return m_overflow ? (isHorizontal() ? m_overflow->maxXVisualOverflow() : m_overflow->maxYVisualOverflow()) : static_cast<LayoutUnit>(ceilf(logicalRight())); }
     LayoutUnit logicalTopVisualOverflow(LayoutUnit lineTop) const
     {
         if (m_overflow)
diff --git a/Source/WebCore/rendering/InlineTextBox.cpp b/Source/WebCore/rendering/InlineTextBox.cpp
index c9e8c07cb..639d6bad6 100644
--- a/Source/WebCore/rendering/InlineTextBox.cpp
+++ b/Source/WebCore/rendering/InlineTextBox.cpp
@@ -496,11 +496,6 @@ void InlineTextBox::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset,
         // When only painting the selection, don't bother to paint if there is none.
         return;
 
-    if (Frame* frame = renderer()->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(renderer(), paintInfo.rect);
-    }
-
     if (m_truncation != cNoTruncation) {
         if (renderer()->containingBlock()->style()->isLeftToRightDirection() != isLeftToRightDirection()) {
             // Make the visible fragment of text hug the edge closest to the rest of the run by moving the origin
@@ -567,6 +562,17 @@ void InlineTextBox::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset,
             paintSelection(context, boxOrigin, styleToUse, font);
     }
 
+    if (Frame* frame = renderer()->frame()) {
+        if (Page* page = frame->page()) {
+            // FIXME: Right now, InlineTextBoxes never call addRelevantUnpaintedObject() even though they might 
+            // legitimately be unpainted if they are waiting on a slow-loading web font. We should fix that, and
+            // when we do, we will have to account for the fact the InlineTextBoxes do not always have unique
+            // renderers and Page currently relies on each unpainted object having a unique renderer.
+            if (paintInfo.phase == PaintPhaseForeground)
+                page->addRelevantRepaintedObject(renderer(), IntRect(boxOrigin.x(), boxOrigin.y(), logicalWidth(), logicalHeight()));
+        }
+    }
+
     // 2. Now paint the foreground, including text and decorations like underline/overline (in quirks mode only).
     Color textFillColor;
     Color textStrokeColor;
diff --git a/Source/WebCore/rendering/LayoutState.cpp b/Source/WebCore/rendering/LayoutState.cpp
index e89dcc5db..1fbfc0cdd 100644
--- a/Source/WebCore/rendering/LayoutState.cpp
+++ b/Source/WebCore/rendering/LayoutState.cpp
@@ -70,8 +70,7 @@ LayoutState::LayoutState(LayoutState* prev, RenderBox* renderer, const LayoutSiz
         m_clipRect = prev->m_clipRect;
 
     if (renderer->hasOverflowClip()) {
-        RenderLayer* layer = renderer->layer();
-        LayoutRect clipRect(toPoint(m_paintOffset) + renderer->view()->layoutDelta(), layer->size());
+        LayoutRect clipRect(toPoint(m_paintOffset) + renderer->view()->layoutDelta(), renderer->cachedSizeForOverflowClip());
         if (m_clipped)
             m_clipRect.intersect(clipRect);
         else {
@@ -156,10 +155,9 @@ LayoutState::LayoutState(RenderObject* root)
     m_paintOffset = LayoutSize(absContentPoint.x(), absContentPoint.y());
 
     if (container->hasOverflowClip()) {
-        RenderBox* containerBox = toRenderBox(container);
-        RenderLayer* layer = containerBox->layer();
         m_clipped = true;
-        m_clipRect = LayoutRect(toPoint(m_paintOffset), layer->size());
+        RenderBox* containerBox = toRenderBox(container);
+        m_clipRect = LayoutRect(toPoint(m_paintOffset), containerBox->cachedSizeForOverflowClip());
         m_paintOffset -= containerBox->scrolledContentOffset();
     }
 }
@@ -280,7 +278,7 @@ void LayoutState::computeLineGridPaginationOrigin(RenderBox* renderer)
         if (pageLogicalTop > firstLineTopWithLeading) {
             // Shift to the next highest line grid multiple past the page logical top. Cache the delta
             // between this new value and the page logical top as the pagination origin.
-            LayoutUnit remainder = (pageLogicalTop - firstLineTopWithLeading) % gridLineHeight;
+            LayoutUnit remainder = roundToInt(pageLogicalTop - firstLineTopWithLeading) % roundToInt(gridLineHeight);
             LayoutUnit paginationDelta = gridLineHeight - remainder;
             if (isHorizontalWritingMode)
                 m_lineGridPaginationOrigin.setHeight(paginationDelta);
diff --git a/Source/WebCore/rendering/LayoutTypes.h b/Source/WebCore/rendering/LayoutTypes.h
index 72cbf2fd9..2041ee597 100644
--- a/Source/WebCore/rendering/LayoutTypes.h
+++ b/Source/WebCore/rendering/LayoutTypes.h
@@ -38,6 +38,7 @@
 
 #include "FloatRect.h"
 #include "IntRect.h"
+#include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
@@ -58,11 +59,27 @@ inline IntRect pixelSnappedIntRect(const LayoutRect& rect)
     return rect;
 }
 
+inline IntRect pixelSnappedIntRect(LayoutUnit left, LayoutUnit top, LayoutUnit width, LayoutUnit height)
+{
+    return IntRect(left, top, width, height);
+}
+
+inline IntRect pixelSnappedIntRect(const LayoutPoint& location, const LayoutSize& size)
+{
+    return IntRect(location, size);
+}
+
 inline IntRect pixelSnappedIntRectFromEdges(LayoutUnit left, LayoutUnit top, LayoutUnit right, LayoutUnit bottom)
 {
     return IntRect(left, top, right - left, bottom - top);
 }
 
+inline int snapSizeToPixel(LayoutUnit size, LayoutUnit location) 
+{
+    UNUSED_PARAM(location);
+    return size;
+}
+
 inline IntSize roundedIntSize(const LayoutSize& s)
 {
     return s;
@@ -98,6 +115,11 @@ inline LayoutSize flooredLayoutSize(const FloatPoint& p)
     return LayoutSize(static_cast<int>(p.x()), static_cast<int>(p.y()));
 }
 
+inline int roundToInt(LayoutUnit value)
+{
+    return value;
+}
+
 inline LayoutUnit roundedLayoutUnit(float value)
 {
     return lroundf(value);
@@ -123,6 +145,11 @@ inline LayoutUnit layoutMod(const LayoutUnit& numerator, const LayoutUnit& denom
     return numerator % denominator;
 }
 
+inline LayoutUnit clampToLayoutUnit(double value)
+{
+    return clampToInteger(value);
+}
+
 } // namespace WebCore
 
 #endif // LayoutTypes_h
diff --git a/Source/WebCore/rendering/RenderBlock.cpp b/Source/WebCore/rendering/RenderBlock.cpp
index 413c60ece..d87d77226 100755
--- a/Source/WebCore/rendering/RenderBlock.cpp
+++ b/Source/WebCore/rendering/RenderBlock.cpp
@@ -38,6 +38,7 @@
 #include "InlineIterator.h"
 #include "InlineTextBox.h"
 #include "LayoutRepainter.h"
+#include "OverflowEvent.h"
 #include "PODFreeListArena.h"
 #include "Page.h"
 #include "PaintInfo.h"
@@ -83,8 +84,60 @@ typedef WTF::HashSet<RenderBlock*> DelayedUpdateScrollInfoSet;
 static int gDelayUpdateScrollInfo = 0;
 static DelayedUpdateScrollInfoSet* gDelayedUpdateScrollInfoSet = 0;
 
+// We only create "generated" renderers like one for first-letter and
+// before/after pseudo elements if:
+// - the firstLetterBlock can have children in the DOM and
+// - the block doesn't have any special assumption on its text children.
+// This correctly prevents form controls from having such renderers.
+static inline bool canHaveGeneratedChildren(RenderObject* renderer)
+{
+    return (renderer->canHaveChildren()
+            && (!renderer->isDeprecatedFlexibleBox()
+                || static_cast<RenderDeprecatedFlexibleBox*>(renderer)->canHaveGeneratedChildren()));
+}
+
 bool RenderBlock::s_canPropagateFloatIntoSibling = false;
 
+// This class helps dispatching the 'overflow' event on layout change. overflow can be set on RenderBoxes, yet the existing code
+// only works on RenderBlocks. If this change, this class should be shared with other RenderBoxes.
+class OverflowEventDispatcher {
+    WTF_MAKE_NONCOPYABLE(OverflowEventDispatcher);
+public:
+    OverflowEventDispatcher(const RenderBlock* block)
+        : m_block(block)
+        , m_hadHorizontalLayoutOverflow(false)
+        , m_hadVerticalLayoutOverflow(false)
+    {
+        m_shouldDispatchEvent = !m_block->isAnonymous() && m_block->hasOverflowClip() && m_block->document()->hasListenerType(Document::OVERFLOWCHANGED_LISTENER);
+        if (m_shouldDispatchEvent) {
+            m_hadHorizontalLayoutOverflow = m_block->hasHorizontalLayoutOverflow();
+            m_hadVerticalLayoutOverflow = m_block->hasVerticalLayoutOverflow();
+        }
+    }
+
+    ~OverflowEventDispatcher()
+    {
+        if (!m_shouldDispatchEvent)
+            return;
+
+        bool hasHorizontalLayoutOverflow = m_block->hasHorizontalLayoutOverflow();
+        bool hasVerticalLayoutOverflow = m_block->hasVerticalLayoutOverflow();
+
+        bool horizontalLayoutOverflowChanged = hasHorizontalLayoutOverflow != m_hadHorizontalLayoutOverflow;
+        bool verticalLayoutOverflowChanged = hasVerticalLayoutOverflow != m_hadVerticalLayoutOverflow;
+        if (horizontalLayoutOverflowChanged || verticalLayoutOverflowChanged) {
+            if (FrameView* frameView = m_block->document()->view())
+                frameView->scheduleEvent(OverflowEvent::create(horizontalLayoutOverflowChanged, hasHorizontalLayoutOverflow, verticalLayoutOverflowChanged, hasVerticalLayoutOverflow), m_block->node());
+        }
+    }
+
+private:
+    const RenderBlock* m_block;
+    bool m_shouldDispatchEvent;
+    bool m_hadHorizontalLayoutOverflow;
+    bool m_hadVerticalLayoutOverflow;
+};
+
 // Our MarginInfo state used when laying out block children.
 RenderBlock::MarginInfo::MarginInfo(RenderBlock* block, LayoutUnit beforeBorderPadding, LayoutUnit afterBorderPadding)
     : m_atBeforeSideOfBlock(true)
@@ -125,6 +178,7 @@ RenderBlock::RenderBlock(Node* node)
       , m_lineHeight(-1)
       , m_beingDestroyed(false)
       , m_hasPositionedFloats(false)
+      , m_hasMarkupTruncation(false)
 {
     setChildrenInline(true);
 }
@@ -261,7 +315,7 @@ void RenderBlock::styleDidChange(StyleDifference diff, const RenderStyle* oldSty
     m_lineHeight = -1;
 
     // Update pseudos for :before and :after now.
-    if (!isAnonymous() && document()->usesBeforeAfterRules() && canHaveChildren()) {
+    if (!isAnonymous() && document()->usesBeforeAfterRules() && canHaveGeneratedChildren(this)) {
         updateBeforeAfterContent(BEFORE);
         updateBeforeAfterContent(AFTER);
     }
@@ -380,8 +434,17 @@ void RenderBlock::addChildToAnonymousColumnBlocks(RenderObject* newChild, Render
     ASSERT(!continuation()); // We don't yet support column spans that aren't immediate children of the multi-column block.
         
     // The goal is to locate a suitable box in which to place our child.
-    RenderBlock* beforeChildParent = toRenderBlock(beforeChild && beforeChild->parent()->isRenderBlock() ? beforeChild->parent() : lastChild());
-    
+    RenderBlock* beforeChildParent = 0;
+    if (beforeChild) {
+        RenderObject* curr = beforeChild;
+        while (curr && curr->parent() != this)
+            curr = curr->parent();
+        beforeChildParent = toRenderBlock(curr);
+        ASSERT(beforeChildParent);
+        ASSERT(beforeChildParent->isAnonymousColumnsBlock() || beforeChildParent->isAnonymousColumnSpanBlock());
+    } else
+        beforeChildParent = toRenderBlock(lastChild());
+
     // If the new child is floating or positioned it can just go in that block.
     if (newChild->isFloatingOrPositioned()) {
         beforeChildParent->addChildIgnoringAnonymousColumnBlocks(newChild, beforeChild);
@@ -491,6 +554,14 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
     if (beforeChild && childrenInline())
         deleteLineBoxTree();
 
+    // We have to remove the descendant child from our positioned objects list
+    // before we do the split and move some of the children to cloneBlock. Since
+    // we are doing layout anyway, it is easier to blow away the entire list, than
+    // traversing down the subtree looking for positioned childs and then remove them
+    // from our positioned objects list.
+    if (beforeChild)
+        removePositionedObjects(0);
+
     // Now take all of the children from beforeChild to the end and remove
     // them from |this| and place them in the clone.
     moveChildrenTo(cloneBlock, beforeChild, 0, true);
@@ -504,6 +575,7 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
     // Once we hit the anonymous columns block we're done.
     RenderBoxModelObject* curr = toRenderBoxModelObject(parent());
     RenderBoxModelObject* currChild = this;
+    RenderObject* currChildNextSibling = currChild->nextSibling();
     
     while (curr && curr != fromBlock) {
         ASSERT(curr->isRenderBlock());
@@ -530,15 +602,20 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
         // Someone may have indirectly caused a <q> to split.  When this happens, the :after content
         // has to move into the inline continuation.  Call updateBeforeAfterContent to ensure that the inline's :after
         // content gets properly destroyed.
+        bool isLastChild = (currChildNextSibling == blockCurr->lastChild());
         if (document()->usesBeforeAfterRules())
             blockCurr->children()->updateBeforeAfterContent(blockCurr, AFTER);
+        if (isLastChild && currChildNextSibling != blockCurr->lastChild())
+            currChildNextSibling = 0; // We destroyed the last child, so now we need to update
+                                      // the value of currChildNextSibling.
 
         // Now we need to take all of the children starting from the first child
         // *after* currChild and append them all to the clone.
-        blockCurr->moveChildrenTo(cloneBlock, currChild->nextSibling(), 0, true);
+        blockCurr->moveChildrenTo(cloneBlock, currChildNextSibling, 0, true);
 
         // Keep walking up the chain.
         currChild = curr;
+        currChildNextSibling = currChild->nextSibling();
         curr = toRenderBoxModelObject(curr->parent());
     }
 
@@ -547,7 +624,7 @@ void RenderBlock::splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock,
 
     // Now take all the children after currChild and remove them from the fromBlock
     // and put them in the toBlock.
-    fromBlock->moveChildrenTo(toBlock, currChild->nextSibling(), 0, true);
+    fromBlock->moveChildrenTo(toBlock, currChildNextSibling, 0, true);
 }
 
 void RenderBlock::splitFlow(RenderObject* beforeChild, RenderBlock* newBlockBox,
@@ -835,7 +912,11 @@ void RenderBlock::addChildIgnoringAnonymousColumnBlocks(RenderObject* newChild,
             // We are nested inside a multi-column element and are being split by the span.  We have to break up
             // our block into continuations.
             RenderBoxModelObject* oldContinuation = continuation();
-            setContinuation(newBox);
+
+            // When we split an anonymous block, there's no need to do any continuation hookup,
+            // since we haven't actually split a real element.
+            if (!isAnonymousBlock())
+                setContinuation(newBox);
 
             // Someone may have put a <p> inside a <q>, causing a split.  When this happens, the :after content
             // has to move into the inline continuation.  Call updateBeforeAfterContent to ensure that our :after
@@ -1201,8 +1282,8 @@ void RenderBlock::removeChild(RenderObject* oldChild)
         // are floating, then we need to pull the content up also.
         RenderBlock* anonBlock = toRenderBlock((prev && prev->isAnonymousBlock()) ? prev : next);
         if ((anonBlock->previousSibling() || anonBlock->nextSibling())
-            && (!anonBlock->previousSibling() || (anonBlock->previousSibling()->style()->styleType() != NOPSEUDO && anonBlock->previousSibling()->isFloating()))
-            && (!anonBlock->nextSibling() || (anonBlock->nextSibling()->style()->styleType() != NOPSEUDO && anonBlock->nextSibling()->isFloating()))) {
+            && (!anonBlock->previousSibling() || (anonBlock->previousSibling()->style()->styleType() != NOPSEUDO && anonBlock->previousSibling()->isFloating() && !anonBlock->previousSibling()->previousSibling()))
+            && (!anonBlock->nextSibling() || (anonBlock->nextSibling()->style()->styleType() != NOPSEUDO && anonBlock->nextSibling()->isFloating() && !anonBlock->nextSibling()->nextSibling()))) {
             collapseAnonymousBoxChild(this, anonBlock);
         }
     }
@@ -1290,16 +1371,24 @@ void RenderBlock::finishDelayUpdateScrollInfo()
 
 void RenderBlock::updateScrollInfoAfterLayout()
 {
-    if (hasOverflowClip()) {
-        if (gDelayUpdateScrollInfo)
-            gDelayedUpdateScrollInfoSet->add(this);
-        else
-            layer()->updateScrollInfoAfterLayout();
+    if (!hasOverflowClip())
+        return;
+
+    if (!hasLayer()) {
+        updateCachedSizeForOverflowClip();
+        return;
     }
+
+    if (gDelayUpdateScrollInfo)
+        gDelayedUpdateScrollInfoSet->add(this);
+    else
+        layer()->updateScrollInfoAfterLayout();
 }
 
 void RenderBlock::layout()
 {
+    OverflowEventDispatcher dispatcher(this);
+
     // Update our first letter info now.
     updateFirstLetter();
 
@@ -1522,7 +1611,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren, LayoutUnit pageLogicalHeigh
 
         repaintRect.inflate(maximalOutlineSize(PaintPhaseOutline));
         
-        if (hasOverflowClip()) {
+        if (hasOverflowClipWithLayer()) {
             // Adjust repaint rect for scroll offset
             repaintRect.move(-scrolledContentOffset());
 
@@ -1631,8 +1720,12 @@ void RenderBlock::addOverflowFromPositionedObjects()
         positionedObject = *it;
         
         // Fixed positioned elements don't contribute to layout overflow, since they don't scroll with the content.
-        if (positionedObject->style()->position() != FixedPosition)
-            addOverflowFromChild(positionedObject);
+        if (positionedObject->style()->position() != FixedPosition) {
+            int x = positionedObject->x();
+            if (style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
+                x -= verticalScrollbarWidth();
+            addOverflowFromChild(positionedObject, IntSize(x, positionedObject->y()));
+        }
     }
 }
 
@@ -1742,6 +1835,10 @@ bool RenderBlock::handleRunInChild(RenderBox* child)
         return false;
     // FIXME: We don't handle non-block elements with run-in for now.
     if (!child->isRenderBlock())
+        return false;  
+    // Run-in child shouldn't intrude into the sibling block if it is part of a
+    // continuation chain. In that case, treat it as a normal block.
+    if (child->isElementContinuation() || child->virtualContinuation())
         return false;
 
     RenderBlock* blockRunIn = toRenderBlock(child);
@@ -2024,6 +2121,8 @@ LayoutUnit RenderBlock::computeStartPositionDeltaForChildAvoidingFloats(const Re
 void RenderBlock::determineLogicalLeftPositionForChild(RenderBox* child)
 {
     LayoutUnit startPosition = borderStart() + paddingStart();
+    if (style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
+        startPosition -= verticalScrollbarWidth();
     LayoutUnit totalAvailableLogicalWidth = borderAndPaddingLogicalWidth() + availableLogicalWidth();
 
     // Add in our start margin.
@@ -2352,7 +2451,7 @@ bool RenderBlock::simplifiedLayout()
     if ((!posChildNeedsLayout() && !needsSimplifiedNormalFlowLayout()) || normalChildNeedsLayout() || selfNeedsLayout())
         return false;
 
-    LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), hasColumns() || hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
+    LayoutStateMaintainer statePusher(view(), this, locationOffset(), hasColumns() || hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
     
     if (needsPositionedMovementLayout() && !tryLayoutDoingPositionedMovementOnly())
         return false;
@@ -2545,7 +2644,7 @@ void RenderBlock::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
     // Our scrollbar widgets paint exactly when we tell them to, so that they work properly with
     // z-index.  We paint after we painted the background/border, so that the scrollbars will
     // sit above the background/border.
-    if (hasOverflowClip() && style()->visibility() == VISIBLE && (phase == PaintPhaseBlockBackground || phase == PaintPhaseChildBlockBackground) && paintInfo.shouldPaintWithinRoot(this))
+    if (hasOverflowClipWithLayer() && style()->visibility() == VISIBLE && (phase == PaintPhaseBlockBackground || phase == PaintPhaseChildBlockBackground) && paintInfo.shouldPaintWithinRoot(this))
         layer()->paintOverflowControls(paintInfo.context, roundedIntPoint(adjustedPaintOffset), paintInfo.rect);
 }
 
@@ -3841,6 +3940,36 @@ LayoutUnit RenderBlock::logicalLeftOffsetForLine(LayoutUnit logicalTop, LayoutUn
     if (applyTextIndent && style()->isLeftToRightDirection())
         left += textIndentOffset();
 
+    if (style()->lineAlign() == LineAlignNone)
+        return left;
+    
+    // Push in our left offset so that it is aligned with the character grid.
+    LayoutState* layoutState = view()->layoutState();
+    if (!layoutState)
+        return left;
+
+    RenderBlock* lineGrid = layoutState->lineGrid();
+    if (!lineGrid || lineGrid->style()->writingMode() != style()->writingMode())
+        return left;
+
+    // FIXME: Should letter-spacing apply? This is complicated since it doesn't apply at the edge?
+    float maxCharWidth = lineGrid->style()->font().primaryFont()->maxCharWidth();
+    if (!maxCharWidth)
+        return left;
+
+    LayoutUnit lineGridOffset = lineGrid->isHorizontalWritingMode() ? layoutState->lineGridOffset().width(): layoutState->lineGridOffset().height();
+    LayoutUnit layoutOffset = lineGrid->isHorizontalWritingMode() ? layoutState->layoutOffset().width() : layoutState->layoutOffset().height();
+    
+    // Push in to the nearest character width (truncated so that we pixel snap left).
+    // FIXME: Should be patched when subpixel layout lands, since this calculation doesn't have to pixel snap
+    // any more (https://bugs.webkit.org/show_bug.cgi?id=79946).
+    // FIXME: This is wrong for RTL (https://bugs.webkit.org/show_bug.cgi?id=79945).
+    // FIXME: This doesn't work with columns or regions (https://bugs.webkit.org/show_bug.cgi?id=79942).
+    // FIXME: This doesn't work when the inline position of the object isn't set ahead of time.
+    // FIXME: Dynamic changes to the font or to the inline position need to result in a deep relayout.
+    // (https://bugs.webkit.org/show_bug.cgi?id=79944)
+    float remainder = fmodf(maxCharWidth - fmodf(left + layoutOffset - lineGridOffset, maxCharWidth), maxCharWidth);
+    left += remainder;
     return left;
 }
 
@@ -3860,6 +3989,36 @@ LayoutUnit RenderBlock::logicalRightOffsetForLine(LayoutUnit logicalTop, LayoutU
     if (applyTextIndent && !style()->isLeftToRightDirection())
         right -= textIndentOffset();
     
+    if (style()->lineAlign() == LineAlignNone)
+        return right;
+    
+    // Push in our right offset so that it is aligned with the character grid.
+    LayoutState* layoutState = view()->layoutState();
+    if (!layoutState)
+        return right;
+
+    RenderBlock* lineGrid = layoutState->lineGrid();
+    if (!lineGrid || lineGrid->style()->writingMode() != style()->writingMode())
+        return right;
+
+    // FIXME: Should letter-spacing apply? This is complicated since it doesn't apply at the edge?
+    float maxCharWidth = lineGrid->style()->font().primaryFont()->maxCharWidth();
+    if (!maxCharWidth)
+        return right;
+
+    LayoutUnit lineGridOffset = lineGrid->isHorizontalWritingMode() ? layoutState->lineGridOffset().width(): layoutState->lineGridOffset().height();
+    LayoutUnit layoutOffset = lineGrid->isHorizontalWritingMode() ? layoutState->layoutOffset().width() : layoutState->layoutOffset().height();
+    
+    // Push in to the nearest character width (truncated so that we pixel snap right).
+    // FIXME: Should be patched when subpixel layout lands, since this calculation doesn't have to pixel snap
+    // any more (https://bugs.webkit.org/show_bug.cgi?id=79946).
+    // FIXME: This is wrong for RTL (https://bugs.webkit.org/show_bug.cgi?id=79945).
+    // FIXME: This doesn't work with columns or regions (https://bugs.webkit.org/show_bug.cgi?id=79942).
+    // FIXME: This doesn't work when the inline position of the object isn't set ahead of time.
+    // FIXME: Dynamic changes to the font or to the inline position need to result in a deep relayout.
+    // (https://bugs.webkit.org/show_bug.cgi?id=79944)
+    float remainder = fmodf(fmodf(right + layoutOffset - lineGridOffset, maxCharWidth), maxCharWidth);
+    right -= ceilf(remainder);
     return right;
 }
 
@@ -4315,7 +4474,7 @@ LayoutUnit RenderBlock::getClearDelta(RenderBox* child, LayoutUnit logicalTop)
 
 bool RenderBlock::isPointInOverflowControl(HitTestResult& result, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset)
 {
-    if (!scrollsOverflow())
+    if (!scrollsOverflow() || !hasLayer())
         return false;
 
     return layer()->hitTestOverflowControls(result, pointInContainer - toLayoutSize(accumulatedOffset));
@@ -4619,12 +4778,17 @@ VisiblePosition RenderBlock::positionForPointWithInlineChildren(const LayoutPoin
     if (closestBox) {
         if (moveCaretToBoundary && pointInLogicalContents.y() < firstRootBoxWithChildren->selectionTop()
             && pointInLogicalContents.y() < firstRootBoxWithChildren->logicalTop()) {
+            InlineBox* box = firstRootBoxWithChildren->firstLeafChild();
+            if (box->isLineBreak()) {
+                if (InlineBox* newBox = box->nextLeafChildIgnoringLineBreak())
+                    box = newBox;
+            }
             // y coordinate is above first root line box, so return the start of the first
-            return VisiblePosition(positionForBox(firstRootBoxWithChildren->firstLeafChild(), true), DOWNSTREAM);
+            return VisiblePosition(positionForBox(box, true), DOWNSTREAM);
         }
 
         // pass the box a top position that is inside it
-        LayoutPoint point(pointInLogicalContents.x(), closestBox->logicalTop());
+        LayoutPoint point(pointInLogicalContents.x(), max(closestBox->root()->lineTop(), closestBox->root()->selectionTop()));
         if (!isHorizontalWritingMode())
             point = point.transposedPoint();
         if (closestBox->renderer()->isReplaced())
@@ -5810,23 +5974,12 @@ static inline bool shouldSkipForFirstLetter(UChar c)
     return isSpaceOrNewline(c) || c == noBreakSpace || isPunctuationForFirstLetter(c);
 }
 
-// We only honor first-letter if 
-// - the firstLetterBlock can have children in the DOM and
-// - the block doesn't have any special assumption on its text children.
-// This correctly prevents form controls from honoring first-letter.
-static inline bool isSafeToCreateFirstLetterRendererOn(RenderObject* renderer)
-{
-    return (renderer->canHaveChildren()
-            && !(renderer->isDeprecatedFlexibleBox()
-                 && static_cast<RenderDeprecatedFlexibleBox*>(renderer)->buttonText()));
-}
-
 static inline RenderObject* findFirstLetterBlock(RenderBlock* start)
 {
     RenderObject* firstLetterBlock = start;
     while (true) {
         bool canHaveFirstLetterRenderer = firstLetterBlock->style()->hasPseudoStyle(FIRST_LETTER)
-            && isSafeToCreateFirstLetterRendererOn(firstLetterBlock);
+            && canHaveGeneratedChildren(firstLetterBlock);
         if (canHaveFirstLetterRenderer)
             return firstLetterBlock;
 
@@ -5839,7 +5992,7 @@ static inline RenderObject* findFirstLetterBlock(RenderBlock* start)
 
     return 0;
 }
-   
+
 void RenderBlock::updateFirstLetter()
 {
     if (!document()->usesFirstLetterRules())
@@ -5869,7 +6022,7 @@ void RenderBlock::updateFirstLetter()
             currChild = currChild->nextSibling();
         } else if (currChild->isReplaced() || currChild->isRenderButton() || currChild->isMenuList())
             break;
-        else if (currChild->style()->hasPseudoStyle(FIRST_LETTER) && currChild->canHaveChildren())  {
+        else if (currChild->style()->hasPseudoStyle(FIRST_LETTER) && canHaveGeneratedChildren(currChild))  {
             // We found a lower-level node with first-letter, which supersedes the higher-level style
             firstLetterBlock = currChild;
             currChild = currChild->firstChild();
@@ -6222,7 +6375,7 @@ void RenderBlock::setPageLogicalOffset(int logicalOffset)
     m_rareData->m_pageLogicalOffset = logicalOffset;
 }
 
-void RenderBlock::absoluteRects(Vector<LayoutRect>& rects, const LayoutPoint& accumulatedOffset) const
+void RenderBlock::absoluteRects(Vector<IntRect>& rects, const LayoutPoint& accumulatedOffset) const
 {
     // For blocks inside inlines, we go ahead and include margins so that we run right up to the
     // inline boxes above and below us (thus getting merged with them to form a single irregular
@@ -6230,12 +6383,12 @@ void RenderBlock::absoluteRects(Vector<LayoutRect>& rects, const LayoutPoint& ac
     if (isAnonymousBlockContinuation()) {
         // FIXME: This is wrong for block-flows that are horizontal.
         // https://bugs.webkit.org/show_bug.cgi?id=46781
-        rects.append(LayoutRect(accumulatedOffset.x(), accumulatedOffset.y() - collapsedMarginBefore(),
+        rects.append(pixelSnappedIntRect(accumulatedOffset.x(), accumulatedOffset.y() - collapsedMarginBefore(),
                                 width(), height() + collapsedMarginBefore() + collapsedMarginAfter()));
         continuation()->absoluteRects(rects, accumulatedOffset - toLayoutSize(location() +
                 inlineElementContinuation()->containingBlock()->location()));
     } else
-        rects.append(LayoutRect(accumulatedOffset, size()));
+        rects.append(pixelSnappedIntRect(accumulatedOffset, size()));
 }
 
 void RenderBlock::absoluteQuads(Vector<FloatQuad>& quads, bool* wasFixed) const
@@ -6393,7 +6546,7 @@ LayoutRect RenderBlock::localCaretRect(InlineBox* inlineBox, int caretOffset, La
     return LayoutRect(x, y, caretWidth, height);
 }
 
-void RenderBlock::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint& additionalOffset)
+void RenderBlock::addFocusRingRects(Vector<IntRect>& rects, const LayoutPoint& additionalOffset)
 {
     // For blocks inside inlines, we go ahead and include margins so that we run right up to the
     // inline boxes above and below us (thus getting merged with them to form a single irregular
@@ -6409,17 +6562,17 @@ void RenderBlock::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint
         float bottomMargin = nextInlineHasLineBox ? collapsedMarginAfter() : static_cast<LayoutUnit>(0);
         LayoutRect rect(additionalOffset.x(), additionalOffset.y() - topMargin, width(), height() + topMargin + bottomMargin);
         if (!rect.isEmpty())
-            rects.append(rect);
+            rects.append(pixelSnappedIntRect(rect));
     } else if (width() && height())
-        rects.append(LayoutRect(additionalOffset, size()));
+        rects.append(pixelSnappedIntRect(additionalOffset, size()));
 
     if (!hasOverflowClip() && !hasControlClip()) {
         for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
-            LayoutUnit top = max(curr->lineTop(), static_cast<LayoutUnit>(curr->top()));
-            LayoutUnit bottom = min(curr->lineBottom(), static_cast<LayoutUnit>(curr->top() + curr->height()));
+            LayoutUnit top = max<LayoutUnit>(curr->lineTop(), curr->top());
+            LayoutUnit bottom = min<LayoutUnit>(curr->lineBottom(), curr->top() + curr->height());
             LayoutRect rect(additionalOffset.x() + curr->x(), additionalOffset.y() + top, curr->width(), bottom - top);
             if (!rect.isEmpty())
-                rects.append(rect);
+                rects.append(pixelSnappedIntRect(rect));
         }
 
         for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
@@ -6582,7 +6735,7 @@ LayoutUnit RenderBlock::pageLogicalTopForOffset(LayoutUnit offset) const
         LayoutUnit pageLogicalHeight = renderView->layoutState()->pageLogicalHeight();
         if (!pageLogicalHeight)
             return 0;
-        return cumulativeOffset - (cumulativeOffset - firstPageLogicalTop) % pageLogicalHeight;
+        return cumulativeOffset - roundToInt(cumulativeOffset - firstPageLogicalTop) % roundToInt(pageLogicalHeight);
     }
     return enclosingRenderFlowThread()->regionLogicalTopForLine(cumulativeOffset);
 }
@@ -7203,7 +7356,7 @@ TextRun RenderBlock::constructTextRun(RenderObject* context, const Font& font, c
         if (flags & RespectDirection)
             textDirection = style->direction();
         if (flags & RespectDirectionOverride)
-            directionalOverride |= style->unicodeBidi() == Override;
+            directionalOverride |= isOverride(style->unicodeBidi());
     }
 
     TextRun run(characters, length, false, 0, 0, expansion, textDirection, directionalOverride);
diff --git a/Source/WebCore/rendering/RenderBlock.h b/Source/WebCore/rendering/RenderBlock.h
index 8996da5ef..cf2317348 100644
--- a/Source/WebCore/rendering/RenderBlock.h
+++ b/Source/WebCore/rendering/RenderBlock.h
@@ -113,6 +113,9 @@ public:
     static bool hasPercentHeightDescendant(RenderBox*);
 #endif
 
+    void setHasMarkupTruncation(bool b) { m_hasMarkupTruncation = b; }
+    bool hasMarkupTruncation() const { return m_hasMarkupTruncation; }
+
     RootInlineBox* createAndAppendRootInlineBox();
 
     bool generatesLineBoxesForInlineChild(RenderObject*);
@@ -182,7 +185,7 @@ public:
 
     int pixelSnappedLogicalLeftOffsetForLine(LayoutUnit position, bool firstLine) const
     {
-        return logicalLeftOffsetForLine(position, logicalLeftOffsetForContent(position), firstLine, 0);
+        return roundToInt(logicalLeftOffsetForLine(position, logicalLeftOffsetForContent(position), firstLine, 0));
     }
     
     LayoutUnit startAlignedOffsetForLine(RenderBox* child, LayoutUnit position, bool firstLine);
@@ -378,6 +381,8 @@ public:
 protected:
     virtual void willBeDestroyed();
 
+    void updateScrollInfoAfterLayout();
+
     // These functions are only used internally to manipulate the render tree structure via remove/insert/appendChildNode.
     // Since they are typically called only to move objects around within anonymous blocks (which only have layers in
     // the case of column spans), the default for fullRemoveInsert is false rather than true.
@@ -467,7 +472,7 @@ protected:
     void addOverflowFromInlineChildren();
     void addVisualOverflowFromTheme();
 
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
 
 #if ENABLE(SVG)
     // Only used by RenderSVGText, which explicitely overrides RenderBlock::layoutBlock(), do NOT use for anything else.
@@ -527,7 +532,7 @@ private:
     struct FloatWithRect {
         FloatWithRect(RenderBox* f)
             : object(f)
-            , rect(LayoutRect(f->x() - f->marginLeft(), f->y() - f->marginTop(), f->width() + f->marginLeft() + f->marginRight(), f->height() + f->marginTop() + f->marginBottom()))
+            , rect(LayoutRect(f->x() - f->marginLeft(), f->y() - f->marginTop(), f->width() + f->marginWidth(), f->height() + f->marginHeight()))
             , everHadLayout(f->everHadLayout())
         {
         }
@@ -634,11 +639,11 @@ private:
     LayoutUnit logicalRightForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->maxX() : child->maxY(); }
     LayoutUnit logicalWidthForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->width() : child->height(); }
 
-    // FIXME: The implementation for these functions will change once we move to subpixel layout. See bug 60318.
-    int pixelSnappedLogicalTopForFloat(const FloatingObject* child) const { return logicalTopForFloat(child); }
-    int pixelSnappedLogicalBottomForFloat(const FloatingObject* child) const { return logicalBottomForFloat(child); }
-    int pixelSnappedLogicalLeftForFloat(const FloatingObject* child) const { return logicalLeftForFloat(child); }
-    int pixelSnappedLogicalRightForFloat(const FloatingObject* child) const { return logicalRightForFloat(child); }
+    int pixelSnappedLogicalTopForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->pixelSnappedY() : child->pixelSnappedX(); }
+    int pixelSnappedLogicalBottomForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->pixelSnappedMaxY() : child->pixelSnappedMaxX(); }
+    int pixelSnappedLogicalLeftForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->pixelSnappedX() : child->pixelSnappedY(); }
+    int pixelSnappedLogicalRightForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->pixelSnappedMaxX() : child->pixelSnappedMaxY(); }
+    int pixelSnappedLogicalWidthForFloat(const FloatingObject* child) const { return isHorizontalWritingMode() ? child->pixelSnappedWidth() : child->pixelSnappedHeight(); }
 
     void setLogicalTopForFloat(FloatingObject* child, LayoutUnit logicalTop)
     {
@@ -810,7 +815,7 @@ private:
     LayoutUnit logicalLeftSelectionOffset(RenderBlock* rootBlock, LayoutUnit position);
     LayoutUnit logicalRightSelectionOffset(RenderBlock* rootBlock, LayoutUnit position);
     
-    virtual void absoluteRects(Vector<LayoutRect>&, const LayoutPoint& accumulatedOffset) const;
+    virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const;
     virtual void absoluteQuads(Vector<FloatQuad>&, bool* wasFixed) const;
 
     LayoutUnit desiredColumnWidth() const;
@@ -839,8 +844,6 @@ private:
 
     bool expandsToEncloseOverhangingFloats() const;
 
-    void updateScrollInfoAfterLayout();
-
     RenderObject* splitAnonymousBlocksAroundChild(RenderObject* beforeChild);
     RenderObject* splitTablePartsAroundChild(RenderObject* beforeChild);
     void splitBlocks(RenderBlock* fromBlock, RenderBlock* toBlock, RenderBlock* middleBlock,
@@ -1119,9 +1122,10 @@ protected:
     RenderObjectChildList m_children;
     RenderLineBoxList m_lineBoxes;   // All of the root line boxes created for this block flow.  For example, <div>Hello<br>world.</div> will have two total lines for the <div>.
 
-    mutable signed m_lineHeight : 30;
+    mutable signed m_lineHeight : 29;
     bool m_beingDestroyed : 1;
     bool m_hasPositionedFloats : 1;
+    bool m_hasMarkupTruncation : 1;
 
     // RenderRubyBase objects need to be able to split and merge, moving their children around
     // (calling moveChildTo, moveAllChildrenTo, and makeChildrenNonInline).
diff --git a/Source/WebCore/rendering/RenderBlockLineLayout.cpp b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
index 47b632464..e98db5c79 100755
--- a/Source/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/Source/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -114,9 +114,9 @@ private:
 
 inline void LineWidth::updateAvailableWidth()
 {
-    int height = m_block->logicalHeight();
-    m_left = m_block->logicalLeftOffsetForLine(height, m_isFirstLine);
-    m_right = m_block->logicalRightOffsetForLine(height, m_isFirstLine);
+    LayoutUnit height = m_block->logicalHeight();
+    m_left = m_block->pixelSnappedLogicalLeftOffsetForLine(height, m_isFirstLine);
+    m_right = m_block->pixelSnappedLogicalRightOffsetForLine(height, m_isFirstLine);
 
     computeAvailableWidthFromLeftAndRight();
 }
@@ -759,8 +759,8 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
                                                          GlyphOverflowAndFallbackFontsMap& textBoxDataMap, VerticalPositionCache& verticalPositionCache)
 {
     ETextAlign textAlign = textAlignmentForLine(!reachedEnd && !lineBox->endsWithBreak());
-    float logicalLeft = logicalLeftOffsetForLine(logicalHeight(), lineInfo.isFirstLine());
-    float availableLogicalWidth = logicalRightOffsetForLine(logicalHeight(), lineInfo.isFirstLine()) - logicalLeft;
+    float logicalLeft = pixelSnappedLogicalLeftOffsetForLine(logicalHeight(), lineInfo.isFirstLine());
+    float availableLogicalWidth = pixelSnappedLogicalRightOffsetForLine(logicalHeight(), lineInfo.isFirstLine()) - logicalLeft;
 
     bool needsWordSpacing = false;
     float totalLogicalWidth = lineBox->getFlowSpacingLogicalWidth();
@@ -943,10 +943,10 @@ void RenderBlock::appendFloatingObjectToLastLine(FloatingObject* floatingObject)
 }
 
 // FIXME: This should be a BidiStatus constructor or create method.
-static inline BidiStatus statusWithDirection(TextDirection textDirection)
+static inline BidiStatus statusWithDirection(TextDirection textDirection, bool isOverride)
 {
     WTF::Unicode::Direction direction = textDirection == LTR ? LeftToRight : RightToLeft;
-    RefPtr<BidiContext> context = BidiContext::create(textDirection == LTR ? 0 : 1, direction, false, FromStyleOrDOM);
+    RefPtr<BidiContext> context = BidiContext::create(textDirection == LTR ? 0 : 1, direction, isOverride, FromStyleOrDOM);
 
     // This copies BidiStatus and may churn the ref on BidiContext. I doubt it matters.
     return BidiStatus(direction, direction, direction, context.release());
@@ -980,10 +980,10 @@ static inline void constructBidiRuns(InlineBidiResolver& topResolver, BidiRunLis
         if (unicodeBidi == Plaintext)
             determineDirectionality(direction, InlineIterator(isolatedInline, isolatedRun->object(), 0));
         else {
-            ASSERT(unicodeBidi == Isolate);
+            ASSERT(unicodeBidi == Isolate || unicodeBidi == OverrideIsolate);
             direction = isolatedInline->style()->direction();
         }
-        isolatedResolver.setStatus(statusWithDirection(direction));
+        isolatedResolver.setStatus(statusWithDirection(direction, isOverride(unicodeBidi)));
 
         // FIXME: The fact that we have to construct an Iterator here
         // currently prevents this code from moving into BidiResolver.
@@ -1272,7 +1272,7 @@ void RenderBlock::layoutRunsAndFloatsInRange(LineLayoutState& layoutState, Inlin
             if (isNewUBAParagraph && styleToUse->unicodeBidi() == Plaintext && !resolver.context()->parent()) {
                 TextDirection direction = styleToUse->direction();
                 determineDirectionality(direction, resolver.position());
-                resolver.setStatus(BidiStatus(direction, styleToUse->unicodeBidi() == Override));
+                resolver.setStatus(BidiStatus(direction, isOverride(styleToUse->unicodeBidi())));
             }
             // FIXME: This ownership is reversed. We should own the BidiRunList and pass it to createBidiRunsForLine.
             BidiRunList<BidiRun>& bidiRuns = resolver.runs();
@@ -1462,7 +1462,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, LayoutUnit& repain
     LineLayoutState layoutState(isFullLayout, repaintLogicalTop, repaintLogicalBottom);
 
     if (isFullLayout)
-        deleteLineBoxTree();
+        lineBoxes()->deleteLineBoxes(renderArena());
 
     // Text truncation only kicks in if your overflow isn't visible and your text-overflow-mode isn't
     // clip.
@@ -1486,7 +1486,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, LayoutUnit& repain
             if (o->isReplaced() || o->isFloating() || o->isPositioned()) {
                 RenderBox* box = toRenderBox(o);
 
-                if (relayoutChildren || o->style()->width().isPercent() || o->style()->height().isPercent())
+                if (relayoutChildren || box->hasRelativeDimensions())
                     o->setChildNeedsLayout(true, false);
 
                 // If relayoutChildren is set and the child has percentage padding or an embedded content box, we also need to invalidate the childs pref widths.
@@ -1546,7 +1546,7 @@ void RenderBlock::checkFloatsInCleanLine(RootInlineBox* line, Vector<FloatWithRe
     for (Vector<RenderBox*>::iterator it = cleanLineFloats->begin(); it != end; ++it) {
         RenderBox* floatingBox = *it;
         floatingBox->layoutIfNeeded();
-        LayoutSize newSize(floatingBox->width() + floatingBox->marginLeft() + floatingBox->marginRight(), floatingBox->height() + floatingBox->marginTop() + floatingBox->marginBottom());
+        LayoutSize newSize(floatingBox->width() + floatingBox->marginWidth(), floatingBox->height() + floatingBox->marginHeight());
         ASSERT(floatIndex < floats.size());
         if (floats[floatIndex].object != floatingBox) {
             encounteredNewFloat = true;
@@ -1682,7 +1682,7 @@ RootInlineBox* RenderBlock::determineStartPosition(LineLayoutState& layoutState,
         TextDirection direction = style()->direction();
         if (style()->unicodeBidi() == Plaintext)
             determineDirectionality(direction, InlineIterator(this, bidiFirstSkippingEmptyInlines(this), 0));
-        resolver.setStatus(BidiStatus(direction, style()->unicodeBidi() == Override));
+        resolver.setStatus(BidiStatus(direction, isOverride(style()->unicodeBidi())));
         InlineIterator iter = InlineIterator(this, bidiFirstSkippingEmptyInlines(this, &resolver), 0);
         resolver.setPosition(iter, numberOfIsolateAncestors(iter));
     }
diff --git a/Source/WebCore/rendering/RenderBox.cpp b/Source/WebCore/rendering/RenderBox.cpp
index d21c2405d..bafdc376a 100644
--- a/Source/WebCore/rendering/RenderBox.cpp
+++ b/Source/WebCore/rendering/RenderBox.cpp
@@ -263,6 +263,9 @@ void RenderBox::willBeDestroyed()
     // value during laying out. It causes a use-after-free bug.
     ASSERT(!RenderBlock::hasPercentHeightDescendant(this));
 
+    if (hasOverflowClip() && everHadLayout() && !hasLayer())
+        clearCachedSizeForOverflowClip();
+
     RenderBoxModelObject::willBeDestroyed();
 }
 
@@ -285,7 +288,7 @@ void RenderBox::removeFloatingOrPositionedChildFromBlockLists()
 
         if (parentBlock) {
             RenderObject* parent = parentBlock->parent();
-            if (parent && parent->isDeprecatedFlexibleBox())
+            if (parent && parent->isFlexibleBoxIncludingDeprecated())
                 parentBlock = toRenderBlock(parent);
 
             parentBlock->markSiblingsWithFloatsForLayout(this);
@@ -360,7 +363,7 @@ void RenderBox::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle
 
     // If our zoom factor changes and we have a defined scrollLeft/Top, we need to adjust that value into the
     // new zoomed coordinate space.
-    if (hasOverflowClip() && oldStyle && newStyle && oldStyle->effectiveZoom() != newStyle->effectiveZoom()) {
+    if (hasOverflowClipWithLayer() && oldStyle && newStyle && oldStyle->effectiveZoom() != newStyle->effectiveZoom()) {
         if (int left = layer()->scrollXOffset()) {
             left = (left / oldStyle->effectiveZoom()) * newStyle->effectiveZoom();
             layer()->scrollToXOffset(left);
@@ -463,6 +466,10 @@ void RenderBox::layout()
         child = child->nextSibling();
     }
     statePusher.pop();
+
+    if (hasOverflowClip() && !hasLayer())
+        updateCachedSizeForOverflowClip();
+
     setNeedsLayout(false);
 }
 
@@ -480,17 +487,17 @@ LayoutUnit RenderBox::clientHeight() const
 
 int RenderBox::pixelSnappedClientWidth() const
 {
-    return clientWidth();
+    return snapSizeToPixel(clientWidth(), clientLeft());
 }
 
 int RenderBox::pixelSnappedClientHeight() const
 {
-    return clientHeight();
+    return snapSizeToPixel(clientHeight(), clientTop());
 }
 
 int RenderBox::scrollWidth() const
 {
-    if (hasOverflowClip())
+    if (hasOverflowClipWithLayer())
         return layer()->scrollWidth();
     // For objects with visible overflow, this matches IE.
     // FIXME: Need to work right with writing modes.
@@ -501,7 +508,7 @@ int RenderBox::scrollWidth() const
 
 int RenderBox::scrollHeight() const
 {
-    if (hasOverflowClip())
+    if (hasOverflowClipWithLayer())
         return layer()->scrollHeight();
     // For objects with visible overflow, this matches IE.
     // FIXME: Need to work right with writing modes.
@@ -510,29 +517,29 @@ int RenderBox::scrollHeight() const
 
 int RenderBox::scrollLeft() const
 {
-    return hasOverflowClip() ? layer()->scrollXOffset() : 0;
+    return hasOverflowClipWithLayer() ? layer()->scrollXOffset() : 0;
 }
 
 int RenderBox::scrollTop() const
 {
-    return hasOverflowClip() ? layer()->scrollYOffset() : 0;
+    return hasOverflowClipWithLayer() ? layer()->scrollYOffset() : 0;
 }
 
 void RenderBox::setScrollLeft(int newLeft)
 {
-    if (hasOverflowClip())
+    if (hasOverflowClipWithLayer())
         layer()->scrollToXOffset(newLeft, RenderLayer::ScrollOffsetClamped);
 }
 
 void RenderBox::setScrollTop(int newTop)
 {
-    if (hasOverflowClip())
+    if (hasOverflowClipWithLayer())
         layer()->scrollToYOffset(newTop, RenderLayer::ScrollOffsetClamped);
 }
 
 void RenderBox::absoluteRects(Vector<IntRect>& rects, const LayoutPoint& accumulatedOffset) const
 {
-    rects.append(LayoutRect(accumulatedOffset, size()));
+    rects.append(pixelSnappedIntRect(accumulatedOffset, size()));
 }
 
 void RenderBox::absoluteQuads(Vector<FloatQuad>& quads, bool* wasFixed) const
@@ -581,10 +588,10 @@ LayoutRect RenderBox::outlineBoundsForRepaint(RenderBoxModelObject* repaintConta
     return box;
 }
 
-void RenderBox::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint& additionalOffset)
+void RenderBox::addFocusRingRects(Vector<IntRect>& rects, const LayoutPoint& additionalOffset)
 {
     if (!size().isEmpty())
-        rects.append(LayoutRect(additionalOffset, size()));
+        rects.append(pixelSnappedIntRect(additionalOffset, size()));
 }
 
 LayoutRect RenderBox::reflectionBox() const
@@ -651,13 +658,13 @@ bool RenderBox::fixedElementLaysOutRelativeToFrame(Frame* frame, FrameView* fram
 
 bool RenderBox::includeVerticalScrollbarSize() const
 {
-    return hasOverflowClip() && !layer()->hasOverlayScrollbars()
+    return hasOverflowClipWithLayer() && !layer()->hasOverlayScrollbars()
         && (style()->overflowY() == OSCROLL || style()->overflowY() == OAUTO);
 }
 
 bool RenderBox::includeHorizontalScrollbarSize() const
 {
-    return hasOverflowClip() && !layer()->hasOverlayScrollbars()
+    return hasOverflowClipWithLayer() && !layer()->hasOverlayScrollbars()
         && (style()->overflowX() == OSCROLL || style()->overflowX() == OAUTO);
 }
 
@@ -749,8 +756,56 @@ bool RenderBox::needsPreferredWidthsRecalculation() const
 IntSize RenderBox::scrolledContentOffset() const
 {
     ASSERT(hasOverflowClip());
-    ASSERT(hasLayer());
-    return layer()->scrolledContentOffset();
+
+    if (hasLayer())
+        return layer()->scrolledContentOffset();
+
+    // If we have no layer, it means that we have no overflowing content as we lazily
+    // allocate it on demand. Thus we don't have any scroll offset.
+    ASSERT(!requiresLayerForOverflowClip());
+    return LayoutSize();
+}
+
+typedef HashMap<const RenderBox*, LayoutSize> RendererSizeCache;
+static RendererSizeCache& cachedSizeForOverflowClipMap()
+{
+    DEFINE_STATIC_LOCAL(RendererSizeCache, cachedSizeForOverflowClipMap, ());
+    return cachedSizeForOverflowClipMap;
+}
+
+IntSize RenderBox::cachedSizeForOverflowClip() const
+{
+    ASSERT(hasOverflowClip());
+    if (hasLayer())
+        return layer()->size();
+
+    ASSERT(!requiresLayerForOverflowClip());
+    RendererSizeCache::iterator it = cachedSizeForOverflowClipMap().find(this);
+    if (it == cachedSizeForOverflowClipMap().end())
+        return LayoutSize();
+
+    return it->second;
+}
+
+void RenderBox::updateCachedSizeForOverflowClip()
+{
+    ASSERT(hasOverflowClip());
+    ASSERT(!requiresLayerForOverflowClip());
+    ASSERT(!hasLayer());
+
+    cachedSizeForOverflowClipMap().set(this, size());
+}
+
+void RenderBox::clearCachedSizeForOverflowClip()
+{
+    ASSERT(hasOverflowClip());
+    ASSERT(!requiresLayerForOverflowClip());
+    ASSERT(!hasLayer());
+
+    // FIXME: We really would like to enable this ASSERT. However the current updateScrollInfoAfterLayout
+    // is not bullet-proof and it triggers in non-obvious ways under NRWT.
+    // ASSERT(cachedSizeForOverflowClipMap().contains(this));
+    cachedSizeForOverflowClipMap().remove(this);
 }
 
 LayoutUnit RenderBox::minPreferredLogicalWidth() const
@@ -795,9 +850,9 @@ void RenderBox::setOverrideWidth(LayoutUnit width)
 
 void RenderBox::clearOverrideSize()
 {
-    if (hasOverrideHeight())
+    if (gOverrideHeightMap)
         gOverrideHeightMap->remove(this);
-    if (hasOverrideWidth())
+    if (gOverrideWidthMap)
         gOverrideWidthMap->remove(this);
 }
 
@@ -1070,7 +1125,7 @@ void RenderBox::paintFillLayers(const PaintInfo& paintInfo, const Color& c, cons
 void RenderBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, const LayoutRect& rect,
     BackgroundBleedAvoidance bleedAvoidance, CompositeOperator op, RenderObject* backgroundObject)
 {
-    paintFillLayerExtended(paintInfo, c, fillLayer, rect, bleedAvoidance, 0, IntSize(), op, backgroundObject);
+    paintFillLayerExtended(paintInfo, c, fillLayer, rect, bleedAvoidance, 0, LayoutSize(), op, backgroundObject);
 }
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -1133,8 +1188,8 @@ bool RenderBox::repaintLayerRectsForImage(WrappedImagePtr image, const FillLayer
                     }
                     rendererRect = LayoutRect(-layerRenderer->marginLeft(),
                         -layerRenderer->marginTop(),
-                        max(layerRenderer->width() + layerRenderer->marginLeft() + layerRenderer->marginRight() + layerRenderer->borderLeft() + layerRenderer->borderRight(), rw),
-                        max(layerRenderer->height() + layerRenderer->marginTop() + layerRenderer->marginBottom() + layerRenderer->borderTop() + layerRenderer->borderBottom(), rh));
+                        max(layerRenderer->width() + layerRenderer->marginWidth() + layerRenderer->borderLeft() + layerRenderer->borderRight(), rw),
+                        max(layerRenderer->height() + layerRenderer->marginHeight() + layerRenderer->borderTop() + layerRenderer->borderBottom(), rh));
                 } else {
                     layerRenderer = this;
                     rendererRect = borderBoxRect();
@@ -1182,7 +1237,7 @@ bool RenderBox::pushContentsClip(PaintInfo& paintInfo, const LayoutPoint& accumu
         return false;
         
     bool isControlClip = hasControlClip();
-    bool isOverflowClip = hasOverflowClip() && !layer()->isSelfPaintingLayer();
+    bool isOverflowClip = hasOverflowClip() && !hasSelfPaintingLayer();
     
     if (!isControlClip && !isOverflowClip)
         return false;
@@ -1204,7 +1259,7 @@ bool RenderBox::pushContentsClip(PaintInfo& paintInfo, const LayoutPoint& accumu
 
 void RenderBox::popContentsClip(PaintInfo& paintInfo, PaintPhase originalPhase, const LayoutPoint& accumulatedOffset)
 {
-    ASSERT(hasControlClip() || (hasOverflowClip() && !layer()->isSelfPaintingLayer()));
+    ASSERT(hasControlClip() || (hasOverflowClip() && !hasSelfPaintingLayer()));
 
     paintInfo.context->restore();
     if (originalPhase == PaintPhaseOutline) {
@@ -1224,8 +1279,11 @@ LayoutRect RenderBox::overflowClipRect(const LayoutPoint& location, RenderRegion
     clipRect.setSize(clipRect.size() - LayoutSize(borderLeft() + borderRight(), borderTop() + borderBottom()));
 
     // Subtract out scrollbars if we have them.
-    if (layer())
+     if (layer()) {
+        if (style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
+            clipRect.move(layer()->verticalScrollbarWidth(relevancy), 0);
         clipRect.contract(layer()->verticalScrollbarWidth(relevancy), layer()->horizontalScrollbarHeight(relevancy));
+     }
 
     return clipRect;
 }
@@ -1265,7 +1323,7 @@ LayoutUnit RenderBox::shrinkLogicalWidthToAvoidFloats(LayoutUnit childMarginStar
     LayoutUnit logicalTopPosition = logicalTop();
     LayoutUnit adjustedPageOffsetForContainingBlock = offsetFromLogicalTopOfFirstPage - logicalTop();
     if (region) {
-        LayoutUnit offsetFromLogicalTopOfRegion = region ? region->offsetFromLogicalTopOfFirstPage() - offsetFromLogicalTopOfFirstPage : 0;
+        LayoutUnit offsetFromLogicalTopOfRegion = region ? region->offsetFromLogicalTopOfFirstPage() - offsetFromLogicalTopOfFirstPage : zeroLayoutUnit;
         logicalTopPosition = max(logicalTopPosition, logicalTopPosition + offsetFromLogicalTopOfRegion);
         containingBlockRegion = cb->clampToStartAndEndRegions(region);
     }
@@ -1346,8 +1404,7 @@ void RenderBox::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool
     if (RenderView* v = view()) {
         if (v->layoutStateEnabled() && !repaintContainer) {
             LayoutState* layoutState = v->layoutState();
-            LayoutSize offset = layoutState->m_paintOffset;
-            offset.expand(x(), y());
+            LayoutSize offset = layoutState->m_paintOffset + locationOffset();
             if (style()->position() == RelativePosition && layer())
                 offset += layer()->relativePositionOffset();
             transformState.move(offset);
@@ -1474,7 +1531,7 @@ void RenderBox::positionLineBox(InlineBox* box)
             // our object was inline originally, since otherwise it would have ended up underneath
             // the inlines.
             RootInlineBox* root = box->root();
-            root->block()->setStaticInlinePositionForChild(this, root->lineTopWithLeading(), lroundf(box->logicalLeft()));
+            root->block()->setStaticInlinePositionForChild(this, root->lineTopWithLeading(), roundedLayoutUnit(box->logicalLeft()));
             if (style()->hasStaticInlinePosition(box->isHorizontal()))
                 setChildNeedsLayout(true, false); // Just go ahead and mark the positioned object as needing layout, so it will update its position properly.
         } else {
@@ -1597,7 +1654,7 @@ void RenderBox::computeRectForRepaint(RenderBoxModelObject* repaintContainer, La
 #endif
 
     LayoutPoint topLeft = rect.location();
-    topLeft.move(x(), y());
+    topLeft.move(locationOffset());
 
     EPosition position = styleToUse->position();
 
@@ -1607,7 +1664,7 @@ void RenderBox::computeRectForRepaint(RenderBoxModelObject* repaintContainer, La
         fixed = position == FixedPosition;
         rect = layer()->transform()->mapRect(rect);
         topLeft = rect.location();
-        topLeft.move(x(), y());
+        topLeft.move(locationOffset());
     } else if (position == FixedPosition)
         fixed = true;
 
@@ -1642,7 +1699,7 @@ void RenderBox::computeRectForRepaint(RenderBoxModelObject* repaintContainer, La
         topLeft -= containerBox->scrolledContentOffset(); // For overflow:auto/scroll/hidden.
 
         LayoutRect repaintRect(topLeft, rect.size());
-        LayoutRect boxRect(LayoutPoint(), containerBox->layer()->size());
+        LayoutRect boxRect(LayoutPoint(), containerBox->cachedSizeForOverflowClip());
         rect = intersection(repaintRect, boxRect);
         if (rect.isEmpty())
             return;
@@ -1830,7 +1887,8 @@ bool RenderBox::sizesToIntrinsicLogicalWidth(LogicalWidthType widthType) const
     // In the case of columns that have a stretch alignment, we go ahead and layout at the
     // stretched size to avoid an extra layout when applying alignment.
     if (parent()->isFlexibleBox()) {
-        if (!parent()->style()->isColumnFlexDirection())
+        // For multiline columns, we need to apply the flex-line-pack first, so we can't stretch now.
+        if (!parent()->style()->isColumnFlexDirection() || parent()->style()->flexWrap() != FlexWrapNone)
             return true;
         EFlexAlign itemAlign = style()->flexItemAlign();
         if (itemAlign != AlignStretch && (itemAlign != AlignAuto || parent()->style()->flexAlign() != AlignStretch))
@@ -3675,6 +3733,10 @@ void RenderBox::addLayoutOverflow(const LayoutRect& rect)
     if (!m_overflow)
         m_overflow = adoptPtr(new RenderOverflow(clientBox, borderBoxRect()));
     
+    // Lazily allocate our layer as we will need it to hold our scroll information.
+    if (hasOverflowClip())
+        ensureLayer();
+
     m_overflow->addLayoutOverflow(overflowRect);
 }
 
@@ -3884,7 +3946,7 @@ LayoutPoint RenderBox::flipForWritingModeForChild(const RenderBox* child, const
     return LayoutPoint(point.x() + width() - child->width() - (2 * child->x()), point.y());
 }
 
-void RenderBox::flipForWritingMode(IntRect& rect) const
+void RenderBox::flipForWritingMode(LayoutRect& rect) const
 {
     if (!style()->isFlippedBlocksWritingMode())
         return;
@@ -3895,18 +3957,18 @@ void RenderBox::flipForWritingMode(IntRect& rect) const
         rect.setX(width() - rect.maxX());
 }
 
-int RenderBox::flipForWritingMode(int position) const
+LayoutUnit RenderBox::flipForWritingMode(LayoutUnit position) const
 {
     if (!style()->isFlippedBlocksWritingMode())
         return position;
     return logicalHeight() - position;
 }
 
-IntPoint RenderBox::flipForWritingMode(const IntPoint& position) const
+LayoutPoint RenderBox::flipForWritingMode(const LayoutPoint& position) const
 {
     if (!style()->isFlippedBlocksWritingMode())
         return position;
-    return isHorizontalWritingMode() ? IntPoint(position.x(), height() - position.y()) : IntPoint(width() - position.x(), position.y());
+    return isHorizontalWritingMode() ? LayoutPoint(position.x(), height() - position.y()) : LayoutPoint(width() - position.x(), position.y());
 }
 
 LayoutPoint RenderBox::flipForWritingModeIncludingColumns(const LayoutPoint& point) const
@@ -3916,11 +3978,11 @@ LayoutPoint RenderBox::flipForWritingModeIncludingColumns(const LayoutPoint& poi
     return toRenderBlock(this)->flipForWritingModeIncludingColumns(point);
 }
 
-IntSize RenderBox::flipForWritingMode(const IntSize& offset) const
+LayoutSize RenderBox::flipForWritingMode(const LayoutSize& offset) const
 {
     if (!style()->isFlippedBlocksWritingMode())
         return offset;
-    return isHorizontalWritingMode() ? IntSize(offset.width(), height() - offset.height()) : IntSize(width() - offset.width(), offset.height());
+    return isHorizontalWritingMode() ? LayoutSize(offset.width(), height() - offset.height()) : LayoutSize(width() - offset.width(), offset.height());
 }
 
 FloatPoint RenderBox::flipForWritingMode(const FloatPoint& position) const
@@ -3960,4 +4022,11 @@ LayoutSize RenderBox::topLeftLocationOffset() const
     return LayoutSize(rect.x(), rect.y());
 }
 
+bool RenderBox::hasRelativeDimensions() const
+{
+    return style()->height().isPercent() || style()->width().isPercent()
+            || style()->maxHeight().isPercent() || style()->maxWidth().isPercent()
+            || style()->minHeight().isPercent() || style()->minWidth().isPercent();
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderBox.h b/Source/WebCore/rendering/RenderBox.h
index 31ec39a20..2bba71f0b 100644
--- a/Source/WebCore/rendering/RenderBox.h
+++ b/Source/WebCore/rendering/RenderBox.h
@@ -42,6 +42,11 @@ public:
     RenderBox(Node*);
     virtual ~RenderBox();
 
+    virtual bool requiresLayer() const OVERRIDE { return isRoot() || isPositioned() || isRelPositioned() || isTransparent() || requiresLayerForOverflowClip() || hasTransform() || hasMask() || hasReflection() || hasFilter() || style()->specifiesColumns(); }
+    bool requiresLayerForOverflowClip() const;
+
+    bool hasOverflowClipWithLayer() const { return hasOverflowClip() && hasLayer(); }
+
     // Use this with caution! No type checking is done!
     RenderBox* firstChildBox() const;
     RenderBox* lastChildBox() const;
@@ -127,11 +132,13 @@ public:
     LayoutRect frameRect() const { return m_frameRect; }
     void setFrameRect(const LayoutRect& rect) { m_frameRect = rect; }
 
-    LayoutRect borderBoxRect() const { return LayoutRect(0, 0, width(), height()); }
-    virtual LayoutRect borderBoundingBox() const { return borderBoxRect(); } 
+    // FIXME: We shouldn't be returning this as a LayoutRect, since it loses its position and won't properly pixel snap.
+    LayoutRect borderBoxRect() const { return LayoutRect(LayoutPoint(), size()); }
+    IntRect pixelSnappedBorderBoxRect() const { return IntRect(IntPoint(), IntSize(m_frameRect.pixelSnappedWidth(), m_frameRect.pixelSnappedHeight())); }
+    virtual IntRect borderBoundingBox() const { return pixelSnappedBorderBoxRect(); }
 
     // The content area of the box (excludes padding and border).
-    LayoutRect contentBoxRect() const { return LayoutRect(borderLeft() + paddingLeft(), borderTop() + paddingTop(), contentWidth(), contentHeight()); }
+    LayoutRect contentBoxRect(PaddingOptions paddingOption = ExcludeIntrinsicPadding) const { return LayoutRect(borderLeft() + paddingLeft(paddingOption), borderTop() + paddingTop(paddingOption), contentWidth(paddingOption), contentHeight(paddingOption)); }
     // The content box in absolute coords. Ignores transforms.
     LayoutRect absoluteContentBox() const;
     // The content box converted to absolute coords (taking transforms into account).
@@ -139,7 +146,7 @@ public:
 
     // Bounds of the outline box in absolute coords. Respects transforms
     virtual LayoutRect outlineBoundsForRepaint(RenderBoxModelObject* /*repaintContainer*/, LayoutPoint* cachedOffsetToRepaintContainer) const;
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
 
     // Use this with caution! No type checking is done!
     RenderBox* previousSiblingBox() const;
@@ -178,10 +185,10 @@ public:
     
     void updateLayerTransform();
 
-    LayoutUnit contentWidth() const { return clientWidth() - paddingLeft() - paddingRight(); }
-    LayoutUnit contentHeight() const { return clientHeight() - paddingTop() - paddingBottom(); }
-    LayoutUnit contentLogicalWidth() const { return style()->isHorizontalWritingMode() ? contentWidth() : contentHeight(); }
-    LayoutUnit contentLogicalHeight() const { return style()->isHorizontalWritingMode() ? contentHeight() : contentWidth(); }
+    LayoutUnit contentWidth(PaddingOptions paddingOption = ExcludeIntrinsicPadding) const { return clientWidth() - paddingLeft(paddingOption) - paddingRight(paddingOption); }
+    LayoutUnit contentHeight(PaddingOptions paddingOption = ExcludeIntrinsicPadding) const { return clientHeight() - paddingTop(paddingOption) - paddingBottom(paddingOption); }
+    LayoutUnit contentLogicalWidth(PaddingOptions paddingOption = ExcludeIntrinsicPadding) const { return style()->isHorizontalWritingMode() ? contentWidth(paddingOption) : contentHeight(paddingOption); }
+    LayoutUnit contentLogicalHeight(PaddingOptions paddingOption = ExcludeIntrinsicPadding) const { return style()->isHorizontalWritingMode() ? contentHeight(paddingOption) : contentWidth(paddingOption); }
 
     // IE extensions. Used to calculate offsetWidth/Height.  Overridden by inlines (RenderFlow)
     // to return the remaining width on a given line (and the height of a single line).
@@ -246,7 +253,7 @@ public:
     virtual LayoutUnit collapsedMarginBefore() const { return marginBefore(); }
     virtual LayoutUnit collapsedMarginAfter() const { return marginAfter(); }
 
-    virtual void absoluteRects(Vector<LayoutRect>&, const LayoutPoint& accumulatedOffset) const;
+    virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const;
     virtual void absoluteQuads(Vector<FloatQuad>&, bool* wasFixed) const;
     
     LayoutRect reflectionBox() const;
@@ -321,7 +328,7 @@ public:
         return document()->inQuirksMode() && style()->logicalHeight().isAuto() && !isFloatingOrPositioned() && (isRoot() || isBody());
     }
 
-    virtual LayoutSize intrinsicSize() const { return LayoutSize(); }
+    virtual IntSize intrinsicSize() const { return IntSize(); }
     LayoutUnit intrinsicLogicalWidth() const { return style()->isHorizontalWritingMode() ? intrinsicSize().width() : intrinsicSize().height(); }
     LayoutUnit intrinsicLogicalHeight() const { return style()->isHorizontalWritingMode() ? intrinsicSize().height() : intrinsicSize().width(); }
 
@@ -424,11 +431,11 @@ public:
     virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
 
     LayoutPoint flipForWritingModeForChild(const RenderBox* child, const LayoutPoint&) const;
-    int flipForWritingMode(int position) const; // The offset is in the block direction (y for horizontal writing modes, x for vertical writing modes).
-    IntPoint flipForWritingMode(const IntPoint&) const;
+    LayoutUnit flipForWritingMode(LayoutUnit position) const; // The offset is in the block direction (y for horizontal writing modes, x for vertical writing modes).
+    LayoutPoint flipForWritingMode(const LayoutPoint&) const;
     LayoutPoint flipForWritingModeIncludingColumns(const LayoutPoint&) const;
-    IntSize flipForWritingMode(const IntSize&) const;
-    void flipForWritingMode(IntRect&) const;
+    LayoutSize flipForWritingMode(const LayoutSize&) const;
+    void flipForWritingMode(LayoutRect&) const;
     FloatPoint flipForWritingMode(const FloatPoint&) const;
     void flipForWritingMode(FloatRect&) const;
     // These represent your location relative to your container as a physical offset.
@@ -448,6 +455,33 @@ public:
     virtual void computeIntrinsicRatioInformation(FloatSize& /* intrinsicSize */, double& /* intrinsicRatio */, bool& /* isPercentageIntrinsicSize */) const { }
 
     IntSize scrolledContentOffset() const;
+    IntSize cachedSizeForOverflowClip() const;
+    void updateCachedSizeForOverflowClip();
+    void clearCachedSizeForOverflowClip();
+
+    virtual bool hasRelativeDimensions() const;
+
+    bool hasHorizontalLayoutOverflow() const
+    {
+        if (RenderOverflow* overflow = hasRenderOverflow()) {
+            LayoutRect layoutOverflowRect = overflow->layoutOverflowRect();
+            flipForWritingMode(layoutOverflowRect);
+            return layoutOverflowRect.x() < x() || layoutOverflowRect.maxX() > x() + logicalWidth();
+        }
+
+        return false;
+    }
+
+    bool hasVerticalLayoutOverflow() const
+    {
+        if (RenderOverflow* overflow = hasRenderOverflow()) {
+            LayoutRect layoutOverflowRect = overflow->layoutOverflowRect();
+            flipForWritingMode(layoutOverflowRect);
+            return layoutOverflowRect.y() < y() || layoutOverflowRect.maxY() > y() + logicalHeight();
+        }
+
+        return false;
+    }
 
 protected:
     virtual void willBeDestroyed();
@@ -577,6 +611,24 @@ inline RenderBox* RenderBox::lastChildBox() const
     return toRenderBox(lastChild());
 }
 
+inline bool RenderBox::requiresLayerForOverflowClip() const
+{
+    if (!hasOverflowClip())
+        return false;
+
+    // The resizer is attached to the RenderLayer so we need one.
+    if (style()->resize() != RESIZE_NONE)
+        return true;
+
+    // FIXME: overflow: auto could also lazily create its layer but some repainting
+    // issues are arising from that.
+    bool onlyOverflowHidden = style()->overflowX() == OHIDDEN && style()->overflowY() == OHIDDEN;
+
+    // Currently {push|pop}ContentsClip do not handle properly all cases involving a clip
+    // with a border radius so we need a RenderLayer to handle them.
+    return !onlyOverflowHidden || style()->hasBorderRadius();
+}
+
 } // namespace WebCore
 
 #endif // RenderBox_h
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.cpp b/Source/WebCore/rendering/RenderBoxModelObject.cpp
index e3ab32180..c709705bc 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/Source/WebCore/rendering/RenderBoxModelObject.cpp
@@ -48,6 +48,7 @@ using namespace HTMLNames;
 
 bool RenderBoxModelObject::s_wasFloating = false;
 bool RenderBoxModelObject::s_hadLayer = false;
+bool RenderBoxModelObject::s_hadTransform = false;
 bool RenderBoxModelObject::s_layerWasSelfPainting = false;
 
 static const double cInterpolationCutoff = 800. * 800.;
@@ -220,26 +221,23 @@ static ImageQualityController* imageQualityController()
     return gImageQualityController;
 }
 
-void RenderBoxModelObject::setSelectionState(SelectionState s)
+void RenderBoxModelObject::setSelectionState(SelectionState state)
 {
-    if (selectionState() == s)
-        return;
-    
-    if (s == SelectionInside && selectionState() != SelectionNone)
+    if (state == SelectionInside && selectionState() != SelectionNone)
         return;
 
-    if ((s == SelectionStart && selectionState() == SelectionEnd)
-        || (s == SelectionEnd && selectionState() == SelectionStart))
+    if ((state == SelectionStart && selectionState() == SelectionEnd)
+        || (state == SelectionEnd && selectionState() == SelectionStart))
         RenderObject::setSelectionState(SelectionBoth);
     else
-        RenderObject::setSelectionState(s);
-    
-    // FIXME:
-    // We should consider whether it is OK propagating to ancestor RenderInlines.
+        RenderObject::setSelectionState(state);
+
+    // FIXME: We should consider whether it is OK propagating to ancestor RenderInlines.
     // This is a workaround for http://webkit.org/b/32123
-    RenderBlock* cb = containingBlock();
-    if (cb && !cb->isRenderView())
-        cb->setSelectionState(s);
+    // The containing block can be null in case of an orphaned tree.
+    RenderBlock* containingBlock = this->containingBlock();
+    if (containingBlock && !containingBlock->isRenderView())
+        containingBlock->setSelectionState(state);
 }
 
 bool RenderBoxModelObject::shouldPaintAtLowQuality(GraphicsContext* context, Image* image, const void* layer, const LayoutSize& size)
@@ -302,6 +300,7 @@ void RenderBoxModelObject::styleWillChange(StyleDifference diff, const RenderSty
 {
     s_wasFloating = isFloating();
     s_hadLayer = hasLayer();
+    s_hadTransform = hasTransform();
     if (s_hadLayer)
         s_layerWasSelfPainting = layer()->isSelfPaintingLayer();
 
@@ -352,18 +351,28 @@ void RenderBoxModelObject::styleWillChange(StyleDifference diff, const RenderSty
     RenderObject::styleWillChange(diff, newStyle);
 }
 
+void RenderBoxModelObject::ensureLayer()
+{
+    if (m_layer)
+        return;
+
+    m_layer = new (renderArena()) RenderLayer(this);
+    setHasLayer(true);
+    m_layer->insertOnlyThisLayer();
+}
+
 void RenderBoxModelObject::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderObject::styleDidChange(diff, oldStyle);
     updateBoxModelInfoFromStyle();
-    
+
     if (requiresLayer()) {
         if (!layer() && layerCreationAllowedForSubtree()) {
             if (s_wasFloating && isFloating())
                 setChildNeedsLayout(true);
-            m_layer = new (renderArena()) RenderLayer(this);
-            setHasLayer(true);
-            m_layer->insertOnlyThisLayer();
+
+            ensureLayer();
+
             if (parent() && !needsLayout() && containingBlock()) {
                 m_layer->setRepaintStatus(NeedsFullRepaint);
                 // There is only one layer to update, it is not worth using |cachedOffset| since
@@ -377,6 +386,10 @@ void RenderBoxModelObject::styleDidChange(StyleDifference diff, const RenderStyl
         m_layer->removeOnlyThisLayer(); // calls destroyLayer() which clears m_layer
         if (s_wasFloating && isFloating())
             setChildNeedsLayout(true);
+        if (s_hadTransform)
+            setNeedsLayoutAndPrefWidthsRecalc();
+        if (hasOverflowClip())
+            toRenderBox(this)->updateCachedSizeForOverflowClip();
     }
 
     if (layer()) {
@@ -537,7 +550,7 @@ int RenderBoxModelObject::pixelSnappedOffsetHeight() const
     return offsetHeight();
 }
 
-LayoutUnit RenderBoxModelObject::paddingTop(bool) const
+LayoutUnit RenderBoxModelObject::paddingTop(PaddingOptions) const
 {
     LayoutUnit w = 0;
     Length padding = style()->paddingTop();
@@ -546,7 +559,7 @@ LayoutUnit RenderBoxModelObject::paddingTop(bool) const
     return padding.calcMinValue(w);
 }
 
-LayoutUnit RenderBoxModelObject::paddingBottom(bool) const
+LayoutUnit RenderBoxModelObject::paddingBottom(PaddingOptions) const
 {
     LayoutUnit w = 0;
     Length padding = style()->paddingBottom();
@@ -555,7 +568,7 @@ LayoutUnit RenderBoxModelObject::paddingBottom(bool) const
     return padding.calcMinValue(w);
 }
 
-LayoutUnit RenderBoxModelObject::paddingLeft(bool) const
+LayoutUnit RenderBoxModelObject::paddingLeft(PaddingOptions) const
 {
     LayoutUnit w = 0;
     Length padding = style()->paddingLeft();
@@ -564,7 +577,7 @@ LayoutUnit RenderBoxModelObject::paddingLeft(bool) const
     return padding.calcMinValue(w);
 }
 
-LayoutUnit RenderBoxModelObject::paddingRight(bool) const
+LayoutUnit RenderBoxModelObject::paddingRight(PaddingOptions) const
 {
     LayoutUnit w = 0;
     Length padding = style()->paddingRight();
@@ -573,7 +586,7 @@ LayoutUnit RenderBoxModelObject::paddingRight(bool) const
     return padding.calcMinValue(w);
 }
 
-LayoutUnit RenderBoxModelObject::paddingBefore(bool) const
+LayoutUnit RenderBoxModelObject::paddingBefore(PaddingOptions) const
 {
     LayoutUnit w = 0;
     Length padding = style()->paddingBefore();
@@ -582,7 +595,7 @@ LayoutUnit RenderBoxModelObject::paddingBefore(bool) const
     return padding.calcMinValue(w);
 }
 
-LayoutUnit RenderBoxModelObject::paddingAfter(bool) const
+LayoutUnit RenderBoxModelObject::paddingAfter(PaddingOptions) const
 {
     LayoutUnit w = 0;
     Length padding = style()->paddingAfter();
@@ -591,7 +604,7 @@ LayoutUnit RenderBoxModelObject::paddingAfter(bool) const
     return padding.calcMinValue(w);
 }
 
-LayoutUnit RenderBoxModelObject::paddingStart(bool) const
+LayoutUnit RenderBoxModelObject::paddingStart(PaddingOptions) const
 {
     LayoutUnit w = 0;
     Length padding = style()->paddingStart();
@@ -600,7 +613,7 @@ LayoutUnit RenderBoxModelObject::paddingStart(bool) const
     return padding.calcMinValue(w);
 }
 
-LayoutUnit RenderBoxModelObject::paddingEnd(bool) const
+LayoutUnit RenderBoxModelObject::paddingEnd(PaddingOptions) const
 {
     LayoutUnit w = 0;
     Length padding = style()->paddingEnd();
diff --git a/Source/WebCore/rendering/RenderBoxModelObject.h b/Source/WebCore/rendering/RenderBoxModelObject.h
index 11e97c3fd..553584769 100644
--- a/Source/WebCore/rendering/RenderBoxModelObject.h
+++ b/Source/WebCore/rendering/RenderBoxModelObject.h
@@ -40,6 +40,8 @@ enum BackgroundBleedAvoidance {
     BackgroundBleedUseTransparencyLayer
 };
 
+enum PaddingOptions { IncludeIntrinsicPadding, ExcludeIntrinsicPadding };
+
 // This class is the base for all objects that adhere to the CSS box model as described
 // at http://www.w3.org/TR/CSS21/box.html
 
@@ -60,9 +62,9 @@ public:
     virtual LayoutUnit offsetWidth() const = 0;
     virtual LayoutUnit offsetHeight() const = 0;
 
+    int pixelSnappedOffsetLeft() const { return roundToInt(offsetLeft()); }
+    int pixelSnappedOffsetTop() const { return roundToInt(offsetTop()); }
     // FIXME: The implementation for these functions will change once we move to subpixel layout. See bug 60318.
-    int pixelSnappedOffsetLeft() const { return offsetLeft(); }
-    int pixelSnappedOffsetTop() const { return offsetTop(); }
     int pixelSnappedOffsetWidth() const;
     int pixelSnappedOffsetHeight() const;
 
@@ -72,29 +74,29 @@ public:
 
     bool hasSelfPaintingLayer() const;
     RenderLayer* layer() const { return m_layer; }
-    virtual bool requiresLayer() const { return isRoot() || isPositioned() || isRelPositioned() || isTransparent() || hasOverflowClip() || hasTransform() || hasMask() || hasReflection() || hasFilter() || style()->specifiesColumns(); }
+    virtual bool requiresLayer() const { return isRoot() || isPositioned() || isRelPositioned() || isTransparent() || hasTransform() || hasMask() || hasReflection() || hasFilter() || style()->specifiesColumns(); }
 
     // This will work on inlines to return the bounding box of all of the lines' border boxes.
     virtual LayoutRect borderBoundingBox() const = 0;
 
     // Virtual since table cells override
-    virtual LayoutUnit paddingTop(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingBottom(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingLeft(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingRight(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingBefore(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingAfter(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingStart(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingEnd(bool includeIntrinsicPadding = true) const;
-
-    virtual LayoutUnit borderTop() const { return style()->borderTopWidth(); }
-    virtual LayoutUnit borderBottom() const { return style()->borderBottomWidth(); }
-    virtual LayoutUnit borderLeft() const { return style()->borderLeftWidth(); }
-    virtual LayoutUnit borderRight() const { return style()->borderRightWidth(); }
-    virtual LayoutUnit borderBefore() const { return style()->borderBeforeWidth(); }
-    virtual LayoutUnit borderAfter() const { return style()->borderAfterWidth(); }
-    virtual LayoutUnit borderStart() const { return style()->borderStartWidth(); }
-    virtual LayoutUnit borderEnd() const { return style()->borderEndWidth(); }
+    virtual LayoutUnit paddingTop(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingBottom(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingLeft(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingRight(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingBefore(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingAfter(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingStart(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingEnd(PaddingOptions = IncludeIntrinsicPadding) const;
+
+    virtual int borderTop() const { return style()->borderTopWidth(); }
+    virtual int borderBottom() const { return style()->borderBottomWidth(); }
+    virtual int borderLeft() const { return style()->borderLeftWidth(); }
+    virtual int borderRight() const { return style()->borderRightWidth(); }
+    virtual int borderBefore() const { return style()->borderBeforeWidth(); }
+    virtual int borderAfter() const { return style()->borderAfterWidth(); }
+    virtual int borderStart() const { return style()->borderStartWidth(); }
+    virtual int borderEnd() const { return style()->borderEndWidth(); }
 
     LayoutUnit borderAndPaddingHeight() const { return borderTop() + borderBottom() + paddingTop() + paddingBottom(); }
     LayoutUnit borderAndPaddingWidth() const { return borderLeft() + borderRight() + paddingLeft() + paddingRight(); }
@@ -114,6 +116,8 @@ public:
     virtual LayoutUnit marginAfter() const = 0;
     virtual LayoutUnit marginStart() const = 0;
     virtual LayoutUnit marginEnd() const = 0;
+    LayoutUnit marginHeight() const { return marginTop() + marginBottom(); }
+    LayoutUnit marginWidth() const { return marginLeft() + marginRight(); }
 
     bool hasInlineDirectionBordersPaddingOrMargin() const { return hasInlineDirectionBordersOrPadding() || marginStart()|| marginEnd(); }
     bool hasInlineDirectionBordersOrPadding() const { return borderStart() || borderEnd() || paddingStart()|| paddingEnd(); }
@@ -207,6 +211,8 @@ public:
     RenderObject* firstLetterRemainingText() const;
     void setFirstLetterRemainingText(RenderObject*);
 
+    void ensureLayer();
+
 private:
     virtual bool isBoxModelObject() const { return true; }
 
@@ -238,6 +244,7 @@ private:
     // Used to store state between styleWillChange and styleDidChange
     static bool s_wasFloating;
     static bool s_hadLayer;
+    static bool s_hadTransform;
     static bool s_layerWasSelfPainting;
 };
 
diff --git a/Source/WebCore/rendering/RenderButton.cpp b/Source/WebCore/rendering/RenderButton.cpp
index dd23130a6..380c5da35 100644
--- a/Source/WebCore/rendering/RenderButton.cpp
+++ b/Source/WebCore/rendering/RenderButton.cpp
@@ -141,6 +141,14 @@ String RenderButton::text() const
     return m_buttonText ? m_buttonText->text() : 0;
 }
 
+bool RenderButton::canHaveGeneratedChildren() const
+{
+    // Input elements can't have generated children, but button elements can. We'll
+    // write the code assuming any other button types that might emerge in the future
+    // can also have children.
+    return !node()->hasTagName(inputTag);
+}
+
 void RenderButton::updateBeforeAfterContent(PseudoId type)
 {
     if (m_inner)
@@ -149,11 +157,6 @@ void RenderButton::updateBeforeAfterContent(PseudoId type)
         children()->updateBeforeAfterContent(this, type);
 }
 
-RenderText* RenderButton::buttonText() const
-{
-    return m_buttonText;
-}
-
 LayoutRect RenderButton::controlClipRect(const LayoutPoint& additionalOffset) const
 {
     // Clip to the padding box to at least give content the extra padding space.
diff --git a/Source/WebCore/rendering/RenderButton.h b/Source/WebCore/rendering/RenderButton.h
index c851abc7d..fb94af988 100644
--- a/Source/WebCore/rendering/RenderButton.h
+++ b/Source/WebCore/rendering/RenderButton.h
@@ -50,7 +50,7 @@ public:
 
     virtual void updateBeforeAfterContent(PseudoId);
 
-    virtual RenderText* buttonText() const OVERRIDE;
+    virtual bool canHaveGeneratedChildren() const OVERRIDE;
     virtual bool hasControlClip() const { return true; }
     virtual LayoutRect controlClipRect(const LayoutPoint&) const;
 
diff --git a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
index 4e88d5c6b..add01a0c2 100644
--- a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.cpp
@@ -226,7 +226,7 @@ void RenderDeprecatedFlexibleBox::layoutBlock(bool relayoutChildren, LayoutUnit
         return;
 
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
-    LayoutStateMaintainer statePusher(view(), this, LayoutSize(x(), y()), hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
+    LayoutStateMaintainer statePusher(view(), this, locationOffset(), hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
 
     if (inRenderFlowThread()) {
         // Regions changing widths can force us to relayout our children.
@@ -305,8 +305,7 @@ void RenderDeprecatedFlexibleBox::layoutBlock(bool relayoutChildren, LayoutUnit
 
     // Update our scrollbars if we're overflow:auto/scroll/hidden now that we know if
     // we overflow or not.
-    if (hasOverflowClip())
-        layer()->updateScrollInfoAfterLayout();
+    updateScrollInfoAfterLayout();
 
     // Repaint with our new bounds if they are different from our old bounds.
     repainter.repaintAfterLayout();
@@ -395,7 +394,7 @@ void RenderDeprecatedFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
                 if (ascent == -1)
                     ascent = child->height() + child->marginBottom();
                 ascent += child->marginTop();
-                LayoutUnit descent = (child->marginTop() + child->height() + child->marginBottom()) - ascent;
+                LayoutUnit descent = (child->height() + child->marginHeight()) - ascent;
 
                 // Update our maximum ascent.
                 maxAscent = max(maxAscent, ascent);
@@ -407,7 +406,7 @@ void RenderDeprecatedFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
                 setHeight(max(yPos + maxAscent + maxDescent, height()));
             }
             else
-                setHeight(max(height(), yPos + child->marginTop() + child->height() + child->marginBottom()));
+                setHeight(max(height(), yPos + child->height() + child->marginHeight()));
         }
 
         if (!iterator.first() && hasLineIfEmpty())
@@ -461,7 +460,7 @@ void RenderDeprecatedFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             LayoutUnit childY = yPos;
             switch (style()->boxAlign()) {
                 case BCENTER:
-                    childY += child->marginTop() + max<LayoutUnit>(0, (contentHeight() - (child->height() + child->marginTop() + child->marginBottom())) / 2);
+                    childY += child->marginTop() + max<LayoutUnit>(0, (contentHeight() - (child->height() + child->marginHeight())) / 2);
                     break;
                 case BBASELINE: {
                     LayoutUnit ascent = child->firstLineBoxBaseline();
@@ -700,7 +699,7 @@ void RenderDeprecatedFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             switch (style()->boxAlign()) {
                 case BCENTER:
                 case BBASELINE: // Baseline just maps to center for vertical boxes
-                    childX += child->marginLeft() + max<LayoutUnit>(0, (contentWidth() - (child->width() + child->marginLeft() + child->marginRight())) / 2);
+                    childX += child->marginLeft() + max<LayoutUnit>(0, (contentWidth() - (child->width() + child->marginWidth())) / 2);
                     break;
                 case BEND:
                     if (!style()->isLeftToRightDirection())
diff --git a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h
index 101bedbe3..9a42bd401 100644
--- a/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h
+++ b/Source/WebCore/rendering/RenderDeprecatedFlexibleBox.h
@@ -49,7 +49,7 @@ public:
     virtual bool isDeprecatedFlexibleBox() const { return true; }
     virtual bool isFlexingChildren() const { return m_flexingChildren; }
     virtual bool isStretchingChildren() const { return m_stretchingChildren; }
-    virtual RenderText* buttonText() const { return 0; }
+    virtual bool canHaveGeneratedChildren() const { return true; }
 
     void placeChild(RenderBox* child, const LayoutPoint& location);
 
diff --git a/Source/WebCore/rendering/RenderDetails.cpp b/Source/WebCore/rendering/RenderDetails.cpp
deleted file mode 100644
index 39882b197..000000000
--- a/Source/WebCore/rendering/RenderDetails.cpp
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "RenderDetails.h"
-
-#if ENABLE(DETAILS)
-
-#include "CSSStyleSelector.h"
-#include "HTMLDetailsElement.h"
-#include "HTMLNames.h"
-
-namespace WebCore {
-
-using namespace HTMLNames;
-
-RenderDetails::RenderDetails(Node* node)
-    : RenderBlock(node)
-{
-}
-
-void RenderDetails::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
-{
-    RenderBlock::styleDidChange(diff, oldStyle);
-    // Ensure that if we ended up being inline that we set our replaced flag
-    // so that we're treated like an inline-block.
-    setReplaced(isInline());
-}
-
-bool RenderDetails::isOpen() const
-{
-    return node() && node()->isElementNode() ? !static_cast<Element*>(node())->getAttribute(openAttr).isNull() : false;
-}
-
-} // namespace WebCore
-
-#endif
diff --git a/Source/WebCore/rendering/RenderDetails.h b/Source/WebCore/rendering/RenderDetails.h
deleted file mode 100644
index b89cedc06..000000000
--- a/Source/WebCore/rendering/RenderDetails.h
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef RenderDetails_h
-#define RenderDetails_h
-
-#if ENABLE(DETAILS)
-
-#include "RenderBlock.h"
-#include "RenderObject.h"
-
-namespace WebCore {
-
-class RenderDetails : public RenderBlock {
-public:
-    explicit RenderDetails(Node*);
-
-    bool isOpen() const;
-
-private:
-    virtual const char* renderName() const { return "RenderDetails"; }
-    virtual bool isDetails() const { return true; }
-    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
-};
-
-inline RenderDetails* toRenderDetails(RenderObject* object)
-{
-    ASSERT(!object || object->isDetails());
-    return static_cast<RenderDetails*>(object);
-}
-
-// This will catch anyone doing an unnecessary cast.
-void toRenderDetails(const RenderDetails*);
-
-} // namespace WebCore
-
-#endif
-
-#endif // RenderDetails_h
diff --git a/Source/WebCore/rendering/RenderDetailsMarker.cpp b/Source/WebCore/rendering/RenderDetailsMarker.cpp
index c1468b543..bcffaac1c 100644
--- a/Source/WebCore/rendering/RenderDetailsMarker.cpp
+++ b/Source/WebCore/rendering/RenderDetailsMarker.cpp
@@ -23,10 +23,10 @@
 
 #if ENABLE(DETAILS)
 
+#include "Element.h"
 #include "GraphicsContext.h"
 #include "HTMLNames.h"
 #include "PaintInfo.h"
-#include "RenderDetails.h"
 
 namespace WebCore {
 
@@ -37,13 +37,6 @@ RenderDetailsMarker::RenderDetailsMarker(Node* node)
 {
 }
 
-bool RenderDetailsMarker::isOpen() const
-{
-    if (RenderDetails* owner = details())
-        return owner->isOpen();
-    return false;
-}
-
 static Path createPath(const FloatPoint* path)
 {
     Path result;
@@ -144,14 +137,14 @@ void RenderDetailsMarker::paint(PaintInfo& paintInfo, const LayoutPoint& paintOf
     paintInfo.context->fillPath(getPath(boxOrigin));
 }
 
-RenderDetails* RenderDetailsMarker::details() const
+bool RenderDetailsMarker::isOpen() const
 {
     for (RenderObject* renderer = parent(); renderer; renderer = renderer->parent()) {
-        if (renderer->isDetails())
-            return toRenderDetails(renderer);
+        if (renderer->node() && renderer->node()->hasTagName(detailsTag))
+            return !toElement(renderer->node())->getAttribute(openAttr).isNull();
     }
 
-    return 0;
+    return false;
 }
 
 }
diff --git a/Source/WebCore/rendering/RenderDetailsMarker.h b/Source/WebCore/rendering/RenderDetailsMarker.h
index 2b41c39f0..3afac553b 100644
--- a/Source/WebCore/rendering/RenderDetailsMarker.h
+++ b/Source/WebCore/rendering/RenderDetailsMarker.h
@@ -27,8 +27,6 @@
 
 namespace WebCore {
 
-class RenderDetails;
-
 class RenderDetailsMarker : public RenderBlock {
 public:
     RenderDetailsMarker(Node*);
@@ -45,7 +43,6 @@ private:
     bool isOpen() const;
     Path getCanonicalPath() const;
     Path getPath(const IntPoint& origin) const;
-    RenderDetails* details() const;
 };
 
 inline RenderDetailsMarker* toRenderDetailsMarker(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderEmbeddedObject.cpp b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
index bdafd62d5..c239db277 100644
--- a/Source/WebCore/rendering/RenderEmbeddedObject.cpp
+++ b/Source/WebCore/rendering/RenderEmbeddedObject.cpp
@@ -139,11 +139,20 @@ void RenderEmbeddedObject::setMissingPluginIndicatorIsPressed(bool pressed)
 
 void RenderEmbeddedObject::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
 {
+    Page* page = 0;
+    if (Frame* frame = this->frame())
+        page = frame->page();
+
     if (pluginCrashedOrWasMissing()) {
+        if (page && paintInfo.phase == PaintPhaseForeground)
+            page->addRelevantUnpaintedObject(this, visualOverflowRect());
         RenderReplaced::paint(paintInfo, paintOffset);
         return;
     }
-    
+
+    if (page && paintInfo.phase == PaintPhaseForeground)
+        page->addRelevantRepaintedObject(this, visualOverflowRect());
+
     RenderPart::paint(paintInfo, paintOffset);
 }
 
@@ -167,11 +176,6 @@ void RenderEmbeddedObject::paintReplaced(PaintInfo& paintInfo, const LayoutPoint
     float textWidth;
     if (!getReplacementTextGeometry(paintOffset, contentRect, path, replacementTextRect, font, run, textWidth))
         return;
-
-    if (Frame* frame = this->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(this, paintInfo.rect);
-    }
     
     GraphicsContextStateSaver stateSaver(*context);
     context->clip(contentRect);
diff --git a/Source/WebCore/rendering/RenderFieldset.cpp b/Source/WebCore/rendering/RenderFieldset.cpp
index 1d18bb9df..3b70e6a11 100644
--- a/Source/WebCore/rendering/RenderFieldset.cpp
+++ b/Source/WebCore/rendering/RenderFieldset.cpp
@@ -158,7 +158,7 @@ void RenderFieldset::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint
     // https://bugs.webkit.org/show_bug.cgi?id=47236
     if (style()->isHorizontalWritingMode()) {
         LayoutUnit clipTop = paintRect.y();
-        LayoutUnit clipHeight = max(static_cast<LayoutUnit>(style()->borderTopWidth()), legend->height());
+        LayoutUnit clipHeight = max(static_cast<LayoutUnit>(style()->borderTopWidth()), legend->height() - ((legend->height() - borderTop()) / 2));
         graphicsContext->clipOut(LayoutRect(paintRect.x() + legend->x(), clipTop, legend->width(), clipHeight));
     } else {
         LayoutUnit clipLeft = paintRect.x();
diff --git a/Source/WebCore/rendering/RenderFileUploadControl.cpp b/Source/WebCore/rendering/RenderFileUploadControl.cpp
index a927f3fae..74e6f7de7 100644
--- a/Source/WebCore/rendering/RenderFileUploadControl.cpp
+++ b/Source/WebCore/rendering/RenderFileUploadControl.cpp
@@ -32,7 +32,7 @@
 #include "RenderText.h"
 #include "RenderTheme.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "TextRun.h"
 #include "VisiblePosition.h"
 #include <math.h>
@@ -220,7 +220,7 @@ HTMLInputElement* RenderFileUploadControl::uploadButton() const
 
     ASSERT(input->hasShadowRoot());
 
-    Node* buttonNode = input->shadowRootList()->oldestShadowRoot()->firstChild();
+    Node* buttonNode = input->shadowTree()->oldestShadowRoot()->firstChild();
     return buttonNode && buttonNode->isHTMLElement() && buttonNode->hasTagName(inputTag) ? static_cast<HTMLInputElement*>(buttonNode) : 0;
 }
 
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.cpp b/Source/WebCore/rendering/RenderFlexibleBox.cpp
index f2f993d7b..e9dd8381d 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/Source/WebCore/rendering/RenderFlexibleBox.cpp
@@ -34,6 +34,7 @@
 #include "LayoutRepainter.h"
 #include "RenderLayer.h"
 #include "RenderView.h"
+#include <limits>
 
 namespace WebCore {
 
@@ -56,8 +57,11 @@ public:
     {
         copyToVector(flexOrderValues, m_orderValues);
         std::sort(m_orderValues.begin(), m_orderValues.end());
+        first();
     }
 
+    RenderBox* currentChild() { return m_currentChild; }
+
     RenderBox* first()
     {
         reset();
@@ -98,6 +102,40 @@ private:
     Vector<int>::const_iterator m_orderValuesIterator;
 };
 
+struct RenderFlexibleBox::WrapReverseContext {
+    explicit WrapReverseContext(EFlexWrap flexWrap)
+        : isWrapReverse(flexWrap == FlexWrapReverse)
+    {
+    }
+
+    void addCrossAxisOffset(LayoutUnit offset)
+    {
+        if (!isWrapReverse)
+            return;
+        crossAxisOffsets.append(offset);
+    }
+
+    void addNumberOfChildrenOnLine(size_t numberOfChildren)
+    {
+        if (!isWrapReverse)
+            return;
+        childrenPerLine.append(numberOfChildren);
+    }
+
+    LayoutUnit lineCrossAxisDelta(size_t line, LayoutUnit crossAxisContentExtent) const
+    {
+        ASSERT(line + 1 < crossAxisOffsets.size());
+        LayoutUnit lineHeight = crossAxisOffsets[line + 1] - crossAxisOffsets[line];
+        LayoutUnit originalOffset = crossAxisOffsets[line] - crossAxisOffsets[0];
+        LayoutUnit newOffset = crossAxisContentExtent - originalOffset - lineHeight;
+        return newOffset - originalOffset;
+    }
+
+    WTF::Vector<LayoutUnit> crossAxisOffsets;
+    WTF::Vector<size_t> childrenPerLine;
+    bool isWrapReverse;
+};
+
 
 RenderFlexibleBox::RenderFlexibleBox(Node* node)
     : RenderBlock(node)
@@ -200,7 +238,7 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren, int, BlockLayoutPass)
         return;
 
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
-    LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
+    LayoutStateMaintainer statePusher(view(), this, locationOffset(), hasTransform() || hasReflection() || style()->isFlippedBlocksWritingMode());
 
     if (inRenderFlowThread()) {
         // Regions changing widths can force us to relayout our children.
@@ -246,8 +284,7 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren, int, BlockLayoutPass)
 
     // Update our scroll information if we're overflow:auto/scroll/hidden now that we know if
     // we overflow or not.
-    if (hasOverflowClip())
-        layer()->updateScrollInfoAfterLayout();
+    updateScrollInfoAfterLayout();
 
     repainter.repaintAfterLayout();
 
@@ -279,6 +316,11 @@ bool RenderFlexibleBox::isLeftToRightFlow() const
     return style()->isLeftToRightDirection() ^ (style()->flexDirection() == FlowRowReverse);
 }
 
+bool RenderFlexibleBox::isMultiline() const
+{
+    return style()->flexWrap() != FlexWrapNone;
+}
+
 Length RenderFlexibleBox::mainAxisLengthForChild(RenderBox* child) const
 {
     return isHorizontalFlow() ? child->style()->width() : child->style()->height();
@@ -375,9 +417,20 @@ LayoutUnit RenderFlexibleBox::flowAwareBorderBefore() const
     return borderTop();
 }
 
-LayoutUnit RenderFlexibleBox::crossAxisBorderAndPaddingExtent() const
+LayoutUnit RenderFlexibleBox::flowAwareBorderAfter() const
 {
-    return isHorizontalFlow() ? borderAndPaddingHeight() : borderAndPaddingWidth();
+    switch (transformedWritingMode()) {
+    case TopToBottomWritingMode:
+        return borderBottom();
+    case BottomToTopWritingMode:
+        return borderTop();
+    case LeftToRightWritingMode:
+        return borderRight();
+    case RightToLeftWritingMode:
+        return borderLeft();
+    }
+    ASSERT_NOT_REACHED();
+    return borderTop();
 }
 
 LayoutUnit RenderFlexibleBox::flowAwarePaddingStart() const
@@ -410,6 +463,22 @@ LayoutUnit RenderFlexibleBox::flowAwarePaddingBefore() const
     return paddingTop();
 }
 
+LayoutUnit RenderFlexibleBox::flowAwarePaddingAfter() const
+{
+    switch (transformedWritingMode()) {
+    case TopToBottomWritingMode:
+        return paddingBottom();
+    case BottomToTopWritingMode:
+        return paddingTop();
+    case LeftToRightWritingMode:
+        return paddingRight();
+    case RightToLeftWritingMode:
+        return paddingLeft();
+    }
+    ASSERT_NOT_REACHED();
+    return paddingTop();
+}
+
 LayoutUnit RenderFlexibleBox::flowAwareMarginStartForChild(RenderBox* child) const
 {
     if (isHorizontalFlow())
@@ -458,7 +527,7 @@ LayoutUnit RenderFlexibleBox::flowAwareMarginAfterForChild(RenderBox* child) con
 
 LayoutUnit RenderFlexibleBox::crossAxisMarginExtentForChild(RenderBox* child) const
 {
-    return isHorizontalFlow() ? child->marginTop() + child->marginBottom() : child->marginLeft() + child->marginRight();
+    return isHorizontalFlow() ? child->marginHeight() : child->marginWidth();
 }
 
 LayoutUnit RenderFlexibleBox::crossAxisScrollbarExtent() const
@@ -509,17 +578,34 @@ void RenderFlexibleBox::layoutFlexItems(bool relayoutChildren)
     float totalPositiveFlexibility;
     float totalNegativeFlexibility;
     FlexOrderIterator flexIterator(this, flexOrderValues);
-    computeFlexOrder(flexIterator, orderedChildren, preferredMainAxisExtent, totalPositiveFlexibility, totalNegativeFlexibility);
 
-    LayoutUnit availableFreeSpace = mainAxisContentExtent() - preferredMainAxisExtent;
-    InflexibleFlexItemSize inflexibleItems;
-    WTF::Vector<LayoutUnit> childSizes;
-    while (!runFreeSpaceAllocationAlgorithm(orderedChildren, availableFreeSpace, totalPositiveFlexibility, totalNegativeFlexibility, inflexibleItems, childSizes)) {
-        ASSERT(totalPositiveFlexibility >= 0 && totalNegativeFlexibility >= 0);
-        ASSERT(inflexibleItems.size() > 0);
+    // For wrap-reverse, we need to layout as wrap, then reverse the lines. The next two arrays
+    // are some extra information so it's possible to reverse the lines.
+    WrapReverseContext wrapReverseContext(style()->flexWrap());
+
+    LayoutUnit crossAxisOffset = flowAwareBorderBefore() + flowAwarePaddingBefore();
+    LayoutUnit mainAxisFlexibleSpace = mainAxisContentExtent();
+    while (computeNextFlexLine(flexIterator, orderedChildren, preferredMainAxisExtent, totalPositiveFlexibility, totalNegativeFlexibility)) {
+        LayoutUnit availableFreeSpace = mainAxisFlexibleSpace - preferredMainAxisExtent;
+        InflexibleFlexItemSize inflexibleItems;
+        WTF::Vector<LayoutUnit> childSizes;
+        while (!runFreeSpaceAllocationAlgorithm(orderedChildren, availableFreeSpace, totalPositiveFlexibility, totalNegativeFlexibility, inflexibleItems, childSizes)) {
+            ASSERT(totalPositiveFlexibility >= 0 && totalNegativeFlexibility >= 0);
+            ASSERT(inflexibleItems.size() > 0);
+        }
+
+        wrapReverseContext.addNumberOfChildrenOnLine(orderedChildren.size());
+        wrapReverseContext.addCrossAxisOffset(crossAxisOffset);
+        layoutAndPlaceChildren(crossAxisOffset, orderedChildren, childSizes, availableFreeSpace);
+    }
+
+    if (wrapReverseContext.isWrapReverse) {
+        wrapReverseContext.addCrossAxisOffset(crossAxisOffset);
+        flipForWrapReverse(flexIterator, wrapReverseContext);
     }
 
-    layoutAndPlaceChildren(orderedChildren, childSizes, availableFreeSpace);
+    // direction:rtl + flex-direction:column means the cross-axis direction is flipped.
+    flipForRightToLeftColumn(flexIterator);
 }
 
 float RenderFlexibleBox::positiveFlexForChild(RenderBox* child) const
@@ -532,14 +618,13 @@ float RenderFlexibleBox::negativeFlexForChild(RenderBox* child) const
     return isHorizontalFlow() ? child->style()->flexboxWidthNegativeFlex() : child->style()->flexboxHeightNegativeFlex();
 }
 
-LayoutUnit RenderFlexibleBox::availableAlignmentSpaceForChild(RenderBox* child)
+LayoutUnit RenderFlexibleBox::availableAlignmentSpaceForChild(LayoutUnit lineCrossAxisExtent, RenderBox* child)
 {
-    LayoutUnit crossContentExtent = crossAxisContentExtent();
     LayoutUnit childCrossExtent = crossAxisMarginExtentForChild(child) + crossAxisExtentForChild(child);
-    return crossContentExtent - childCrossExtent;
+    return lineCrossAxisExtent - childCrossExtent;
 }
 
-LayoutUnit RenderFlexibleBox::marginBoxAscent(RenderBox* child)
+LayoutUnit RenderFlexibleBox::marginBoxAscentForChild(RenderBox* child)
 {
     LayoutUnit ascent = child->firstLineBoxBaseline();
     if (ascent == -1)
@@ -576,28 +661,35 @@ void RenderFlexibleBox::computeMainAxisPreferredSizes(bool relayoutChildren, Fle
     }
 }
 
-void RenderFlexibleBox::computeFlexOrder(FlexOrderIterator& iterator, OrderedFlexItemList& orderedChildren, LayoutUnit& preferredMainAxisExtent, float& totalPositiveFlexibility, float& totalNegativeFlexibility)
+bool RenderFlexibleBox::computeNextFlexLine(FlexOrderIterator& iterator, OrderedFlexItemList& orderedChildren, LayoutUnit& preferredMainAxisExtent, float& totalPositiveFlexibility, float& totalNegativeFlexibility)
 {
     orderedChildren.clear();
     preferredMainAxisExtent = 0;
     totalPositiveFlexibility = totalNegativeFlexibility = 0;
-    for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
-        orderedChildren.append(child);
-        if (child->isPositioned())
+
+    if (!iterator.currentChild())
+        return false;
+
+    for (RenderBox* child = iterator.currentChild(); child; child = iterator.next()) {
+        if (child->isPositioned()) {
+            orderedChildren.append(child);
             continue;
+        }
 
         LayoutUnit childMainAxisExtent = mainAxisBorderAndPaddingExtentForChild(child) + preferredMainAxisContentExtentForChild(child);
         if (isHorizontalFlow())
-            childMainAxisExtent += child->marginLeft() + child->marginRight();
+            childMainAxisExtent += child->marginWidth();
         else
-            childMainAxisExtent += child->marginTop() + child->marginBottom();
+            childMainAxisExtent += child->marginHeight();
 
-        // FIXME: When implementing multiline, we would return here if adding
-        // the child's main axis extent would cause us to overflow.
+        if (isMultiline() && preferredMainAxisExtent + childMainAxisExtent > mainAxisContentExtent() && orderedChildren.size() > 0)
+            break;
+        orderedChildren.append(child);
         preferredMainAxisExtent += childMainAxisExtent;
         totalPositiveFlexibility += positiveFlexForChild(child);
         totalNegativeFlexibility += negativeFlexForChild(child);
     }
+    return true;
 }
 
 // Returns true if we successfully ran the algorithm and sized the flex items.
@@ -707,20 +799,28 @@ static EFlexAlign flexAlignForChild(RenderBox* child)
 {
     EFlexAlign align = child->style()->flexItemAlign();
     if (align == AlignAuto)
-        return child->parent()->style()->flexAlign();
+        align = child->parent()->style()->flexAlign();
+
+    if (child->parent()->style()->flexWrap() == FlexWrapReverse) {
+        if (align == AlignStart)
+            align = AlignEnd;
+        else if (align == AlignEnd)
+            align = AlignStart;
+    }
+
     return align;
 }
 
-void RenderFlexibleBox::layoutAndPlaceChildren(const OrderedFlexItemList& children, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace)
+void RenderFlexibleBox::layoutAndPlaceChildren(LayoutUnit& crossAxisOffset, const OrderedFlexItemList& children, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace)
 {
     LayoutUnit mainAxisOffset = flowAwareBorderStart() + flowAwarePaddingStart();
     mainAxisOffset += initialPackingOffset(availableFreeSpace, style()->flexPack(), childSizes.size());
     if (style()->flexDirection() == FlowRowReverse)
         mainAxisOffset += isHorizontalFlow() ? verticalScrollbarWidth() : horizontalScrollbarHeight();
 
-    LayoutUnit crossAxisOffset = flowAwareBorderBefore() + flowAwarePaddingBefore();
     LayoutUnit totalMainExtent = mainAxisExtent();
     LayoutUnit maxAscent = 0, maxDescent = 0; // Used when flex-align: baseline.
+    LayoutUnit maxChildCrossAxisExtent = 0;
     bool shouldFlipMainAxis = !isColumnFlow() && !isLeftToRightFlow();
     for (size_t i = 0; i < children.size(); ++i) {
         RenderBox* child = children[i];
@@ -734,19 +834,20 @@ void RenderFlexibleBox::layoutAndPlaceChildren(const OrderedFlexItemList& childr
         child->setChildNeedsLayout(true);
         child->layoutIfNeeded();
 
-        LayoutUnit childCrossAxisExtent;
+        LayoutUnit childCrossAxisMarginBoxExtent;
         if (flexAlignForChild(child) == AlignBaseline) {
-            LayoutUnit ascent = marginBoxAscent(child);
+            LayoutUnit ascent = marginBoxAscentForChild(child);
             LayoutUnit descent = (crossAxisMarginExtentForChild(child) + crossAxisExtentForChild(child)) - ascent;
 
             maxAscent = std::max(maxAscent, ascent);
             maxDescent = std::max(maxDescent, descent);
 
-            childCrossAxisExtent = maxAscent + maxDescent;
+            childCrossAxisMarginBoxExtent = maxAscent + maxDescent;
         } else
-            childCrossAxisExtent =  crossAxisExtentForChild(child);
+            childCrossAxisMarginBoxExtent = crossAxisExtentForChild(child) + crossAxisMarginExtentForChild(child);
         if (crossAxisLength().isAuto())
-            setCrossAxisExtent(std::max(crossAxisExtent(), crossAxisBorderAndPaddingExtent() + crossAxisMarginExtentForChild(child) + childCrossAxisExtent + crossAxisScrollbarExtent()));
+            setCrossAxisExtent(std::max(crossAxisExtent(), crossAxisOffset + flowAwareBorderAfter() + flowAwarePaddingAfter() + childCrossAxisMarginBoxExtent + crossAxisScrollbarExtent()));
+        maxChildCrossAxisExtent = std::max(maxChildCrossAxisExtent, childCrossAxisMarginBoxExtent);
 
         mainAxisOffset += flowAwareMarginStartForChild(child);
 
@@ -759,22 +860,25 @@ void RenderFlexibleBox::layoutAndPlaceChildren(const OrderedFlexItemList& childr
         mainAxisOffset += childMainExtent + flowAwareMarginEndForChild(child);
 
         mainAxisOffset += packingSpaceBetweenChildren(availableFreeSpace, style()->flexPack(), childSizes.size());
-
-        if (isColumnFlow())
-            setLogicalHeight(mainAxisOffset + flowAwareBorderEnd() + flowAwarePaddingEnd() + scrollbarLogicalHeight());
     }
 
+    if (isColumnFlow())
+        setLogicalHeight(mainAxisOffset + flowAwareBorderEnd() + flowAwarePaddingEnd() + scrollbarLogicalHeight());
+
     if (style()->flexDirection() == FlowColumnReverse) {
         // We have to do an extra pass for column-reverse to reposition the flex items since the start depends
         // on the height of the flexbox, which we only know after we've positioned all the flex items.
         computeLogicalHeight();
-        layoutColumnReverse(children, childSizes, availableFreeSpace);
+        layoutColumnReverse(children, childSizes, crossAxisOffset, availableFreeSpace);
     }
 
-    alignChildren(children, maxAscent);
+    LayoutUnit lineCrossAxisExtent = isMultiline() ? maxChildCrossAxisExtent : crossAxisContentExtent();
+    alignChildren(children, lineCrossAxisExtent, maxAscent);
+
+    crossAxisOffset += lineCrossAxisExtent;
 }
 
-void RenderFlexibleBox::layoutColumnReverse(const OrderedFlexItemList& children, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace)
+void RenderFlexibleBox::layoutColumnReverse(const OrderedFlexItemList& children, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit crossAxisOffset, LayoutUnit availableFreeSpace)
 {
     // This is similar to the logic in layoutAndPlaceChildren, except we place the children
     // starting from the end of the flexbox. We also don't need to layout anything since we're
@@ -783,7 +887,6 @@ void RenderFlexibleBox::layoutColumnReverse(const OrderedFlexItemList& children,
     mainAxisOffset -= initialPackingOffset(availableFreeSpace, style()->flexPack(), childSizes.size());
     mainAxisOffset -= isHorizontalFlow() ? verticalScrollbarWidth() : horizontalScrollbarHeight();
 
-    LayoutUnit crossAxisOffset = flowAwareBorderBefore() + flowAwarePaddingBefore();
     for (size_t i = 0; i < children.size(); ++i) {
         RenderBox* child = children[i];
         if (child->isPositioned()) {
@@ -816,9 +919,9 @@ void RenderFlexibleBox::adjustAlignmentForChild(RenderBox* child, LayoutUnit del
         child->repaintDuringLayoutIfMoved(oldRect);
 }
 
-void RenderFlexibleBox::alignChildren(const OrderedFlexItemList& children, LayoutUnit maxAscent)
+void RenderFlexibleBox::alignChildren(const OrderedFlexItemList& children, LayoutUnit lineCrossAxisExtent, LayoutUnit maxAscent)
 {
-    LayoutUnit crossExtent = crossAxisExtent();
+    LayoutUnit minMarginAfterBaseline = std::numeric_limits<LayoutUnit>::max();
 
     for (size_t i = 0; i < children.size(); ++i) {
         RenderBox* child = children[i];
@@ -829,7 +932,7 @@ void RenderFlexibleBox::alignChildren(const OrderedFlexItemList& children, Layou
         case AlignStretch: {
             if (!isColumnFlow() && child->style()->logicalHeight().isAuto()) {
                 LayoutUnit logicalHeightBefore = child->logicalHeight();
-                LayoutUnit stretchedLogicalHeight = child->logicalHeight() + RenderFlexibleBox::availableAlignmentSpaceForChild(child);
+                LayoutUnit stretchedLogicalHeight = child->logicalHeight() + availableAlignmentSpaceForChild(lineCrossAxisExtent, child);
                 child->setLogicalHeight(stretchedLogicalHeight);
                 child->computeLogicalHeight();
 
@@ -839,31 +942,83 @@ void RenderFlexibleBox::alignChildren(const OrderedFlexItemList& children, Layou
                     child->setChildNeedsLayout(true);
                     child->layoutIfNeeded();
                 }
+            } else if (isColumnFlow() && child->style()->logicalWidth().isAuto() && isMultiline()) {
+                // FIXME: Handle min-width and max-width.
+                LayoutUnit childWidth = lineCrossAxisExtent - crossAxisMarginExtentForChild(child);
+                child->setOverrideWidth(std::max(0, childWidth));
+                child->setChildNeedsLayout(true);
+                child->layoutIfNeeded();
             }
+            // Since wrap-reverse flips cross start and cross end, strech children should be aligned with the cross end.
+            if (style()->flexWrap() == FlexWrapReverse)
+                adjustAlignmentForChild(child, availableAlignmentSpaceForChild(lineCrossAxisExtent, child));
             break;
         }
         case AlignStart:
             break;
         case AlignEnd:
-            adjustAlignmentForChild(child, RenderFlexibleBox::availableAlignmentSpaceForChild(child));
+            adjustAlignmentForChild(child, availableAlignmentSpaceForChild(lineCrossAxisExtent, child));
             break;
         case AlignCenter:
-            adjustAlignmentForChild(child, RenderFlexibleBox::availableAlignmentSpaceForChild(child) / 2);
+            adjustAlignmentForChild(child, availableAlignmentSpaceForChild(lineCrossAxisExtent, child) / 2);
             break;
         case AlignBaseline: {
-            LayoutUnit ascent = marginBoxAscent(child);
-            adjustAlignmentForChild(child, maxAscent - ascent);
+            LayoutUnit ascent = marginBoxAscentForChild(child);
+            LayoutUnit startOffset = maxAscent - ascent;
+            adjustAlignmentForChild(child, startOffset);
+
+            if (style()->flexWrap() == FlexWrapReverse)
+                minMarginAfterBaseline = std::min(minMarginAfterBaseline, availableAlignmentSpaceForChild(lineCrossAxisExtent, child) - startOffset);
             break;
         }
         }
+    }
 
-        // direction:rtl + flex-direction:column means the cross-axis direction is flipped.
-        if (!style()->isLeftToRightDirection() && isColumnFlow()) {
-            LayoutPoint location = flowAwareLocationForChild(child);
-            location.setY(crossExtent - crossAxisExtentForChild(child) - location.y());
-            setFlowAwareLocationForChild(child, location);
+    // wrap-reverse flips the cross axis start and end. For baseline alignment, this means we
+    // need to align the after edge of baseline elements with the after edge of the flex line.
+    if (style()->flexWrap() == FlexWrapReverse && minMarginAfterBaseline) {
+        for (size_t i = 0; i < children.size(); ++i) {
+            RenderBox* child = children[i];
+            if (flexAlignForChild(child) == AlignBaseline)
+                adjustAlignmentForChild(child, minMarginAfterBaseline);
         }
+    }
+}
+
+void RenderFlexibleBox::flipForRightToLeftColumn(FlexOrderIterator& iterator)
+{
+    if (style()->isLeftToRightDirection() || !isColumnFlow())
+        return;
+
+    LayoutUnit crossExtent = crossAxisExtent();
+    for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
+        LayoutPoint location = flowAwareLocationForChild(child);
+        location.setY(crossExtent - crossAxisExtentForChild(child) - location.y());
+        setFlowAwareLocationForChild(child, location);
+    }
+}
 
+void RenderFlexibleBox::flipForWrapReverse(FlexOrderIterator& iterator, const WrapReverseContext& wrapReverseContext)
+{
+    if (!isColumnFlow())
+        computeLogicalHeight();
+
+    size_t currentChild = 0;
+    size_t lineNumber = 0;
+    LayoutUnit contentExtent = crossAxisContentExtent();
+    for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
+        LayoutPoint location = flowAwareLocationForChild(child);
+        location.setY(location.y() + wrapReverseContext.lineCrossAxisDelta(lineNumber, contentExtent));
+
+        LayoutRect oldRect = child->frameRect();
+        setFlowAwareLocationForChild(child, location);
+        if (!selfNeedsLayout() && child->checkForRepaintDuringLayout())
+            child->repaintDuringLayoutIfMoved(oldRect);
+
+        if (++currentChild == wrapReverseContext.childrenPerLine[lineNumber]) {
+            ++lineNumber;
+            currentChild = 0;
+        }
     }
 }
 
diff --git a/Source/WebCore/rendering/RenderFlexibleBox.h b/Source/WebCore/rendering/RenderFlexibleBox.h
index 0ee715f7e..3490bf1c6 100644
--- a/Source/WebCore/rendering/RenderFlexibleBox.h
+++ b/Source/WebCore/rendering/RenderFlexibleBox.h
@@ -56,9 +56,12 @@ private:
     typedef WTF::HashMap<const RenderBox*, LayoutUnit> InflexibleFlexItemSize;
     typedef WTF::Vector<RenderBox*> OrderedFlexItemList;
 
+    struct WrapReverseContext;
+
     bool hasOrthogonalFlow(RenderBox* child) const;
     bool isColumnFlow() const;
     bool isLeftToRightFlow() const;
+    bool isMultiline() const;
     Length crossAxisLength() const;
     Length mainAxisLengthForChild(RenderBox* child) const;
     void setCrossAxisExtent(LayoutUnit);
@@ -70,12 +73,13 @@ private:
     LayoutUnit mainAxisContentExtent() const;
     WritingMode transformedWritingMode() const;
     LayoutUnit flowAwareBorderStart() const;
-    LayoutUnit flowAwareBorderBefore() const;
     LayoutUnit flowAwareBorderEnd() const;
-    LayoutUnit crossAxisBorderAndPaddingExtent() const;
+    LayoutUnit flowAwareBorderBefore() const;
+    LayoutUnit flowAwareBorderAfter() const;
     LayoutUnit flowAwarePaddingStart() const;
-    LayoutUnit flowAwarePaddingBefore() const;
     LayoutUnit flowAwarePaddingEnd() const;
+    LayoutUnit flowAwarePaddingBefore() const;
+    LayoutUnit flowAwarePaddingAfter() const;
     LayoutUnit flowAwareMarginStartForChild(RenderBox* child) const;
     LayoutUnit flowAwareMarginEndForChild(RenderBox* child) const;
     LayoutUnit flowAwareMarginBeforeForChild(RenderBox* child) const;
@@ -95,17 +99,19 @@ private:
     float positiveFlexForChild(RenderBox* child) const;
     float negativeFlexForChild(RenderBox* child) const;
 
-    LayoutUnit availableAlignmentSpaceForChild(RenderBox*);
-    LayoutUnit marginBoxAscent(RenderBox*);
+    LayoutUnit availableAlignmentSpaceForChild(LayoutUnit lineCrossAxisExtent, RenderBox*);
+    LayoutUnit marginBoxAscentForChild(RenderBox*);
 
     void computeMainAxisPreferredSizes(bool relayoutChildren, FlexOrderHashSet&);
-    void computeFlexOrder(FlexOrderIterator&, OrderedFlexItemList& orderedChildren, LayoutUnit& preferredMainAxisExtent, float& totalPositiveFlexibility, float& totalNegativeFlexibility);
+    bool computeNextFlexLine(FlexOrderIterator&, OrderedFlexItemList& orderedChildren, LayoutUnit& preferredMainAxisExtent, float& totalPositiveFlexibility, float& totalNegativeFlexibility);
     bool runFreeSpaceAllocationAlgorithm(const OrderedFlexItemList&, LayoutUnit& availableFreeSpace, float& totalPositiveFlexibility, float& totalNegativeFlexibility, InflexibleFlexItemSize&, WTF::Vector<LayoutUnit>& childSizes);
     void setLogicalOverrideSize(RenderBox* child, LayoutUnit childPreferredSize);
     void prepareChildForPositionedLayout(RenderBox* child, LayoutUnit mainAxisOffset, LayoutUnit crossAxisOffset);
-    void layoutAndPlaceChildren(const OrderedFlexItemList&, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace);
-    void layoutColumnReverse(const OrderedFlexItemList&, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace);
-    void alignChildren(const OrderedFlexItemList&, LayoutUnit maxAscent);
+    void layoutAndPlaceChildren(LayoutUnit& crossAxisOffset, const OrderedFlexItemList&, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit availableFreeSpace);
+    void layoutColumnReverse(const OrderedFlexItemList&, const WTF::Vector<LayoutUnit>& childSizes, LayoutUnit crossAxisOffset, LayoutUnit availableFreeSpace);
+    void alignChildren(const OrderedFlexItemList&, LayoutUnit lineCrossAxisExtent, LayoutUnit maxAscent);
+    void flipForRightToLeftColumn(FlexOrderIterator&);
+    void flipForWrapReverse(FlexOrderIterator&, const WrapReverseContext&);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderFlowThread.cpp b/Source/WebCore/rendering/RenderFlowThread.cpp
index 9e47d4dc9..e241d9670 100644
--- a/Source/WebCore/rendering/RenderFlowThread.cpp
+++ b/Source/WebCore/rendering/RenderFlowThread.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -13,7 +13,7 @@
  *    disclaimer in the documentation and/or other materials
  *    provided with the distribution.
  * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS” AND ANY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
@@ -905,4 +905,70 @@ void RenderFlowThread::computeOverflowStateForRegions(LayoutUnit oldClientAfterE
     m_overflow = lastReg && (lastReg->regionState() == RenderRegion::RegionOverflow);
 }
 
+bool RenderFlowThread::regionInRange(const RenderRegion* targetRegion, const RenderRegion* startRegion, const RenderRegion* endRegion) const
+{
+    ASSERT(targetRegion);
+
+    for (RenderRegionList::const_iterator it = m_regionList.find(const_cast<RenderRegion*>(startRegion)); it != m_regionList.end(); ++it) {
+        const RenderRegion* currRegion = *it;
+        if (!currRegion->isValid())
+            continue;
+        if (targetRegion == currRegion)
+            return true;
+        if (currRegion == endRegion)
+            break;
+    }
+
+    return false;
+}
+
+bool RenderFlowThread::objectInFlowRegion(const RenderObject* object, const RenderRegion* region) const
+{
+    ASSERT(object);
+    ASSERT(region);
+
+    if (!object->inRenderFlowThread())
+        return false;
+    if (object->enclosingRenderFlowThread() != this)
+        return false;
+    if (!m_regionList.contains(const_cast<RenderRegion*>(region)))
+        return false;
+
+    RenderBox* enclosingBox = object->enclosingBox();
+    RenderRegion* enclosingBoxStartRegion = 0;
+    RenderRegion* enclosingBoxEndRegion = 0;
+    getRegionRangeForBox(enclosingBox, enclosingBoxStartRegion, enclosingBoxEndRegion);
+    if (!regionInRange(region, enclosingBoxStartRegion, enclosingBoxEndRegion))
+        return false;
+
+    if (object->isBox())
+        return true;
+
+    LayoutRect objectABBRect = object->absoluteBoundingBoxRect(true);
+    if (!objectABBRect.width())
+        objectABBRect.setWidth(1);
+    if (!objectABBRect.height())
+        objectABBRect.setHeight(1); 
+    if (objectABBRect.intersects(region->absoluteBoundingBoxRect(true)))
+        return true;
+
+    if (region == lastRegion()) {
+        // If the object does not intersect any of the enclosing box regions
+        // then the object is in last region.
+        for (RenderRegionList::const_iterator it = m_regionList.find(enclosingBoxStartRegion); it != m_regionList.end(); ++it) {
+            const RenderRegion* currRegion = *it;
+            if (!region->isValid())
+                continue;
+            if (currRegion == region)
+                break;
+            if (objectABBRect.intersects(currRegion->absoluteBoundingBoxRect(true)))
+                return false;
+        }
+        return true;
+    }
+
+    return false;
+}
+
 } // namespace WebCore
+
diff --git a/Source/WebCore/rendering/RenderFlowThread.h b/Source/WebCore/rendering/RenderFlowThread.h
index d05938891..b958eb164 100644
--- a/Source/WebCore/rendering/RenderFlowThread.h
+++ b/Source/WebCore/rendering/RenderFlowThread.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -13,7 +13,7 @@
  *    disclaimer in the documentation and/or other materials
  *    provided with the distribution.
  * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER “AS IS” AND ANY
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE
@@ -136,6 +136,10 @@ public:
     void computeOverflowStateForRegions(LayoutUnit oldClientAfterEdge);
 
     bool overflow() const { return m_overflow; }
+
+    // Check if the object is in region and the region is part of this flow thread.
+    bool objectInFlowRegion(const RenderObject*, const RenderRegion*) const;
+
 private:
     virtual const char* renderName() const { return "RenderFlowThread"; }
 
@@ -146,6 +150,8 @@ private:
 
     bool shouldRepaint(const LayoutRect&) const;
 
+    bool regionInRange(const RenderRegion* targetRegion, const RenderRegion* startRegion, const RenderRegion* endRegion) const;
+
     typedef ListHashSet<RenderObject*> FlowThreadChildList;
     FlowThreadChildList m_flowThreadChildList;
 
diff --git a/Source/WebCore/rendering/RenderHTMLCanvas.cpp b/Source/WebCore/rendering/RenderHTMLCanvas.cpp
index 7ce0681fb..0df9fe998 100644
--- a/Source/WebCore/rendering/RenderHTMLCanvas.cpp
+++ b/Source/WebCore/rendering/RenderHTMLCanvas.cpp
@@ -58,13 +58,16 @@ bool RenderHTMLCanvas::requiresLayer() const
 
 void RenderHTMLCanvas::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
 {
+    LayoutRect rect = contentBoxRect();
+    rect.moveBy(paintOffset);
+
     if (Frame* frame = this->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(this, paintInfo.rect);
+        if (Page* page = frame->page()) {
+            if (paintInfo.phase == PaintPhaseForeground)
+                page->addRelevantRepaintedObject(this, rect);
+        }
     }
 
-    LayoutRect rect = contentBoxRect();
-    rect.moveBy(paintOffset);
     bool useLowQualityScale = style()->imageRendering() == ImageRenderingOptimizeContrast;
     static_cast<HTMLCanvasElement*>(node())->paint(paintInfo.context, rect, useLowQualityScale);
 }
diff --git a/Source/WebCore/rendering/RenderImage.cpp b/Source/WebCore/rendering/RenderImage.cpp
index de3e7e190..6406f6f66 100644
--- a/Source/WebCore/rendering/RenderImage.cpp
+++ b/Source/WebCore/rendering/RenderImage.cpp
@@ -264,10 +264,17 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOf
 
     GraphicsContext* context = paintInfo.context;
 
+    Page* page = 0;
+    if (Frame* frame = this->frame())
+        page = frame->page();
+
     if (!m_imageResource->hasImage() || m_imageResource->errorOccurred()) {
         if (paintInfo.phase == PaintPhaseSelection)
             return;
 
+        if (page && paintInfo.phase == PaintPhaseForeground)
+            page->addRelevantUnpaintedObject(this, visualOverflowRect());
+
         if (cWidth > 2 && cHeight > 2) {
             // Draw an outline rect where the image should be.
             context->setStrokeStyle(SolidStroke);
@@ -325,13 +332,11 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOf
         }
     } else if (m_imageResource->hasImage() && cWidth > 0 && cHeight > 0) {
         RefPtr<Image> img = m_imageResource->image(cWidth, cHeight);
-        if (!img || img->isNull())
+        if (!img || img->isNull()) {
+            if (page && paintInfo.phase == PaintPhaseForeground)
+                page->addRelevantUnpaintedObject(this, visualOverflowRect());
             return;
-
-    if (Frame* frame = this->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(this, paintInfo.rect);
-    }
+        }
 
 #if PLATFORM(MAC)
         if (style()->highlight() != nullAtom && !paintInfo.context->paintingDisabled())
@@ -342,6 +347,15 @@ void RenderImage::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOf
         LayoutPoint contentLocation = paintOffset;
         contentLocation.move(leftBorder + leftPad, topBorder + topPad);
         paintIntoRect(context, LayoutRect(contentLocation, contentSize));
+        
+        if (cachedImage() && page && paintInfo.phase == PaintPhaseForeground) {
+            // For now, count images as unpainted if they are still progressively loading. We may want 
+            // to refine this in the future to account for the portion of the image that has painted.
+            if (cachedImage()->isLoading())
+                page->addRelevantUnpaintedObject(this, LayoutRect(contentLocation, contentSize));
+            else
+                page->addRelevantRepaintedObject(this, LayoutRect(contentLocation, contentSize));
+        }
     }
 }
 
@@ -490,8 +504,8 @@ void RenderImage::updateAltText()
 
 LayoutUnit RenderImage::computeReplacedLogicalWidth(bool includeMaxWidth) const
 {
-    // If we've got an explicit width/height assigned, propagate it to the image resource.    
-    if (style()->logicalWidth().isFixed() && style()->logicalHeight().isFixed()) {
+    // If we've got an explicit width/height assigned, propagate it to the image resource.
+    if (style()->logicalWidth().isSpecified() && style()->logicalHeight().isSpecified()) {
         LayoutUnit width = RenderReplaced::computeReplacedLogicalWidth(includeMaxWidth);
         m_imageResource->setContainerSizeForRenderer(IntSize(width, computeReplacedLogicalHeight()));
         return width;
diff --git a/Source/WebCore/rendering/RenderInline.cpp b/Source/WebCore/rendering/RenderInline.cpp
index 3be57ae0a..0a5a65ee9 100644
--- a/Source/WebCore/rendering/RenderInline.cpp
+++ b/Source/WebCore/rendering/RenderInline.cpp
@@ -507,15 +507,15 @@ void RenderInline::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
     m_lineBoxes.paint(this, paintInfo, paintOffset);
 }
 
-void RenderInline::absoluteRects(Vector<LayoutRect>& rects, const LayoutPoint& accumulatedOffset) const
+void RenderInline::absoluteRects(Vector<IntRect>& rects, const LayoutPoint& accumulatedOffset) const
 {
     if (!alwaysCreateLineBoxes())
         culledInlineAbsoluteRects(this, rects, toLayoutSize(accumulatedOffset));
     else if (InlineFlowBox* curr = firstLineBox()) {
         for (; curr; curr = curr->nextLineBox())
-            rects.append(enclosingLayoutRect(FloatRect(accumulatedOffset + curr->topLeft(), curr->size())));
+            rects.append(enclosingIntRect(FloatRect(accumulatedOffset + curr->topLeft(), curr->size())));
     } else
-        rects.append(LayoutRect(accumulatedOffset, LayoutSize()));
+        rects.append(IntRect(roundedIntPoint(accumulatedOffset), IntSize()));
 
     if (continuation()) {
         if (continuation()->isBox()) {
@@ -526,7 +526,7 @@ void RenderInline::absoluteRects(Vector<LayoutRect>& rects, const LayoutPoint& a
     }
 }
 
-void RenderInline::culledInlineAbsoluteRects(const RenderInline* container, Vector<LayoutRect>& rects, const LayoutSize& offset) const
+void RenderInline::culledInlineAbsoluteRects(const RenderInline* container, Vector<IntRect>& rects, const LayoutSize& offset) const
 {
     if (!culledInlineFirstLineBox()) {
         rects.append(IntRect(offset.width(), offset.height(), 0, 0));
@@ -548,9 +548,9 @@ void RenderInline::culledInlineAbsoluteRects(const RenderInline* container, Vect
                 int logicalHeight = container->style(rootBox->isFirstLineStyle())->font().fontMetrics().height();
                 FloatRect result;
                 if (isHorizontal)
-                    result = FloatRect(offset.width() + currBox->inlineBoxWrapper()->x() - currBox->marginLeft(), offset.height() + logicalTop, currBox->width() + currBox->marginLeft() + currBox->marginRight(), logicalHeight);
+                    result = FloatRect(offset.width() + currBox->inlineBoxWrapper()->x() - currBox->marginLeft(), offset.height() + logicalTop, currBox->width() + currBox->marginWidth(), logicalHeight);
                 else
-                    result = FloatRect(offset.width() + logicalTop, offset.height() + currBox->inlineBoxWrapper()->y() - currBox->marginTop(), logicalHeight, currBox->height() + currBox->marginTop() + currBox->marginBottom());
+                    result = FloatRect(offset.width() + logicalTop, offset.height() + currBox->inlineBoxWrapper()->y() - currBox->marginTop(), logicalHeight, currBox->height() + currBox->marginHeight());
                 rects.append(enclosingIntRect(result));
             }
         } else if (curr->isRenderInline()) {
@@ -632,9 +632,9 @@ void RenderInline::culledInlineAbsoluteQuads(const RenderInline* container, Vect
                 int logicalHeight = container->style(rootBox->isFirstLineStyle())->font().fontMetrics().height();
                 FloatRect result;
                 if (isHorizontal)
-                    result = FloatRect(currBox->inlineBoxWrapper()->x() - currBox->marginLeft(), logicalTop, currBox->width() + currBox->marginLeft() + currBox->marginRight(), logicalHeight);
+                    result = FloatRect(currBox->inlineBoxWrapper()->x() - currBox->marginLeft(), logicalTop, currBox->width() + currBox->marginWidth(), logicalHeight);
                 else
-                    result = FloatRect(logicalTop, currBox->inlineBoxWrapper()->y() - currBox->marginTop(), logicalHeight, currBox->height() + currBox->marginTop() + currBox->marginBottom());
+                    result = FloatRect(logicalTop, currBox->inlineBoxWrapper()->y() - currBox->marginTop(), logicalHeight, currBox->height() + currBox->marginHeight());
                 quads.append(localToAbsoluteQuad(result));
             }
         } else if (curr->isRenderInline()) {
@@ -838,9 +838,9 @@ FloatRect RenderInline::culledInlineBoundingBox(const RenderInline* container) c
                 int logicalTop = rootBox->logicalTop() + (rootBox->renderer()->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent() - container->style(rootBox->isFirstLineStyle())->font().fontMetrics().ascent());
                 int logicalHeight = container->style(rootBox->isFirstLineStyle())->font().fontMetrics().height();
                 if (isHorizontal)
-                    result.uniteIfNonZero(FloatRect(currBox->inlineBoxWrapper()->x() - currBox->marginLeft(), logicalTop, currBox->width() + currBox->marginLeft() + currBox->marginRight(), logicalHeight));
+                    result.uniteIfNonZero(FloatRect(currBox->inlineBoxWrapper()->x() - currBox->marginLeft(), logicalTop, currBox->width() + currBox->marginWidth(), logicalHeight));
                 else
-                    result.uniteIfNonZero(FloatRect(logicalTop, currBox->inlineBoxWrapper()->y() - currBox->marginTop(), logicalHeight, currBox->height() + currBox->marginTop() + currBox->marginBottom()));
+                    result.uniteIfNonZero(FloatRect(logicalTop, currBox->inlineBoxWrapper()->y() - currBox->marginTop(), logicalHeight, currBox->height() + currBox->marginHeight()));
             }
         } else if (curr->isRenderInline()) {
             // If the child doesn't need line boxes either, then we can recur.
@@ -1033,7 +1033,7 @@ LayoutRect RenderInline::clippedOverflowRectForRepaint(RenderBoxModelObject* rep
         LayoutRect repaintRect(r);
         repaintRect.move(-cb->scrolledContentOffset()); // For overflow:auto/scroll/hidden.
 
-        LayoutRect boxRect(LayoutPoint(), cb->layer()->size());
+        LayoutRect boxRect(LayoutPoint(), cb->cachedSizeForOverflowClip());
         r = intersection(repaintRect, boxRect);
     }
     
@@ -1135,7 +1135,7 @@ void RenderInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
         topLeft -= containerBox->scrolledContentOffset(); // For overflow:auto/scroll/hidden.
 
         LayoutRect repaintRect(topLeft, rect.size());
-        LayoutRect boxRect(LayoutPoint(), containerBox->layer()->size());
+        LayoutRect boxRect(LayoutPoint(), containerBox->cachedSizeForOverflowClip());
         rect = intersection(repaintRect, boxRect);
         if (rect.isEmpty())
             return;
@@ -1368,13 +1368,13 @@ void RenderInline::imageChanged(WrappedImagePtr, const IntRect*)
     repaint();
 }
 
-void RenderInline::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint& additionalOffset)
+void RenderInline::addFocusRingRects(Vector<IntRect>& rects, const LayoutPoint& additionalOffset)
 {
     if (!alwaysCreateLineBoxes())
         culledInlineAbsoluteRects(this, rects, toLayoutSize(additionalOffset));
     else {
         for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextLineBox())
-            rects.append(enclosingLayoutRect(FloatRect(additionalOffset.x() + curr->x(), additionalOffset.y() + curr->y(), curr->width(), curr->height())));
+            rects.append(enclosingIntRect(FloatRect(additionalOffset.x() + curr->x(), additionalOffset.y() + curr->y(), curr->width(), curr->height())));
     }
 
     for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
@@ -1587,14 +1587,6 @@ void RenderInline::addDashboardRegions(Vector<DashboardRegionValue>& regions)
         region.bounds.setX(absPos.x() + region.bounds.x());
         region.bounds.setY(absPos.y() + region.bounds.y());
 
-        if (frame()) {
-            float deviceScaleFactor = frame()->page()->deviceScaleFactor();
-            if (deviceScaleFactor != 1.0f) {
-                region.bounds.scale(deviceScaleFactor);
-                region.clip.scale(deviceScaleFactor);
-            }
-        }
-
         regions.append(region);
     }
 }
diff --git a/Source/WebCore/rendering/RenderInline.h b/Source/WebCore/rendering/RenderInline.h
index 557ce59a0..0cb026448 100644
--- a/Source/WebCore/rendering/RenderInline.h
+++ b/Source/WebCore/rendering/RenderInline.h
@@ -46,7 +46,7 @@ public:
     virtual LayoutUnit marginStart() const;
     virtual LayoutUnit marginEnd() const;
 
-    virtual void absoluteRects(Vector<LayoutRect>&, const LayoutPoint& accumulatedOffset) const;
+    virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const;
     virtual void absoluteQuads(Vector<FloatQuad>&, bool* wasFixed) const;
 
     virtual LayoutSize offsetFromContainer(RenderObject*, const LayoutPoint&) const;
@@ -73,7 +73,7 @@ public:
     
     LayoutSize relativePositionedInlineOffset(const RenderBox* child) const;
 
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
     void paintOutline(GraphicsContext*, const LayoutPoint&);
 
     using RenderBoxModelObject::continuation;
@@ -102,7 +102,7 @@ private:
     LayoutRect culledInlineVisualOverflowBoundingBox() const;
     InlineBox* culledInlineFirstLineBox() const;
     InlineBox* culledInlineLastLineBox() const;
-    void culledInlineAbsoluteRects(const RenderInline* container, Vector<LayoutRect>&, const LayoutSize&) const;
+    void culledInlineAbsoluteRects(const RenderInline* container, Vector<IntRect>&, const LayoutSize&) const;
     void culledInlineAbsoluteQuads(const RenderInline* container, Vector<FloatQuad>&) const;
 
     void addChildToContinuation(RenderObject* newChild, RenderObject* beforeChild);
diff --git a/Source/WebCore/rendering/RenderLayer.cpp b/Source/WebCore/rendering/RenderLayer.cpp
index a5b028b65..9cf767ee8 100644
--- a/Source/WebCore/rendering/RenderLayer.cpp
+++ b/Source/WebCore/rendering/RenderLayer.cpp
@@ -108,7 +108,7 @@
 #include "SVGNames.h"
 #endif
 
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
 // FIXME: border radius clipping triggers too-slow path on Chromium
 // https://bugs.webkit.org/show_bug.cgi?id=69866
 #define DISABLE_ROUNDED_CORNER_CLIPPING
@@ -153,7 +153,6 @@ RenderLayer::RenderLayer(RenderBoxModelObject* renderer)
     , m_paintingInsideReflection(false)
     , m_inOverflowRelayout(false)
     , m_repaintStatus(NeedsNormalRepaint)
-    , m_overflowStatusDirty(true)
     , m_visibleContentStatusDirty(true)
     , m_hasVisibleContent(false)
     , m_visibleDescendantStatusDirty(false)
@@ -1197,6 +1196,11 @@ void RenderLayer::removeOnlyThisLayer()
     bool hasLayerOffset;
     const LayoutPoint offsetFromRootBeforeMove = computeOffsetFromRoot(hasLayerOffset);
 
+    // Remove the child reflection layer before moving other child layers.
+    // The reflection layer should not be moved to the parent.
+    if (reflection())
+        removeChild(reflectionLayer());
+
     // Now walk our kids and reattach them to our parent.
     RenderLayer* current = m_first;
     while (current) {
@@ -1212,10 +1216,7 @@ void RenderLayer::removeOnlyThisLayer()
     }
 
     // Remove us from the parent.
-    if (reflection())
-        removeChild(reflectionLayer());
     m_parent->removeChild(this);
-
     m_renderer->destroyLayer();
 }
 
@@ -1386,7 +1387,7 @@ void RenderLayer::panScrollFromPoint(const LayoutPoint& sourcePoint)
     scrollByRecursively(adjustedScrollDelta(xDelta), adjustedScrollDelta(yDelta), ScrollOffsetClamped);
 }
 
-void RenderLayer::scrollByRecursively(LayoutUnit xDelta, LayoutUnit yDelta, ScrollOffsetClamping clamp)
+void RenderLayer::scrollByRecursively(int xDelta, int yDelta, ScrollOffsetClamping clamp)
 {
     if (!xDelta && !yDelta)
         return;
@@ -1396,13 +1397,13 @@ void RenderLayer::scrollByRecursively(LayoutUnit xDelta, LayoutUnit yDelta, Scro
         restrictedByLineClamp = !renderer()->parent()->style()->lineClamp().isNone();
 
     if (renderer()->hasOverflowClip() && !restrictedByLineClamp) {
-        LayoutUnit newOffsetX = scrollXOffset() + xDelta;
-        LayoutUnit newOffsetY = scrollYOffset() + yDelta;
+        int newOffsetX = scrollXOffset() + xDelta;
+        int newOffsetY = scrollYOffset() + yDelta;
         scrollToOffset(newOffsetX, newOffsetY, clamp);
 
         // If this layer can't do the scroll we ask the next layer up that can scroll to try
-        LayoutUnit leftToScrollX = newOffsetX - scrollXOffset();
-        LayoutUnit leftToScrollY = newOffsetY - scrollYOffset();
+        int leftToScrollX = newOffsetX - scrollXOffset();
+        int leftToScrollY = newOffsetY - scrollYOffset();
         if ((leftToScrollX || leftToScrollY) && renderer()->parent()) {
             if (RenderLayer* scrollableLayer = enclosingScrollableLayer())
                 scrollableLayer->scrollByRecursively(leftToScrollX, leftToScrollY);
@@ -1420,21 +1421,21 @@ void RenderLayer::scrollByRecursively(LayoutUnit xDelta, LayoutUnit yDelta, Scro
     }
 }
 
-void RenderLayer::scrollToOffset(LayoutUnit x, LayoutUnit y, ScrollOffsetClamping clamp)
+void RenderLayer::scrollToOffset(int x, int y, ScrollOffsetClamping clamp)
 {
     if (clamp == ScrollOffsetClamped) {
         RenderBox* box = renderBox();
         if (!box)
             return;
 
-        LayoutUnit maxX = scrollWidth() - box->clientWidth();
-        LayoutUnit maxY = scrollHeight() - box->clientHeight();
+        int maxX = scrollWidth() - box->clientWidth();
+        int maxY = scrollHeight() - box->clientHeight();
 
-        x = min(max<LayoutUnit>(x, 0), maxX);
-        y = min(max<LayoutUnit>(y, 0), maxY);
+        x = min(max(x, 0), maxX);
+        y = min(max(y, 0), maxY);
     }
 
-    LayoutPoint newScrollOffset(x, y);
+    IntPoint newScrollOffset(x, y);
     if (newScrollOffset != LayoutPoint(scrollXOffset(), scrollYOffset()))
         scrollToOffsetWithoutAnimation(newScrollOffset);
 }
@@ -1545,15 +1546,18 @@ void RenderLayer::scrollRectToVisible(const LayoutRect& rect, const ScrollAlignm
         LayoutRect exposeRect = LayoutRect(rect.x() + scrollXOffset(), rect.y() + scrollYOffset(), rect.width(), rect.height());
         LayoutRect r = getRectToExpose(layerBounds, exposeRect, alignX, alignY);
         
-        LayoutUnit xOffset = r.x() - absPos.x();
-        LayoutUnit yOffset = r.y() - absPos.y();
+        LayoutUnit adjustedX = r.x() - absPos.x();
+        LayoutUnit adjustedY = r.y() - absPos.y();
         // Adjust offsets if they're outside of the allowable range.
-        xOffset = max<LayoutUnit>(0, min(scrollWidth() - layerBounds.width(), xOffset));
-        yOffset = max<LayoutUnit>(0, min(scrollHeight() - layerBounds.height(), yOffset));
+        adjustedX = max<LayoutUnit>(0, min(scrollWidth() - layerBounds.width(), adjustedX));
+        adjustedY = max<LayoutUnit>(0, min(scrollHeight() - layerBounds.height(), adjustedY));
+
+        int xOffset = roundToInt(adjustedX);
+        int yOffset = roundToInt(adjustedY);
         
         if (xOffset != scrollXOffset() || yOffset != scrollYOffset()) {
-            LayoutUnit diffX = scrollXOffset();
-            LayoutUnit diffY = scrollYOffset();
+            int diffX = scrollXOffset();
+            int diffY = scrollYOffset();
             scrollToOffset(xOffset, yOffset);
             diffX = scrollXOffset() - diffX;
             diffY = scrollYOffset() - diffY;
@@ -1576,11 +1580,11 @@ void RenderLayer::scrollRectToVisible(const LayoutRect& rect, const ScrollAlignm
                     LayoutRect viewRect = frameView->visibleContentRect();
                     LayoutRect exposeRect = getRectToExpose(viewRect, rect, alignX, alignY);
 
-                    LayoutUnit xOffset = exposeRect.x();
-                    LayoutUnit yOffset = exposeRect.y();
+                    int xOffset = roundToInt(exposeRect.x());
+                    int yOffset = roundToInt(exposeRect.y());
                     // Adjust offsets if they're outside of the allowable range.
-                    xOffset = max<LayoutUnit>(0, min(frameView->contentsWidth(), xOffset));
-                    yOffset = max<LayoutUnit>(0, min(frameView->contentsHeight(), yOffset));
+                    xOffset = max(0, min(frameView->contentsWidth(), xOffset));
+                    yOffset = max(0, min(frameView->contentsHeight(), yOffset));
 
                     frameView->setScrollPosition(IntPoint(xOffset, yOffset));
                     parentLayer = ownerElement->renderer()->enclosingLayer();
@@ -1734,6 +1738,10 @@ void RenderLayer::resize(const PlatformMouseEvent& evt, const LayoutSize& oldOff
     element->setMinimumSizeForResizing(minimumSize);
     
     LayoutSize adjustedOldOffset = LayoutSize(oldOffset.width() / zoomFactor, oldOffset.height() / zoomFactor);
+    if (renderer->style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft()) {
+        newOffset.setWidth(-newOffset.width());
+        adjustedOldOffset.setWidth(-adjustedOldOffset.width());
+    }
     
     LayoutSize difference = (currentSize + newOffset - adjustedOldOffset).expandedTo(minimumSize) - currentSize;
 
@@ -1829,6 +1837,13 @@ bool RenderLayer::isActive() const
     return page && page->focusController()->isActive();
 }
 
+static int cornerStart(const RenderLayer* layer, int minX, int maxX, int thickness)
+{
+    if (layer->renderer()->style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
+        return minX + layer->renderer()->style()->borderLeftWidth();
+    return maxX - thickness - layer->renderer()->style()->borderRightWidth();
+}
+
 static IntRect cornerRect(const RenderLayer* layer, const IntRect& bounds)
 {
     int horizontalThickness;
@@ -1848,7 +1863,7 @@ static IntRect cornerRect(const RenderLayer* layer, const IntRect& bounds)
         horizontalThickness = layer->verticalScrollbar()->width();
         verticalThickness = layer->horizontalScrollbar()->height();
     }
-    return IntRect(bounds.maxX() - horizontalThickness - layer->renderer()->style()->borderRightWidth(), 
+    return IntRect(cornerStart(layer, bounds.x(), bounds.maxX(), horizontalThickness),
                    bounds.maxY() - verticalThickness - layer->renderer()->style()->borderBottomWidth(),
                    horizontalThickness, verticalThickness);
 }
@@ -1971,15 +1986,32 @@ IntPoint RenderLayer::currentMousePosition() const
     return renderer()->frame() ? renderer()->frame()->eventHandler()->currentMousePosition() : IntPoint();
 }
 
+LayoutUnit RenderLayer::verticalScrollbarStart(int minX, int maxX) const
+{
+    const RenderBox* box = renderBox();
+    if (renderer()->style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
+        return minX + box->borderLeft();
+    return maxX - box->borderRight() - m_vBar->width();
+}
+
+LayoutUnit RenderLayer::horizontalScrollbarStart(int minX) const
+{
+    const RenderBox* box = renderBox();
+    int x = minX + box->borderLeft();
+    if (renderer()->style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
+        x += m_vBar ? m_vBar->width() : resizerCornerRect(this, box->borderBoxRect()).width();
+    return x;
+}
+
 IntSize RenderLayer::scrollbarOffset(const Scrollbar* scrollbar) const
 {
     RenderBox* box = renderBox();
 
     if (scrollbar == m_vBar.get())
-        return IntSize(box->width() - box->borderRight() - scrollbar->width(), box->borderTop());
+        return IntSize(verticalScrollbarStart(0, box->width()), box->borderTop());
 
     if (scrollbar == m_hBar.get())
-        return IntSize(box->borderLeft(), box->height() - box->borderBottom() - scrollbar->height());
+        return IntSize(horizontalScrollbarStart(0), box->height() - box->borderBottom() - scrollbar->height());
     
     ASSERT_NOT_REACHED();
     return IntSize();
@@ -2004,9 +2036,9 @@ void RenderLayer::invalidateScrollbarRect(Scrollbar* scrollbar, const IntRect& r
     RenderBox* box = renderBox();
     ASSERT(box);
     if (scrollbar == m_vBar.get())
-        scrollRect.move(box->width() - box->borderRight() - scrollbar->width(), box->borderTop());
+        scrollRect.move(verticalScrollbarStart(0, box->width()), box->borderTop());
     else
-        scrollRect.move(box->borderLeft(), box->height() - box->borderBottom() - scrollbar->height());
+        scrollRect.move(horizontalScrollbarStart(0), box->height() - box->borderBottom() - scrollbar->height());
     renderer()->repaintRectangle(scrollRect);
 }
 
@@ -2146,11 +2178,14 @@ int RenderLayer::horizontalScrollbarHeight(OverlayScrollbarSizeRelevancy relevan
 
 IntSize RenderLayer::offsetFromResizeCorner(const IntPoint& absolutePoint) const
 {
-    // Currently the resize corner is always the bottom right corner
+    // Currently the resize corner is either the bottom right corner or the bottom left corner.
     // FIXME: This assumes the location is 0, 0. Is this guaranteed to always be the case?
-    IntPoint bottomRight = toPoint(size());
+    IntSize elementSize = size();
+    if (renderer()->style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft())
+        elementSize.setWidth(0);
+    IntPoint resizerPoint = toPoint(elementSize);
     IntPoint localPoint = roundedIntPoint(absoluteToContents(absolutePoint));
-    return localPoint - bottomRight;
+    return localPoint - resizerPoint;
 }
 
 bool RenderLayer::hasOverflowControls() const
@@ -2171,13 +2206,13 @@ void RenderLayer::positionOverflowControls(const IntSize& offsetFromLayer)
     const IntRect& scrollCorner = scrollCornerRect();
     IntRect absBounds(borderBox.location() + offsetFromLayer, borderBox.size());
     if (m_vBar)
-        m_vBar->setFrameRect(IntRect(absBounds.maxX() - box->borderRight() - m_vBar->width(),
+        m_vBar->setFrameRect(IntRect(verticalScrollbarStart(absBounds.x(), absBounds.maxX()),
                                      absBounds.y() + box->borderTop(),
                                      m_vBar->width(),
                                      absBounds.height() - (box->borderTop() + box->borderBottom()) - scrollCorner.height()));
 
     if (m_hBar)
-        m_hBar->setFrameRect(IntRect(absBounds.x() + box->borderLeft(),
+        m_hBar->setFrameRect(IntRect(horizontalScrollbarStart(absBounds.x()),
                                      absBounds.maxY() - box->borderBottom() - m_hBar->height(),
                                      absBounds.width() - (box->borderLeft() + box->borderRight()) - scrollCorner.width(),
                                      m_hBar->height()));
@@ -2212,30 +2247,20 @@ void RenderLayer::positionOverflowControls(const IntSize& offsetFromLayer)
         m_resizer->setFrameRect(resizerCornerRect(this, borderBox));
 }
 
-LayoutUnit RenderLayer::scrollWidth()
+int RenderLayer::scrollWidth()
 {
     if (m_scrollDimensionsDirty)
         computeScrollDimensions();
     return m_scrollSize.width();
 }
 
-LayoutUnit RenderLayer::scrollHeight()
+int RenderLayer::scrollHeight()
 {
     if (m_scrollDimensionsDirty)
         computeScrollDimensions();
     return m_scrollSize.height();
 }
 
-int RenderLayer::pixelSnappedScrollWidth()
-{
-    return scrollWidth();
-}
-
-int RenderLayer::pixelSnappedScrollHeight()
-{
-    return scrollHeight();
-}
-
 LayoutUnit RenderLayer::overflowTop() const
 {
     RenderBox* box = renderBox();
@@ -2284,32 +2309,9 @@ void RenderLayer::computeScrollDimensions(bool* needHBar, bool* needVBar)
     setScrollOrigin(IntPoint(-m_scrollOverflow.width(), -m_scrollOverflow.height()));
 
     if (needHBar)
-        *needHBar = pixelSnappedScrollWidth() > box->pixelSnappedClientWidth();
+        *needHBar = scrollWidth() > box->pixelSnappedClientWidth();
     if (needVBar)
-        *needVBar = pixelSnappedScrollHeight() > box->pixelSnappedClientHeight();
-}
-
-void RenderLayer::updateOverflowStatus(bool horizontalOverflow, bool verticalOverflow)
-{
-    if (m_overflowStatusDirty) {
-        m_horizontalOverflow = horizontalOverflow;
-        m_verticalOverflow = verticalOverflow;
-        m_overflowStatusDirty = false;
-        return;
-    }
-    
-    bool horizontalOverflowChanged = (m_horizontalOverflow != horizontalOverflow);
-    bool verticalOverflowChanged = (m_verticalOverflow != verticalOverflow);
-    
-    if (horizontalOverflowChanged || verticalOverflowChanged) {
-        m_horizontalOverflow = horizontalOverflow;
-        m_verticalOverflow = verticalOverflow;
-        
-        if (FrameView* frameView = renderer()->document()->view()) {
-            frameView->scheduleEvent(OverflowEvent::create(horizontalOverflowChanged, horizontalOverflow, verticalOverflowChanged, verticalOverflow),
-                renderer()->node());
-        }
-    }
+        *needVBar = scrollHeight() > box->pixelSnappedClientHeight();
 }
 
 void RenderLayer::updateScrollInfoAfterLayout()
@@ -2327,8 +2329,8 @@ void RenderLayer::updateScrollInfoAfterLayout()
     if (box->style()->overflowX() != OMARQUEE) {
         // Layout may cause us to be in an invalid scroll position.  In this case we need
         // to pull our scroll offsets back to the max (or push them up to the min).
-        int newX = max(0, min(scrollXOffset(), scrollWidth() - box->clientWidth()));
-        int newY = max(0, min(scrollYOffset(), scrollHeight() - box->clientHeight()));
+        int newX = max(0, min<int>(scrollXOffset(), scrollWidth() - box->clientWidth()));
+        int newY = max(0, min<int>(scrollYOffset(), scrollHeight() - box->clientHeight()));
         if (newX != scrollXOffset() || newY != scrollYOffset())
             scrollToOffset(newX, newY);
     }
@@ -2404,10 +2406,7 @@ void RenderLayer::updateScrollInfoAfterLayout()
     }
 
     if (scrollOffsetOriginal != scrollOffset())
-        scrollToOffsetWithoutAnimation(LayoutPoint(scrollXOffset(), scrollYOffset()));
-
-    if (renderer()->node() && renderer()->document()->hasListenerType(Document::OVERFLOWCHANGED_LISTENER))
-        updateOverflowStatus(horizontalOverflow, verticalOverflow);
+        scrollToOffsetWithoutAnimation(IntPoint(scrollXOffset(), scrollYOffset()));
 }
 
 void RenderLayer::paintOverflowControls(GraphicsContext* context, const IntPoint& paintOffset, const IntRect& damageRect, bool paintingOverlayControls)
@@ -2514,6 +2513,16 @@ void RenderLayer::drawPlatformResizerImage(GraphicsContext* context, IntRect res
     }
 
     IntRect imageRect(resizerCornerRect.maxXMaxYCorner() - cornerResizerSize, cornerResizerSize);
+    if (renderer()->style()->shouldPlaceBlockDirectionScrollbarOnLogicalLeft()) {
+        context->save();
+        context->translate(imageRect.x(), imageRect.y());
+        imageRect.setX(0);
+        imageRect.setY(0);
+        context->scale(FloatSize(-1.0, 1.0));
+        context->drawImage(resizeCornerImage.get(), renderer()->style()->colorSpace(), imageRect);
+        context->restore();
+        return;
+    }
     context->drawImage(resizeCornerImage.get(), renderer()->style()->colorSpace(), imageRect);
 }
 
@@ -2588,7 +2597,7 @@ bool RenderLayer::hitTestOverflowControls(HitTestResult& result, const IntPoint&
     int resizeControlSize = max(resizeControlRect.height(), 0);
 
     if (m_vBar && m_vBar->shouldParticipateInHitTesting()) {
-        LayoutRect vBarRect(box->width() - box->borderRight() - m_vBar->width(), 
+        LayoutRect vBarRect(verticalScrollbarStart(0, box->width()),
                             box->borderTop(),
                             m_vBar->width(),
                             box->height() - (box->borderTop() + box->borderBottom()) - (m_hBar ? m_hBar->height() : resizeControlSize));
@@ -2600,7 +2609,7 @@ bool RenderLayer::hitTestOverflowControls(HitTestResult& result, const IntPoint&
 
     resizeControlSize = max(resizeControlRect.width(), 0);
     if (m_hBar && m_hBar->shouldParticipateInHitTesting()) {
-        LayoutRect hBarRect(box->borderLeft(),
+        LayoutRect hBarRect(horizontalScrollbarStart(0),
                             box->height() - box->borderBottom() - m_hBar->height(),
                             box->width() - (box->borderLeft() + box->borderRight()) - (m_vBar ? m_vBar->width() : resizeControlSize),
                             m_hBar->height());
@@ -3653,8 +3662,12 @@ void RenderLayer::calculateClipRects(const RenderLayer* rootLayer, RenderRegion*
     // Update the clip rects that will be passed to child layers.
     if (renderer()->hasOverflowClip() || renderer()->hasClip()) {
         // This layer establishes a clip of some kind.
+
+        // This offset cannot use convertToLayerCoords, because sometimes our rootLayer may be across
+        // some transformed layer boundary, for example, in the RenderLayerCompositor overlapMap, where
+        // clipRects are needed in view space.
         LayoutPoint offset;
-        convertToLayerCoords(rootLayer, offset);
+        offset = roundedIntPoint(renderer()->localToContainerPoint(FloatPoint(), rootLayer->renderer()));
         RenderView* view = renderer()->view();
         ASSERT(view);
         if (view && clipRects.fixed() && rootLayer->renderer() == view) {
diff --git a/Source/WebCore/rendering/RenderLayer.h b/Source/WebCore/rendering/RenderLayer.h
index 4c5be0cdc..4f5ec91f1 100644
--- a/Source/WebCore/rendering/RenderLayer.h
+++ b/Source/WebCore/rendering/RenderLayer.h
@@ -280,10 +280,8 @@ public:
 
     LayoutRect rect() const { return LayoutRect(location(), size()); }
 
-    LayoutUnit scrollWidth();
-    LayoutUnit scrollHeight();
-    int pixelSnappedScrollWidth();
-    int pixelSnappedScrollHeight();
+    int scrollWidth();
+    int scrollHeight();
 
     void panScrollFromPoint(const LayoutPoint&);
 
@@ -293,15 +291,15 @@ public:
     };
 
     // Scrolling methods for layers that can scroll their overflow.
-    void scrollByRecursively(LayoutUnit xDelta, LayoutUnit yDelta, ScrollOffsetClamping = ScrollOffsetUnclamped);
+    void scrollByRecursively(int xDelta, int yDelta, ScrollOffsetClamping = ScrollOffsetUnclamped);
 
     int scrollXOffset() const { return m_scrollOffset.width() + scrollOrigin().x(); }
     int scrollYOffset() const { return m_scrollOffset.height() + scrollOrigin().y(); }
     IntSize scrollOffset() const { return IntSize(scrollXOffset(), scrollYOffset()); }
 
-    void scrollToOffset(LayoutUnit, LayoutUnit, ScrollOffsetClamping = ScrollOffsetUnclamped);
-    void scrollToXOffset(LayoutUnit x, ScrollOffsetClamping clamp = ScrollOffsetUnclamped) { scrollToOffset(x, scrollYOffset(), clamp); }
-    void scrollToYOffset(LayoutUnit y, ScrollOffsetClamping clamp = ScrollOffsetUnclamped) { scrollToOffset(scrollXOffset(), y, clamp); }
+    void scrollToOffset(int, int, ScrollOffsetClamping = ScrollOffsetUnclamped);
+    void scrollToXOffset(int x, ScrollOffsetClamping clamp = ScrollOffsetUnclamped) { scrollToOffset(x, scrollYOffset(), clamp); }
+    void scrollToYOffset(int y, ScrollOffsetClamping clamp = ScrollOffsetUnclamped) { scrollToOffset(scrollXOffset(), y, clamp); }
 
     void scrollRectToVisible(const LayoutRect&, const ScrollAlignment& alignX = ScrollAlignment::alignCenterIfNeeded, const ScrollAlignment& alignY = ScrollAlignment::alignCenterIfNeeded);
 
@@ -680,8 +678,6 @@ private:
 
     IntSize scrollbarOffset(const Scrollbar*) const;
     
-    void updateOverflowStatus(bool horizontalOverflow, bool verticalOverflow);
-
     void childVisibilityChanged(bool newVisibility);
     void dirtyVisibleDescendantStatus();
     void updateVisibilityStatus();
@@ -755,6 +751,9 @@ private:
             ;
     }
 
+    LayoutUnit verticalScrollbarStart(int minX, int maxX) const;
+    LayoutUnit horizontalScrollbarStart(int minX) const;
+
 protected:
     // The bitfields are up here so they will fall into the padding from ScrollableArea on 64-bit.
 
@@ -773,9 +772,6 @@ protected:
     bool m_inOverflowRelayout : 1;
     unsigned m_repaintStatus : 2; // RepaintStatus
 
-    bool m_overflowStatusDirty : 1;
-    bool m_horizontalOverflow : 1;
-    bool m_verticalOverflow : 1;
     bool m_visibleContentStatusDirty : 1;
     bool m_hasVisibleContent : 1;
     bool m_visibleDescendantStatusDirty : 1;
@@ -821,7 +817,7 @@ protected:
     // Our scroll offsets if the view is scrolled.
     IntSize m_scrollOffset;
 
-    LayoutSize m_scrollOverflow;
+    IntSize m_scrollOverflow;
     
     // The width/height of our scrolled area.
     LayoutSize m_scrollSize;
diff --git a/Source/WebCore/rendering/RenderLayerBacking.cpp b/Source/WebCore/rendering/RenderLayerBacking.cpp
index f559970b4..daed5c265 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.cpp
+++ b/Source/WebCore/rendering/RenderLayerBacking.cpp
@@ -210,22 +210,21 @@ static bool layerOrAncestorIsTransformed(RenderLayer* layer)
     
     return false;
 }
-    
-#if ENABLE(FULLSCREEN_API)
-static bool layerOrAncestorIsFullScreen(RenderLayer* layer)
+
+bool RenderLayerBacking::shouldClipCompositedBounds() const
 {
-    // Don't traverse through the render layer tree if we do not yet have a full screen renderer.        
-    if (!layer->renderer()->document()->fullScreenRenderer())
+    if (m_usingTiledCacheLayer)
+        return true;
+
+    if (!compositor()->compositingConsultsOverlap())
         return false;
 
-    for (RenderLayer* curr = layer; curr; curr = curr->parent()) {
-        if (curr->renderer()->isRenderFullScreen())
-            return true;
-    }
-    
-    return false;
+    if (layerOrAncestorIsTransformed(m_owningLayer))
+        return false;
+
+    return true;
 }
-#endif
+
 
 void RenderLayerBacking::updateCompositedBounds()
 {
@@ -233,14 +232,8 @@ void RenderLayerBacking::updateCompositedBounds()
 
     // Clip to the size of the document or enclosing overflow-scroll layer.
     // If this or an ancestor is transformed, we can't currently compute the correct rect to intersect with.
-    // We'd need RenderObject::convertContainerToLocalQuad(), which doesn't yet exist.  If this
-    // is a fullscreen renderer, don't clip to the viewport, as the renderer will be asked to
-    // display outside of the viewport bounds.
-    if (compositor()->compositingConsultsOverlap() && !layerOrAncestorIsTransformed(m_owningLayer) 
-#if ENABLE(FULLSCREEN_API)
-        && !layerOrAncestorIsFullScreen(m_owningLayer)
-#endif
-        ) {
+    // We'd need RenderObject::convertContainerToLocalQuad(), which doesn't yet exist.
+    if (shouldClipCompositedBounds()) {
         RenderView* view = m_owningLayer->renderer()->view();
         RenderLayer* rootLayer = view->layer();
 
diff --git a/Source/WebCore/rendering/RenderLayerBacking.h b/Source/WebCore/rendering/RenderLayerBacking.h
index e1fafc0ac..a75e318b9 100644
--- a/Source/WebCore/rendering/RenderLayerBacking.h
+++ b/Source/WebCore/rendering/RenderLayerBacking.h
@@ -199,7 +199,9 @@ private:
 
     bool containsNonEmptyRenderers() const;
     bool hasVisibleNonCompositingDescendantLayers() const;
-    
+
+    bool shouldClipCompositedBounds() const;
+
     void paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*, const IntRect& paintDirtyRect, PaintBehavior, GraphicsLayerPaintingPhase, RenderObject* paintingRoot);
 
     static int graphicsLayerToCSSProperty(AnimatedPropertyID);
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.cpp b/Source/WebCore/rendering/RenderLayerCompositor.cpp
index 75a280c95..dbcbf2158 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/Source/WebCore/rendering/RenderLayerCompositor.cpp
@@ -75,6 +75,58 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+class RenderLayerCompositor::OverlapMap {
+    WTF_MAKE_NONCOPYABLE(OverlapMap);
+public:
+    OverlapMap()
+    {
+        // Begin assuming the root layer will be composited so that there is
+        // something on the stack. The root layer should also never get an
+        // popCompositingContainer call.
+        pushCompositingContainer();
+    }
+
+    void add(const RenderLayer* layer, const IntRect& bounds)
+    {
+        // Layers do not contribute to overlap immediately--instead, they will
+        // contribute to overlap as soon as their composited ancestor has been
+        // recursively processed and popped off the stack.
+        ASSERT(m_overlapStack.size() >= 2);
+        m_overlapStack[m_overlapStack.size() - 2].unite(bounds);
+        m_layers.add(layer);
+    }
+
+    bool contains(const RenderLayer* layer)
+    {
+        return m_layers.contains(layer);
+    }
+
+    bool overlapsLayers(const IntRect& bounds) const
+    {
+        return m_overlapStack.last().intersects(bounds);
+    }
+
+    bool isEmpty()
+    {
+        return m_layers.isEmpty();
+    }
+
+    void pushCompositingContainer()
+    {
+        m_overlapStack.append(Region());
+    }
+
+    void popCompositingContainer()
+    {
+        m_overlapStack[m_overlapStack.size() - 2].unite(m_overlapStack.last());
+        m_overlapStack.removeLast();
+    }
+
+private:
+    Vector<Region> m_overlapStack;
+    HashSet<const RenderLayer*> m_layers;
+};
+
 struct CompositingState {
     CompositingState(RenderLayer* compAncestor)
         : m_compositingAncestor(compAncestor)
@@ -365,6 +417,11 @@ bool RenderLayerCompositor::updateBacking(RenderLayer* layer, CompositingChangeR
 
             layer->ensureBacking();
 
+            // The RenderLayer's needs to update repaint rects here, because the target
+            // repaintContainer may have changed after becoming a composited layer.
+            // https://bugs.webkit.org/show_bug.cgi?id=80641
+            layer->computeRepaintRects();
+
 #if PLATFORM(MAC) && USE(CA)
             Settings* settings = m_renderView->document()->settings();
             if (settings && settings->acceleratedDrawingEnabled())
@@ -586,12 +643,12 @@ void RenderLayerCompositor::addToOverlapMap(OverlapMap& overlapMap, RenderLayer*
 
     if (!boundsComputed) {
         layerBounds = layer->renderer()->localToAbsoluteQuad(FloatRect(layer->localBoundingBox())).enclosingBoundingBox();
-        // Empty rects never intersect, but we need them to for the purposes of overlap testing.
-        if (layerBounds.isEmpty())
-            layerBounds.setSize(IntSize(1, 1));
         boundsComputed = true;
     }
 
+    if (layerBounds.isEmpty())
+        return;
+
     IntRect clipRect = pixelSnappedIntRect(layer->backgroundClipRect(rootRenderLayer(), 0, true).rect()); // FIXME: Incorrect for CSS regions.
     clipRect.scale(pageScaleFactor());
     clipRect.intersect(layerBounds);
@@ -637,18 +694,6 @@ void RenderLayerCompositor::addToOverlapMapRecursive(OverlapMap& overlapMap, Ren
     }
 }
 
-bool RenderLayerCompositor::overlapsCompositedLayers(OverlapMap& overlapMap, const IntRect& layerBounds)
-{
-    RenderLayerCompositor::OverlapMap::const_iterator end = overlapMap.end();
-    for (RenderLayerCompositor::OverlapMap::const_iterator it = overlapMap.begin(); it != end; ++it) {
-        const IntRect& bounds = it->second;
-        if (layerBounds.intersects(bounds))
-            return true;
-    }
-    
-    return false;
-}
-
 //  Recurse through the layers in z-index and overflow order (which is equivalent to painting order)
 //  For the z-order children of a compositing layer:
 //      If a child layers has a compositing layer, then all subsequent layers must
@@ -675,10 +720,8 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
         // If we're testing for overlap, we only need to composite if we overlap something that is already composited.
         absBounds = layer->renderer()->localToAbsoluteQuad(FloatRect(layer->localBoundingBox())).enclosingBoundingBox();
         // Empty rects never intersect, but we need them to for the purposes of overlap testing.
-        if (absBounds.isEmpty())
-            absBounds.setSize(IntSize(1, 1));
         haveComputedBounds = true;
-        mustOverlapCompositedLayers = overlapsCompositedLayers(*overlapMap, absBounds);
+        mustOverlapCompositedLayers = overlapMap->overlapsLayers(absBounds);
     }
     
     layer->setMustOverlapCompositedLayers(mustOverlapCompositedLayers);
@@ -688,7 +731,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     // ancestor with m_subtreeIsCompositing set to false.
     CompositingState childState(compositingState.m_compositingAncestor);
 #ifndef NDEBUG
-    ++childState.m_depth;
+    childState.m_depth = compositingState.m_depth + 1;
 #endif
 
     bool willBeComposited = needsToBeComposited(layer);
@@ -697,10 +740,9 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
         compositingState.m_subtreeIsCompositing = true;
         // This layer now acts as the ancestor for kids.
         childState.m_compositingAncestor = layer;
-    }
 
-    if (overlapMap && childState.m_compositingAncestor && !childState.m_compositingAncestor->isRootLayer()) {
-        addToOverlapMap(*overlapMap, layer, absBounds, haveComputedBounds);
+        if (overlapMap)
+            overlapMap->pushCompositingContainer();
     }
 
 #if ENABLE(VIDEO)
@@ -726,7 +768,7 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
                     layer->setMustOverlapCompositedLayers(true);
                     childState.m_compositingAncestor = layer;
                     if (overlapMap)
-                        addToOverlapMap(*overlapMap, layer, absBounds, haveComputedBounds);
+                        overlapMap->pushCompositingContainer();
                     willBeComposited = true;
                 }
             }
@@ -760,13 +802,22 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     
     ASSERT(willBeComposited == needsToBeComposited(layer));
 
+    // All layers (even ones that aren't being composited) need to get added to
+    // the overlap map. Layers that do not composite will draw into their
+    // compositing ancestor's backing, and so are still considered for overlap.
+    if (overlapMap && childState.m_compositingAncestor && !childState.m_compositingAncestor->isRootLayer())
+        addToOverlapMap(*overlapMap, layer, absBounds, haveComputedBounds);
+
     // If we have a software transform, and we have layers under us, we need to also
     // be composited. Also, if we have opacity < 1, then we need to be a layer so that
     // the child layers are opaque, then rendered with opacity on this layer.
     if (!willBeComposited && canBeComposited(layer) && childState.m_subtreeIsCompositing && requiresCompositingWhenDescendantsAreCompositing(layer->renderer())) {
         layer->setMustOverlapCompositedLayers(true);
-        if (overlapMap)
+        childState.m_compositingAncestor = layer;
+        if (overlapMap) {
+            overlapMap->pushCompositingContainer();
             addToOverlapMapRecursive(*overlapMap, layer);
+        }
         willBeComposited = true;
     }
 
@@ -784,11 +835,17 @@ void RenderLayerCompositor::computeCompositingRequirements(RenderLayer* layer, O
     // setHasCompositingDescendant() may have changed the answer to needsToBeComposited() when clipping,
     // so test that again.
     if (!willBeComposited && canBeComposited(layer) && clipsCompositingDescendants(layer)) {
-        if (overlapMap)
+        childState.m_compositingAncestor = layer;
+        if (overlapMap) {
+            overlapMap->pushCompositingContainer();
             addToOverlapMapRecursive(*overlapMap, layer);
+        }
         willBeComposited = true;
     }
 
+    if (overlapMap && childState.m_compositingAncestor == layer && !layer->isRootLayer())
+        overlapMap->popCompositingContainer();
+
     // If we're back at the root, and no other layers need to be composited, and the root layer itself doesn't need
     // to be composited, then we can drop out of compositing mode altogether. However, don't drop out of compositing mode
     // if there are composited layers that we didn't hit in our traversal (e.g. because of visibility:hidden).
@@ -939,13 +996,6 @@ void RenderLayerCompositor::rebuildCompositingLayerTree(RenderLayer* layer, Vect
             }
         }
 
-#if ENABLE(FULLSCREEN_API)
-        // For the sake of clients of the full screen renderer, don't reparent
-        // the full screen layer out from under them if they're in the middle of
-        // animating.
-        if (layer->renderer()->isRenderFullScreen() && m_renderView->document()->isAnimatingFullScreen())
-            return;
-#endif
         childLayersOfEnclosingLayer.append(layerBacking->childForSuperlayers());
     }
 }
@@ -978,7 +1028,7 @@ void RenderLayerCompositor::frameViewDidScroll()
     IntPoint scrollPosition = frameView->scrollPosition();
 
     if (RenderLayerBacking* backing = rootRenderLayer()->backing())
-        backing->graphicsLayer()->visibleRectChanged();
+        backing->graphicsLayer()->visibleRectChanged(frameView->visibleContentRect(false /* exclude scrollbars */));
 
     if (!m_scrollLayer)
         return;
@@ -1338,7 +1388,6 @@ bool RenderLayerCompositor::requiresCompositingLayer(const RenderLayer* layer) c
              || (canRender3DTransforms() && renderer->style()->backfaceVisibility() == BackfaceVisibilityHidden)
              || clipsCompositingDescendants(layer)
              || requiresCompositingForAnimation(renderer)
-             || requiresCompositingForFullScreen(renderer)
              || requiresCompositingForFilters(renderer)
              || requiresCompositingForPosition(renderer, layer);
 }
@@ -1505,6 +1554,12 @@ bool RenderLayerCompositor::requiresCompositingForAnimation(RenderObject* render
 
     if (AnimationController* animController = renderer->animation()) {
         return (animController->isRunningAnimationOnRenderer(renderer, CSSPropertyOpacity) && inCompositingMode())
+#if ENABLE(CSS_FILTERS)
+#if !defined(BUILDING_ON_SNOW_LEOPARD) && !defined(BUILDING_ON_LION)
+            // <rdar://problem/10907251> - WebKit2 doesn't support CA animations of CI filters on Lion and below
+            || animController->isRunningAnimationOnRenderer(renderer, CSSPropertyWebkitFilter)
+#endif // !SNOW_LEOPARD && !LION
+#endif // CSS_FILTERS
             || animController->isRunningAnimationOnRenderer(renderer, CSSPropertyWebkitTransform);
     }
     return false;
@@ -1515,16 +1570,6 @@ bool RenderLayerCompositor::requiresCompositingWhenDescendantsAreCompositing(Ren
     return renderer->hasTransform() || renderer->isTransparent() || renderer->hasMask() || renderer->hasReflection() || renderer->hasFilter();
 }
     
-bool RenderLayerCompositor::requiresCompositingForFullScreen(RenderObject* renderer) const
-{
-#if ENABLE(FULLSCREEN_API)
-    return renderer->isRenderFullScreen() && m_renderView->document()->isAnimatingFullScreen();
-#else
-    UNUSED_PARAM(renderer);
-    return false;
-#endif
-}
-
 bool RenderLayerCompositor::requiresCompositingForFilters(RenderObject* renderer) const
 {
 #if ENABLE(CSS_FILTERS)
diff --git a/Source/WebCore/rendering/RenderLayerCompositor.h b/Source/WebCore/rendering/RenderLayerCompositor.h
index 86aea07a6..98a2a9f95 100644
--- a/Source/WebCore/rendering/RenderLayerCompositor.h
+++ b/Source/WebCore/rendering/RenderLayerCompositor.h
@@ -210,6 +210,8 @@ public:
     void documentBackgroundColorDidChange();
 
 private:
+    class OverlapMap;
+
     // GraphicsLayerClient Implementation
     virtual void notifyAnimationStarted(const GraphicsLayer*, double) { }
     virtual void notifySyncRequired(const GraphicsLayer*) { scheduleLayerFlush(); }
@@ -233,10 +235,8 @@ private:
     // Repaint the given rect (which is layer's coords), and regions of child layers that intersect that rect.
     void recursiveRepaintLayerRect(RenderLayer*, const IntRect&);
 
-    typedef HashMap<RenderLayer*, IntRect> OverlapMap;
     void addToOverlapMap(OverlapMap&, RenderLayer*, IntRect& layerBounds, bool& boundsComputed);
     void addToOverlapMapRecursive(OverlapMap&, RenderLayer*);
-    static bool overlapsCompositedLayers(OverlapMap&, const IntRect& layerBounds);
 
     void updateCompositingLayersTimerFired(Timer<RenderLayerCompositor>*);
 
@@ -282,7 +282,6 @@ private:
     bool requiresCompositingForPlugin(RenderObject*) const;
     bool requiresCompositingForFrame(RenderObject*) const;
     bool requiresCompositingWhenDescendantsAreCompositing(RenderObject*) const;
-    bool requiresCompositingForFullScreen(RenderObject*) const;
     bool requiresCompositingForFilters(RenderObject*) const;
     bool requiresCompositingForScrollableFrame() const;
     bool requiresCompositingForPosition(RenderObject*, const RenderLayer*) const;
diff --git a/Source/WebCore/rendering/RenderListBox.cpp b/Source/WebCore/rendering/RenderListBox.cpp
index 68ae283e3..e9b0ede36 100644
--- a/Source/WebCore/rendering/RenderListBox.cpp
+++ b/Source/WebCore/rendering/RenderListBox.cpp
@@ -316,7 +316,7 @@ void RenderListBox::paintObject(PaintInfo& paintInfo, const LayoutPoint& paintOf
     }
 }
 
-void RenderListBox::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint& additionalOffset)
+void RenderListBox::addFocusRingRects(Vector<IntRect>& rects, const LayoutPoint& additionalOffset)
 {
     if (!isSpatialNavigationEnabled(frame()))
         return RenderBlock::addFocusRingRects(rects, additionalOffset);
@@ -326,7 +326,7 @@ void RenderListBox::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoi
     // Focus the last selected item.
     int selectedItem = select->activeSelectionEndListIndex();
     if (selectedItem >= 0) {
-        rects.append(itemBoundingBoxRect(additionalOffset, selectedItem));
+        rects.append(pixelSnappedIntRect(itemBoundingBoxRect(additionalOffset, selectedItem)));
         return;
     }
 
@@ -336,7 +336,7 @@ void RenderListBox::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoi
     for (int i = 0; i < size; ++i) {
         HTMLElement* element = listItems[i];
         if (element->hasTagName(optionTag) && !toHTMLOptionElement(element)->disabled()) {
-            rects.append(itemBoundingBoxRect(additionalOffset, i));
+            rects.append(pixelSnappedIntRect(itemBoundingBoxRect(additionalOffset, i)));
             return;
         }
     }
@@ -409,7 +409,7 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, const LayoutPoint&
 
     unsigned length = itemText.length();
     const UChar* string = itemText.characters();
-    TextRun textRun(string, length, false, 0, 0, TextRun::AllowTrailingExpansion, itemStyle->direction(), itemStyle->unicodeBidi() == Override, TextRun::NoRounding);
+    TextRun textRun(string, length, false, 0, 0, TextRun::AllowTrailingExpansion, itemStyle->direction(), isOverride(itemStyle->unicodeBidi()), TextRun::NoRounding);
     Font itemFont = style()->font();
     LayoutRect r = itemBoundingBoxRect(paintOffset, listIndex);
     r.move(itemOffsetForAlignment(textRun, itemStyle, itemFont, r));
@@ -643,15 +643,15 @@ int RenderListBox::verticalScrollbarWidth() const
 
 // FIXME: We ignore padding in the vertical direction as far as these values are concerned, since that's
 // how the control currently paints.
-LayoutUnit RenderListBox::scrollWidth() const
+int RenderListBox::scrollWidth() const
 {
     // There is no horizontal scrolling allowed.
-    return clientWidth();
+    return pixelSnappedClientWidth();
 }
 
 int RenderListBox::scrollHeight() const
 {
-    return max(pixelSnappedClientHeight(), listHeight());
+    return max(pixelSnappedClientHeight(), roundToInt(listHeight()));
 }
 
 int RenderListBox::scrollLeft() const
diff --git a/Source/WebCore/rendering/RenderListBox.h b/Source/WebCore/rendering/RenderListBox.h
index 407fa5247..707b61d40 100644
--- a/Source/WebCore/rendering/RenderListBox.h
+++ b/Source/WebCore/rendering/RenderListBox.h
@@ -77,7 +77,7 @@ private:
 
     virtual void layout();
 
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
 
     virtual bool canBeProgramaticallyScrolled() const { return true; }
     virtual void autoscroll();
@@ -97,9 +97,9 @@ private:
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
 
     // ScrollableArea interface.
-    virtual LayoutUnit scrollSize(ScrollbarOrientation) const;
-    virtual LayoutUnit scrollPosition(Scrollbar*) const;
-    virtual void setScrollOffset(const LayoutPoint&);
+    virtual int scrollSize(ScrollbarOrientation) const;
+    virtual int scrollPosition(Scrollbar*) const;
+    virtual void setScrollOffset(const IntPoint&);
     virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&);
     virtual bool isActive() const;
     virtual bool isScrollCornerVisible() const { return false; } // We don't support resize on list boxes yet. If we did these would have to change.
diff --git a/Source/WebCore/rendering/RenderListItem.cpp b/Source/WebCore/rendering/RenderListItem.cpp
index 883218d4f..6c0677ed8 100644
--- a/Source/WebCore/rendering/RenderListItem.cpp
+++ b/Source/WebCore/rendering/RenderListItem.cpp
@@ -247,14 +247,15 @@ void RenderListItem::updateMarkerLocation()
             LayoutStateDisabler layoutStateDisabler(view());
             updateFirstLetter();
             m_marker->remove();
-            // If markerPar is an anonymous block that will lose all its children, destroy it
-            if (markerPar && (markerPar != lineBoxParent) && markerPar->isAnonymousBlock() && !(toRenderBlock(markerPar)->firstChild()))
-                markerPar->destroy();
             if (!lineBoxParent)
                 lineBoxParent = this;
             lineBoxParent->addChild(m_marker, firstNonMarkerChild(lineBoxParent));
             if (m_marker->preferredLogicalWidthsDirty())
                 m_marker->computePreferredLogicalWidths();
+            // If markerPar is an anonymous block that has lost all its children, destroy it.
+            // Extraneous anonymous blocks can cause problems for RenderBlock::updateBeforeAfterContent.
+            if (markerPar && markerPar->isAnonymousBlock() && !markerPar->firstChild() && !toRenderBlock(markerPar)->continuation())
+                markerPar->destroy();
         }
     }
 }
diff --git a/Source/WebCore/rendering/RenderListMarker.cpp b/Source/WebCore/rendering/RenderListMarker.cpp
index fe193987c..8c804549e 100644
--- a/Source/WebCore/rendering/RenderListMarker.cpp
+++ b/Source/WebCore/rendering/RenderListMarker.cpp
@@ -1094,7 +1094,7 @@ IntRect RenderListMarker::localSelectionRect()
 {
     InlineBox* box = inlineBoxWrapper();
     if (!box)
-        return IntRect(0, 0, width(), height());
+        return IntRect(IntPoint(), size());
     RootInlineBox* root = m_inlineBoxWrapper->root();
     int newLogicalTop = root->block()->style()->isFlippedBlocksWritingMode() ? m_inlineBoxWrapper->logicalBottom() - root->selectionBottom() : root->selectionTop() - m_inlineBoxWrapper->logicalTop();
     if (root->block()->style()->isHorizontalWritingMode())
@@ -1694,11 +1694,12 @@ IntRect RenderListMarker::getRelativeMarkerRect()
 
 void RenderListMarker::setSelectionState(SelectionState state)
 {
+    // The selection state for our containing block hierarchy is updated by the base class call.
     RenderBox::setSelectionState(state);
-    if (InlineBox* box = inlineBoxWrapper())
-        if (RootInlineBox* root = box->root())
+
+    if (m_inlineBoxWrapper && canUpdateSelectionOnRootLineBoxes())
+        if (RootInlineBox* root = m_inlineBoxWrapper->root())
             root->setHasSelectedChildren(state != SelectionNone);
-    containingBlock()->setSelectionState(state);
 }
 
 LayoutRect RenderListMarker::selectionRectForRepaint(RenderBoxModelObject* repaintContainer, bool clipToVisibleContent)
diff --git a/Source/WebCore/rendering/RenderMediaControls.cpp b/Source/WebCore/rendering/RenderMediaControls.cpp
index 97d2774da..f791274e7 100644
--- a/Source/WebCore/rendering/RenderMediaControls.cpp
+++ b/Source/WebCore/rendering/RenderMediaControls.cpp
@@ -90,12 +90,23 @@ static const int mediaSliderThumbHeight = 14;
 
 void RenderMediaControls::adjustMediaSliderThumbSize(RenderStyle* style)
 {
-    ControlPart part = style->appearance();
-    if (part != MediaSliderThumbPart && part != MediaVolumeSliderThumbPart)
+    int part;
+    switch (style->appearance()) {
+    case MediaSliderThumbPart:
+        part = MediaSliderThumb;
+        break;
+    case MediaVolumeSliderThumbPart:
+        part = MediaVolumeSliderThumb;
+        break;
+    case MediaFullScreenVolumeSliderThumbPart:
+        part = MediaFullScreenVolumeSliderThumb;
+        break;
+    default:
         return;
+    }
 
     CGSize size;
-    wkMeasureMediaUIPart(part == MediaSliderThumbPart ? MediaSliderThumb : MediaVolumeSliderThumb, WKMediaControllerThemeQuickTime, 0, &size);
+    wkMeasureMediaUIPart(part, WKMediaControllerThemeQuickTime, 0, &size);
 
     float zoomLevel = style->effectiveZoom();
     style->setWidth(Length(static_cast<int>(size.width * zoomLevel), Fixed));
@@ -163,6 +174,12 @@ bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, R
         case MediaVolumeSliderThumb:
             wkDrawMediaUIPart(WKMediaUIPartVolumeSliderThumb, themeStyle, paintInfo.context->platformContext(), r, determineState(o));
             break;
+        case MediaFullScreenVolumeSlider:
+            wkDrawMediaUIPart(WKMediaUIPartFullScreenVolumeSlider, themeStyle, paintInfo.context->platformContext(), r, determineState(o));
+            break;
+        case MediaFullScreenVolumeSliderThumb:
+            wkDrawMediaUIPart(WKMediaUIPartFullScreenVolumeSliderThumb, themeStyle, paintInfo.context->platformContext(), r, determineState(o));
+            break;
         case MediaTimelineContainer:
             wkDrawMediaUIPart(WKMediaUIPartBackground, themeStyle, paintInfo.context->platformContext(), r, determineState(o));
             break;
diff --git a/Source/WebCore/rendering/RenderMediaControlsChromium.cpp b/Source/WebCore/rendering/RenderMediaControlsChromium.cpp
index 8a2580515..66b088260 100644
--- a/Source/WebCore/rendering/RenderMediaControlsChromium.cpp
+++ b/Source/WebCore/rendering/RenderMediaControlsChromium.cpp
@@ -238,6 +238,16 @@ static bool paintMediaTimelineContainer(RenderObject* object, const PaintInfo& p
     return true;
 }
 
+static bool paintMediaFullscreenButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    HTMLMediaElement* mediaElement = toParentMediaElement(object);
+    if (!mediaElement)
+        return false;
+
+    DEFINE_STATIC_LOCAL(Image*, mediaFullscreen, (platformResource("mediaFullscreen")));
+    return paintMediaButton(paintInfo.context, rect, mediaFullscreen);
+}
+
 bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType part, RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     switch (part) {
@@ -257,8 +267,9 @@ bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType
         return paintMediaVolumeSliderThumb(object, paintInfo, rect);
     case MediaTimelineContainer:
         return paintMediaTimelineContainer(object, paintInfo, rect);
-    case MediaVolumeSliderMuteButton:
     case MediaFullscreenButton:
+        return paintMediaFullscreenButton(object, paintInfo, rect);
+    case MediaVolumeSliderMuteButton:
     case MediaSeekBackButton:
     case MediaSeekForwardButton:
     case MediaVolumeSliderContainer:
@@ -272,6 +283,8 @@ bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType
     case MediaHideClosedCaptionsButton:
     case MediaTextTrackDisplayContainer:
     case MediaTextTrackDisplay:
+    case MediaFullScreenVolumeSlider:
+    case MediaFullScreenVolumeSliderThumb:
         ASSERT_NOT_REACHED();
         break;
     }
diff --git a/Source/WebCore/rendering/RenderMenuList.cpp b/Source/WebCore/rendering/RenderMenuList.cpp
index 3f7ac3081..a47aebbae 100644
--- a/Source/WebCore/rendering/RenderMenuList.cpp
+++ b/Source/WebCore/rendering/RenderMenuList.cpp
@@ -447,7 +447,8 @@ PopupMenuStyle RenderMenuList::itemStyle(unsigned listIndex) const
     HTMLElement* element = listItems[listIndex];
     
     RenderStyle* style = element->renderStyle() ? element->renderStyle() : element->computedStyle();
-    return style ? PopupMenuStyle(style->visitedDependentColor(CSSPropertyColor), itemBackgroundColor(listIndex), style->font(), style->visibility() == VISIBLE, style->display() == NONE, style->textIndent(), style->direction(), style->unicodeBidi() == Override) : menuStyle();
+    return style ? PopupMenuStyle(style->visitedDependentColor(CSSPropertyColor), itemBackgroundColor(listIndex), style->font(), style->visibility() == VISIBLE,
+        style->display() == NONE, style->textIndent(), style->direction(), isOverride(style->unicodeBidi())) : menuStyle();
 }
 
 Color RenderMenuList::itemBackgroundColor(unsigned listIndex) const
@@ -476,7 +477,8 @@ Color RenderMenuList::itemBackgroundColor(unsigned listIndex) const
 PopupMenuStyle RenderMenuList::menuStyle() const
 {
     RenderStyle* s = m_innerBlock ? m_innerBlock->style() : style();
-    return PopupMenuStyle(s->visitedDependentColor(CSSPropertyColor), s->visitedDependentColor(CSSPropertyBackgroundColor), s->font(), s->visibility() == VISIBLE, s->display() == NONE, s->textIndent(), style()->direction(), style()->unicodeBidi() == Override);
+    return PopupMenuStyle(s->visitedDependentColor(CSSPropertyColor), s->visitedDependentColor(CSSPropertyBackgroundColor), s->font(), s->visibility() == VISIBLE,
+        s->display() == NONE, s->textIndent(), style()->direction(), isOverride(style()->unicodeBidi()));
 }
 
 HostWindow* RenderMenuList::hostWindow() const
diff --git a/Source/WebCore/rendering/RenderMenuList.h b/Source/WebCore/rendering/RenderMenuList.h
index 27872eba2..7466b1ff9 100644
--- a/Source/WebCore/rendering/RenderMenuList.h
+++ b/Source/WebCore/rendering/RenderMenuList.h
@@ -67,7 +67,7 @@ private:
 
     virtual LayoutRect controlClipRect(const LayoutPoint&) const;
     virtual bool hasControlClip() const { return true; }
-    virtual RenderText* buttonText() const OVERRIDE { return m_buttonText; }
+    virtual bool canHaveGeneratedChildren() const OVERRIDE { return false; }
 
     virtual const char* renderName() const { return "RenderMenuList"; }
 
diff --git a/Source/WebCore/rendering/RenderObject.cpp b/Source/WebCore/rendering/RenderObject.cpp
index a91b7f89c..fbe452577 100755
--- a/Source/WebCore/rendering/RenderObject.cpp
+++ b/Source/WebCore/rendering/RenderObject.cpp
@@ -644,8 +644,9 @@ void RenderObject::markContainingBlocksForLayout(bool scheduleRelayout, RenderOb
         if (!container && !object->isRenderView())
             return;
         if (!last->isText() && last->style()->isPositioned()) {
-            bool willSkipRelativelyPositionedInlines = !object->isRenderBlock();
-            while (object && !object->isRenderBlock()) // Skip relatively positioned inlines and get to the enclosing RenderBlock.
+            bool willSkipRelativelyPositionedInlines = !object->isRenderBlock() || object->isAnonymousBlock();
+            // Skip relatively positioned inlines and anonymous blocks to get to the enclosing RenderBlock.
+            while (object && (!object->isRenderBlock() || object->isAnonymousBlock()))
                 object = object->container();
             if (!object || object->posChildNeedsLayout())
                 return;
@@ -1109,7 +1110,7 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
     
 void RenderObject::paintFocusRing(GraphicsContext* context, const LayoutPoint& paintOffset, RenderStyle* style)
 {
-    Vector<LayoutRect> focusRingRects;
+    Vector<IntRect> focusRingRects;
     addFocusRingRects(focusRingRects, paintOffset);
     if (style->outlineStyleIsAuto())
         context->drawFocusRing(focusRingRects, style->outlineWidth(), style->outlineOffset(), style->visitedDependentColor(CSSPropertyOutlineColor));
@@ -1196,7 +1197,7 @@ void RenderObject::paintOutline(GraphicsContext* graphicsContext, const LayoutRe
         graphicsContext->endTransparencyLayer();
 }
 
-LayoutRect RenderObject::absoluteBoundingBoxRect(bool useTransforms) const
+IntRect RenderObject::absoluteBoundingBoxRect(bool useTransforms) const
 {
     if (useTransforms) {
         Vector<FloatQuad> quads;
@@ -1206,29 +1207,29 @@ LayoutRect RenderObject::absoluteBoundingBoxRect(bool useTransforms) const
         if (!n)
             return IntRect();
     
-        LayoutRect result = quads[0].enclosingBoundingBox();
+        IntRect result = quads[0].enclosingBoundingBox();
         for (size_t i = 1; i < n; ++i)
             result.unite(quads[i].enclosingBoundingBox());
         return result;
     }
 
     FloatPoint absPos = localToAbsolute();
-    Vector<LayoutRect> rects;
+    Vector<IntRect> rects;
     absoluteRects(rects, flooredLayoutPoint(absPos));
 
     size_t n = rects.size();
     if (!n)
-        return LayoutRect();
+        return IntRect();
 
     LayoutRect result = rects[0];
     for (size_t i = 1; i < n; ++i)
         result.unite(rects[i]);
-    return result;
+    return pixelSnappedIntRect(result);
 }
 
 void RenderObject::absoluteFocusRingQuads(Vector<FloatQuad>& quads)
 {
-    Vector<LayoutRect> rects;
+    Vector<IntRect> rects;
     // FIXME: addFocusRingRects() needs to be passed this transform-unaware
     // localToAbsolute() offset here because RenderInline::addFocusRingRects()
     // implicitly assumes that. This doesn't work correctly with transformed
@@ -1237,7 +1238,7 @@ void RenderObject::absoluteFocusRingQuads(Vector<FloatQuad>& quads)
     addFocusRingRects(rects, flooredLayoutPoint(absolutePoint));
     size_t count = rects.size(); 
     for (size_t i = 0; i < count; ++i) {
-        LayoutRect rect = rects[i];
+        IntRect rect = rects[i];
         rect.move(-absolutePoint.x(), -absolutePoint.y());
         quads.append(localToAbsoluteQuad(FloatQuad(rect)));
     }
@@ -1519,7 +1520,7 @@ void RenderObject::computeRectForRepaint(RenderBoxModelObject* repaintContainer,
             LayoutRect repaintRect(rect);
             repaintRect.move(-boxParent->scrolledContentOffset()); // For overflow:auto/scroll/hidden.
 
-            LayoutRect boxRect(LayoutPoint(), boxParent->layer()->size());
+            LayoutRect boxRect(LayoutPoint(), boxParent->cachedSizeForOverflowClip());
             rect = intersection(repaintRect, boxRect);
             if (rect.isEmpty())
                 return;
@@ -2093,6 +2094,15 @@ FloatQuad RenderObject::localToContainerQuad(const FloatQuad& localQuad, RenderB
     return transformState.lastPlanarQuad();
 }
 
+FloatPoint RenderObject::localToContainerPoint(const FloatPoint& localPoint, RenderBoxModelObject* repaintContainer, bool fixed, bool* wasFixed) const
+{
+    TransformState transformState(TransformState::ApplyTransformDirection, localPoint);
+    mapLocalToContainer(repaintContainer, fixed, true, transformState, wasFixed);
+    transformState.flatten();
+
+    return transformState.lastPlanarPoint();
+}
+
 LayoutSize RenderObject::offsetFromContainer(RenderObject* o, const LayoutPoint& point) const
 {
     ASSERT(o == container());
@@ -2230,6 +2240,21 @@ bool RenderObject::isSelectionBorder() const
     return st == SelectionStart || st == SelectionEnd || st == SelectionBoth;
 }
 
+inline void RenderObject::clearLayoutRootIfNeeded() const
+{
+    if (node() && !documentBeingDestroyed() && frame()) {
+        if (FrameView* view = frame()->view()) {
+            if (view->layoutRoot() == this) {
+                ASSERT_NOT_REACHED();
+                // This indicates a failure to layout the child, which is why
+                // the layout root is still set to |this|. Make sure to clear it
+                // since we are getting destroyed.
+                view->clearLayoutRoot();
+            }
+        }
+    }
+}
+
 void RenderObject::willBeDestroyed()
 {
     // Destroy any leftover anonymous children.
@@ -2280,6 +2305,8 @@ void RenderObject::willBeDestroyed()
         setHasLayer(false);
         toRenderBoxModelObject(this)->destroyLayer();
     }
+
+    clearLayoutRootIfNeeded();
 }
 
 void RenderObject::destroyAndCleanupAnonymousWrappers()
@@ -2604,14 +2631,6 @@ void RenderObject::addDashboardRegions(Vector<DashboardRegionValue>& regions)
         region.bounds.setX(absPos.x() + styleRegion.offset.left().value());
         region.bounds.setY(absPos.y() + styleRegion.offset.top().value());
 
-        if (frame()) {
-            float deviceScaleFactor = frame()->page()->deviceScaleFactor();
-            if (deviceScaleFactor != 1.0f) {
-                region.bounds.scale(deviceScaleFactor);
-                region.clip.scale(deviceScaleFactor);
-            }
-        }
-
         regions.append(region);
     }
 }
@@ -2635,6 +2654,10 @@ bool RenderObject::willRenderImage(CachedImage*)
     if (style()->visibility() != VISIBLE)
         return false;
 
+    // We will not render a new image when Active DOM is suspended
+    if (document()->activeDOMObjectsAreSuspended())
+        return false;
+
     // If we're not in a window (i.e., we're dormant from being put in the b/f cache or in a background tab)
     // then we don't want to render either.
     return !document()->inPageCache() && !document()->view()->isOffscreen();
@@ -2803,6 +2826,12 @@ CursorDirective RenderObject::getCursor(const LayoutPoint&, Cursor&) const
     return SetCursorBasedOnStyle;
 }
 
+bool RenderObject::canUpdateSelectionOnRootLineBoxes()
+{
+    RenderBlock* containingBlock = this->containingBlock();
+    return containingBlock ? !containingBlock->needsLayout() : true;
+}
+
 #if ENABLE(SVG)
 
 RenderSVGResourceContainer* RenderObject::toRenderSVGResourceContainer()
diff --git a/Source/WebCore/rendering/RenderObject.h b/Source/WebCore/rendering/RenderObject.h
index ac1bfc76d..60e2a403c 100644
--- a/Source/WebCore/rendering/RenderObject.h
+++ b/Source/WebCore/rendering/RenderObject.h
@@ -286,8 +286,8 @@ public:
     virtual bool isBoxModelObject() const { return false; }
     virtual bool isCounter() const { return false; }
     virtual bool isQuote() const { return false; }
+
 #if ENABLE(DETAILS)
-    virtual bool isDetails() const { return false; }
     virtual bool isDetailsMarker() const { return false; }
 #endif
     virtual bool isEmbeddedObject() const { return false; }
@@ -325,9 +325,6 @@ public:
 
     virtual bool isSlider() const { return false; }
     virtual bool isSliderThumb() const { return false; }
-#if ENABLE(DETAILS)
-    virtual bool isSummary() const { return false; }
-#endif
     virtual bool isTable() const { return false; }
     virtual bool isTableCell() const { return false; }
     virtual bool isTableCol() const { return false; }
@@ -403,7 +400,6 @@ public:
     virtual bool isSVGResourceContainer() const { return false; }
     virtual bool isSVGResourceFilter() const { return false; }
     virtual bool isSVGResourceFilterPrimitive() const { return false; }
-    virtual bool isSVGShadowTreeRootContainer() const { return false; }
 
     virtual RenderSVGResourceContainer* toRenderSVGResourceContainer();
 
@@ -644,8 +640,10 @@ public:
     {
         return localToContainerQuad(quad, 0, fixed, wasFixed);
     }
+
     // Convert a local quad into the coordinate system of container, taking transforms into account.
     FloatQuad localToContainerQuad(const FloatQuad&, RenderBoxModelObject* repaintContainer, bool fixed = false, bool* wasFixed = 0) const;
+    FloatPoint localToContainerPoint(const FloatPoint&, RenderBoxModelObject* repaintContainer, bool fixed = false, bool* wasFixed = 0) const;
 
     // Return the offset from the container() renderer (excluding transforms). In multi-column layout,
     // different offsets apply at different points, so return the offset that applies to the given point.
@@ -653,11 +651,11 @@ public:
     // Return the offset from an object up the container() chain. Asserts that none of the intermediate objects have transforms.
     LayoutSize offsetFromAncestorContainer(RenderObject*) const;
     
-    virtual void absoluteRects(Vector<LayoutRect>&, const LayoutPoint&) const { }
+    virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint&) const { }
 
     // FIXME: useTransforms should go away eventually
-    LayoutRect absoluteBoundingBoxRect(bool useTransform = true) const;
-    LayoutRect absoluteBoundingBoxRectIgnoringTransforms() const { return absoluteBoundingBoxRect(false); }
+    IntRect absoluteBoundingBoxRect(bool useTransform = true) const;
+    IntRect absoluteBoundingBoxRectIgnoringTransforms() const { return absoluteBoundingBoxRect(false); }
 
     // Build an array of quads in absolute coords for line boxes
     virtual void absoluteQuads(Vector<FloatQuad>&, bool* /*wasFixed*/ = 0) const { }
@@ -748,9 +746,6 @@ public:
     // Applied as a "slop" to dirty rect checks during the outline painting phase's dirty-rect checks.
     LayoutUnit maximalOutlineSize(PaintPhase) const;
 
-    void setHasMarkupTruncation(bool b = true) { m_bitfields.setHasMarkupTruncation(b); }
-    bool hasMarkupTruncation() const { return m_bitfields.hasMarkupTruncation(); }
-
     enum SelectionState {
         SelectionNone, // The object is not selected.
         SelectionStart, // The object either contains the start of a selection run or is the start of a run
@@ -763,6 +758,8 @@ public:
     // descendants (as described above in the SelectionState enum declaration).
     SelectionState selectionState() const { return m_bitfields.selectionState(); }
     virtual void setSelectionState(SelectionState state) { m_bitfields.setSelectionState(state); }
+    inline void setSelectionStateIfNeeded(SelectionState);
+    bool canUpdateSelectionOnRootLineBoxes();
 
     // A single rectangle that encompasses all of the selected objects within this object.  Used to determine the tightest
     // possible bounding box for the selection.
@@ -842,7 +839,7 @@ public:
     bool shouldUseTransformFromContainer(const RenderObject* container) const;
     void getTransformFromContainer(const RenderObject* container, const LayoutSize& offsetInContainer, TransformationMatrix&) const;
     
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&) { };
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&) { };
 
     LayoutRect absoluteOutlineBounds() const
     {
@@ -872,6 +869,7 @@ protected:
 
     void adjustRectForOutlineAndShadow(LayoutRect&) const;
 
+    void clearLayoutRootIfNeeded() const;
     virtual void willBeDestroyed();
     void arenaDelete(RenderArena*, void* objectBase);
 
@@ -933,7 +931,6 @@ private:
             , m_childrenInline(false)
             , m_marginBeforeQuirk(false) 
             , m_marginAfterQuirk(false)
-            , m_hasMarkupTruncation(false)
             , m_hasColumns(false)
             , m_selectionState(SelectionNone)
         {
@@ -977,7 +974,6 @@ private:
         ADD_BOOLEAN_BITFIELD(childrenInline, ChildrenInline);
         ADD_BOOLEAN_BITFIELD(marginBeforeQuirk, MarginBeforeQuirk);
         ADD_BOOLEAN_BITFIELD(marginAfterQuirk, MarginAfterQuirk);
-        ADD_BOOLEAN_BITFIELD(hasMarkupTruncation, HasMarkupTruncation);
         ADD_BOOLEAN_BITFIELD(hasColumns, HasColumns);
 
     private:
@@ -1120,6 +1116,14 @@ inline bool RenderObject::layerCreationAllowedForSubtree() const
     return true;
 }
 
+inline void RenderObject::setSelectionStateIfNeeded(SelectionState state)
+{
+    if (selectionState() == state)
+        return;
+
+    setSelectionState(state);
+}
+
 inline void makeMatrixRenderable(TransformationMatrix& matrix, bool has3DRendering)
 {
 #if !ENABLE(3D_RENDERING)
diff --git a/Source/WebCore/rendering/RenderRegion.cpp b/Source/WebCore/rendering/RenderRegion.cpp
index 42f7d2955..5b7692a6c 100644
--- a/Source/WebCore/rendering/RenderRegion.cpp
+++ b/Source/WebCore/rendering/RenderRegion.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -139,11 +139,6 @@ void RenderRegion::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintO
     if (!m_flowThread || !isValid())
         return;
 
-    if (Frame* frame = this->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(this, paintInfo.rect);
-    }
-
     setRegionBoxesRegionStyle();
     m_flowThread->paintIntoRegion(paintInfo, this, LayoutPoint(paintOffset.x() + borderLeft() + paddingLeft(), paintOffset.y() + borderTop() + paddingTop()));
     restoreRegionBoxesOriginalStyle();
diff --git a/Source/WebCore/rendering/RenderRegion.h b/Source/WebCore/rendering/RenderRegion.h
index d46d6da67..70fa23b30 100644
--- a/Source/WebCore/rendering/RenderRegion.h
+++ b/Source/WebCore/rendering/RenderRegion.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -56,6 +56,7 @@ public:
     void attachRegion();
     void detachRegion();
 
+    RenderFlowThread* flowThread() const { return m_flowThread; }
     RenderFlowThread* parentFlowThread() const { return m_parentFlowThread; }
 
     // Valid regions do not create circular dependencies with other flows.
diff --git a/Source/WebCore/rendering/RenderReplaced.cpp b/Source/WebCore/rendering/RenderReplaced.cpp
index 6bdb1831c..39bacfa7f 100644
--- a/Source/WebCore/rendering/RenderReplaced.cpp
+++ b/Source/WebCore/rendering/RenderReplaced.cpp
@@ -137,11 +137,6 @@ void RenderReplaced::paint(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
         drawSelectionTint = false;
     }
 
-    if (Frame* frame = this->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(this, paintInfo.rect);
-    }
-
     bool completelyClippedOut = false;
     if (style()->hasBorderRadius()) {
         LayoutRect borderRect = LayoutRect(adjustedPaintOffset, size());
@@ -196,10 +191,12 @@ bool RenderReplaced::shouldPaint(PaintInfo& paintInfo, const LayoutPoint& paintO
         bottom = max(selBottom, bottom);
     }
     
-    LayoutUnit os = 2 * maximalOutlineSize(paintInfo.phase);
-    if (adjustedPaintOffset.x() + minXVisualOverflow() >= paintInfo.rect.maxX() + os || adjustedPaintOffset.x() + maxXVisualOverflow() <= paintInfo.rect.x() - os)
+    LayoutRect localRepaintRect = paintInfo.rect;
+    localRepaintRect.inflate(maximalOutlineSize(paintInfo.phase));
+    if (adjustedPaintOffset.x() + minXVisualOverflow() >= localRepaintRect.maxX() || adjustedPaintOffset.x() + maxXVisualOverflow() <= localRepaintRect.x())
         return false;
-    if (top >= paintInfo.rect.maxY() + os || bottom <= paintInfo.rect.y() - os)
+
+    if (top >= localRepaintRect.maxY() || bottom <= localRepaintRect.y())
         return false;
 
     return true;
@@ -440,9 +437,7 @@ void RenderReplaced::computePreferredLogicalWidths()
     if (style()->maxWidth().isFixed())
         m_maxPreferredLogicalWidth = min(m_maxPreferredLogicalWidth, style()->maxWidth().value() + (style()->boxSizing() == CONTENT_BOX ? borderAndPadding : zeroLayoutUnit));
 
-    if (style()->width().isPercent() || style()->height().isPercent()
-        || style()->maxWidth().isPercent() || style()->maxHeight().isPercent()
-        || style()->minWidth().isPercent() || style()->minHeight().isPercent())
+    if (hasRelativeDimensions())
         m_minPreferredLogicalWidth = 0;
     else
         m_minPreferredLogicalWidth = m_maxPreferredLogicalWidth;
@@ -500,7 +495,7 @@ IntRect RenderReplaced::localSelectionRect(bool checkWhetherSelected) const
 
     if (!m_inlineBoxWrapper)
         // We're a block-level replaced element.  Just return our own dimensions.
-        return IntRect(0, 0, width(), height());
+        return IntRect(IntPoint(), size());
     
     RootInlineBox* root = m_inlineBoxWrapper->root();
     int newLogicalTop = root->block()->style()->isFlippedBlocksWritingMode() ? m_inlineBoxWrapper->logicalBottom() - root->selectionBottom() : root->selectionTop() - m_inlineBoxWrapper->logicalTop();
@@ -509,14 +504,14 @@ IntRect RenderReplaced::localSelectionRect(bool checkWhetherSelected) const
     return IntRect(newLogicalTop, 0, root->selectionHeight(), height());
 }
 
-void RenderReplaced::setSelectionState(SelectionState s)
+void RenderReplaced::setSelectionState(SelectionState state)
 {
-    RenderBox::setSelectionState(s); // The selection state for our containing block hierarchy is updated by the base class call.
-    if (m_inlineBoxWrapper) {
-        RootInlineBox* line = m_inlineBoxWrapper->root();
-        if (line)
-            line->setHasSelectedChildren(isSelected());
-    }
+    // The selection state for our containing block hierarchy is updated by the base class call.
+    RenderBox::setSelectionState(state);
+
+    if (m_inlineBoxWrapper && canUpdateSelectionOnRootLineBoxes())
+        if (RootInlineBox* root = m_inlineBoxWrapper->root())
+            root->setHasSelectedChildren(isSelected());
 }
 
 bool RenderReplaced::isSelected() const
diff --git a/Source/WebCore/rendering/RenderScrollbar.cpp b/Source/WebCore/rendering/RenderScrollbar.cpp
index 25eb5a7b3..6f6fd53ea 100644
--- a/Source/WebCore/rendering/RenderScrollbar.cpp
+++ b/Source/WebCore/rendering/RenderScrollbar.cpp
@@ -202,7 +202,7 @@ void RenderScrollbar::updateScrollbarParts(bool destroy)
     }
     
     if (newThickness != oldThickness) {
-        setFrameRect(IntRect(x(), y(), isHorizontal ? width() : newThickness, isHorizontal ? newThickness : height()));
+        setFrameRect(IntRect(location(), IntSize(isHorizontal ? width() : newThickness, isHorizontal ? newThickness : height())));
         if (RenderBox* box = owningRenderer())
             box->setChildNeedsLayout(true);
     }
@@ -297,7 +297,7 @@ IntRect RenderScrollbar::buttonRect(ScrollbarPart partType)
     
     bool isHorizontal = orientation() == HorizontalScrollbar;
     if (partType == BackButtonStartPart)
-        return IntRect(x(), y(), isHorizontal ? partRenderer->width() : width(), isHorizontal ? height() : partRenderer->height());
+        return IntRect(location(), IntSize(isHorizontal ? partRenderer->width() : width(), isHorizontal ? height() : partRenderer->height()));
     if (partType == ForwardButtonEndPart)
         return IntRect(isHorizontal ? x() + width() - partRenderer->width() : x(),
         
@@ -355,10 +355,10 @@ IntRect RenderScrollbar::trackPieceRectWithMargins(ScrollbarPart partType, const
     IntRect rect = oldRect;
     if (orientation() == HorizontalScrollbar) {
         rect.setX(rect.x() + partRenderer->marginLeft());
-        rect.setWidth(rect.width() - (partRenderer->marginLeft() + partRenderer->marginRight()));
+        rect.setWidth(rect.width() - partRenderer->marginWidth());
     } else {
         rect.setY(rect.y() + partRenderer->marginTop());
-        rect.setHeight(rect.height() - (partRenderer->marginTop() + partRenderer->marginBottom()));
+        rect.setHeight(rect.height() - partRenderer->marginHeight());
     }
     return rect;
 }
diff --git a/Source/WebCore/rendering/RenderScrollbar.h b/Source/WebCore/rendering/RenderScrollbar.h
index 810c98ff3..7fe2fac8b 100644
--- a/Source/WebCore/rendering/RenderScrollbar.h
+++ b/Source/WebCore/rendering/RenderScrollbar.h
@@ -85,7 +85,7 @@ private:
     HashMap<unsigned, RenderScrollbarPart*> m_parts;
 };
 
-inline RenderScrollbar* toRenderScrollbar(Scrollbar* scrollbar)
+inline RenderScrollbar* toRenderScrollbar(ScrollbarThemeClient* scrollbar)
 {
     ASSERT(!scrollbar || scrollbar->isCustomScrollbar());
     return static_cast<RenderScrollbar*>(scrollbar);
diff --git a/Source/WebCore/rendering/RenderScrollbarTheme.cpp b/Source/WebCore/rendering/RenderScrollbarTheme.cpp
index 87309d44e..44e2aa631 100644
--- a/Source/WebCore/rendering/RenderScrollbarTheme.cpp
+++ b/Source/WebCore/rendering/RenderScrollbarTheme.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "RenderScrollbarTheme.h"
 #include "RenderScrollbar.h"
+#include "ScrollbarThemeClient.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -36,7 +37,7 @@ RenderScrollbarTheme* RenderScrollbarTheme::renderScrollbarTheme()
     return &theme;
 }
 
-void RenderScrollbarTheme::buttonSizesAlongTrackAxis(Scrollbar* scrollbar, int& beforeSize, int& afterSize)
+void RenderScrollbarTheme::buttonSizesAlongTrackAxis(ScrollbarThemeClient* scrollbar, int& beforeSize, int& afterSize)
 {
     IntRect firstButton = backButtonRect(scrollbar, BackButtonStartPart);
     IntRect secondButton = forwardButtonRect(scrollbar, ForwardButtonStartPart);
@@ -51,7 +52,7 @@ void RenderScrollbarTheme::buttonSizesAlongTrackAxis(Scrollbar* scrollbar, int&
     }
 }
 
-bool RenderScrollbarTheme::hasButtons(Scrollbar* scrollbar)
+bool RenderScrollbarTheme::hasButtons(ScrollbarThemeClient* scrollbar)
 {
     int startSize;
     int endSize;
@@ -59,27 +60,27 @@ bool RenderScrollbarTheme::hasButtons(Scrollbar* scrollbar)
     return (startSize + endSize) <= (scrollbar->orientation() == HorizontalScrollbar ? scrollbar->width() : scrollbar->height());
 }
 
-bool RenderScrollbarTheme::hasThumb(Scrollbar* scrollbar)
+bool RenderScrollbarTheme::hasThumb(ScrollbarThemeClient* scrollbar)
 {
     return trackLength(scrollbar) - thumbLength(scrollbar) >= 0;
 }
 
-int RenderScrollbarTheme::minimumThumbLength(Scrollbar* scrollbar)
+int RenderScrollbarTheme::minimumThumbLength(ScrollbarThemeClient* scrollbar)
 {
     return toRenderScrollbar(scrollbar)->minimumThumbLength();
 }
 
-IntRect RenderScrollbarTheme::backButtonRect(Scrollbar* scrollbar, ScrollbarPart partType, bool)
+IntRect RenderScrollbarTheme::backButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart partType, bool)
 {
     return toRenderScrollbar(scrollbar)->buttonRect(partType);
 }
 
-IntRect RenderScrollbarTheme::forwardButtonRect(Scrollbar* scrollbar, ScrollbarPart partType, bool)
+IntRect RenderScrollbarTheme::forwardButtonRect(ScrollbarThemeClient* scrollbar, ScrollbarPart partType, bool)
 {
     return toRenderScrollbar(scrollbar)->buttonRect(partType);
 }
 
-IntRect RenderScrollbarTheme::trackRect(Scrollbar* scrollbar, bool)
+IntRect RenderScrollbarTheme::trackRect(ScrollbarThemeClient* scrollbar, bool)
 {
     if (!hasButtons(scrollbar))
         return scrollbar->frameRect();
@@ -91,7 +92,7 @@ IntRect RenderScrollbarTheme::trackRect(Scrollbar* scrollbar, bool)
     return toRenderScrollbar(scrollbar)->trackRect(startLength, endLength);
 }
 
-IntRect RenderScrollbarTheme::constrainTrackRectToTrackPieces(Scrollbar* scrollbar, const IntRect& rect)
+IntRect RenderScrollbarTheme::constrainTrackRectToTrackPieces(ScrollbarThemeClient* scrollbar, const IntRect& rect)
 { 
     IntRect backRect = toRenderScrollbar(scrollbar)->trackPieceRectWithMargins(BackTrackPart, rect);
     IntRect forwardRect = toRenderScrollbar(scrollbar)->trackPieceRectWithMargins(ForwardTrackPart, rect);
@@ -112,27 +113,27 @@ void RenderScrollbarTheme::paintScrollCorner(ScrollView*, GraphicsContext* conte
     context->fillRect(cornerRect, Color::white, ColorSpaceDeviceRGB);
 }
 
-void RenderScrollbarTheme::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
+void RenderScrollbarTheme::paintScrollbarBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar)
 {
     toRenderScrollbar(scrollbar)->paintPart(context, ScrollbarBGPart, scrollbar->frameRect());
 }
 
-void RenderScrollbarTheme::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void RenderScrollbarTheme::paintTrackBackground(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     toRenderScrollbar(scrollbar)->paintPart(context, TrackBGPart, rect);
 }
 
-void RenderScrollbarTheme::paintTrackPiece(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+void RenderScrollbarTheme::paintTrackPiece(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
     toRenderScrollbar(scrollbar)->paintPart(context, part, rect);
 }
 
-void RenderScrollbarTheme::paintButton(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
+void RenderScrollbarTheme::paintButton(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
     toRenderScrollbar(scrollbar)->paintPart(context, part, rect);
 }
 
-void RenderScrollbarTheme::paintThumb(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
+void RenderScrollbarTheme::paintThumb(GraphicsContext* context, ScrollbarThemeClient* scrollbar, const IntRect& rect)
 {
     toRenderScrollbar(scrollbar)->paintPart(context, ThumbPart, rect);
 }
diff --git a/Source/WebCore/rendering/RenderScrollbarTheme.h b/Source/WebCore/rendering/RenderScrollbarTheme.h
index 70c24a5ea..9cef3949f 100644
--- a/Source/WebCore/rendering/RenderScrollbarTheme.h
+++ b/Source/WebCore/rendering/RenderScrollbarTheme.h
@@ -46,35 +46,35 @@ public:
 
     virtual void paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect);
 
-    virtual bool shouldCenterOnThumb(Scrollbar* scrollbar, const PlatformMouseEvent& event) { return ScrollbarTheme::theme()->shouldCenterOnThumb(scrollbar, event); }
+    virtual bool shouldCenterOnThumb(ScrollbarThemeClient* scrollbar, const PlatformMouseEvent& event) { return ScrollbarTheme::theme()->shouldCenterOnThumb(scrollbar, event); }
     
     virtual double initialAutoscrollTimerDelay() { return ScrollbarTheme::theme()->initialAutoscrollTimerDelay(); }
     virtual double autoscrollTimerDelay() { return ScrollbarTheme::theme()->autoscrollTimerDelay(); }
 
-    virtual void registerScrollbar(Scrollbar* scrollbar) { return ScrollbarTheme::theme()->registerScrollbar(scrollbar); }
-    virtual void unregisterScrollbar(Scrollbar* scrollbar) { return ScrollbarTheme::theme()->unregisterScrollbar(scrollbar); }
+    virtual void registerScrollbar(ScrollbarThemeClient* scrollbar) { return ScrollbarTheme::theme()->registerScrollbar(scrollbar); }
+    virtual void unregisterScrollbar(ScrollbarThemeClient* scrollbar) { return ScrollbarTheme::theme()->unregisterScrollbar(scrollbar); }
 
-    virtual int minimumThumbLength(Scrollbar*);
+    virtual int minimumThumbLength(ScrollbarThemeClient*);
 
-    void buttonSizesAlongTrackAxis(Scrollbar* scrollbar, int& beforeSize, int& afterSize);
+    void buttonSizesAlongTrackAxis(ScrollbarThemeClient*, int& beforeSize, int& afterSize);
     
     static RenderScrollbarTheme* renderScrollbarTheme();
 
 protected:
-    virtual bool hasButtons(Scrollbar*);
-    virtual bool hasThumb(Scrollbar*);
+    virtual bool hasButtons(ScrollbarThemeClient*);
+    virtual bool hasThumb(ScrollbarThemeClient*);
 
-    virtual IntRect backButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect forwardButtonRect(Scrollbar*, ScrollbarPart, bool painting = false);
-    virtual IntRect trackRect(Scrollbar*, bool painting = false);
+    virtual IntRect backButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect forwardButtonRect(ScrollbarThemeClient*, ScrollbarPart, bool painting = false);
+    virtual IntRect trackRect(ScrollbarThemeClient*, bool painting = false);
     
-    virtual void paintScrollbarBackground(GraphicsContext*, Scrollbar*);    
-    virtual void paintTrackBackground(GraphicsContext*, Scrollbar*, const IntRect&);
-    virtual void paintTrackPiece(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-    virtual void paintButton(GraphicsContext*, Scrollbar*, const IntRect&, ScrollbarPart);
-    virtual void paintThumb(GraphicsContext*, Scrollbar*, const IntRect&);
+    virtual void paintScrollbarBackground(GraphicsContext*, ScrollbarThemeClient*);
+    virtual void paintTrackBackground(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
+    virtual void paintTrackPiece(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+    virtual void paintButton(GraphicsContext*, ScrollbarThemeClient*, const IntRect&, ScrollbarPart);
+    virtual void paintThumb(GraphicsContext*, ScrollbarThemeClient*, const IntRect&);
 
-    virtual IntRect constrainTrackRectToTrackPieces(Scrollbar*, const IntRect&);
+    virtual IntRect constrainTrackRectToTrackPieces(ScrollbarThemeClient*, const IntRect&);
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderSummary.h b/Source/WebCore/rendering/RenderSummary.h
deleted file mode 100644
index b73b36147..000000000
--- a/Source/WebCore/rendering/RenderSummary.h
+++ /dev/null
@@ -1,56 +0,0 @@
-/*
- * Copyright (C) 2010, 2011 Nokia Corporation and/or its subsidiary(-ies)
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef RenderSummary_h
-#define RenderSummary_h
-
-#if ENABLE(DETAILS)
-
-#include "RenderBlock.h"
-
-namespace WebCore {
-
-class RenderDetails;
-
-class RenderSummary : public RenderBlock {
-public:
-    explicit RenderSummary(Node*);
-
-private:
-    virtual const char* renderName() const { return "RenderSummary"; }
-    virtual bool isSummary() const { return true; }
-    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
-};
-
-inline RenderSummary* toRenderSummary(RenderObject* object)
-{
-    ASSERT(!object || object->isSummary());
-    return static_cast<RenderSummary*>(object);
-}
-
-// This will catch anyone doing an unnecessary cast.
-void toRenderSummary(const RenderSummary*);
-
-}
-
-#endif
-
-#endif // RenderSummary_h
-
diff --git a/Source/WebCore/rendering/RenderTable.cpp b/Source/WebCore/rendering/RenderTable.cpp
index 1a42652db..2c8cae1dd 100644
--- a/Source/WebCore/rendering/RenderTable.cpp
+++ b/Source/WebCore/rendering/RenderTable.cpp
@@ -270,11 +270,11 @@ void RenderTable::computeLogicalWidth()
 LayoutUnit RenderTable::convertStyleLogicalWidthToComputedWidth(const Length& styleLogicalWidth, LayoutUnit availableWidth)
 {
     // HTML tables' width styles already include borders and paddings, but CSS tables' width styles do not.
-    LayoutUnit borders = 0;
+    int borders = 0;
     bool isCSSTable = !node() || !node()->hasTagName(tableTag);
     if (isCSSTable && styleLogicalWidth.isFixed() && styleLogicalWidth.isPositive()) {
         recalcBordersInRowDirection();
-        borders = borderStart() + borderEnd() + (collapseBorders() ? zeroLayoutUnit : paddingStart() + paddingEnd());
+        borders = borderStart() + borderEnd() + (collapseBorders() ? 0 : paddingStart() + paddingEnd());
     }
     return styleLogicalWidth.calcMinValue(availableWidth) + borders;
 }
@@ -840,14 +840,14 @@ void RenderTable::recalcSections() const
     m_needsSectionRecalc = false;
 }
 
-LayoutUnit RenderTable::calcBorderStart() const
+int RenderTable::calcBorderStart() const
 {
     if (collapseBorders()) {
         // Determined by the first cell of the first row. See the CSS 2.1 spec, section 17.6.2.
         if (!numEffCols())
             return 0;
 
-        LayoutUnit borderWidth = 0;
+        unsigned borderWidth = 0;
 
         const BorderValue& tb = style()->borderStart();
         if (tb.style() == BHIDDEN)
@@ -860,7 +860,7 @@ LayoutUnit RenderTable::calcBorderStart() const
             if (gb.style() == BHIDDEN)
                 return 0;
             if (gb.style() > BHIDDEN)
-                borderWidth = max<LayoutUnit>(borderWidth, gb.width());
+                borderWidth = max(borderWidth, gb.width());
         }
         
         if (const RenderTableSection* topNonEmptySection = this->topNonEmptySection()) {
@@ -869,7 +869,7 @@ LayoutUnit RenderTable::calcBorderStart() const
                 return 0;
 
             if (sb.style() > BHIDDEN)
-                borderWidth = max<LayoutUnit>(borderWidth, sb.width());
+                borderWidth = max(borderWidth, sb.width());
 
             const RenderTableSection::CellStruct& cs = topNonEmptySection->cellAt(0, 0);
             
@@ -883,9 +883,9 @@ LayoutUnit RenderTable::calcBorderStart() const
                     return 0;
 
                 if (cb.style() > BHIDDEN)
-                    borderWidth = max<LayoutUnit>(borderWidth, cb.width());
+                    borderWidth = max(borderWidth, cb.width());
                 if (rb.style() > BHIDDEN)
-                    borderWidth = max<LayoutUnit>(borderWidth, rb.width());
+                    borderWidth = max(borderWidth, rb.width());
             }
         }
         return (borderWidth + (style()->isLeftToRightDirection() ? 0 : 1)) / 2;
@@ -893,14 +893,14 @@ LayoutUnit RenderTable::calcBorderStart() const
     return RenderBlock::borderStart();
 }
 
-LayoutUnit RenderTable::calcBorderEnd() const
+int RenderTable::calcBorderEnd() const
 {
     if (collapseBorders()) {
         // Determined by the last cell of the first row. See the CSS 2.1 spec, section 17.6.2.
         if (!numEffCols())
             return 0;
 
-        LayoutUnit borderWidth = 0;
+        unsigned borderWidth = 0;
 
         const BorderValue& tb = style()->borderEnd();
         if (tb.style() == BHIDDEN)
@@ -914,7 +914,7 @@ LayoutUnit RenderTable::calcBorderEnd() const
             if (gb.style() == BHIDDEN)
                 return 0;
             if (gb.style() > BHIDDEN)
-                borderWidth = max<LayoutUnit>(borderWidth, gb.width());
+                borderWidth = max(borderWidth, gb.width());
         }
 
         if (const RenderTableSection* topNonEmptySection = this->topNonEmptySection()) {
@@ -923,7 +923,7 @@ LayoutUnit RenderTable::calcBorderEnd() const
                 return 0;
 
             if (sb.style() > BHIDDEN)
-                borderWidth = max<LayoutUnit>(borderWidth, sb.width());
+                borderWidth = max(borderWidth, sb.width());
 
             const RenderTableSection::CellStruct& cs = topNonEmptySection->cellAt(0, endColumn);
             
@@ -937,9 +937,9 @@ LayoutUnit RenderTable::calcBorderEnd() const
                     return 0;
 
                 if (cb.style() > BHIDDEN)
-                    borderWidth = max<LayoutUnit>(borderWidth, cb.width());
+                    borderWidth = max(borderWidth, cb.width());
                 if (rb.style() > BHIDDEN)
-                    borderWidth = max<LayoutUnit>(borderWidth, rb.width());
+                    borderWidth = max(borderWidth, rb.width());
             }
         }
         return (borderWidth + (style()->isLeftToRightDirection() ? 1 : 0)) / 2;
@@ -953,7 +953,7 @@ void RenderTable::recalcBordersInRowDirection()
     m_borderEnd = calcBorderEnd();
 }
 
-LayoutUnit RenderTable::borderBefore() const
+int RenderTable::borderBefore() const
 {
     if (collapseBorders()) {
         recalcSectionsIfNeeded();
@@ -962,7 +962,7 @@ LayoutUnit RenderTable::borderBefore() const
     return RenderBlock::borderBefore();
 }
 
-LayoutUnit RenderTable::borderAfter() const
+int RenderTable::borderAfter() const
 {
     if (collapseBorders()) {
         recalcSectionsIfNeeded();
@@ -971,11 +971,11 @@ LayoutUnit RenderTable::borderAfter() const
     return RenderBlock::borderAfter();
 }
 
-LayoutUnit RenderTable::outerBorderBefore() const
+int RenderTable::outerBorderBefore() const
 {
     if (!collapseBorders())
         return 0;
-    LayoutUnit borderWidth = 0;
+    int borderWidth = 0;
     if (RenderTableSection* topSection = this->topSection()) {
         borderWidth = topSection->outerBorderBefore();
         if (borderWidth < 0)
@@ -985,15 +985,15 @@ LayoutUnit RenderTable::outerBorderBefore() const
     if (tb.style() == BHIDDEN)
         return 0;
     if (tb.style() > BHIDDEN)
-        borderWidth = max<LayoutUnit>(borderWidth, tb.width() / 2);
+        borderWidth = max<int>(borderWidth, tb.width() / 2);
     return borderWidth;
 }
 
-LayoutUnit RenderTable::outerBorderAfter() const
+int RenderTable::outerBorderAfter() const
 {
     if (!collapseBorders())
         return 0;
-    LayoutUnit borderWidth = 0;
+    int borderWidth = 0;
     RenderTableSection* bottomSection;
     if (m_foot)
         bottomSection = m_foot;
@@ -1011,16 +1011,16 @@ LayoutUnit RenderTable::outerBorderAfter() const
     if (tb.style() == BHIDDEN)
         return 0;
     if (tb.style() > BHIDDEN)
-        borderWidth = max<LayoutUnit>(borderWidth, (tb.width() + 1) / 2);
+        borderWidth = max<int>(borderWidth, (tb.width() + 1) / 2);
     return borderWidth;
 }
 
-LayoutUnit RenderTable::outerBorderStart() const
+int RenderTable::outerBorderStart() const
 {
     if (!collapseBorders())
         return 0;
 
-    LayoutUnit borderWidth = 0;
+    int borderWidth = 0;
 
     const BorderValue& tb = style()->borderStart();
     if (tb.style() == BHIDDEN)
@@ -1032,7 +1032,7 @@ LayoutUnit RenderTable::outerBorderStart() const
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (!child->isTableSection())
             continue;
-        LayoutUnit sw = toRenderTableSection(child)->outerBorderStart();
+        int sw = toRenderTableSection(child)->outerBorderStart();
         if (sw < 0)
             continue;
         allHidden = false;
@@ -1044,12 +1044,12 @@ LayoutUnit RenderTable::outerBorderStart() const
     return borderWidth;
 }
 
-LayoutUnit RenderTable::outerBorderEnd() const
+int RenderTable::outerBorderEnd() const
 {
     if (!collapseBorders())
         return 0;
 
-    LayoutUnit borderWidth = 0;
+    int borderWidth = 0;
 
     const BorderValue& tb = style()->borderEnd();
     if (tb.style() == BHIDDEN)
@@ -1061,7 +1061,7 @@ LayoutUnit RenderTable::outerBorderEnd() const
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (!child->isTableSection())
             continue;
-        LayoutUnit sw = toRenderTableSection(child)->outerBorderEnd();
+        int sw = toRenderTableSection(child)->outerBorderEnd();
         if (sw < 0)
             continue;
         allHidden = false;
diff --git a/Source/WebCore/rendering/RenderTable.h b/Source/WebCore/rendering/RenderTable.h
index 9a6557e03..d4e4fca91 100644
--- a/Source/WebCore/rendering/RenderTable.h
+++ b/Source/WebCore/rendering/RenderTable.h
@@ -52,33 +52,33 @@ public:
     
     bool collapseBorders() const { return style()->borderCollapse(); }
 
-    LayoutUnit borderStart() const { return m_borderStart; }
-    LayoutUnit borderEnd() const { return m_borderEnd; }
-    LayoutUnit borderBefore() const;
-    LayoutUnit borderAfter() const;
+    int borderStart() const { return m_borderStart; }
+    int borderEnd() const { return m_borderEnd; }
+    int borderBefore() const;
+    int borderAfter() const;
 
-    LayoutUnit borderLeft() const
+    int borderLeft() const
     {
         if (style()->isHorizontalWritingMode())
             return style()->isLeftToRightDirection() ? borderStart() : borderEnd();
         return style()->isFlippedBlocksWritingMode() ? borderAfter() : borderBefore();
     }
 
-    LayoutUnit borderRight() const
+    int borderRight() const
     {
         if (style()->isHorizontalWritingMode())
             return style()->isLeftToRightDirection() ? borderEnd() : borderStart();
         return style()->isFlippedBlocksWritingMode() ? borderBefore() : borderAfter();
     }
 
-    LayoutUnit borderTop() const
+    int borderTop() const
     {
         if (style()->isHorizontalWritingMode())
             return style()->isFlippedBlocksWritingMode() ? borderAfter() : borderBefore();
         return style()->isLeftToRightDirection() ? borderStart() : borderEnd();
     }
 
-    LayoutUnit borderBottom() const
+    int borderBottom() const
     {
         if (style()->isHorizontalWritingMode())
             return style()->isFlippedBlocksWritingMode() ? borderBefore() : borderAfter();
@@ -87,41 +87,41 @@ public:
 
     Color bgColor() const { return style()->visitedDependentColor(CSSPropertyBackgroundColor); }
 
-    LayoutUnit outerBorderBefore() const;
-    LayoutUnit outerBorderAfter() const;
-    LayoutUnit outerBorderStart() const;
-    LayoutUnit outerBorderEnd() const;
+    int outerBorderBefore() const;
+    int outerBorderAfter() const;
+    int outerBorderStart() const;
+    int outerBorderEnd() const;
 
-    LayoutUnit outerBorderLeft() const
+    int outerBorderLeft() const
     {
         if (style()->isHorizontalWritingMode())
             return style()->isLeftToRightDirection() ? outerBorderStart() : outerBorderEnd();
         return style()->isFlippedBlocksWritingMode() ? outerBorderAfter() : outerBorderBefore();
     }
 
-    LayoutUnit outerBorderRight() const
+    int outerBorderRight() const
     {
         if (style()->isHorizontalWritingMode())
             return style()->isLeftToRightDirection() ? outerBorderEnd() : outerBorderStart();
         return style()->isFlippedBlocksWritingMode() ? outerBorderBefore() : outerBorderAfter();
     }
 
-    LayoutUnit outerBorderTop() const
+    int outerBorderTop() const
     {
         if (style()->isHorizontalWritingMode())
             return style()->isFlippedBlocksWritingMode() ? outerBorderAfter() : outerBorderBefore();
         return style()->isLeftToRightDirection() ? outerBorderStart() : outerBorderEnd();
     }
 
-    LayoutUnit outerBorderBottom() const
+    int outerBorderBottom() const
     {
         if (style()->isHorizontalWritingMode())
             return style()->isFlippedBlocksWritingMode() ? outerBorderBefore() : outerBorderAfter();
         return style()->isLeftToRightDirection() ? outerBorderEnd() : outerBorderStart();
     }
 
-    LayoutUnit calcBorderStart() const;
-    LayoutUnit calcBorderEnd() const;
+    int calcBorderStart() const;
+    int calcBorderEnd() const;
     void recalcBordersInRowDirection();
 
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
@@ -271,8 +271,8 @@ private:
     
     short m_hSpacing;
     short m_vSpacing;
-    LayoutUnit m_borderStart;
-    LayoutUnit m_borderEnd;
+    int m_borderStart;
+    int m_borderEnd;
 };
 
 inline RenderTableSection* RenderTable::topSection() const
diff --git a/Source/WebCore/rendering/RenderTableCell.cpp b/Source/WebCore/rendering/RenderTableCell.cpp
index 434ac0d69..4243848d9 100644
--- a/Source/WebCore/rendering/RenderTableCell.cpp
+++ b/Source/WebCore/rendering/RenderTableCell.cpp
@@ -191,51 +191,51 @@ void RenderTableCell::layout()
     setCellWidthChanged(false);
 }
 
-LayoutUnit RenderTableCell::paddingTop(bool includeIntrinsicPadding) const
+LayoutUnit RenderTableCell::paddingTop(PaddingOptions paddingOption) const
 {
     LayoutUnit result = RenderBlock::paddingTop();
-    if (!includeIntrinsicPadding || !isHorizontalWritingMode())
+    if (paddingOption == ExcludeIntrinsicPadding || !isHorizontalWritingMode())
         return result;
     return result + (style()->writingMode() == TopToBottomWritingMode ? intrinsicPaddingBefore() : intrinsicPaddingAfter());
 }
 
-LayoutUnit RenderTableCell::paddingBottom(bool includeIntrinsicPadding) const
+LayoutUnit RenderTableCell::paddingBottom(PaddingOptions paddingOption) const
 {
     LayoutUnit result = RenderBlock::paddingBottom();
-    if (!includeIntrinsicPadding || !isHorizontalWritingMode())
+    if (paddingOption == ExcludeIntrinsicPadding || !isHorizontalWritingMode())
         return result;
     return result + (style()->writingMode() == TopToBottomWritingMode ? intrinsicPaddingAfter() : intrinsicPaddingBefore());
 }
 
-LayoutUnit RenderTableCell::paddingLeft(bool includeIntrinsicPadding) const
+LayoutUnit RenderTableCell::paddingLeft(PaddingOptions paddingOption) const
 {
     LayoutUnit result = RenderBlock::paddingLeft();
-    if (!includeIntrinsicPadding || isHorizontalWritingMode())
+    if (paddingOption == ExcludeIntrinsicPadding || isHorizontalWritingMode())
         return result;
     return result + (style()->writingMode() == LeftToRightWritingMode ? intrinsicPaddingBefore() : intrinsicPaddingAfter());
     
 }
 
-LayoutUnit RenderTableCell::paddingRight(bool includeIntrinsicPadding) const
+LayoutUnit RenderTableCell::paddingRight(PaddingOptions paddingOption) const
 {   
     LayoutUnit result = RenderBlock::paddingRight();
-    if (!includeIntrinsicPadding || isHorizontalWritingMode())
+    if (paddingOption == ExcludeIntrinsicPadding || isHorizontalWritingMode())
         return result;
     return result + (style()->writingMode() == LeftToRightWritingMode ? intrinsicPaddingAfter() : intrinsicPaddingBefore());
 }
 
-LayoutUnit RenderTableCell::paddingBefore(bool includeIntrinsicPadding) const
+LayoutUnit RenderTableCell::paddingBefore(PaddingOptions paddingOption) const
 {
     LayoutUnit result = RenderBlock::paddingBefore();
-    if (!includeIntrinsicPadding)
+    if (paddingOption == ExcludeIntrinsicPadding)
         return result;
     return result + intrinsicPaddingBefore();
 }
 
-LayoutUnit RenderTableCell::paddingAfter(bool includeIntrinsicPadding) const
+LayoutUnit RenderTableCell::paddingAfter(PaddingOptions paddingOption) const
 {
     LayoutUnit result = RenderBlock::paddingAfter();
-    if (!includeIntrinsicPadding)
+    if (paddingOption == ExcludeIntrinsicPadding)
         return result;
     return result + intrinsicPaddingAfter();
 }
@@ -267,11 +267,11 @@ LayoutRect RenderTableCell::clippedOverflowRectForRepaint(RenderBoxModelObject*
         return RenderBlock::clippedOverflowRectForRepaint(repaintContainer);
 
     bool rtl = !table()->style()->isLeftToRightDirection();
-    LayoutUnit outlineSize = style()->outlineSize();
-    LayoutUnit left = max(borderHalfLeft(true), outlineSize);
-    LayoutUnit right = max(borderHalfRight(true), outlineSize);
-    LayoutUnit top = max(borderHalfTop(true), outlineSize);
-    LayoutUnit bottom = max(borderHalfBottom(true), outlineSize);
+    int outlineSize = style()->outlineSize();
+    int left = max(borderHalfLeft(true), outlineSize);
+    int right = max(borderHalfRight(true), outlineSize);
+    int top = max(borderHalfTop(true), outlineSize);
+    int bottom = max(borderHalfBottom(true), outlineSize);
     if ((left && !rtl) || (right && rtl)) {
         if (RenderTableCell* before = table()->cellBefore(this)) {
             top = max(top, before->borderHalfTop(true));
@@ -328,7 +328,7 @@ LayoutUnit RenderTableCell::cellBaselinePosition() const
     LayoutUnit firstLineBaseline = firstLineBoxBaseline();
     if (firstLineBaseline != -1)
         return firstLineBaseline;
-    return paddingBefore() + borderBefore() + contentLogicalHeight();
+    return paddingBefore() + borderBefore() + contentLogicalHeight(IncludeIntrinsicPadding);
 }
 
 void RenderTableCell::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
@@ -747,49 +747,49 @@ inline CollapsedBorderValue RenderTableCell::cachedCollapsedBottomBorder(RenderS
     return tableStyle->isLeftToRightDirection() ? section()->cachedCollapsedBorder(this, CBSEnd) : section()->cachedCollapsedBorder(this, CBSStart);
 }
 
-LayoutUnit RenderTableCell::borderLeft() const
+int RenderTableCell::borderLeft() const
 {
     return table()->collapseBorders() ? borderHalfLeft(false) : RenderBlock::borderLeft();
 }
 
-LayoutUnit RenderTableCell::borderRight() const
+int RenderTableCell::borderRight() const
 {
     return table()->collapseBorders() ? borderHalfRight(false) : RenderBlock::borderRight();
 }
 
-LayoutUnit RenderTableCell::borderTop() const
+int RenderTableCell::borderTop() const
 {
     return table()->collapseBorders() ? borderHalfTop(false) : RenderBlock::borderTop();
 }
 
-LayoutUnit RenderTableCell::borderBottom() const
+int RenderTableCell::borderBottom() const
 {
     return table()->collapseBorders() ? borderHalfBottom(false) : RenderBlock::borderBottom();
 }
 
 // FIXME: https://bugs.webkit.org/show_bug.cgi?id=46191, make the collapsed border drawing
 // work with different block flow values instead of being hard-coded to top-to-bottom.
-LayoutUnit RenderTableCell::borderStart() const
+int RenderTableCell::borderStart() const
 {
     return table()->collapseBorders() ? borderHalfStart(false) : RenderBlock::borderStart();
 }
 
-LayoutUnit RenderTableCell::borderEnd() const
+int RenderTableCell::borderEnd() const
 {
     return table()->collapseBorders() ? borderHalfEnd(false) : RenderBlock::borderEnd();
 }
 
-LayoutUnit RenderTableCell::borderBefore() const
+int RenderTableCell::borderBefore() const
 {
     return table()->collapseBorders() ? borderHalfBefore(false) : RenderBlock::borderBefore();
 }
 
-LayoutUnit RenderTableCell::borderAfter() const
+int RenderTableCell::borderAfter() const
 {
     return table()->collapseBorders() ? borderHalfAfter(false) : RenderBlock::borderAfter();
 }
 
-LayoutUnit RenderTableCell::borderHalfLeft(bool outer) const
+int RenderTableCell::borderHalfLeft(bool outer) const
 {
     RenderStyle* tableStyle = table()->style();
     if (tableStyle->isHorizontalWritingMode())
@@ -797,7 +797,7 @@ LayoutUnit RenderTableCell::borderHalfLeft(bool outer) const
     return tableStyle->isFlippedBlocksWritingMode() ? borderHalfAfter(outer) : borderHalfBefore(outer);
 }
 
-LayoutUnit RenderTableCell::borderHalfRight(bool outer) const
+int RenderTableCell::borderHalfRight(bool outer) const
 {
     RenderStyle* tableStyle = table()->style();
     if (tableStyle->isHorizontalWritingMode())
@@ -805,7 +805,7 @@ LayoutUnit RenderTableCell::borderHalfRight(bool outer) const
     return tableStyle->isFlippedBlocksWritingMode() ? borderHalfBefore(outer) : borderHalfAfter(outer);
 }
 
-LayoutUnit RenderTableCell::borderHalfTop(bool outer) const
+int RenderTableCell::borderHalfTop(bool outer) const
 {
     RenderStyle* tableStyle = table()->style();
     if (tableStyle->isHorizontalWritingMode())
@@ -813,7 +813,7 @@ LayoutUnit RenderTableCell::borderHalfTop(bool outer) const
     return tableStyle->isLeftToRightDirection() ? borderHalfStart(outer) : borderHalfEnd(outer);
 }
 
-LayoutUnit RenderTableCell::borderHalfBottom(bool outer) const
+int RenderTableCell::borderHalfBottom(bool outer) const
 {
     RenderStyle* tableStyle = table()->style();
     if (tableStyle->isHorizontalWritingMode())
@@ -821,7 +821,7 @@ LayoutUnit RenderTableCell::borderHalfBottom(bool outer) const
     return tableStyle->isLeftToRightDirection() ? borderHalfEnd(outer) : borderHalfStart(outer);
 }
 
-LayoutUnit RenderTableCell::borderHalfStart(bool outer) const
+int RenderTableCell::borderHalfStart(bool outer) const
 {
     CollapsedBorderValue border = collapsedStartBorder(DoNotIncludeBorderColor);
     if (border.exists())
@@ -829,7 +829,7 @@ LayoutUnit RenderTableCell::borderHalfStart(bool outer) const
     return 0;
 }
     
-LayoutUnit RenderTableCell::borderHalfEnd(bool outer) const
+int RenderTableCell::borderHalfEnd(bool outer) const
 {
     CollapsedBorderValue border = collapsedEndBorder(DoNotIncludeBorderColor);
     if (border.exists())
@@ -837,7 +837,7 @@ LayoutUnit RenderTableCell::borderHalfEnd(bool outer) const
     return 0;
 }
 
-LayoutUnit RenderTableCell::borderHalfBefore(bool outer) const
+int RenderTableCell::borderHalfBefore(bool outer) const
 {
     CollapsedBorderValue border = collapsedBeforeBorder(DoNotIncludeBorderColor);
     if (border.exists())
@@ -845,7 +845,7 @@ LayoutUnit RenderTableCell::borderHalfBefore(bool outer) const
     return 0;
 }
 
-LayoutUnit RenderTableCell::borderHalfAfter(bool outer) const
+int RenderTableCell::borderHalfAfter(bool outer) const
 {
     CollapsedBorderValue border = collapsedAfterBorder(DoNotIncludeBorderColor);
     if (border.exists())
@@ -960,18 +960,20 @@ void RenderTableCell::paintCollapsedBorders(PaintInfo& paintInfo, const LayoutPo
     if (!paintInfo.shouldPaintWithinRoot(this) || style()->visibility() != VISIBLE)
         return;
 
-    LayoutPoint adjustedPaintOffset = paintOffset + location();
-    LayoutUnit os = 2 * maximalOutlineSize(paintInfo.phase);
-    if (!(adjustedPaintOffset.y() - table()->outerBorderTop() < paintInfo.rect.maxY() + os
-        && adjustedPaintOffset.y() + height() + table()->outerBorderBottom() > paintInfo.rect.y() - os))
+    LayoutRect localRepaintRect = paintInfo.rect;
+    localRepaintRect.inflate(maximalOutlineSize(paintInfo.phase));
+
+    LayoutRect paintRect = LayoutRect(paintOffset + location(), size());
+    if (paintRect.y() - table()->outerBorderTop() >= localRepaintRect.maxY())
+        return;
+
+    if (paintRect.maxY() + table()->outerBorderBottom() <= localRepaintRect.y())
         return;
 
     GraphicsContext* graphicsContext = paintInfo.context;
     if (!table()->currentBorderValue() || graphicsContext->paintingDisabled())
         return;
 
-    LayoutRect paintRect = LayoutRect(adjustedPaintOffset, size());
-
     RenderStyle* tableStyle = table()->style();
     CollapsedBorderValue leftVal = cachedCollapsedLeftBorder(tableStyle);
     CollapsedBorderValue rightVal = cachedCollapsedRightBorder(tableStyle);
@@ -979,16 +981,16 @@ void RenderTableCell::paintCollapsedBorders(PaintInfo& paintInfo, const LayoutPo
     CollapsedBorderValue bottomVal = cachedCollapsedBottomBorder(tableStyle);
      
     // Adjust our x/y/width/height so that we paint the collapsed borders at the correct location.
-    LayoutUnit topWidth = topVal.width();
-    LayoutUnit bottomWidth = bottomVal.width();
-    LayoutUnit leftWidth = leftVal.width();
-    LayoutUnit rightWidth = rightVal.width();
-    
-    LayoutUnit x = paintRect.x() - leftWidth / 2;
-    LayoutUnit y = paintRect.y() - topWidth / 2;
-    LayoutUnit w = paintRect.width() + leftWidth / 2 + (rightWidth + 1) / 2;
-    LayoutUnit h = paintRect.height() + topWidth / 2 + (bottomWidth + 1) / 2;
-    
+    int topWidth = topVal.width();
+    int bottomWidth = bottomVal.width();
+    int leftWidth = leftVal.width();
+    int rightWidth = rightVal.width();
+
+    IntRect borderRect = pixelSnappedIntRect(paintRect.x() - leftWidth / 2,
+            paintRect.y() - topWidth / 2,
+            paintRect.width() + leftWidth / 2 + (rightWidth + 1) / 2,
+            paintRect.height() + topWidth / 2 + (bottomWidth + 1) / 2);
+
     EBorderStyle topStyle = collapsedBorderStyle(topVal.style());
     EBorderStyle bottomStyle = collapsedBorderStyle(bottomVal.style());
     EBorderStyle leftStyle = collapsedBorderStyle(leftVal.style());
@@ -1002,10 +1004,10 @@ void RenderTableCell::paintCollapsedBorders(PaintInfo& paintInfo, const LayoutPo
     // We never paint diagonals at the joins.  We simply let the border with the highest
     // precedence paint on top of borders with lower precedence.  
     CollapsedBorders borders;
-    borders.addBorder(topVal, BSTop, renderTop, x, y, x + w, y + topWidth, topStyle);
-    borders.addBorder(bottomVal, BSBottom, renderBottom, x, y + h - bottomWidth, x + w, y + h, bottomStyle);
-    borders.addBorder(leftVal, BSLeft, renderLeft, x, y, x + leftWidth, y + h, leftStyle);
-    borders.addBorder(rightVal, BSRight, renderRight, x + w - rightWidth, y, x + w, y + h, rightStyle);
+    borders.addBorder(topVal, BSTop, renderTop, borderRect.x(), borderRect.y(), borderRect.maxX(), borderRect.y() + topWidth, topStyle);
+    borders.addBorder(bottomVal, BSBottom, renderBottom, borderRect.x(), borderRect.maxY() - bottomWidth, borderRect.maxX(), borderRect.maxY(), bottomStyle);
+    borders.addBorder(leftVal, BSLeft, renderLeft, borderRect.x(), borderRect.y(), borderRect.x() + leftWidth, borderRect.maxY(), leftStyle);
+    borders.addBorder(rightVal, BSRight, renderRight, borderRect.maxX() - rightWidth, borderRect.y(), borderRect.maxX(), borderRect.maxY(), rightStyle);
 
     bool antialias = shouldAntialiasLines(graphicsContext);
     
diff --git a/Source/WebCore/rendering/RenderTableCell.h b/Source/WebCore/rendering/RenderTableCell.h
index e0b4a0558..e18372ac5 100644
--- a/Source/WebCore/rendering/RenderTableCell.h
+++ b/Source/WebCore/rendering/RenderTableCell.h
@@ -91,14 +91,14 @@ public:
 
     void updateLogicalWidth(LayoutUnit);
 
-    virtual LayoutUnit borderLeft() const;
-    virtual LayoutUnit borderRight() const;
-    virtual LayoutUnit borderTop() const;
-    virtual LayoutUnit borderBottom() const;
-    virtual LayoutUnit borderStart() const;
-    virtual LayoutUnit borderEnd() const;
-    virtual LayoutUnit borderBefore() const;
-    virtual LayoutUnit borderAfter() const;
+    virtual int borderLeft() const;
+    virtual int borderRight() const;
+    virtual int borderTop() const;
+    virtual int borderBottom() const;
+    virtual int borderStart() const;
+    virtual int borderEnd() const;
+    virtual int borderBefore() const;
+    virtual int borderAfter() const;
 
     void collectBorderValues(RenderTable::CollapsedBorderValues&) const;
     static void sortBorderValues(RenderTable::CollapsedBorderValues&);
@@ -120,16 +120,16 @@ public:
     int intrinsicPaddingBefore() const { return m_intrinsicPaddingBefore; }
     int intrinsicPaddingAfter() const { return m_intrinsicPaddingAfter; }
 
-    virtual LayoutUnit paddingTop(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingBottom(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingLeft(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingRight(bool includeIntrinsicPadding = true) const;
+    virtual LayoutUnit paddingTop(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingBottom(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingLeft(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingRight(PaddingOptions = IncludeIntrinsicPadding) const;
     
     // FIXME: For now we just assume the cell has the same block flow direction as the table.  It's likely we'll
     // create an extra anonymous RenderBlock to handle mixing directionality anyway, in which case we can lock
     // the block flow directionality of the cells to the table's directionality.
-    virtual LayoutUnit paddingBefore(bool includeIntrinsicPadding = true) const;
-    virtual LayoutUnit paddingAfter(bool includeIntrinsicPadding = true) const;
+    virtual LayoutUnit paddingBefore(PaddingOptions = IncludeIntrinsicPadding) const;
+    virtual LayoutUnit paddingAfter(PaddingOptions = IncludeIntrinsicPadding) const;
 
     void setOverrideHeightFromRowHeight(LayoutUnit);
 
@@ -159,15 +159,15 @@ private:
     virtual LayoutRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer) const;
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, LayoutRect&, bool fixed = false) const;
 
-    LayoutUnit borderHalfLeft(bool outer) const;
-    LayoutUnit borderHalfRight(bool outer) const;
-    LayoutUnit borderHalfTop(bool outer) const;
-    LayoutUnit borderHalfBottom(bool outer) const;
+    int borderHalfLeft(bool outer) const;
+    int borderHalfRight(bool outer) const;
+    int borderHalfTop(bool outer) const;
+    int borderHalfBottom(bool outer) const;
 
-    LayoutUnit borderHalfStart(bool outer) const;
-    LayoutUnit borderHalfEnd(bool outer) const;
-    LayoutUnit borderHalfBefore(bool outer) const;
-    LayoutUnit borderHalfAfter(bool outer) const;
+    int borderHalfStart(bool outer) const;
+    int borderHalfEnd(bool outer) const;
+    int borderHalfBefore(bool outer) const;
+    int borderHalfAfter(bool outer) const;
 
     CollapsedBorderValue collapsedStartBorder(IncludeBorderColorOrNot = IncludeBorderColor) const;
     CollapsedBorderValue collapsedEndBorder(IncludeBorderColorOrNot = IncludeBorderColor) const;
diff --git a/Source/WebCore/rendering/RenderTableRow.h b/Source/WebCore/rendering/RenderTableRow.h
index 67d81c6a5..f3175dfc0 100644
--- a/Source/WebCore/rendering/RenderTableRow.h
+++ b/Source/WebCore/rendering/RenderTableRow.h
@@ -57,7 +57,8 @@ private:
     virtual LayoutRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer) const;
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, const LayoutPoint& pointInContainer, const LayoutPoint& accumulatedOffset, HitTestAction);
 
-    virtual bool requiresLayer() const { return isTransparent() || hasOverflowClip() || hasTransform() || hasMask() || hasFilter(); }
+    // We need to allocate a layer whenever we have an overflow clip as RenderTableSection::paintObject does not push rows' clips.
+    virtual bool requiresLayer() const OVERRIDE { return isTransparent() || hasOverflowClip() || hasTransform() || hasMask() || hasFilter(); }
 
     virtual void paint(PaintInfo&, const LayoutPoint&);
 
diff --git a/Source/WebCore/rendering/RenderTableSection.cpp b/Source/WebCore/rendering/RenderTableSection.cpp
index 844209c8d..08a8c9b7d 100644
--- a/Source/WebCore/rendering/RenderTableSection.cpp
+++ b/Source/WebCore/rendering/RenderTableSection.cpp
@@ -304,7 +304,7 @@ void RenderTableSection::setCellLogicalWidths()
                     if (!statePusher.didPush()) {
                         // Technically, we should also push state for the row, but since
                         // rows don't push a coordinate transform, that's not necessary.
-                        statePusher.push(this, LayoutSize(x(), y()));
+                        statePusher.push(this, locationOffset());
                     }
                     cell->repaint();
                 }
@@ -334,6 +334,7 @@ int RenderTableSection::calcRowLogicalHeight()
     m_rowPos[0] = spacing;
 
     for (unsigned r = 0; r < m_grid.size(); r++) {
+        m_grid[r].baseline = 0;
         LayoutUnit baselineDescent = 0;
 
         // Our base size is the biggest logical height from our cells' styles (excluding row spanning cells).
@@ -416,10 +417,110 @@ void RenderTableSection::layout()
         }
     }
     statePusher.pop();
+
+    if (hasOverflowClip() && !hasLayer())
+        updateCachedSizeForOverflowClip();
+
     setNeedsLayout(false);
 }
 
-int RenderTableSection::layoutRows(int toAdd)
+int RenderTableSection::distributeExtraLogicalHeightToPercentRows(int extraLogicalHeight, int totalPercent)
+{
+    if (!totalPercent)
+        return extraLogicalHeight;
+
+    unsigned totalRows = m_grid.size();
+    int totalHeight = m_rowPos[totalRows] + extraLogicalHeight;
+    int add = 0;
+    totalPercent = min(totalPercent, 100);
+    int rowHeight = m_rowPos[1] - m_rowPos[0];
+    for (unsigned r = 0; r < totalRows; ++r) {
+        if (totalPercent > 0 && m_grid[r].logicalHeight.isPercent()) {
+            int toAdd = min<int>(extraLogicalHeight, (totalHeight * m_grid[r].logicalHeight.percent() / 100) - rowHeight);
+            // If toAdd is negative, then we don't want to shrink the row (this bug
+            // affected Outlook Web Access).
+            toAdd = max(0, toAdd);
+            add += toAdd;
+            extraLogicalHeight -= toAdd;
+            totalPercent -= m_grid[r].logicalHeight.percent();
+        }
+        ASSERT(totalRows >= 1);
+        if (r < totalRows - 1)
+            rowHeight = m_rowPos[r + 2] - m_rowPos[r + 1];
+        m_rowPos[r + 1] += add;
+    }
+    return extraLogicalHeight;
+}
+
+int RenderTableSection::distributeExtraLogicalHeightToAutoRows(int extraLogicalHeight, unsigned autoRowsCount)
+{
+    if (!autoRowsCount)
+        return extraLogicalHeight;
+
+    int add = 0;
+    for (unsigned r = 0; r < m_grid.size(); ++r) {
+        if (autoRowsCount > 0 && m_grid[r].logicalHeight.isAuto()) {
+            // Recomputing |extraLogicalHeightForRow| guarantees that we properly ditribute round |extraLogicalHeight|.
+            int extraLogicalHeightForRow = extraLogicalHeight / autoRowsCount;
+            add += extraLogicalHeightForRow;
+            extraLogicalHeight -= extraLogicalHeightForRow;
+            --autoRowsCount;
+        }
+        m_rowPos[r + 1] += add;
+    }
+    return extraLogicalHeight;
+}
+
+int RenderTableSection::distributeRemainingExtraLogicalHeight(int extraLogicalHeight)
+{
+    unsigned totalRows = m_grid.size();
+
+    if (extraLogicalHeight <= 0 || !m_rowPos[totalRows])
+        return extraLogicalHeight;
+
+    // FIXME: m_rowPos[totalRows] - m_rowPos[0] is the total rows' size.
+    int totalRowSize = m_rowPos[totalRows];
+    int add = 0;
+    int previousRowPosition = m_rowPos[0];
+    for (unsigned r = 0; r < totalRows; r++) {
+        // weight with the original height
+        add += extraLogicalHeight * (m_rowPos[r + 1] - previousRowPosition) / totalRowSize;
+        previousRowPosition = m_rowPos[r + 1];
+        m_rowPos[r + 1] += add;
+    }
+
+    return extraLogicalHeight;
+}
+
+int RenderTableSection::distributeExtraLogicalHeightToRows(int extraLogicalHeight)
+{
+    if (!extraLogicalHeight)
+        return extraLogicalHeight;
+
+    unsigned totalRows = m_grid.size();
+    if (!totalRows)
+        return extraLogicalHeight;
+
+    if (!m_rowPos[totalRows] && nextSibling())
+        return extraLogicalHeight;
+
+    unsigned autoRowsCount = 0;
+    int totalPercent = 0;
+    for (unsigned r = 0; r < totalRows; r++) {
+        if (m_grid[r].logicalHeight.isAuto())
+            ++autoRowsCount;
+        else if (m_grid[r].logicalHeight.isPercent())
+            totalPercent += m_grid[r].logicalHeight.percent();
+    }
+
+    int remainingExtraLogicalHeight = extraLogicalHeight;
+    remainingExtraLogicalHeight = distributeExtraLogicalHeightToPercentRows(remainingExtraLogicalHeight, totalPercent);
+    remainingExtraLogicalHeight = distributeExtraLogicalHeightToAutoRows(remainingExtraLogicalHeight, autoRowsCount);
+    remainingExtraLogicalHeight = distributeRemainingExtraLogicalHeight(remainingExtraLogicalHeight);
+    return remainingExtraLogicalHeight;
+}
+
+int RenderTableSection::layoutRows(int extraLogicalHeight)
 {
 #ifndef NDEBUG
     setNeedsLayoutIsForbidden(true);
@@ -437,71 +538,13 @@ int RenderTableSection::layoutRows(int toAdd)
     m_overflowingCells.clear();
     m_forceSlowPaintPathWithOverflowingCell = false;
 
-    if (toAdd && totalRows && (m_rowPos[totalRows] || !nextSibling())) {
-        int totalHeight = m_rowPos[totalRows] + toAdd;
-
-        int dh = toAdd;
-        int totalPercent = 0;
-        int numAuto = 0;
-        for (unsigned r = 0; r < totalRows; r++) {
-            if (m_grid[r].logicalHeight.isAuto())
-                numAuto++;
-            else if (m_grid[r].logicalHeight.isPercent())
-                totalPercent += m_grid[r].logicalHeight.percent();
-        }
-        if (totalPercent) {
-            // try to satisfy percent
-            int add = 0;
-            totalPercent = min(totalPercent, 100);
-            int rh = m_rowPos[1] - m_rowPos[0];
-            for (unsigned r = 0; r < totalRows; r++) {
-                if (totalPercent > 0 && m_grid[r].logicalHeight.isPercent()) {
-                    int toAdd = min<int>(dh, (totalHeight * m_grid[r].logicalHeight.percent() / 100) - rh);
-                    // If toAdd is negative, then we don't want to shrink the row (this bug
-                    // affected Outlook Web Access).
-                    toAdd = max(0, toAdd);
-                    add += toAdd;
-                    dh -= toAdd;
-                    totalPercent -= m_grid[r].logicalHeight.percent();
-                }
-                ASSERT(totalRows >= 1);
-                if (r < totalRows - 1)
-                    rh = m_rowPos[r + 2] - m_rowPos[r + 1];
-                m_rowPos[r + 1] += add;
-            }
-        }
-        if (numAuto) {
-            // distribute over variable cols
-            int add = 0;
-            for (unsigned r = 0; r < totalRows; r++) {
-                if (numAuto > 0 && m_grid[r].logicalHeight.isAuto()) {
-                    int toAdd = dh / numAuto;
-                    add += toAdd;
-                    dh -= toAdd;
-                    numAuto--;
-                }
-                m_rowPos[r + 1] += add;
-            }
-        }
-        if (dh > 0 && m_rowPos[totalRows]) {
-            // if some left overs, distribute equally.
-            int tot = m_rowPos[totalRows];
-            int add = 0;
-            int prev = m_rowPos[0];
-            for (unsigned r = 0; r < totalRows; r++) {
-                // weight with the original height
-                add += dh * (m_rowPos[r + 1] - prev) / tot;
-                prev = m_rowPos[r + 1];
-                m_rowPos[r + 1] += add;
-            }
-        }
-    }
+    extraLogicalHeight = distributeExtraLogicalHeightToRows(extraLogicalHeight);
 
     int hspacing = table()->hBorderSpacing();
     int vspacing = table()->vBorderSpacing();
     unsigned nEffCols = table()->numEffCols();
 
-    LayoutStateMaintainer statePusher(view(), this, LayoutSize(x(), y()), style()->isFlippedBlocksWritingMode());
+    LayoutStateMaintainer statePusher(view(), this, locationOffset(), style()->isFlippedBlocksWritingMode());
 
     for (unsigned r = 0; r < totalRows; r++) {
         // Set the row's x/y position and width/height.
@@ -911,7 +954,7 @@ LayoutUnit RenderTableSection::firstLineBoxBaseline() const
         const CellStruct& cs = firstRow.at(i);
         const RenderTableCell* cell = cs.primaryCell();
         if (cell)
-            firstLineBaseline = max(firstLineBaseline, cell->logicalTop() + cell->paddingBefore() + cell->borderBefore() + cell->contentLogicalHeight());
+            firstLineBaseline = max(firstLineBaseline, cell->logicalTop() + cell->paddingBefore() + cell->borderBefore() + cell->contentLogicalHeight(IncludeIntrinsicPadding));
     }
 
     return firstLineBaseline;
@@ -992,17 +1035,63 @@ void RenderTableSection::paintCell(RenderTableCell* cell, PaintInfo& paintInfo,
         cell->paint(paintInfo, cellPoint);
 }
 
-void RenderTableSection::paintObject(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
+CellSpan RenderTableSection::dirtiedRows(const LayoutRect& damageRect) const
 {
-    // Check which rows and cols are visible and only paint these.
-    unsigned totalRows = m_grid.size();
-    unsigned totalCols = table()->columns().size();
+    if (m_forceSlowPaintPathWithOverflowingCell) 
+        return fullTableRowSpan();
 
-    PaintPhase paintPhase = paintInfo.phase;
+    LayoutUnit before = style()->isHorizontalWritingMode() ? damageRect.y() : damageRect.x();
+
+    // binary search to find a row
+    unsigned startRow = std::lower_bound(m_rowPos.begin(), m_rowPos.end(), before) - m_rowPos.begin();
+
+    // The binary search above gives us the first row with
+    // a y position >= the top of the paint rect. Thus, the previous
+    // may need to be repainted as well.
+    if (startRow == m_rowPos.size() || (startRow > 0 && (m_rowPos[startRow] >  before)))
+        --startRow;
+
+    LayoutUnit after = (style()->isHorizontalWritingMode() ? damageRect.maxY() : damageRect.maxX());
+    unsigned endRow = std::lower_bound(m_rowPos.begin(), m_rowPos.end(), after) - m_rowPos.begin();
+    if (endRow == m_rowPos.size())
+        --endRow;
+
+    if (!endRow && m_rowPos[0] - table()->outerBorderBefore() <= after)
+        ++endRow;
+
+    return CellSpan(startRow, endRow);
+}
 
-    LayoutUnit os = 2 * maximalOutlineSize(paintPhase);
-    unsigned startrow = 0;
-    unsigned endrow = totalRows;
+
+CellSpan RenderTableSection::dirtiedColumns(const LayoutRect& damageRect) const
+{
+    if (m_forceSlowPaintPathWithOverflowingCell) 
+        return fullTableColumnSpan();
+
+    // FIXME: Implement RTL.
+    if (!style()->isLeftToRightDirection())
+        return fullTableColumnSpan();
+
+    LayoutUnit start = style()->isHorizontalWritingMode() ? damageRect.x() : damageRect.y();
+    Vector<int>& columnPos = table()->columnPositions();
+    unsigned startCol = std::lower_bound(columnPos.begin(), columnPos.end(), start) - columnPos.begin();
+    if ((startCol == columnPos.size()) || (startCol > 0 && (columnPos[startCol] > start)))
+        --startCol;
+
+    LayoutUnit end = (style()->isHorizontalWritingMode() ? damageRect.maxX() : damageRect.maxY());
+    unsigned endCol = std::lower_bound(columnPos.begin(), columnPos.end(), end) - columnPos.begin();
+    if (endCol == columnPos.size())
+        --endCol;
+
+    if (!endCol && columnPos[0] - table()->outerBorderStart() <= end)
+        ++endCol;
+
+    return CellSpan(startCol, endCol);
+}
+
+void RenderTableSection::paintObject(PaintInfo& paintInfo, const LayoutPoint& paintOffset)
+{
+    PaintPhase paintPhase = paintInfo.phase;
 
     LayoutRect localRepaintRect = paintInfo.rect;
     localRepaintRect.moveBy(-paintOffset);
@@ -1013,56 +1102,23 @@ void RenderTableSection::paintObject(PaintInfo& paintInfo, const LayoutPoint& pa
             localRepaintRect.setX(width() - localRepaintRect.maxX());
     }
 
-    if (!m_forceSlowPaintPathWithOverflowingCell) {
-        LayoutUnit before = (style()->isHorizontalWritingMode() ? localRepaintRect.y() : localRepaintRect.x()) - os;
-        // binary search to find a row
-        startrow = std::lower_bound(m_rowPos.begin(), m_rowPos.end(), before) - m_rowPos.begin();
-
-        // The binary search above gives us the first row with
-        // a y position >= the top of the paint rect. Thus, the previous
-        // may need to be repainted as well.
-        if (startrow == m_rowPos.size() || (startrow > 0 && (m_rowPos[startrow] >  before)))
-          --startrow;
+    localRepaintRect.inflate(maximalOutlineSize(paintPhase));
 
-        LayoutUnit after = (style()->isHorizontalWritingMode() ? localRepaintRect.maxY() : localRepaintRect.maxX()) + os;
-        endrow = std::lower_bound(m_rowPos.begin(), m_rowPos.end(), after) - m_rowPos.begin();
-        if (endrow == m_rowPos.size())
-          --endrow;
-
-        if (!endrow && m_rowPos[0] - table()->outerBorderBefore() <= after)
-            ++endrow;
-    }
+    CellSpan dirtiedRows = this->dirtiedRows(localRepaintRect);
+    CellSpan dirtiedColumns = this->dirtiedColumns(localRepaintRect);
 
-    unsigned startcol = 0;
-    unsigned endcol = totalCols;
-    // FIXME: Implement RTL.
-    if (!m_forceSlowPaintPathWithOverflowingCell && style()->isLeftToRightDirection()) {
-        LayoutUnit start = (style()->isHorizontalWritingMode() ? localRepaintRect.x() : localRepaintRect.y()) - os;
-        Vector<int>& columnPos = table()->columnPositions();
-        startcol = std::lower_bound(columnPos.begin(), columnPos.end(), start) - columnPos.begin();
-        if ((startcol == columnPos.size()) || (startcol > 0 && (columnPos[startcol] > start)))
-            --startcol;
-
-        LayoutUnit end = (style()->isHorizontalWritingMode() ? localRepaintRect.maxX() : localRepaintRect.maxY()) + os;
-        endcol = std::lower_bound(columnPos.begin(), columnPos.end(), end) - columnPos.begin();
-        if (endcol == columnPos.size())
-            --endcol;
-
-        if (!endcol && columnPos[0] - table()->outerBorderStart() <= end)
-            ++endcol;
-    }
-    if (startcol < endcol) {
+    if (dirtiedColumns.start() < dirtiedColumns.end()) {
         if (!m_hasMultipleCellLevels && !m_overflowingCells.size()) {
             if (paintInfo.phase == PaintPhaseCollapsedTableBorders) {
                 // Collapsed borders are painted from the bottom right to the top left so that precedence
                 // due to cell position is respected.
-                for (unsigned r = endrow; r > startrow; r--) {
+                for (unsigned r = dirtiedRows.end(); r > dirtiedRows.start(); r--) {
                     unsigned row = r - 1;
-                    for (unsigned c = endcol; c > startcol; c--) {
+                    for (unsigned c = dirtiedColumns.end(); c > dirtiedColumns.start(); c--) {
                         unsigned col = c - 1;
                         CellStruct& current = cellAt(row, col);
                         RenderTableCell* cell = current.primaryCell();
-                        if (!cell || (row > startrow && primaryCellAt(row - 1, col) == cell) || (col > startcol && primaryCellAt(row, col - 1) == cell))
+                        if (!cell || (row > dirtiedRows.start() && primaryCellAt(row - 1, col) == cell) || (col > dirtiedColumns.start() && primaryCellAt(row, col - 1) == cell))
                             continue;
                         LayoutPoint cellPoint = flipForWritingModeForChild(cell, paintOffset);
                         cell->paintCollapsedBorders(paintInfo, cellPoint);
@@ -1070,14 +1126,14 @@ void RenderTableSection::paintObject(PaintInfo& paintInfo, const LayoutPoint& pa
                 }
             } else {
                 // Draw the dirty cells in the order that they appear.
-                for (unsigned r = startrow; r < endrow; r++) {
+                for (unsigned r = dirtiedRows.start(); r < dirtiedRows.end(); r++) {
                     RenderTableRow* row = m_grid[r].rowRenderer;
                     if (row && !row->hasSelfPaintingLayer())
                         row->paintOutlineForRowIfNeeded(paintInfo, paintOffset);
-                    for (unsigned c = startcol; c < endcol; c++) {
+                    for (unsigned c = dirtiedColumns.start(); c < dirtiedColumns.end(); c++) {
                         CellStruct& current = cellAt(r, c);
                         RenderTableCell* cell = current.primaryCell();
-                        if (!cell || (r > startrow && primaryCellAt(r - 1, c) == cell) || (c > startcol && primaryCellAt(r, c - 1) == cell))
+                        if (!cell || (r > dirtiedRows.start() && primaryCellAt(r - 1, c) == cell) || (c > dirtiedColumns.start() && primaryCellAt(r, c - 1) == cell))
                             continue;
                         paintCell(cell, paintInfo, paintOffset);
                     }
@@ -1085,7 +1141,11 @@ void RenderTableSection::paintObject(PaintInfo& paintInfo, const LayoutPoint& pa
             }
         } else {
             // The overflowing cells should be scarce to avoid adding a lot of cells to the HashSet.
+#ifndef NDEBUG
+            unsigned totalRows = m_grid.size();
+            unsigned totalCols = table()->columns().size();
             ASSERT(m_overflowingCells.size() < totalRows * totalCols * gMaxAllowedOverflowingCellRatioForFastPaintPath);
+#endif
 
             // To make sure we properly repaint the section, we repaint all the overflowing cells that we collected.
             Vector<RenderTableCell*> cells;
@@ -1093,11 +1153,11 @@ void RenderTableSection::paintObject(PaintInfo& paintInfo, const LayoutPoint& pa
 
             HashSet<RenderTableCell*> spanningCells;
 
-            for (unsigned r = startrow; r < endrow; r++) {
+            for (unsigned r = dirtiedRows.start(); r < dirtiedRows.end(); r++) {
                 RenderTableRow* row = m_grid[r].rowRenderer;
                 if (row && !row->hasSelfPaintingLayer())
                     row->paintOutlineForRowIfNeeded(paintInfo, paintOffset);
-                for (unsigned c = startcol; c < endcol; c++) {
+                for (unsigned c = dirtiedColumns.start(); c < dirtiedColumns.end(); c++) {
                     CellStruct& current = cellAt(r, c);
                     if (!current.hasCells())
                         continue;
diff --git a/Source/WebCore/rendering/RenderTableSection.h b/Source/WebCore/rendering/RenderTableSection.h
index d12c87041..8df74f06f 100644
--- a/Source/WebCore/rendering/RenderTableSection.h
+++ b/Source/WebCore/rendering/RenderTableSection.h
@@ -37,6 +37,23 @@ enum CollapsedBorderSide {
     CBSEnd
 };
 
+// Helper class for paintObject.
+class CellSpan {
+public:
+    CellSpan(unsigned start, unsigned end)
+        : m_start(start)
+        , m_end(end)
+    {
+    }
+
+    unsigned start() const { return m_start; }
+    unsigned end() const { return m_end; }
+
+private:
+    unsigned m_start;
+    unsigned m_end;
+};
+
 class RenderTableCell;
 class RenderTableRow;
 
@@ -168,8 +185,21 @@ private:
 
     void ensureRows(unsigned);
 
+    // Those methods return the remaining extra logical height.
+    // FIXME: We may want to introduce a structure holding the in-flux layout information.
+    int distributeExtraLogicalHeightToRows(int extraLogicalHeight);
+    int distributeExtraLogicalHeightToPercentRows(int extraLogicalHeight, int totalPercent);
+    int distributeExtraLogicalHeightToAutoRows(int extraLogicalHeight, unsigned autoRowsCount);
+    int distributeRemainingExtraLogicalHeight(int extraLogicalHeight);
+
     bool hasOverflowingCell() const { return m_overflowingCells.size() || m_forceSlowPaintPathWithOverflowingCell; }
 
+    CellSpan fullTableRowSpan() const { return CellSpan(0, m_grid.size()); }
+    CellSpan fullTableColumnSpan() const { return CellSpan(0, table()->columns().size()); }
+
+    CellSpan dirtiedRows(const LayoutRect& repaintRect) const;
+    CellSpan dirtiedColumns(const LayoutRect& repaintRect) const;
+
     RenderObjectChildList m_children;
 
     Vector<RowStruct> m_grid;
diff --git a/Source/WebCore/rendering/RenderText.cpp b/Source/WebCore/rendering/RenderText.cpp
index f2408dbcc..d497a33d6 100644
--- a/Source/WebCore/rendering/RenderText.cpp
+++ b/Source/WebCore/rendering/RenderText.cpp
@@ -303,10 +303,10 @@ PassRefPtr<StringImpl> RenderText::originalText() const
     return (e && e->isTextNode()) ? toText(e)->dataImpl() : 0;
 }
 
-void RenderText::absoluteRects(Vector<LayoutRect>& rects, const LayoutPoint& accumulatedOffset) const
+void RenderText::absoluteRects(Vector<IntRect>& rects, const LayoutPoint& accumulatedOffset) const
 {
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox())
-        rects.append(enclosingLayoutRect(FloatRect(accumulatedOffset + box->topLeft(), box->size())));
+        rects.append(enclosingIntRect(FloatRect(accumulatedOffset + box->topLeft(), box->size())));
 }
 
 static FloatRect localQuadForTextBox(InlineTextBox* box, unsigned start, unsigned end, bool useSelectionHeight)
@@ -330,7 +330,7 @@ static FloatRect localQuadForTextBox(InlineTextBox* box, unsigned start, unsigne
     return FloatRect();
 }
 
-void RenderText::absoluteRectsForRange(Vector<LayoutRect>& rects, unsigned start, unsigned end, bool useSelectionHeight, bool* wasFixed)
+void RenderText::absoluteRectsForRange(Vector<IntRect>& rects, unsigned start, unsigned end, bool useSelectionHeight, bool* wasFixed)
 {
     // Work around signed/unsigned issues. This function takes unsigneds, and is often passed UINT_MAX
     // to mean "all the way to the end". InlineTextBox coordinates are unsigneds, so changing this 
@@ -347,7 +347,6 @@ void RenderText::absoluteRectsForRange(Vector<LayoutRect>& rects, unsigned start
         if (start <= box->start() && box->end() < end) {
             FloatRect r = box->calculateBoundaries();
             if (useSelectionHeight) {
-                // FIXME: localSelectionRect should switch to return FloatRect soon with the subpixellayout branch.
                 IntRect selectionRect = box->localSelectionRect(start, end);
                 if (box->isHorizontal()) {
                     r.setHeight(selectionRect.height());
@@ -479,8 +478,11 @@ static bool lineDirectionPointFitsInBox(int pointLineDirection, InlineTextBox* b
 
     // the x coordinate is equal to the left edge of this box
     // the affinity must be downstream so the position doesn't jump back to the previous line
-    if (pointLineDirection == box->logicalLeft())
+    // except when box is the first box in the line
+    if (pointLineDirection <= box->logicalLeft()) {
+        shouldAffinityBeDownstream = !box->prevLeafChild() ? UpstreamIfPositionIsNotAtStart : AlwaysDownstream;
         return true;
+    }
 
     // and the x coordinate is to the left of the right edge of this box
     // check to see if position goes in this box
@@ -491,10 +493,10 @@ static bool lineDirectionPointFitsInBox(int pointLineDirection, InlineTextBox* b
 
     // box is first on line
     // and the x coordinate is to the left of the first text box left edge
-    if (!box->prevOnLine() && pointLineDirection < box->logicalLeft())
+    if (!box->prevLeafChildIgnoringLineBreak() && pointLineDirection < box->logicalLeft())
         return true;
 
-    if (!box->nextOnLine()) {
+    if (!box->nextLeafChildIgnoringLineBreak()) {
         // box is last on line
         // and the x coordinate is to the right of the last text box right edge
         // generate VisiblePosition, use UPSTREAM affinity if possible
@@ -535,7 +537,7 @@ static VisiblePosition createVisiblePositionAfterAdjustingOffsetForBiDi(const In
     if (positionIsAtStartOfBox == box->isLeftToRightDirection()) {
         // offset is on the left edge
 
-        const InlineBox* prevBox = box->prevLeafChild();
+        const InlineBox* prevBox = box->prevLeafChildIgnoringLineBreak();
         if ((prevBox && prevBox->bidiLevel() == box->bidiLevel())
             || box->renderer()->containingBlock()->style()->direction() == box->direction()) // FIXME: left on 12CBA
             return createVisiblePositionForBox(box, box->caretLeftmostOffset(), shouldAffinityBeDownstream);
@@ -545,7 +547,7 @@ static VisiblePosition createVisiblePositionAfterAdjustingOffsetForBiDi(const In
             const InlineBox* leftmostBox;
             do {
                 leftmostBox = prevBox;
-                prevBox = leftmostBox->prevLeafChild();
+                prevBox = leftmostBox->prevLeafChildIgnoringLineBreak();
             } while (prevBox && prevBox->bidiLevel() > box->bidiLevel());
             return createVisiblePositionForBox(leftmostBox, leftmostBox->caretRightmostOffset(), shouldAffinityBeDownstream);
         }
@@ -556,7 +558,7 @@ static VisiblePosition createVisiblePositionAfterAdjustingOffsetForBiDi(const In
             const InlineBox* nextBox = box;
             do {
                 rightmostBox = nextBox;
-                nextBox = rightmostBox->nextLeafChild();
+                nextBox = rightmostBox->nextLeafChildIgnoringLineBreak();
             } while (nextBox && nextBox->bidiLevel() >= box->bidiLevel());
             return createVisiblePositionForBox(rightmostBox,
                 box->isLeftToRightDirection() ? rightmostBox->caretMaxOffset() : rightmostBox->caretMinOffset(), shouldAffinityBeDownstream);
@@ -565,7 +567,7 @@ static VisiblePosition createVisiblePositionAfterAdjustingOffsetForBiDi(const In
         return createVisiblePositionForBox(box, box->caretRightmostOffset(), shouldAffinityBeDownstream);
     }
 
-    const InlineBox* nextBox = box->nextLeafChild();
+    const InlineBox* nextBox = box->nextLeafChildIgnoringLineBreak();
     if ((nextBox && nextBox->bidiLevel() == box->bidiLevel())
         || box->renderer()->containingBlock()->style()->direction() == box->direction())
         return createVisiblePositionForBox(box, box->caretRightmostOffset(), shouldAffinityBeDownstream);
@@ -576,7 +578,7 @@ static VisiblePosition createVisiblePositionAfterAdjustingOffsetForBiDi(const In
         const InlineBox* rightmostBox;
         do {
             rightmostBox = nextBox;
-            nextBox = rightmostBox->nextLeafChild();
+            nextBox = rightmostBox->nextLeafChildIgnoringLineBreak();
         } while (nextBox && nextBox->bidiLevel() > box->bidiLevel());
         return createVisiblePositionForBox(rightmostBox, rightmostBox->caretLeftmostOffset(), shouldAffinityBeDownstream);
     }
@@ -587,7 +589,7 @@ static VisiblePosition createVisiblePositionAfterAdjustingOffsetForBiDi(const In
         const InlineBox* prevBox = box;
         do {
             leftmostBox = prevBox;
-            prevBox = leftmostBox->prevLeafChild();
+            prevBox = leftmostBox->prevLeafChildIgnoringLineBreak();
         } while (prevBox && prevBox->bidiLevel() >= box->bidiLevel());
         return createVisiblePositionForBox(leftmostBox,
             box->isLeftToRightDirection() ? leftmostBox->caretMinOffset() : leftmostBox->caretMaxOffset(), shouldAffinityBeDownstream);
@@ -601,28 +603,14 @@ VisiblePosition RenderText::positionForPoint(const LayoutPoint& point)
     if (!firstTextBox() || textLength() == 0)
         return createVisiblePosition(0, DOWNSTREAM);
 
-    // Get the offset for the position, since this will take rtl text into account.
-    int offset;
-
     LayoutUnit pointLineDirection = firstTextBox()->isHorizontal() ? point.x() : point.y();
     LayoutUnit pointBlockDirection = firstTextBox()->isHorizontal() ? point.y() : point.x();
-    
-    // FIXME: We should be able to roll these special cases into the general cases in the loop below.
-    if (firstTextBox() && pointBlockDirection <  firstTextBox()->root()->selectionBottom() && pointLineDirection < firstTextBox()->logicalLeft()) {
-        // at the y coordinate of the first line or above
-        // and the x coordinate is to the left of the first text box left edge
-        offset = firstTextBox()->offsetForPosition(pointLineDirection);
-        return createVisiblePositionAfterAdjustingOffsetForBiDi(firstTextBox(), offset, UpstreamIfPositionIsNotAtStart);
-    }
-    if (lastTextBox() && pointBlockDirection >= lastTextBox()->root()->selectionTop() && pointLineDirection >= lastTextBox()->logicalRight()) {
-        // at the y coordinate of the last line or below
-        // and the x coordinate is to the right of the last text box right edge
-        offset = lastTextBox()->offsetForPosition(pointLineDirection);
-        return createVisiblePositionAfterAdjustingOffsetForBiDi(lastTextBox(), offset, AlwaysUpstream);
-    }
 
-    InlineTextBox* lastBoxAbove = 0;
+    InlineTextBox* lastBox = 0;
     for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
+        if (box->isLineBreak() && !box->prevLeafChild() && box->nextLeafChild() && !box->nextLeafChild()->isLineBreak())
+            box = box->nextTextBox();
+
         RootInlineBox* rootBox = box->root();
         if (pointBlockDirection >= rootBox->selectionTop() || pointBlockDirection >= rootBox->lineTop()) {
             LayoutUnit bottom = rootBox->selectionBottom();
@@ -631,15 +619,19 @@ VisiblePosition RenderText::positionForPoint(const LayoutPoint& point)
 
             if (pointBlockDirection < bottom) {
                 ShouldAffinityBeDownstream shouldAffinityBeDownstream;
-                offset = box->offsetForPosition(pointLineDirection);
                 if (lineDirectionPointFitsInBox(pointLineDirection, box, shouldAffinityBeDownstream))
-                    return createVisiblePositionAfterAdjustingOffsetForBiDi(box, offset, shouldAffinityBeDownstream);
+                    return createVisiblePositionAfterAdjustingOffsetForBiDi(box, box->offsetForPosition(pointLineDirection), shouldAffinityBeDownstream);
             }
-            lastBoxAbove = box;
         }
+        lastBox = box;
     }
 
-    return createVisiblePosition(lastBoxAbove ? lastBoxAbove->start() + lastBoxAbove->len() : 0, DOWNSTREAM);
+    if (lastBox) {
+        ShouldAffinityBeDownstream shouldAffinityBeDownstream;
+        lineDirectionPointFitsInBox(pointLineDirection, lastBox, shouldAffinityBeDownstream);
+        return createVisiblePositionAfterAdjustingOffsetForBiDi(lastBox, lastBox->offsetForPosition(pointLineDirection) + lastBox->start(), shouldAffinityBeDownstream);
+    }
+    return createVisiblePosition(0, DOWNSTREAM);
 }
 
 LayoutRect RenderText::localCaretRect(InlineBox* inlineBox, int caretOffset, LayoutUnit* extraWidthToEndOfLine)
@@ -1134,39 +1126,41 @@ float RenderText::firstRunY() const
     
 void RenderText::setSelectionState(SelectionState state)
 {
-    InlineTextBox* box;
-
     RenderObject::setSelectionState(state);
-    if (state == SelectionStart || state == SelectionEnd || state == SelectionBoth) {
-        int startPos, endPos;
-        selectionStartEnd(startPos, endPos);
-        if (selectionState() == SelectionStart) {
-            endPos = textLength();
 
-            // to handle selection from end of text to end of line
-            if (startPos != 0 && startPos == endPos)
-                startPos = endPos - 1;
-        } else if (selectionState() == SelectionEnd)
-            startPos = 0;
-
-        for (box = firstTextBox(); box; box = box->nextTextBox()) {
-            if (box->isSelected(startPos, endPos)) {
-                RootInlineBox* line = box->root();
-                if (line)
-                    line->setHasSelectedChildren(true);
+    if (canUpdateSelectionOnRootLineBoxes()) {
+        if (state == SelectionStart || state == SelectionEnd || state == SelectionBoth) {
+            int startPos, endPos;
+            selectionStartEnd(startPos, endPos);
+            if (selectionState() == SelectionStart) {
+                endPos = textLength();
+
+                // to handle selection from end of text to end of line
+                if (startPos && startPos == endPos)
+                    startPos = endPos - 1;
+            } else if (selectionState() == SelectionEnd)
+                startPos = 0;
+
+            for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
+                if (box->isSelected(startPos, endPos)) {
+                    RootInlineBox* root = box->root();
+                    if (root)
+                        root->setHasSelectedChildren(true);
+                }
+            }
+        } else {
+            for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
+                RootInlineBox* root = box->root();
+                if (root)
+                    root->setHasSelectedChildren(state == SelectionInside);
             }
-        }
-    } else {
-        for (box = firstTextBox(); box; box = box->nextTextBox()) {
-            RootInlineBox* line = box->root();
-            if (line)
-                line->setHasSelectedChildren(state == SelectionInside);
         }
     }
 
-    // The returned value can be null in case of an orphaned tree.
-    if (RenderBlock* cb = containingBlock())
-        cb->setSelectionState(state);
+    // The containing block can be null in case of an orphaned tree.
+    RenderBlock* containingBlock = this->containingBlock();
+    if (containingBlock && !containingBlock->isRenderView())
+        containingBlock->setSelectionState(state);
 }
 
 void RenderText::setTextWithOffset(PassRefPtr<StringImpl> text, unsigned offset, unsigned len, bool force)
diff --git a/Source/WebCore/rendering/RenderText.h b/Source/WebCore/rendering/RenderText.h
index 3918336a1..e2c6a8a69 100644
--- a/Source/WebCore/rendering/RenderText.h
+++ b/Source/WebCore/rendering/RenderText.h
@@ -54,8 +54,8 @@ public:
     InlineTextBox* createInlineTextBox();
     void dirtyLineBoxes(bool fullLayout);
 
-    virtual void absoluteRects(Vector<LayoutRect>&, const LayoutPoint& accumulatedOffset) const;
-    void absoluteRectsForRange(Vector<LayoutRect>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false, bool* wasFixed = 0);
+    virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const;
+    void absoluteRectsForRange(Vector<IntRect>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false, bool* wasFixed = 0);
 
     virtual void absoluteQuads(Vector<FloatQuad>&, bool* wasFixed) const;
     void absoluteQuadsForRange(Vector<FloatQuad>&, unsigned startOffset = 0, unsigned endOffset = UINT_MAX, bool useSelectionHeight = false, bool* wasFixed = 0);
diff --git a/Source/WebCore/rendering/RenderTextControl.cpp b/Source/WebCore/rendering/RenderTextControl.cpp
index 0fef05173..2b311f18e 100644
--- a/Source/WebCore/rendering/RenderTextControl.cpp
+++ b/Source/WebCore/rendering/RenderTextControl.cpp
@@ -142,14 +142,9 @@ void RenderTextControl::computeLogicalHeight()
 {
     HTMLElement* innerText = innerTextElement();
     ASSERT(innerText);
-    RenderBox* innerTextRenderBox = innerText->renderBox();
-
-    setHeight(innerTextRenderBox->borderTop() + innerTextRenderBox->borderBottom() +
-              innerTextRenderBox->paddingTop() + innerTextRenderBox->paddingBottom() +
-              innerTextRenderBox->marginTop() + innerTextRenderBox->marginBottom());
-
-    adjustControlHeightBasedOnLineHeight(innerText->renderBox()->lineHeight(true, HorizontalLine, PositionOfInteriorLineBoxes));
-    setHeight(height() + borderAndPaddingHeight());
+    RenderBox* innerTextBox = innerText->renderBox();
+    LayoutUnit nonContentHeight = innerTextBox->borderAndPaddingHeight() + innerTextBox->marginHeight();
+    setHeight(computeControlHeight(innerTextBox->lineHeight(true, HorizontalLine, PositionOfInteriorLineBoxes), nonContentHeight) + borderAndPaddingHeight());
 
     // We are able to have a horizontal scrollbar if the overflow style is scroll, or if its auto and there's no word wrap.
     if (style()->overflowX() == OSCROLL ||  (style()->overflowX() == OAUTO && innerText->renderer()->style()->wordWrap() == NormalWordWrap))
@@ -280,10 +275,10 @@ void RenderTextControl::computePreferredLogicalWidths()
     setPreferredLogicalWidthsDirty(false);
 }
 
-void RenderTextControl::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint& additionalOffset)
+void RenderTextControl::addFocusRingRects(Vector<IntRect>& rects, const LayoutPoint& additionalOffset)
 {
     if (!size().isEmpty())
-        rects.append(LayoutRect(additionalOffset, size()));
+        rects.append(pixelSnappedIntRect(additionalOffset, size()));
 }
 
 RenderObject* RenderTextControl::layoutSpecialExcludedChild(bool relayoutChildren)
diff --git a/Source/WebCore/rendering/RenderTextControl.h b/Source/WebCore/rendering/RenderTextControl.h
index aa936e7a0..0c31ed806 100644
--- a/Source/WebCore/rendering/RenderTextControl.h
+++ b/Source/WebCore/rendering/RenderTextControl.h
@@ -58,7 +58,7 @@ protected:
     static bool hasValidAvgCharWidth(AtomicString family);
     virtual float getAvgCharWidth(AtomicString family);
     virtual LayoutUnit preferredContentWidth(float charWidth) const = 0;
-    virtual void adjustControlHeightBasedOnLineHeight(LayoutUnit lineHeight) = 0;
+    virtual LayoutUnit computeControlHeight(LayoutUnit lineHeight, LayoutUnit nonContentHeight) const = 0;
     virtual RenderStyle* textBaseStyle() const = 0;
 
     virtual void updateFromElement();
@@ -72,7 +72,7 @@ private:
     virtual void removeLeftoverAnonymousBlock(RenderBlock*) { }
     virtual bool avoidsFloats() const { return true; }
     
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
 
     virtual bool canBeProgramaticallyScrolled() const { return true; }
 
diff --git a/Source/WebCore/rendering/RenderTextControlMultiLine.cpp b/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
index 9d91f4b9e..9b4ffe5cf 100644
--- a/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -70,9 +70,9 @@ LayoutUnit RenderTextControlMultiLine::preferredContentWidth(float charWidth) co
     return static_cast<LayoutUnit>(ceilf(charWidth * factor)) + scrollbarThickness();
 }
 
-void RenderTextControlMultiLine::adjustControlHeightBasedOnLineHeight(LayoutUnit lineHeight)
+LayoutUnit RenderTextControlMultiLine::computeControlHeight(LayoutUnit lineHeight, LayoutUnit nonContentHeight) const
 {
-    setHeight(height() + lineHeight * static_cast<HTMLTextAreaElement*>(node())->rows());
+    return lineHeight * static_cast<HTMLTextAreaElement*>(node())->rows() + nonContentHeight;
 }
 
 LayoutUnit RenderTextControlMultiLine::baselinePosition(FontBaseline baselineType, bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
diff --git a/Source/WebCore/rendering/RenderTextControlMultiLine.h b/Source/WebCore/rendering/RenderTextControlMultiLine.h
index 761177a16..3ae1ea210 100644
--- a/Source/WebCore/rendering/RenderTextControlMultiLine.h
+++ b/Source/WebCore/rendering/RenderTextControlMultiLine.h
@@ -38,7 +38,7 @@ private:
 
     virtual float getAvgCharWidth(AtomicString family);
     virtual LayoutUnit preferredContentWidth(float charWidth) const;
-    virtual void adjustControlHeightBasedOnLineHeight(LayoutUnit lineHeight);
+    virtual LayoutUnit computeControlHeight(LayoutUnit lineHeight, LayoutUnit nonContentHeight) const OVERRIDE;
     virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
 
     virtual RenderStyle* textBaseStyle() const;
diff --git a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
index a44e2886c..e7ecedfa6 100644
--- a/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/Source/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -250,7 +250,8 @@ void RenderTextControlSingleLine::layout()
         } else if (containerRenderer->height() < contentHeight()) {
             containerRenderer->style()->setHeight(Length(contentHeight(), Fixed));
             relayoutChildren = true;
-        }
+        } else
+            containerRenderer->style()->setHeight(Length(containerHeight, Fixed));
     }
 
     RenderBlock::layoutBlock(relayoutChildren);
@@ -360,13 +361,6 @@ void RenderTextControlSingleLine::capsLockStateMayHaveChanged()
     }
 }
 
-#if ENABLE(INPUT_SPEECH)
-HTMLElement* RenderTextControlSingleLine::speechButtonElement() const
-{
-    return inputElement()->speechButtonElement();
-}
-#endif
-
 bool RenderTextControlSingleLine::hasControlClip() const
 {
     // Apply control clip for text fields with decorations.
@@ -417,16 +411,6 @@ LayoutUnit RenderTextControlSingleLine::preferredContentWidth(float charWidth) c
     if (maxCharWidth > 0.f)
         result += maxCharWidth - charWidth;
 
-    HTMLElement* resultsButton = resultsButtonElement();
-    if (RenderBox* resultsRenderer = resultsButton ? resultsButton->renderBox() : 0)
-        result += resultsRenderer->borderLeft() + resultsRenderer->borderRight() +
-                  resultsRenderer->paddingLeft() + resultsRenderer->paddingRight();
-
-    HTMLElement* cancelButton = cancelButtonElement();
-    if (RenderBox* cancelRenderer = cancelButton ? cancelButton->renderBox() : 0)
-        result += cancelRenderer->borderLeft() + cancelRenderer->borderRight() +
-                  cancelRenderer->paddingLeft() + cancelRenderer->paddingRight();
-
     if (includesDecoration) {
         HTMLElement* spinButton = innerSpinButtonElement();
         if (RenderBox* spinRenderer = spinButton ? spinButton->renderBox() : 0) {
@@ -438,38 +422,25 @@ LayoutUnit RenderTextControlSingleLine::preferredContentWidth(float charWidth) c
         }
     }
 
-#if ENABLE(INPUT_SPEECH)
-    HTMLElement* speechButton = speechButtonElement();
-    if (RenderBox* speechRenderer = speechButton ? speechButton->renderBox() : 0) {
-        result += speechRenderer->borderLeft() + speechRenderer->borderRight() +
-                  speechRenderer->paddingLeft() + speechRenderer->paddingRight();
-    }
-#endif
     return result;
 }
 
-void RenderTextControlSingleLine::adjustControlHeightBasedOnLineHeight(LayoutUnit lineHeight)
+LayoutUnit RenderTextControlSingleLine::computeControlHeight(LayoutUnit lineHeight, LayoutUnit nonContentHeight) const
 {
     HTMLElement* resultsButton = resultsButtonElement();
     if (RenderBox* resultsRenderer = resultsButton ? resultsButton->renderBox() : 0) {
         resultsRenderer->computeLogicalHeight();
-        setHeight(max(height(),
-                  resultsRenderer->borderTop() + resultsRenderer->borderBottom() +
-                  resultsRenderer->paddingTop() + resultsRenderer->paddingBottom() +
-                  resultsRenderer->marginTop() + resultsRenderer->marginBottom()));
+        nonContentHeight = max(nonContentHeight, resultsRenderer->borderAndPaddingHeight() + resultsRenderer->marginHeight());
         lineHeight = max(lineHeight, resultsRenderer->height());
     }
     HTMLElement* cancelButton = cancelButtonElement();
     if (RenderBox* cancelRenderer = cancelButton ? cancelButton->renderBox() : 0) {
         cancelRenderer->computeLogicalHeight();
-        setHeight(max(height(),
-                  cancelRenderer->borderTop() + cancelRenderer->borderBottom() +
-                  cancelRenderer->paddingTop() + cancelRenderer->paddingBottom() +
-                  cancelRenderer->marginTop() + cancelRenderer->marginBottom()));
+        nonContentHeight = max(nonContentHeight, cancelRenderer->borderAndPaddingHeight() + cancelRenderer->marginHeight());
         lineHeight = max(lineHeight, cancelRenderer->height());
     }
 
-    setHeight(height() + lineHeight);
+    return lineHeight + nonContentHeight;
 }
 
 void RenderTextControlSingleLine::updateFromElement()
@@ -620,7 +591,8 @@ PopupMenuStyle RenderTextControlSingleLine::itemStyle(unsigned) const
 
 PopupMenuStyle RenderTextControlSingleLine::menuStyle() const
 {
-    return PopupMenuStyle(style()->visitedDependentColor(CSSPropertyColor), style()->visitedDependentColor(CSSPropertyBackgroundColor), style()->font(), style()->visibility() == VISIBLE, style()->display() == NONE, style()->textIndent(), style()->direction(), style()->unicodeBidi() == Override);
+    return PopupMenuStyle(style()->visitedDependentColor(CSSPropertyColor), style()->visitedDependentColor(CSSPropertyBackgroundColor), style()->font(), style()->visibility() == VISIBLE,
+        style()->display() == NONE, style()->textIndent(), style()->direction(), isOverride(style()->unicodeBidi()));
 }
 
 int RenderTextControlSingleLine::clientInsetLeft() const
@@ -641,22 +613,18 @@ int RenderTextControlSingleLine::clientInsetRight() const
 LayoutUnit RenderTextControlSingleLine::clientPaddingLeft() const
 {
     LayoutUnit padding = paddingLeft();
-
-    HTMLElement* resultsButton = resultsButtonElement();
-    if (RenderBox* resultsRenderer = resultsButton ? resultsButton->renderBox() : 0)
-        padding += resultsRenderer->width() + resultsRenderer->marginLeft() + resultsRenderer->paddingLeft() + resultsRenderer->marginRight() + resultsRenderer->paddingRight();
-
+    if (RenderBox* box = innerBlockElement() ? innerBlockElement()->renderBox() : 0)
+        padding += box->x();
     return padding;
 }
 
 LayoutUnit RenderTextControlSingleLine::clientPaddingRight() const
 {
     LayoutUnit padding = paddingRight();
-
-    HTMLElement* cancelButton = cancelButtonElement();
-    if (RenderBox* cancelRenderer = cancelButton ? cancelButton->renderBox() : 0)
-        padding += cancelRenderer->width() + cancelRenderer->marginLeft() + cancelRenderer->paddingLeft() + cancelRenderer->marginRight() + cancelRenderer->paddingRight();
-
+    if (RenderBox* containerBox = containerElement() ? containerElement()->renderBox() : 0) {
+        if (RenderBox* innerBlockBox = innerBlockElement() ? innerBlockElement()->renderBox() : 0)
+            padding += containerBox->width() - (innerBlockBox->x() + innerBlockBox->width());
+    }
     return padding;
 }
 
diff --git a/Source/WebCore/rendering/RenderTextControlSingleLine.h b/Source/WebCore/rendering/RenderTextControlSingleLine.h
index 45d19ee99..6e21c856c 100644
--- a/Source/WebCore/rendering/RenderTextControlSingleLine.h
+++ b/Source/WebCore/rendering/RenderTextControlSingleLine.h
@@ -49,10 +49,6 @@ public:
 
     void capsLockStateMayHaveChanged();
 
-#if ENABLE(INPUT_SPEECH)
-    HTMLElement* speechButtonElement() const;
-#endif
-
 private:
     virtual bool hasControlClip() const;
     virtual LayoutRect controlClipRect(const LayoutPoint&) const;
@@ -78,8 +74,8 @@ private:
     int textBlockWidth() const;
     virtual float getAvgCharWidth(AtomicString family);
     virtual LayoutUnit preferredContentWidth(float charWidth) const;
-    virtual void adjustControlHeightBasedOnLineHeight(LayoutUnit lineHeight);
-
+    virtual LayoutUnit computeControlHeight(LayoutUnit lineHeight, LayoutUnit nonContentHeight) const OVERRIDE;
+    
     virtual void updateFromElement();
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
diff --git a/Source/WebCore/rendering/RenderTextFragment.cpp b/Source/WebCore/rendering/RenderTextFragment.cpp
index ff4082422..1f267cde4 100644
--- a/Source/WebCore/rendering/RenderTextFragment.cpp
+++ b/Source/WebCore/rendering/RenderTextFragment.cpp
@@ -33,6 +33,7 @@ RenderTextFragment::RenderTextFragment(Node* node, StringImpl* str, int startOff
     , m_start(startOffset)
     , m_end(length)
     , m_firstLetter(0)
+    , m_allowFragmentReset(true)
 {
 }
 
@@ -42,6 +43,7 @@ RenderTextFragment::RenderTextFragment(Node* node, StringImpl* str)
     , m_end(str ? str->length() : 0)
     , m_contentString(str)
     , m_firstLetter(0)
+    , m_allowFragmentReset(true)
 {
 }
 
@@ -60,7 +62,9 @@ PassRefPtr<StringImpl> RenderTextFragment::originalText() const
 
 void RenderTextFragment::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
+    m_allowFragmentReset = false;
     RenderText::styleDidChange(diff, oldStyle);
+    m_allowFragmentReset = true;
 
     if (RenderBlock* block = blockForAccompanyingFirstLetter()) {
         block->style()->removeCachedPseudoStyle(FIRST_LETTER);
@@ -78,15 +82,18 @@ void RenderTextFragment::willBeDestroyed()
 void RenderTextFragment::setTextInternal(PassRefPtr<StringImpl> text)
 {
     RenderText::setTextInternal(text);
-    if (m_firstLetter) {
-        ASSERT(!m_contentString);
-        m_firstLetter->destroy();
-        m_firstLetter = 0;
+
+    if (m_allowFragmentReset) {
         m_start = 0;
         m_end = textLength();
-        if (Node* t = node()) {
-            ASSERT(!t->renderer());
-            t->setRenderer(this);
+        if (m_firstLetter) {
+            ASSERT(!m_contentString);
+            m_firstLetter->destroy();
+            m_firstLetter = 0;
+            if (Node* t = node()) {
+                ASSERT(!t->renderer());
+                t->setRenderer(this);
+            }
         }
     }
 }
diff --git a/Source/WebCore/rendering/RenderTextFragment.h b/Source/WebCore/rendering/RenderTextFragment.h
index 54b307e3b..426276fe0 100644
--- a/Source/WebCore/rendering/RenderTextFragment.h
+++ b/Source/WebCore/rendering/RenderTextFragment.h
@@ -62,6 +62,7 @@ private:
     unsigned m_end;
     RefPtr<StringImpl> m_contentString;
     RenderObject* m_firstLetter;
+    bool m_allowFragmentReset;
 };
 
 inline RenderTextFragment* toRenderTextFragment(RenderObject* object)
diff --git a/Source/WebCore/rendering/RenderTheme.cpp b/Source/WebCore/rendering/RenderTheme.cpp
index 6be2f5efb..8fd2d6c8b 100644
--- a/Source/WebCore/rendering/RenderTheme.cpp
+++ b/Source/WebCore/rendering/RenderTheme.cpp
@@ -205,6 +205,7 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
             return adjustMenuListButtonStyle(selector, style, e);
         case MediaSliderPart:
         case MediaVolumeSliderPart:
+        case MediaFullScreenVolumeSliderPart:
         case SliderHorizontalPart:
         case SliderVerticalPart:
             return adjustSliderTrackStyle(selector, style, e);
@@ -338,6 +339,10 @@ bool RenderTheme::paint(RenderObject* o, const PaintInfo& paintInfo, const Layou
             return paintMediaVolumeSliderTrack(o, paintInfo, r);
         case MediaVolumeSliderThumbPart:
             return paintMediaVolumeSliderThumb(o, paintInfo, r);
+        case MediaFullScreenVolumeSliderPart:
+            return paintMediaFullScreenVolumeSliderTrack(o, paintInfo, r);
+        case MediaFullScreenVolumeSliderThumbPart:
+            return paintMediaFullScreenVolumeSliderThumb(o, paintInfo, r);
         case MediaTimeRemainingPart:
             return paintMediaTimeRemaining(o, paintInfo, r);
         case MediaCurrentTimePart:
diff --git a/Source/WebCore/rendering/RenderTheme.h b/Source/WebCore/rendering/RenderTheme.h
index f65b8523f..44ef1241e 100644
--- a/Source/WebCore/rendering/RenderTheme.h
+++ b/Source/WebCore/rendering/RenderTheme.h
@@ -314,6 +314,8 @@ protected:
     virtual bool paintMediaControlsBackground(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaCurrentTime(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
     virtual bool paintMediaTimeRemaining(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaFullScreenVolumeSliderTrack(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaFullScreenVolumeSliderThumb(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
 
 public:
     // Methods for state querying
diff --git a/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp b/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp
index 88ac3a8d6..949fdfb5d 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp
+++ b/Source/WebCore/rendering/RenderThemeChromiumAndroid.cpp
@@ -30,6 +30,7 @@
 #include "Color.h"
 #include "PaintInfo.h"
 #include "PlatformSupport.h"
+#include "RenderMediaControlsChromium.h"
 #include "RenderObject.h"
 #include "RenderProgress.h"
 #include "RenderSlider.h"
@@ -63,6 +64,11 @@ Color RenderThemeChromiumAndroid::systemColor(int cssValueId) const
     return RenderTheme::systemColor(cssValueId);
 }
 
+String RenderThemeChromiumAndroid::extraMediaControlsStyleSheet()
+{
+    return String(mediaControlsChromiumAndroidUserAgentStyleSheet, sizeof(mediaControlsChromiumAndroidUserAgentStyleSheet));
+}
+
 String RenderThemeChromiumAndroid::extraDefaultStyleSheet()
 {
     return RenderThemeChromiumLinux::extraDefaultStyleSheet() +
@@ -81,4 +87,16 @@ void RenderThemeChromiumAndroid::adjustInnerSpinButtonStyle(CSSStyleSelector*, R
     }
 }
 
+bool RenderThemeChromiumAndroid::paintMediaFullscreenButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+#if ENABLE(VIDEO)
+    return RenderMediaControlsChromium::paintMediaControlsPart(MediaFullscreenButton, object, paintInfo, rect);
+#else
+    UNUSED_PARAM(object);
+    UNUSED_PARAM(paintInfo);
+    UNUSED_PARAM(rect);
+    return false;
+#endif
+}
+
 } // namespace WebCore
diff --git a/Source/WebCore/rendering/RenderThemeChromiumAndroid.h b/Source/WebCore/rendering/RenderThemeChromiumAndroid.h
index 5fb12bc02..53490135c 100644
--- a/Source/WebCore/rendering/RenderThemeChromiumAndroid.h
+++ b/Source/WebCore/rendering/RenderThemeChromiumAndroid.h
@@ -41,6 +41,12 @@ public:
 
     virtual bool delegatesMenuListRendering() const OVERRIDE { return true; }
 
+    virtual bool paintMediaFullscreenButton(RenderObject*, const PaintInfo&, const IntRect&);
+
+#if ENABLE(VIDEO)
+    virtual String extraMediaControlsStyleSheet() OVERRIDE;
+#endif
+
 #if ENABLE(TOUCH_EVENTS)
     virtual Color platformTapHighlightColor() const OVERRIDE
     {
diff --git a/Source/WebCore/rendering/RenderThemeMac.h b/Source/WebCore/rendering/RenderThemeMac.h
index 25065c422..f8a5657ae 100644
--- a/Source/WebCore/rendering/RenderThemeMac.h
+++ b/Source/WebCore/rendering/RenderThemeMac.h
@@ -157,6 +157,8 @@ protected:
     virtual bool paintMediaVolumeSliderContainer(RenderObject*, const PaintInfo&, const IntRect&);
     virtual bool paintMediaVolumeSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
     virtual bool paintMediaVolumeSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaFullScreenVolumeSliderTrack(RenderObject*, const PaintInfo&, const IntRect&) OVERRIDE;
+    virtual bool paintMediaFullScreenVolumeSliderThumb(RenderObject*, const PaintInfo&, const IntRect&) OVERRIDE;
 
     // Media controls
     virtual String extraMediaControlsStyleSheet();
diff --git a/Source/WebCore/rendering/RenderThemeMac.mm b/Source/WebCore/rendering/RenderThemeMac.mm
index cd566e859..0ae0196bc 100644
--- a/Source/WebCore/rendering/RenderThemeMac.mm
+++ b/Source/WebCore/rendering/RenderThemeMac.mm
@@ -990,7 +990,7 @@ bool RenderThemeMac::paintProgressBar(RenderObject* renderObject, const PaintInf
     trackInfo.reserved = 0;
     trackInfo.filler1 = 0;
 
-    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(inflatedRect.size());
+    OwnPtr<ImageBuffer> imageBuffer = ImageBuffer::create(inflatedRect.size(), 1);
     if (!imageBuffer)
         return true;
 
@@ -1720,24 +1720,34 @@ void RenderThemeMac::adjustSliderThumbSize(RenderStyle* style) const
 
 void RenderThemeMac::adjustMediaSliderThumbSize(RenderStyle* style) const
 {
-    ControlPart part = style->appearance();
+    int wkPart;
+    switch (style->appearance()) {
+    case MediaSliderThumbPart:
+        wkPart = MediaSliderThumb;
+        break;
+    case MediaVolumeSliderThumbPart:
+        wkPart = MediaVolumeSliderThumb;
+        break;
+    case MediaFullScreenVolumeSliderThumbPart:
+        wkPart = MediaFullScreenVolumeSliderThumb;
+        break;
+    default:
+        return;
+    }
 
-    if (part == MediaSliderThumbPart || part == MediaVolumeSliderThumbPart) {
-        int width = mediaSliderThumbWidth;
-        int height = mediaSliderThumbHeight;
-        
-        if (mediaControllerTheme() == MediaControllerThemeQuickTime) {
-            CGSize size;
-            
-            wkMeasureMediaUIPart(part == MediaSliderThumbPart ? MediaSliderThumb : MediaVolumeSliderThumb, MediaControllerThemeQuickTime, NULL, &size);
-            width = size.width;
-            height = size.height;
-        }
-
-        float zoomLevel = style->effectiveZoom();
-        style->setWidth(Length(static_cast<int>(width * zoomLevel), Fixed));
-        style->setHeight(Length(static_cast<int>(height * zoomLevel), Fixed));
+    int width = mediaSliderThumbWidth;
+    int height = mediaSliderThumbHeight;
+
+    if (mediaControllerTheme() == MediaControllerThemeQuickTime) {
+        CGSize size;
+        wkMeasureMediaUIPart(wkPart, MediaControllerThemeQuickTime, NULL, &size);
+        width = size.width;
+        height = size.height;
     }
+
+    float zoomLevel = style->effectiveZoom();
+    style->setWidth(Length(static_cast<int>(width * zoomLevel), Fixed));
+    style->setHeight(Length(static_cast<int>(height * zoomLevel), Fixed));
 }
 
 enum WKMediaControllerThemeState { 
@@ -1977,7 +1987,29 @@ bool RenderThemeMac::paintMediaVolumeSliderThumb(RenderObject* o, const PaintInf
     wkDrawMediaUIPart(MediaVolumeSliderThumb, mediaControllerTheme(), localContext.cgContext(), r, getMediaUIPartStateFlags(node));
     return false;
 }
+
+bool RenderThemeMac::paintMediaFullScreenVolumeSliderTrack(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
+{
+    Node* node = o->node();
+    if (!node)
+        return false;
+    
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+    wkDrawMediaUIPart(MediaFullScreenVolumeSlider, mediaControllerTheme(), localContext.cgContext(), r, getMediaUIPartStateFlags(node));
+    return false;
+}
+
+bool RenderThemeMac::paintMediaFullScreenVolumeSliderThumb(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
+{
+    Node* node = o->node();
+    if (!node)
+        return false;
     
+    LocalCurrentGraphicsContext localContext(paintInfo.context);
+    wkDrawMediaUIPart(MediaFullScreenVolumeSliderThumb, mediaControllerTheme(), localContext.cgContext(), r, getMediaUIPartStateFlags(node));
+    return false;
+}
+
 String RenderThemeMac::extraMediaControlsStyleSheet()
 {
 #if PLATFORM(MAC)
diff --git a/Source/WebCore/rendering/RenderThemeWin.cpp b/Source/WebCore/rendering/RenderThemeWin.cpp
index 64b5c8a95..16795c3b7 100644
--- a/Source/WebCore/rendering/RenderThemeWin.cpp
+++ b/Source/WebCore/rendering/RenderThemeWin.cpp
@@ -457,6 +457,8 @@ unsigned RenderThemeWin::determineState(RenderObject* o)
         result = TS_HOVER;
     if (isChecked(o))
         result += 4; // 4 unchecked states, 4 checked states.
+    else if (isIndeterminate(o) && appearance == CheckboxPart)
+        result += 8;
     return result;
 }
 
diff --git a/Source/WebCore/rendering/RenderTreeAsText.cpp b/Source/WebCore/rendering/RenderTreeAsText.cpp
index 4cb4c0e67..79751ba5f 100644
--- a/Source/WebCore/rendering/RenderTreeAsText.cpp
+++ b/Source/WebCore/rendering/RenderTreeAsText.cpp
@@ -183,7 +183,7 @@ static bool isEmptyOrUnstyledAppleStyleSpan(const Node* node)
     if (!node->hasChildNodes())
         return true;
 
-    StylePropertySet* inlineStyleDecl = elem->inlineStyleDecl();
+    const StylePropertySet* inlineStyleDecl = elem->inlineStyle();
     return (!inlineStyleDecl || inlineStyleDecl->isEmpty());
 }
 
@@ -616,10 +616,10 @@ static void write(TextStream& ts, RenderLayer& l,
             ts << " scrollX " << l.scrollXOffset();
         if (l.scrollYOffset())
             ts << " scrollY " << l.scrollYOffset();
-        if (l.renderBox() && l.renderBox()->pixelSnappedClientWidth() != l.pixelSnappedScrollWidth())
-            ts << " scrollWidth " << l.pixelSnappedScrollWidth();
-        if (l.renderBox() && l.renderBox()->pixelSnappedClientHeight() != l.pixelSnappedScrollHeight())
-            ts << " scrollHeight " << l.pixelSnappedScrollHeight();
+        if (l.renderBox() && l.renderBox()->pixelSnappedClientWidth() != l.scrollWidth())
+            ts << " scrollWidth " << l.scrollWidth();
+        if (l.renderBox() && l.renderBox()->pixelSnappedClientHeight() != l.scrollHeight())
+            ts << " scrollHeight " << l.scrollHeight();
     }
 
     if (paintPhase == LayerPaintPhaseBackground)
diff --git a/Source/WebCore/rendering/RenderVideo.cpp b/Source/WebCore/rendering/RenderVideo.cpp
index 01426090e..1fc87a7d2 100644
--- a/Source/WebCore/rendering/RenderVideo.cpp
+++ b/Source/WebCore/rendering/RenderVideo.cpp
@@ -198,21 +198,29 @@ void RenderVideo::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& paintOf
     MediaPlayer* mediaPlayer = mediaElement()->player();
     bool displayingPoster = videoElement()->shouldDisplayPosterImage();
 
+    Page* page = 0;
+    if (Frame* frame = this->frame())
+        page = frame->page();
+
     if (!displayingPoster) {
-        if (!mediaPlayer)
+        if (!mediaPlayer) {
+            if (page && paintInfo.phase == PaintPhaseForeground)
+                page->addRelevantUnpaintedObject(this, visualOverflowRect());
             return;
+        }
         updatePlayer();
     }
 
     LayoutRect rect = videoBox();
-    if (rect.isEmpty())
+    if (rect.isEmpty()) {
+        if (page && paintInfo.phase == PaintPhaseForeground)
+            page->addRelevantUnpaintedObject(this, visualOverflowRect());
         return;
+    }
     rect.moveBy(paintOffset);
 
-    if (Frame* frame = this->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(this, paintInfo.rect);
-    }
+    if (page && paintInfo.phase == PaintPhaseForeground)
+        page->addRelevantRepaintedObject(this, rect);
 
     if (displayingPoster)
         paintIntoRect(paintInfo.context, rect);
diff --git a/Source/WebCore/rendering/RenderView.cpp b/Source/WebCore/rendering/RenderView.cpp
index df2910763..cd3893a55 100644
--- a/Source/WebCore/rendering/RenderView.cpp
+++ b/Source/WebCore/rendering/RenderView.cpp
@@ -366,9 +366,9 @@ void RenderView::computeRectForRepaint(RenderBoxModelObject* repaintContainer, I
         rect = m_layer->transform()->mapRect(rect);
 }
 
-void RenderView::absoluteRects(Vector<LayoutRect>& rects, const LayoutPoint& accumulatedOffset) const
+void RenderView::absoluteRects(Vector<IntRect>& rects, const LayoutPoint& accumulatedOffset) const
 {
-    rects.append(LayoutRect(accumulatedOffset, m_layer->size()));
+    rects.append(pixelSnappedIntRect(accumulatedOffset, m_layer->size()));
 }
 
 void RenderView::absoluteQuads(Vector<FloatQuad>& quads, bool* wasFixed) const
@@ -498,7 +498,7 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
     // Now clear the selection.
     SelectedObjectMap::iterator oldObjectsEnd = oldSelectedObjects.end();
     for (SelectedObjectMap::iterator i = oldSelectedObjects.begin(); i != oldObjectsEnd; ++i)
-        i->first->setSelectionState(SelectionNone);
+        i->first->setSelectionStateIfNeeded(SelectionNone);
 
     // set selection start and end
     m_selectionStart = start;
@@ -508,12 +508,12 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
 
     // Update the selection status of all objects between m_selectionStart and m_selectionEnd
     if (start && start == end)
-        start->setSelectionState(SelectionBoth);
+        start->setSelectionStateIfNeeded(SelectionBoth);
     else {
         if (start)
-            start->setSelectionState(SelectionStart);
+            start->setSelectionStateIfNeeded(SelectionStart);
         if (end)
-            end->setSelectionState(SelectionEnd);
+            end->setSelectionStateIfNeeded(SelectionEnd);
     }
 
     RenderObject* o = start;
@@ -521,7 +521,7 @@ void RenderView::setSelection(RenderObject* start, int startPos, RenderObject* e
 
     while (o && o != stop) {
         if (o != start && o != end && o->canBeSelectionLeaf())
-            o->setSelectionState(SelectionInside);
+            o->setSelectionStateIfNeeded(SelectionInside);
         o = o->nextInPreOrder();
     }
 
@@ -703,7 +703,7 @@ void RenderView::notifyWidgets(WidgetNotification notification)
 IntRect RenderView::viewRect() const
 {
     if (printing())
-        return IntRect(0, 0, width(), height());
+        return IntRect(IntPoint(), size());
     if (m_frameView)
         return m_frameView->visibleContentRect();
     return IntRect();
diff --git a/Source/WebCore/rendering/RenderView.h b/Source/WebCore/rendering/RenderView.h
index 9ee7a1d6d..66000942e 100644
--- a/Source/WebCore/rendering/RenderView.h
+++ b/Source/WebCore/rendering/RenderView.h
@@ -88,7 +88,7 @@ public:
 
     bool printing() const;
 
-    virtual void absoluteRects(Vector<LayoutRect>&, const LayoutPoint& accumulatedOffset) const;
+    virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const;
     virtual void absoluteQuads(Vector<FloatQuad>&, bool* wasFixed) const;
 
 #if USE(ACCELERATED_COMPOSITING)
diff --git a/Source/WebCore/rendering/RenderWidget.cpp b/Source/WebCore/rendering/RenderWidget.cpp
index ad5a03fd2..55802c4c2 100644
--- a/Source/WebCore/rendering/RenderWidget.cpp
+++ b/Source/WebCore/rendering/RenderWidget.cpp
@@ -359,11 +359,11 @@ IntRect RenderWidget::windowClipRect() const
 
 void RenderWidget::setSelectionState(SelectionState state)
 {
-    if (selectionState() != state) {
-        RenderReplaced::setSelectionState(state);
-        if (m_widget)
-            m_widget->setIsSelected(isSelected());
-    }
+    // The selection state for our containing block hierarchy is updated by the base class call.
+    RenderReplaced::setSelectionState(state);
+
+    if (m_widget)
+        m_widget->setIsSelected(isSelected());
 }
 
 void RenderWidget::clearWidget()
diff --git a/Source/WebCore/rendering/RenderingAllInOne.cpp b/Source/WebCore/rendering/RenderingAllInOne.cpp
index 7e9e7ddcc..b52e2908a 100644
--- a/Source/WebCore/rendering/RenderingAllInOne.cpp
+++ b/Source/WebCore/rendering/RenderingAllInOne.cpp
@@ -50,7 +50,6 @@
 #include "RenderCombineText.cpp"
 #include "RenderCounter.cpp"
 #include "RenderDeprecatedFlexibleBox.cpp"
-#include "RenderDetails.cpp"
 #include "RenderDetailsMarker.cpp"
 #include "RenderEmbeddedObject.cpp"
 #include "RenderFieldset.cpp"
@@ -90,7 +89,6 @@
 #include "RenderScrollbarPart.cpp"
 #include "RenderScrollbarTheme.cpp"
 #include "RenderSlider.cpp"
-#include "RenderSummary.cpp"
 #include "RenderTable.cpp"
 #include "RenderTableCaption.cpp"
 #include "RenderTableCell.cpp"
diff --git a/Source/WebCore/rendering/RootInlineBox.cpp b/Source/WebCore/rendering/RootInlineBox.cpp
index 8d84bfe61..c56560065 100644
--- a/Source/WebCore/rendering/RootInlineBox.cpp
+++ b/Source/WebCore/rendering/RootInlineBox.cpp
@@ -580,6 +580,14 @@ InlineBox* RootInlineBox::closestLeafChildForLogicalLeftPosition(int leftPositio
 {
     InlineBox* firstLeaf = firstLeafChild();
     InlineBox* lastLeaf = lastLeafChild();
+
+    if (firstLeaf != lastLeaf) {
+        if (firstLeaf->isLineBreak())
+            firstLeaf = firstLeaf->nextLeafChildIgnoringLineBreak();
+        else if (lastLeaf->isLineBreak())
+            lastLeaf = lastLeaf->prevLeafChildIgnoringLineBreak();
+    }
+
     if (firstLeaf == lastLeaf && (!onlyEditableLeaves || isEditableLeaf(firstLeaf)))
         return firstLeaf;
 
@@ -595,7 +603,7 @@ InlineBox* RootInlineBox::closestLeafChildForLogicalLeftPosition(int leftPositio
         return lastLeaf;
 
     InlineBox* closestLeaf = 0;
-    for (InlineBox* leaf = firstLeaf; leaf; leaf = leaf->nextLeafChild()) {
+    for (InlineBox* leaf = firstLeaf; leaf; leaf = leaf->nextLeafChildIgnoringLineBreak()) {
         if (!leaf->renderer()->isListMarker() && (!onlyEditableLeaves || isEditableLeaf(leaf))) {
             closestLeaf = leaf;
             if (leftPosition < leaf->logicalRight())
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
index 631266258..84928d4b4 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.cpp
@@ -35,9 +35,7 @@ namespace WebCore {
     
 using namespace MathMLNames;
 
-static const int gTopAdjustDivisor = 3;
 static const int gSubsupScriptMargin = 1;
-static const float gSubSupStretch = 1.2f;
 
 RenderMathMLSubSup::RenderMathMLSubSup(Element* element) 
     : RenderMathMLBlock(element)
@@ -90,6 +88,8 @@ void RenderMathMLSubSup::addChild(RenderObject* child, RenderObject* beforeChild
             scriptsStyle->setVerticalAlign(TOP);
             scriptsStyle->setMarginLeft(Length(gSubsupScriptMargin, Fixed));
             scriptsStyle->setTextAlign(LEFT);
+            // Set this wrapper's font-size for its line-height & baseline position.
+            scriptsStyle->setBlendedFontSize(static_cast<int>(0.75 * style()->fontSize()));
             m_scripts->setStyle(scriptsStyle.release());
             RenderMathMLBlock::addChild(m_scripts, beforeChild);
         }
@@ -126,74 +126,68 @@ RenderMathMLOperator* RenderMathMLSubSup::unembellishedOperator()
 void RenderMathMLSubSup::stretchToHeight(int height)
 {
     RenderBoxModelObject* base = this->base();
-    if (base && base->isRenderMathMLBlock()) {
-        toRenderMathMLBlock(base)->stretchToHeight(static_cast<int>(gSubSupStretch * height));
-        
-        // Adjust the script placement after we stretch
-        if (height > 0 && m_kind == SubSup && m_scripts) {
-            RenderObject* supWrapper = m_scripts->firstChild();
-            if (supWrapper) {
-                // Calculate the script height without the container margins.
-                int supHeight = getBoxModelObjectHeight(supWrapper->firstChild());
-                int supTopAdjust = supHeight / gTopAdjustDivisor;
-                supWrapper->style()->setMarginTop(Length(-supTopAdjust, Fixed));
-                supWrapper->style()->setMarginBottom(Length(height - supHeight + supTopAdjust, Fixed));
-                supWrapper->setNeedsLayout(true);
-            }
-        }
-    }
+    if (base && base->isRenderMathMLBlock())
+        toRenderMathMLBlock(base)->stretchToHeight(height);
 }
 
 void RenderMathMLSubSup::layout()
 {
     RenderBlock::layout();
     
-    if (m_kind == SubSup && m_scripts) {
-        if (RenderBoxModelObject* base = this->base()) {
-            LayoutUnit heightDiff = (m_scripts->offsetHeight() - base->offsetHeight()) / 2;
-            if (heightDiff < 0) 
-                heightDiff = 0;
-            RenderObject* baseWrapper = firstChild();
-            baseWrapper->style()->setPaddingTop(Length(heightDiff, Fixed));
-            baseWrapper->setNeedsLayout(true);
-            RenderBlock::layout();
-        }
-    }    
-}
-
-LayoutUnit RenderMathMLSubSup::baselinePosition(FontBaseline, bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
-{
-    RenderObject* base = firstChild();
-    if (!base) 
-        return offsetHeight();
+    if (m_kind != SubSup || !m_scripts)
+        return;
+    RenderBoxModelObject* base = this->base();
+    RenderObject* superscriptWrapper = m_scripts->firstChild();
+    RenderObject* subscriptWrapper = m_scripts->lastChild();
+    if (!base || !superscriptWrapper || !subscriptWrapper || superscriptWrapper == subscriptWrapper)
+        return;
+    ASSERT(superscriptWrapper->isRenderMathMLBlock());
+    ASSERT(subscriptWrapper->isRenderMathMLBlock());
+    RenderObject* superscript = superscriptWrapper->firstChild();
+    RenderObject* subscript = subscriptWrapper->firstChild();
+    if (!superscript || !subscript)
+        return;
     
-    LayoutUnit baseline = offsetHeight();
-    if (!base || !base->isBoxModelObject()) 
-        return baseline;
-
-    switch (m_kind) {
-    case SubSup:
-        base = base->firstChild();
-        if (m_scripts && base && base->isBoxModelObject()) {
-            RenderBoxModelObject* box = toRenderBoxModelObject(base);
-            
-            int topAdjust = (m_scripts->offsetHeight() - box->offsetHeight()) / 2;
-        
-            // FIXME: The last bit of this calculation should be more exact. Why is the 2-3px scaled for zoom necessary?
-            // The baseline is top spacing of the base + the baseline of the base + adjusted space for zoom
-            float zoomFactor = style()->effectiveZoom();
-            return topAdjust + box->baselinePosition(AlphabeticBaseline, firstLine, direction, linePositionMode) + static_cast<int>((zoomFactor > 1.25 ? 2 : 3) * zoomFactor);
-        }
-        break;
-    case Sup: 
-    case Sub:
-        return RenderMathMLBlock::baselinePosition(AlphabeticBaseline, firstLine, direction, linePositionMode);
+    LineDirectionMode lineDirection = style()->isHorizontalWritingMode() ? HorizontalLine : VerticalLine;
+    LayoutUnit baseBaseline = base->baselinePosition(AlphabeticBaseline, true, lineDirection);
+    LayoutUnit baseExtendUnderBaseline = getBoxModelObjectHeight(base) - baseBaseline;
+    LayoutUnit axis = style()->fontMetrics().xHeight() / 2;
+    LayoutUnit superscriptHeight = getBoxModelObjectHeight(superscript);
+    LayoutUnit subscriptHeight = getBoxModelObjectHeight(subscript);
+    
+    // Our layout rules are: Don't let the superscript go below the "axis" (half x-height above the
+    // baseline), or the subscript above the axis. Also, don't let the superscript's top edge be
+    // below the base's top edge, or the subscript's bottom edge above the base's bottom edge.
+    //
+    // FIXME: Check any subscriptshift or superscriptshift attributes, and maybe use more sophisticated
+    // heuristics from TeX or elsewhere. See https://bugs.webkit.org/show_bug.cgi?id=79274#c5.
+    
+    // Above we did scriptsStyle->setVerticalAlign(TOP) for mscripts' style, so the superscript's
+    // top edge will equal the top edge of the base's padding.
+    LayoutUnit basePaddingTop = superscriptHeight + axis - baseBaseline;
+    // If basePaddingTop is positive, it's indeed the base's padding-top that we need. If it's negative,
+    // then we should instead use its absolute value to pad the bottom of the superscript, to get the
+    // superscript's bottom edge down to the axis. First we compute how much more we need to shift the
+    // subscript down, once its top edge is at the axis.
+    LayoutUnit superPaddingBottom = max<LayoutUnit>(baseExtendUnderBaseline + axis - subscriptHeight, 0);
+    if (basePaddingTop < 0) {
+        superPaddingBottom += -basePaddingTop;
+        basePaddingTop = 0;
     }
     
-    return baseline;
+    setChildNeedsLayout(true, false);
     
-}
+    RenderObject* baseWrapper = firstChild();
+    baseWrapper->style()->setPaddingTop(Length(basePaddingTop, Fixed));
+    baseWrapper->setNeedsLayout(true, false);
     
+    superscriptWrapper->style()->setPaddingBottom(Length(superPaddingBottom, Fixed));
+    superscriptWrapper->setNeedsLayout(true, false);
+    m_scripts->setNeedsLayout(true, false);
+    
+    RenderBlock::layout();
+}
+
 }    
 
 #endif // ENABLE(MATHML)
diff --git a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h
index 9c7d02c89..0a291de97 100644
--- a/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h
+++ b/Source/WebCore/rendering/mathml/RenderMathMLSubSup.h
@@ -39,7 +39,6 @@ public:
     
     virtual RenderMathMLOperator* unembellishedOperator();
     virtual void stretchToHeight(int pixelHeight);
-    virtual LayoutUnit baselinePosition(FontBaseline, bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
 
 protected:
     virtual void layout();
diff --git a/Source/WebCore/rendering/style/RenderStyle.cpp b/Source/WebCore/rendering/style/RenderStyle.cpp
index c62b3b198..8f31e0f7d 100644
--- a/Source/WebCore/rendering/style/RenderStyle.cpp
+++ b/Source/WebCore/rendering/style/RenderStyle.cpp
@@ -135,6 +135,7 @@ ALWAYS_INLINE RenderStyle::RenderStyle(bool)
 #endif
 #if ENABLE(CSS_GRID_LAYOUT)
     rareNonInheritedData.access()->m_grid.init();
+    rareNonInheritedData.access()->m_gridItem.init();
 #endif
     rareInheritedData.init();
     inherited.init();
@@ -424,7 +425,8 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
         }
 #endif
 #if ENABLE(CSS_GRID_LAYOUT)
-        if (rareNonInheritedData->m_grid.get() != other->rareNonInheritedData->m_grid.get())
+        if (rareNonInheritedData->m_grid.get() != other->rareNonInheritedData->m_grid.get()
+            && rareNonInheritedData->m_gridItem.get() != other->rareNonInheritedData->m_gridItem.get())
             return StyleDifferenceLayout;
 #endif
 
@@ -843,14 +845,14 @@ void RenderStyle::setBoxShadow(PassOwnPtr<ShadowData> shadowData, bool add)
 static RoundedRect::Radii calcRadiiFor(const BorderData& border, LayoutSize size)
 {
     return RoundedRect::Radii(
-        LayoutSize(border.topLeft().width().calcValue(size.width()), 
-                   border.topLeft().height().calcValue(size.height())),
-        LayoutSize(border.topRight().width().calcValue(size.width()),
-                   border.topRight().height().calcValue(size.height())),
-        LayoutSize(border.bottomLeft().width().calcValue(size.width()), 
-                   border.bottomLeft().height().calcValue(size.height())),
-        LayoutSize(border.bottomRight().width().calcValue(size.width()), 
-                   border.bottomRight().height().calcValue(size.height())));
+        IntSize(border.topLeft().width().calcValue(size.width()), 
+                border.topLeft().height().calcValue(size.height())),
+        IntSize(border.topRight().width().calcValue(size.width()),
+                border.topRight().height().calcValue(size.height())),
+        IntSize(border.bottomLeft().width().calcValue(size.width()), 
+                border.bottomLeft().height().calcValue(size.height())),
+        IntSize(border.bottomRight().width().calcValue(size.width()), 
+                border.bottomRight().height().calcValue(size.height())));
 }
 
 static float calcConstraintScaleFor(const IntRect& rect, const RoundedRect::Radii& radii)
diff --git a/Source/WebCore/rendering/style/RenderStyle.h b/Source/WebCore/rendering/style/RenderStyle.h
index 647d3e9fc..55151d3ec 100644
--- a/Source/WebCore/rendering/style/RenderStyle.h
+++ b/Source/WebCore/rendering/style/RenderStyle.h
@@ -77,6 +77,7 @@
 
 #if ENABLE(CSS_GRID_LAYOUT)
 #include "StyleGridData.h"
+#include "StyleGridItemData.h"
 #endif
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -814,6 +815,9 @@ public:
 #if ENABLE(CSS_GRID_LAYOUT)
     const Vector<Length>& gridColumns() const { return rareNonInheritedData->m_grid->m_gridColumns; }
     const Vector<Length>& gridRows() const { return rareNonInheritedData->m_grid->m_gridRows; }
+
+    const Length& gridItemColumn() const { return rareNonInheritedData->m_gridItem->m_gridColumn; }
+    const Length& gridItemRow() const { return rareNonInheritedData->m_gridItem->m_gridRow; }
 #endif
 
     const ShadowData* boxShadow() const { return rareNonInheritedData->m_boxShadow.get(); }
@@ -957,7 +961,7 @@ public:
 
     EImageRendering imageRendering() const { return static_cast<EImageRendering>(rareInheritedData->m_imageRendering); }
     
-    ESpeak speak() { return static_cast<ESpeak>(rareInheritedData->speak); }
+    ESpeak speak() const { return static_cast<ESpeak>(rareInheritedData->speak); }
 
 #if ENABLE(CSS_FILTERS)
     FilterOperations& filter() { return rareNonInheritedData.access()->m_filter.access()->m_operations; }
@@ -966,6 +970,12 @@ public:
 #else
     bool hasFilter() const { return false; }
 #endif
+
+#if USE(RTL_SCROLLBAR)
+    bool shouldPlaceBlockDirectionScrollbarOnLogicalLeft() const { return !isLeftToRightDirection() && isHorizontalWritingMode(); }
+#else
+    bool shouldPlaceBlockDirectionScrollbarOnLogicalLeft() const { return false; }
+#endif
         
 // attribute setter methods
 
@@ -1100,7 +1110,7 @@ public:
         return false;
     }
 
-    // Only used for blending font sizes when animating.
+    // Only used for blending font sizes when animating, or MathML anonymous blocks.
     void setBlendedFontSize(int);
 
     void setColor(const Color& v) { SET_VAR(inherited, color, v) }
@@ -1240,6 +1250,9 @@ public:
 #if ENABLE(CSS_GRID_LAYOUT)
     void setGridColumns(const Vector<Length>& lengths) { SET_VAR(rareNonInheritedData.access()->m_grid, m_gridColumns, lengths); }
     void setGridRows(const Vector<Length>& lengths) { SET_VAR(rareNonInheritedData.access()->m_grid, m_gridRows, lengths); }
+
+    void setGridItemColumn(const Length& columnPosition) { SET_VAR(rareNonInheritedData.access()->m_gridItem, m_gridColumn, columnPosition); }
+    void setGridItemRow(const Length& rowPosition) { SET_VAR(rareNonInheritedData.access()->m_gridItem, m_gridRow, rowPosition); }
 #endif
 
     void setMarqueeIncrement(const Length& f) { SET_VAR(rareNonInheritedData.access()->m_marquee, increment, f); }
@@ -1443,21 +1456,9 @@ public:
 
     StyleDifference diff(const RenderStyle*, unsigned& changedContextSensitiveProperties) const;
 
-    bool isDisplayReplacedType() const
-    {
-        return display() == INLINE_BLOCK || display() == INLINE_BOX || display() == INLINE_TABLE;
-    }
-
-    bool isDisplayInlineType() const
-    {
-        return display() == INLINE || isDisplayReplacedType();
-    }
-
-    bool isOriginalDisplayInlineType() const
-    {
-        return originalDisplay() == INLINE || originalDisplay() == INLINE_BLOCK
-            || originalDisplay() == INLINE_BOX || originalDisplay() == INLINE_TABLE;
-    }
+    bool isDisplayReplacedType() const { return isDisplayReplacedType(display()); }
+    bool isDisplayInlineType() const { return isDisplayInlineType(display()); }
+    bool isOriginalDisplayInlineType() const { return isDisplayInlineType(originalDisplay()); }
 
     void setWritingMode(WritingMode v) { inherited_flags.m_writingMode = v; }
 
@@ -1636,6 +1637,10 @@ public:
     }
     static Vector<Length> initialGridColumns() { return initialGridTrackValue(); }
     static Vector<Length> initialGridRows() { return initialGridTrackValue(); }
+
+    // 'auto' is the default.
+    static Length initialGridItemColumn() { return Length(); }
+    static Length initialGridItemRow() { return Length(); }
 #endif
 
     static const AtomicString& initialLineGrid() { return nullAtom; }
@@ -1704,6 +1709,12 @@ private:
         return isHorizontalWritingMode() ? getImageVerticalOutsets(image, logicalTop, logicalBottom) : getImageHorizontalOutsets(image, logicalTop, logicalBottom);
     }
 
+    bool isDisplayReplacedType(EDisplay display) const
+    {
+        return display == INLINE_BLOCK || display == INLINE_BOX || display == INLINE_FLEXBOX || display == INLINE_TABLE;
+    }
+    bool isDisplayInlineType(EDisplay display) const { return display == INLINE || isDisplayReplacedType(display); }
+
     // Color accessors are all private to make sure callers use visitedDependentColor instead to access them.
     const Color& invalidColor() const { static Color invalid; return invalid; }
     const Color& borderLeftColor() const { return surround->border.left().color(); }
diff --git a/Source/WebCore/rendering/style/StyleCachedShader.cpp b/Source/WebCore/rendering/style/StyleCachedShader.cpp
index 52fd2ef64..d9118a15a 100644
--- a/Source/WebCore/rendering/style/StyleCachedShader.cpp
+++ b/Source/WebCore/rendering/style/StyleCachedShader.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/rendering/style/StyleCachedShader.h b/Source/WebCore/rendering/style/StyleCachedShader.h
index 269226457..c2e007756 100644
--- a/Source/WebCore/rendering/style/StyleCachedShader.h
+++ b/Source/WebCore/rendering/style/StyleCachedShader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/rendering/style/StyleCustomFilterProgram.h b/Source/WebCore/rendering/style/StyleCustomFilterProgram.h
index 472e157f5..b6eec7470 100644
--- a/Source/WebCore/rendering/style/StyleCustomFilterProgram.h
+++ b/Source/WebCore/rendering/style/StyleCustomFilterProgram.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2012 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/storage/DOMWindowSQLDatabase.idl b/Source/WebCore/rendering/style/StyleGridItemData.cpp
index 025116202..a633c11d2 100644
--- a/Source/WebCore/storage/DOMWindowSQLDatabase.idl
+++ b/Source/WebCore/rendering/style/StyleGridItemData.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2012 Google Inc.  All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -27,18 +27,29 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
+#include "config.h"
+#include "StyleGridItemData.h"
 
-module window {
+#if ENABLE(CSS_GRID_LAYOUT)
 
-    interface [
-        Conditional=SQL_DATABASE,
-        Supplemental=DOMWindow
-    ] DOMWindowSQLDatabase {
-        [V8EnabledAtRuntime] Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize, in [Callback, Optional] DatabaseCallback creationCallback)
-            raises(DOMException);
-#if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
-        attribute SQLExceptionConstructor SQLException;
-#endif
-    };
+#include "RenderStyle.h"
 
+namespace WebCore {
+
+StyleGridItemData::StyleGridItemData()
+    : m_gridColumn(RenderStyle::initialGridItemColumn())
+    , m_gridRow(RenderStyle::initialGridItemRow())
+{
+}
+
+StyleGridItemData::StyleGridItemData(const StyleGridItemData& o)
+    : RefCounted<StyleGridItemData>()
+    , m_gridColumn(o.m_gridColumn)
+    , m_gridRow(o.m_gridRow)
+{
 }
+
+} // namespace WebCore
+
+#endif // ENABLE(CSS_GRID_LAYOUT)
+
diff --git a/Source/WebCore/platform/AsyncFileStream.h b/Source/WebCore/rendering/style/StyleGridItemData.h
index a555a2467..76306b47b 100644
--- a/Source/WebCore/platform/AsyncFileStream.h
+++ b/Source/WebCore/rendering/style/StyleGridItemData.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010 Google Inc.  All rights reserved.
+ * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,47 +28,46 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef AsyncFileStream_h
-#define AsyncFileStream_h
+#ifndef StyleGridItemData_h
+#define StyleGridItemData_h
 
-#if ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#if ENABLE(CSS_GRID_LAYOUT)
 
-#include "FileStreamClient.h"
-#include <wtf/Forward.h>
+#include "Length.h"
+#include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
-class KURL;
-
-class AsyncFileStream : public RefCounted<AsyncFileStream> {
+class StyleGridItemData : public RefCounted<StyleGridItemData> {
 public:
-    virtual ~AsyncFileStream() { }
-
-    virtual void getSize(const String& path, double expectedModificationTime) = 0;
-    virtual void openForRead(const String& path, long long offset, long long length) = 0;
-    virtual void openForWrite(const String& path) = 0;
-    virtual void close() = 0;
-    virtual void read(char* buffer, int length) = 0;
-    virtual void write(const KURL& blobURL, long long position, int length) = 0;
-    virtual void truncate(long long position) = 0;
-    virtual void stop() = 0;
+    static PassRefPtr<StyleGridItemData> create() { return adoptRef(new StyleGridItemData); }
+    PassRefPtr<StyleGridItemData> copy() const { return adoptRef(new StyleGridItemData(*this)); }
 
-    FileStreamClient* client() const { return m_client; }
-    void setClient(FileStreamClient* client) { m_client = client; }
+    bool operator==(const StyleGridItemData& o) const
+    {
+        return m_gridColumn == o.m_gridColumn && m_gridRow == o.m_gridRow;
+    }
 
-protected:
-    AsyncFileStream(FileStreamClient* client)
-        : m_client(client)
+    bool operator!=(const StyleGridItemData& o) const
     {
+        return !(*this == o);
     }
 
+    // FIXME: For the moment, we only support a subset of the grammar which correspond to:
+    // 'auto' | <length>
+    // When we add more of the syntax, we will need a dedicated GridPosition class.
+    Length m_gridColumn;
+    Length m_gridRow;
+
 private:
-    FileStreamClient* m_client;
+    StyleGridItemData();
+    StyleGridItemData(const StyleGridItemData&);
 };
 
 } // namespace WebCore
 
-#endif // ENABLE(BLOB) || ENABLE(FILE_SYSTEM)
+#endif // ENABLE(CSS_LAYOUT_GRID)
 
-#endif // AsyncFileStream_h
+#endif // StyleGridItemData_h
diff --git a/Source/WebCore/rendering/style/StylePendingShader.h b/Source/WebCore/rendering/style/StylePendingShader.h
index 0046c82a1..98ad91c58 100644
--- a/Source/WebCore/rendering/style/StylePendingShader.h
+++ b/Source/WebCore/rendering/style/StylePendingShader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp b/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp
index 3dc34f021..529fc4eb8 100644
--- a/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp
+++ b/Source/WebCore/rendering/style/StyleRareNonInheritedData.cpp
@@ -98,6 +98,7 @@ StyleRareNonInheritedData::StyleRareNonInheritedData(const StyleRareNonInherited
 #endif
 #if ENABLE(CSS_GRID_LAYOUT)
     , m_grid(o.m_grid)
+    , m_gridItem(o.m_gridItem)
 #endif
     , m_content(o.m_content ? o.m_content->clone() : nullptr)
     , m_counterDirectives(o.m_counterDirectives ? clone(*o.m_counterDirectives) : nullptr)
@@ -165,6 +166,7 @@ bool StyleRareNonInheritedData::operator==(const StyleRareNonInheritedData& o) c
 #endif
 #if ENABLE(CSS_GRID_LAYOUT)
         && m_grid == o.m_grid
+        && m_gridItem == o.m_gridItem
 #endif
         && contentDataEquivalent(o)
         && counterDataEquivalent(o)
diff --git a/Source/WebCore/rendering/style/StyleRareNonInheritedData.h b/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
index 3e2c4a107..e95c55b60 100644
--- a/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
+++ b/Source/WebCore/rendering/style/StyleRareNonInheritedData.h
@@ -48,6 +48,7 @@ class StyleFilterData;
 class StyleFlexibleBoxData;
 #if ENABLE(CSS_GRID_LAYOUT)
 class StyleGridData;
+class StyleGridItemData;
 #endif
 class StyleMarqueeData;
 class StyleMultiColData;
@@ -119,6 +120,7 @@ public:
 
 #if ENABLE(CSS_GRID_LAYOUT)
     DataRef<StyleGridData> m_grid;
+    DataRef<StyleGridItemData> m_gridItem;
 #endif
 
     OwnPtr<ContentData> m_content;
diff --git a/Source/WebCore/rendering/style/StyleShader.h b/Source/WebCore/rendering/style/StyleShader.h
index ff5d2fda6..e38f9bf8f 100644
--- a/Source/WebCore/rendering/style/StyleShader.h
+++ b/Source/WebCore/rendering/style/StyleShader.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011 Adobe Systems Incorporated. All Rights Reserved.
+ * Copyright (C) 2011 Adobe Systems Incorporated. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
diff --git a/Source/WebCore/rendering/svg/RenderSVGAllInOne.cpp b/Source/WebCore/rendering/svg/RenderSVGAllInOne.cpp
index 98be1ba0a..8f8c86ea6 100644
--- a/Source/WebCore/rendering/svg/RenderSVGAllInOne.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGAllInOne.cpp
@@ -49,7 +49,6 @@
 #include "RenderSVGResourceRadialGradient.cpp"
 #include "RenderSVGResourceSolidColor.cpp"
 #include "RenderSVGRoot.cpp"
-#include "RenderSVGShadowTreeRootContainer.cpp"
 #include "RenderSVGShape.cpp"
 #include "RenderSVGTSpan.cpp"
 #include "RenderSVGText.cpp"
@@ -63,11 +62,11 @@
 #include "SVGPathData.cpp"
 #include "SVGRenderSupport.cpp"
 #include "SVGRenderTreeAsText.cpp"
+#include "SVGRenderingContext.cpp"
 #include "SVGResources.cpp"
 #include "SVGResourcesCache.cpp"
 #include "SVGResourcesCycleSolver.cpp"
 #include "SVGRootInlineBox.cpp"
-#include "SVGShadowTreeElements.cpp"
 #include "SVGTextChunk.cpp"
 #include "SVGTextChunkBuilder.cpp"
 #include "SVGTextLayoutAttributes.cpp"
diff --git a/Source/WebCore/rendering/svg/RenderSVGBlock.cpp b/Source/WebCore/rendering/svg/RenderSVGBlock.cpp
index 58f6631fa..cf44efff1 100644
--- a/Source/WebCore/rendering/svg/RenderSVGBlock.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGBlock.cpp
@@ -79,7 +79,7 @@ void RenderSVGBlock::updateBoxModelInfoFromStyle()
     setHasOverflowClip(false);
 }
 
-void RenderSVGBlock::absoluteRects(Vector<LayoutRect>&, const LayoutPoint&) const
+void RenderSVGBlock::absoluteRects(Vector<IntRect>&, const LayoutPoint&) const
 {
     // This code path should never be taken for SVG, as we're assuming useTransforms=true everywhere, absoluteQuads should be used.
     ASSERT_NOT_REACHED();
diff --git a/Source/WebCore/rendering/svg/RenderSVGBlock.h b/Source/WebCore/rendering/svg/RenderSVGBlock.h
index 58cf2620a..ca000f50b 100644
--- a/Source/WebCore/rendering/svg/RenderSVGBlock.h
+++ b/Source/WebCore/rendering/svg/RenderSVGBlock.h
@@ -38,7 +38,7 @@ private:
     virtual void setStyle(PassRefPtr<RenderStyle>);
     virtual void updateBoxModelInfoFromStyle();
 
-    virtual void absoluteRects(Vector<LayoutRect>&, const LayoutPoint& accumulatedOffset) const;
+    virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const;
 
     virtual void willBeDestroyed();
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
diff --git a/Source/WebCore/rendering/svg/RenderSVGContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGContainer.cpp
index 515565521..e16bfa33c 100644
--- a/Source/WebCore/rendering/svg/RenderSVGContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGContainer.cpp
@@ -31,7 +31,7 @@
 #include "RenderSVGResource.h"
 #include "RenderSVGResourceFilter.h"
 #include "RenderView.h"
-#include "SVGRenderSupport.h"
+#include "SVGRenderingContext.h"
 #include "SVGResources.h"
 #include "SVGResourcesCache.h"
 #include "SVGStyledElement.h"
@@ -114,18 +114,18 @@ void RenderSVGContainer::paint(PaintInfo& paintInfo, const LayoutPoint&)
 
         childPaintInfo.applyTransform(localToParentTransform());
 
+        SVGRenderingContext renderingContext;
         bool continueRendering = true;
-        if (childPaintInfo.phase == PaintPhaseForeground)
-            continueRendering = SVGRenderSupport::prepareToRenderSVGContent(this, childPaintInfo);
+        if (childPaintInfo.phase == PaintPhaseForeground) {
+            renderingContext.prepareToRenderSVGContent(this, childPaintInfo);
+            continueRendering = renderingContext.isRenderingPrepared();
+        }
 
         if (continueRendering) {
             childPaintInfo.updatePaintingRootForChildren(this);
             for (RenderObject* child = firstChild(); child; child = child->nextSibling())
                 child->paint(childPaintInfo, IntPoint());
         }
-
-        if (paintInfo.phase == PaintPhaseForeground)
-            SVGRenderSupport::finishRenderSVGContent(this, childPaintInfo, paintInfo.context);
     }
     
     // FIXME: This really should be drawn from local coordinates, but currently we hack it
@@ -140,9 +140,9 @@ void RenderSVGContainer::paint(PaintInfo& paintInfo, const LayoutPoint&)
 }
 
 // addFocusRingRects is called from paintOutline and needs to be in the same coordinates as the paintOuline call
-void RenderSVGContainer::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint&)
+void RenderSVGContainer::addFocusRingRects(Vector<IntRect>& rects, const LayoutPoint&)
 {
-    LayoutRect paintRectInParent = enclosingLayoutRect(localToParentTransform().mapRect(repaintRectInLocalCoordinates()));
+    IntRect paintRectInParent = enclosingIntRect(localToParentTransform().mapRect(repaintRectInLocalCoordinates()));
     if (!paintRectInParent.isEmpty())
         rects.append(paintRectInParent);
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGContainer.h b/Source/WebCore/rendering/svg/RenderSVGContainer.h
index b3324703c..84621f175 100644
--- a/Source/WebCore/rendering/svg/RenderSVGContainer.h
+++ b/Source/WebCore/rendering/svg/RenderSVGContainer.h
@@ -52,7 +52,7 @@ protected:
 
     virtual void layout();
 
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
 
     virtual FloatRect objectBoundingBox() const { return m_objectBoundingBox; }
     virtual FloatRect strokeBoundingBox() const { return m_strokeBoundingBox; }
diff --git a/Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp b/Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp
index dadcaed8a..676e8f4a7 100644
--- a/Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGForeignObject.cpp
@@ -29,7 +29,7 @@
 #include "RenderSVGResource.h"
 #include "RenderView.h"
 #include "SVGForeignObjectElement.h"
-#include "SVGRenderSupport.h"
+#include "SVGRenderingContext.h"
 #include "SVGResourcesCache.h"
 #include "SVGSVGElement.h"
 #include "TransformState.h"
@@ -59,9 +59,12 @@ void RenderSVGForeignObject::paint(PaintInfo& paintInfo, const LayoutPoint&)
     if (SVGRenderSupport::isOverflowHidden(this))
         childPaintInfo.context->clip(m_viewport);
 
+    SVGRenderingContext renderingContext;
     bool continueRendering = true;
-    if (paintInfo.phase == PaintPhaseForeground)
-        continueRendering = SVGRenderSupport::prepareToRenderSVGContent(this, childPaintInfo);
+    if (paintInfo.phase == PaintPhaseForeground) {
+        renderingContext.prepareToRenderSVGContent(this, childPaintInfo);
+        continueRendering = renderingContext.isRenderingPrepared();
+    }
 
     if (continueRendering) {
         // Paint all phases of FO elements atomically, as though the FO element established its
@@ -81,9 +84,6 @@ void RenderSVGForeignObject::paint(PaintInfo& paintInfo, const LayoutPoint&)
             RenderBlock::paint(childPaintInfo, childPoint);
         }
     }
-
-    if (paintInfo.phase == PaintPhaseForeground)
-        SVGRenderSupport::finishRenderSVGContent(this, childPaintInfo, paintInfo.context);
 }
 
 LayoutRect RenderSVGForeignObject::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer) const
diff --git a/Source/WebCore/rendering/svg/RenderSVGImage.cpp b/Source/WebCore/rendering/svg/RenderSVGImage.cpp
index 7230c6ae9..56be5cd41 100644
--- a/Source/WebCore/rendering/svg/RenderSVGImage.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGImage.cpp
@@ -41,7 +41,7 @@
 #include "SVGImageElement.h"
 #include "SVGLength.h"
 #include "SVGPreserveAspectRatio.h"
-#include "SVGRenderSupport.h"
+#include "SVGRenderingContext.h"
 #include "SVGResources.h"
 #include "SVGResourcesCache.h"
 
@@ -124,9 +124,9 @@ void RenderSVGImage::paint(PaintInfo& paintInfo, const LayoutPoint&)
         childPaintInfo.applyTransform(m_localTransform);
 
         if (childPaintInfo.phase == PaintPhaseForeground) {
-            PaintInfo savedInfo(childPaintInfo);
+            SVGRenderingContext renderingContext(this, childPaintInfo);
 
-            if (SVGRenderSupport::prepareToRenderSVGContent(this, childPaintInfo)) {
+            if (renderingContext.isRenderingPrepared()) {
                 RefPtr<Image> image = m_imageResource->image();
                 FloatRect destRect = m_objectBoundingBox;
                 FloatRect srcRect(0, 0, image->width(), image->height());
@@ -136,8 +136,6 @@ void RenderSVGImage::paint(PaintInfo& paintInfo, const LayoutPoint&)
 
                 childPaintInfo.context->drawImage(image.get(), ColorSpaceDeviceRGB, destRect, srcRect);
             }
-
-            SVGRenderSupport::finishRenderSVGContent(this, childPaintInfo, savedInfo.context);
         }
 
         if (drawsOutline)
@@ -183,10 +181,10 @@ void RenderSVGImage::imageChanged(WrappedImagePtr, const IntRect*)
     repaint();
 }
 
-void RenderSVGImage::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint&)
+void RenderSVGImage::addFocusRingRects(Vector<IntRect>& rects, const LayoutPoint&)
 {
     // this is called from paint() after the localTransform has already been applied
-    LayoutRect contentRect = enclosingLayoutRect(repaintRectInLocalCoordinates());
+    IntRect contentRect = enclosingIntRect(repaintRectInLocalCoordinates());
     if (!contentRect.isEmpty())
         rects.append(contentRect);
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGImage.h b/Source/WebCore/rendering/svg/RenderSVGImage.h
index 6a301eaad..9cd3eeac1 100644
--- a/Source/WebCore/rendering/svg/RenderSVGImage.h
+++ b/Source/WebCore/rendering/svg/RenderSVGImage.h
@@ -58,7 +58,7 @@ private:
     virtual FloatRect strokeBoundingBox() const { return m_objectBoundingBox; }
     virtual FloatRect repaintRectInLocalCoordinates() const { return m_repaintBoundingBox; }
 
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
 
     virtual void imageChanged(WrappedImagePtr, const IntRect* = 0);
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp b/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
index 3377fc026..3841336a5 100644
--- a/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGModelObject.cpp
@@ -34,6 +34,7 @@
 #include "RenderSVGModelObject.h"
 
 #include "RenderSVGResource.h"
+#include "SVGNames.h"
 #include "SVGResourcesCache.h"
 #include "SVGStyledElement.h"
 
@@ -71,10 +72,10 @@ LayoutRect RenderSVGModelObject::outlineBoundsForRepaint(RenderBoxModelObject* r
     return containerRelativeQuad.enclosingBoundingBox();
 }
 
-void RenderSVGModelObject::absoluteRects(Vector<LayoutRect>& rects, const LayoutPoint& accumulatedOffset) const
+void RenderSVGModelObject::absoluteRects(Vector<IntRect>& rects, const LayoutPoint& accumulatedOffset) const
 {
-    LayoutRect rect = enclosingLayoutRect(strokeBoundingBox());
-    rect.moveBy(accumulatedOffset);
+    IntRect rect = enclosingIntRect(strokeBoundingBox());
+    rect.moveBy(roundedIntPoint(accumulatedOffset));
     rects.append(rect);
 }
 
@@ -161,7 +162,7 @@ static bool intersectsAllowingEmpty(const FloatRect& r, const FloatRect& other)
 // image, line, path, polygon, polyline, rect, text and use.
 static bool isGraphicsElement(RenderObject* renderer)
 {
-    return renderer->isSVGShape() || renderer->isSVGText() || renderer->isSVGImage() || renderer->isSVGShadowTreeRootContainer();
+    return renderer->isSVGShape() || renderer->isSVGText() || renderer->isSVGImage() || renderer->node()->hasTagName(SVGNames::useTag);
 }
 
 bool RenderSVGModelObject::checkIntersection(RenderObject* renderer, const FloatRect& rect)
diff --git a/Source/WebCore/rendering/svg/RenderSVGModelObject.h b/Source/WebCore/rendering/svg/RenderSVGModelObject.h
index a2f031365..1582ff5fa 100644
--- a/Source/WebCore/rendering/svg/RenderSVGModelObject.h
+++ b/Source/WebCore/rendering/svg/RenderSVGModelObject.h
@@ -55,7 +55,7 @@ public:
     virtual void computeFloatRectForRepaint(RenderBoxModelObject* repaintContainer, FloatRect&, bool fixed = false) const;
     virtual LayoutRect outlineBoundsForRepaint(RenderBoxModelObject* repaintContainer, LayoutPoint*) const;
 
-    virtual void absoluteRects(Vector<LayoutRect>&, const LayoutPoint& accumulatedOffset) const;
+    virtual void absoluteRects(Vector<IntRect>&, const LayoutPoint& accumulatedOffset) const;
     virtual void absoluteQuads(Vector<FloatQuad>&, bool* wasFixed) const;
 
     virtual void mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&, bool* wasFixed = 0) const;
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp
index 34db57d00..ba20502f3 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceClipper.cpp
@@ -244,7 +244,7 @@ bool RenderSVGResourceClipper::drawContentIntoMaskImage(ClipperData* clipperData
             continue;
 
         WindRule newClipRule = style->svgStyle()->clipRule();
-        bool isUseElement = renderer->isSVGShadowTreeRootContainer();
+        bool isUseElement = childNode->hasTagName(SVGNames::useTag);
         if (isUseElement) {
             SVGUseElement* useElement = static_cast<SVGUseElement*>(childNode);
             renderer = useElement->rendererClipChild();
@@ -277,7 +277,7 @@ void RenderSVGResourceClipper::calculateClipContentRepaintRect()
         RenderObject* renderer = childNode->renderer();
         if (!childNode->isSVGElement() || !static_cast<SVGElement*>(childNode)->isStyled() || !renderer)
             continue;
-        if (!renderer->isSVGShape() && !renderer->isSVGText() && !renderer->isSVGShadowTreeRootContainer())
+        if (!renderer->isSVGShape() && !renderer->isSVGText() && !childNode->hasTagName(SVGNames::useTag))
             continue;
         RenderStyle* style = renderer->style();
         if (!style || style->display() == NONE || style->visibility() != VISIBLE)
@@ -307,7 +307,7 @@ bool RenderSVGResourceClipper::hitTestClipContent(const FloatRect& objectBoundin
         RenderObject* renderer = childNode->renderer();
         if (!childNode->isSVGElement() || !static_cast<SVGElement*>(childNode)->isStyled() || !renderer)
             continue;
-        if (!renderer->isSVGShape() && !renderer->isSVGText() && !renderer->isSVGShadowTreeRootContainer())
+        if (!renderer->isSVGShape() && !renderer->isSVGText() && !childNode->hasTagName(SVGNames::useTag))
             continue;
         IntPoint hitPoint;
         HitTestResult result(hitPoint);
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
index 2e03e9f59..2952442cf 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceContainer.cpp
@@ -22,7 +22,6 @@
 #if ENABLE(SVG)
 #include "RenderSVGResourceContainer.h"
 
-#include "RenderSVGShadowTreeRootContainer.h"
 #include "RenderView.h"
 #include "SVGResourcesCache.h"
 #include "SVGStyledTransformableElement.h"
diff --git a/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp b/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
index cf4303d13..43ebee284 100644
--- a/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGResourceFilter.cpp
@@ -300,6 +300,7 @@ void RenderSVGResourceFilter::postApplyResource(RenderObject* object, GraphicsCo
         // Always true if filterData is just built (filterData->builded is false).
         if (!lastEffect->hasResult()) {
             lastEffect->apply();
+            lastEffect->correctFilterResultIfNeeded();
 #if !USE(CG)
             ImageBuffer* resultImage = lastEffect->asImageBuffer();
             if (resultImage)
diff --git a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
index 7baa4fc38..b99701d81 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGRoot.cpp
@@ -38,7 +38,7 @@
 #include "RenderSVGResource.h"
 #include "RenderView.h"
 #include "SVGLength.h"
-#include "SVGRenderSupport.h"
+#include "SVGRenderingContext.h"
 #include "SVGResources.h"
 #include "SVGResourcesCache.h"
 #include "SVGSVGElement.h"
@@ -188,8 +188,20 @@ LayoutUnit RenderSVGRoot::computeReplacedLogicalHeight() const
     if (hasReplacedLogicalHeight())
         return RenderReplaced::computeReplacedLogicalHeight();
 
-    if (svg->heightAttributeEstablishesViewport())
-        return resolveLengthAttributeForSVG(svg->intrinsicHeight(SVGSVGElement::IgnoreCSSProperties), style()->effectiveZoom(), containingBlock()->availableLogicalHeight());
+    if (svg->heightAttributeEstablishesViewport()) {
+        Length height = svg->intrinsicHeight(SVGSVGElement::IgnoreCSSProperties);
+        if (height.isPercent()) {
+            RenderBlock* cb = containingBlock();
+            ASSERT(cb);
+            while (cb->isAnonymous()) {
+                cb = cb->containingBlock();
+                cb->addPercentHeightDescendant(const_cast<RenderSVGRoot*>(this));
+            }
+        } else
+            RenderBlock::removePercentHeightDescendant(const_cast<RenderSVGRoot*>(this));
+
+        return resolveLengthAttributeForSVG(height, style()->effectiveZoom(), containingBlock()->availableLogicalHeight());
+    }
 
     // Only SVGs embedded in <object> reach this point.
     ASSERT(isEmbeddedThroughFrameContainingSVGDocument());
@@ -206,7 +218,7 @@ void RenderSVGRoot::layout()
     bool needsLayout = selfNeedsLayout();
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout() && needsLayout);
 
-    LayoutSize oldSize(width(), height());
+    LayoutSize oldSize = size();
     computeLogicalWidth();
     computeLogicalHeight();
     buildLocalToBorderBoxTransform();
@@ -237,17 +249,22 @@ void RenderSVGRoot::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& adjus
     if (paintInfo.context->paintingDisabled())
         return;
 
+    Page* page = 0;
+    if (Frame* frame = this->frame())
+        page = frame->page();
+
     // Don't paint if we don't have kids, except if we have filters we should paint those.
     if (!firstChild()) {
         SVGResources* resources = SVGResourcesCache::cachedResourcesForRenderObject(this);
-        if (!resources || !resources->filter())
+        if (!resources || !resources->filter()) {
+            if (page && paintInfo.phase == PaintPhaseForeground)
+                page->addRelevantUnpaintedObject(this, visualOverflowRect());
             return;
+        }
     }
 
-    if (Frame* frame = this->frame()) {
-        if (Page* page = frame->page())
-            page->addRelevantRepaintedObject(this, paintInfo.rect);
-    }
+    if (page && paintInfo.phase == PaintPhaseForeground)
+        page->addRelevantRepaintedObject(this, visualOverflowRect());
 
     // Make a copy of the PaintInfo because applyTransform will modify the damage rect.
     PaintInfo childPaintInfo(paintInfo);
@@ -260,21 +277,23 @@ void RenderSVGRoot::paintReplaced(PaintInfo& paintInfo, const LayoutPoint& adjus
     // Transform from our paint container's coordinate system to our local coords.
     childPaintInfo.applyTransform(AffineTransform::translation(adjustedPaintOffset.x() - x(), adjustedPaintOffset.y() - y()) * localToParentTransform());
 
+    SVGRenderingContext renderingContext;
     bool continueRendering = true;
-    if (childPaintInfo.phase == PaintPhaseForeground)
-        continueRendering = SVGRenderSupport::prepareToRenderSVGContent(this, childPaintInfo);
+    if (childPaintInfo.phase == PaintPhaseForeground) {
+        renderingContext.prepareToRenderSVGContent(this, childPaintInfo);
+        continueRendering = renderingContext.isRenderingPrepared();
+    }
 
     if (continueRendering)
         RenderBox::paint(childPaintInfo, LayoutPoint());
 
-    if (childPaintInfo.phase == PaintPhaseForeground)
-        SVGRenderSupport::finishRenderSVGContent(this, childPaintInfo, paintInfo.context);
-
     childPaintInfo.context->restore();
 }
 
 void RenderSVGRoot::willBeDestroyed()
 {
+    RenderBlock::removePercentHeightDescendant(const_cast<RenderSVGRoot*>(this));
+
     SVGResourcesCache::clientDestroyed(this);
     RenderReplaced::willBeDestroyed();
 }
@@ -317,9 +336,9 @@ const AffineTransform& RenderSVGRoot::localToParentTransform() const
     // Slightly optimized version of m_localToParentTransform = AffineTransform::translation(x(), y()) * m_localToBorderBoxTransform;
     m_localToParentTransform = m_localToBorderBoxTransform;
     if (x())
-        m_localToParentTransform.setE(m_localToParentTransform.e() + x());
+        m_localToParentTransform.setE(m_localToParentTransform.e() + roundToInt(x()));
     if (y())
-        m_localToParentTransform.setF(m_localToParentTransform.f() + y());
+        m_localToParentTransform.setF(m_localToParentTransform.f() + roundToInt(y()));
     return m_localToParentTransform;
 }
 
@@ -376,7 +395,7 @@ bool RenderSVGRoot::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
     if (!contentBoxRect().contains(pointInBorderBox))
         return false;
 
-    LayoutPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
+    FloatPoint localPoint = localToParentTransform().inverse().mapPoint(FloatPoint(pointInParent));
 
     for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
         if (child->nodeAtFloatPoint(request, result, localPoint, hitTestAction)) {
@@ -401,6 +420,14 @@ bool RenderSVGRoot::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
     return false;
 }
 
+bool RenderSVGRoot::hasRelativeDimensions() const
+{
+    SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
+    ASSERT(svg);
+
+    return svg->intrinsicHeight(SVGSVGElement::IgnoreCSSProperties).isPercent() || svg->intrinsicWidth(SVGSVGElement::IgnoreCSSProperties).isPercent();
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/rendering/svg/RenderSVGRoot.h b/Source/WebCore/rendering/svg/RenderSVGRoot.h
index 701137f44..adc1884e4 100644
--- a/Source/WebCore/rendering/svg/RenderSVGRoot.h
+++ b/Source/WebCore/rendering/svg/RenderSVGRoot.h
@@ -53,6 +53,8 @@ public:
     IntSize containerSize() const { return m_containerSize; }
     void setContainerSize(const IntSize& containerSize) { m_containerSize = containerSize; }
 
+    virtual bool hasRelativeDimensions() const;
+
 private:
     virtual RenderObjectChildList* virtualChildren() { return children(); }
     virtual const RenderObjectChildList* virtualChildren() const { return children(); }
diff --git a/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.cpp
deleted file mode 100644
index 7cc89e983..000000000
--- a/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.cpp
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "RenderSVGShadowTreeRootContainer.h"
-
-#include "MouseEvent.h"
-#include "SVGShadowTreeElements.h"
-#include "SVGUseElement.h"
-
-namespace WebCore {
-
-RenderSVGShadowTreeRootContainer::RenderSVGShadowTreeRootContainer(SVGUseElement* node)
-    : RenderSVGTransformableContainer(node)
-    , m_recreateTree(false)
-{
-}
-
-RenderSVGShadowTreeRootContainer::~RenderSVGShadowTreeRootContainer()
-{
-    if (m_shadowRoot)
-        m_shadowRoot->clearSVGShadowHost();
-}
-
-void RenderSVGShadowTreeRootContainer::updateStyle(Node::StyleChange change)
-{
-    if (m_shadowRoot && m_shadowRoot->attached())
-        m_shadowRoot->recalcStyle(change);
-}
-
-void RenderSVGShadowTreeRootContainer::updateFromElement()
-{
-    bool hadExistingTree = m_shadowRoot;
-
-    SVGUseElement* useElement = static_cast<SVGUseElement*>(node());
-    if (!m_shadowRoot) {
-        ASSERT(!m_recreateTree);
-        m_shadowRoot = SVGShadowTreeRootElement::create(document(), useElement);
-        useElement->buildPendingResource();
-    }
-
-    ASSERT(m_shadowRoot->svgShadowHost() == useElement);
-
-    bool shouldRecreateTree = m_recreateTree;
-    if (m_recreateTree) {
-        ASSERT(hadExistingTree);
-
-        if (m_shadowRoot->attached())
-            m_shadowRoot->detach();
-
-        m_shadowRoot->removeAllChildren();
-        m_recreateTree = false;
-    }
-
-    // Only rebuild the shadow tree, if we a) never had a tree or b) we were specifically asked to do so
-    // If the use element is a pending resource, and a) or b) is true, do nothing, and wait for the use
-    // element to be asked to buildPendingResource(), this will call us again, with m_recreateTrue=true.
-    if ((shouldRecreateTree || !hadExistingTree) && !useElement->hasPendingResources()) {
-        useElement->buildShadowAndInstanceTree(m_shadowRoot.get());
-
-        // Attach shadow root element
-        m_shadowRoot->attachElement(style(), renderArena());
-
-        // Attach subtree, as if it was a regular non-shadow tree
-        for (Node* child = m_shadowRoot->firstChild(); child; child = child->nextSibling())
-            child->attach();
-    }
-
-    ASSERT(!m_recreateTree);
-    RenderSVGTransformableContainer::updateFromElement();
-}
-
-void RenderSVGShadowTreeRootContainer::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
-{
-    RenderSVGTransformableContainer::styleDidChange(diff, oldStyle);
-
-    if (RenderObject* shadowRootRenderer = m_shadowRoot ? m_shadowRoot->renderer() : 0)
-        shadowRootRenderer->setStyle(style());
-}
-
-Node* RenderSVGShadowTreeRootContainer::rootElement() const
-{
-    return m_shadowRoot.get();
-}
-
-}
-
-#endif
diff --git a/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.h b/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.h
deleted file mode 100644
index cee840965..000000000
--- a/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef RenderSVGShadowTreeRootContainer_h
-#define RenderSVGShadowTreeRootContainer_h
-
-#if ENABLE(SVG)
-#include "RenderSVGTransformableContainer.h"
-
-namespace WebCore {
-    
-class SVGUseElement;
-class SVGShadowTreeRootElement;
-
-class RenderSVGShadowTreeRootContainer : public RenderSVGTransformableContainer {
-public:
-    RenderSVGShadowTreeRootContainer(SVGUseElement*);
-    virtual ~RenderSVGShadowTreeRootContainer();
-
-    virtual bool isSVGShadowTreeRootContainer() const { return true; }
-
-    void markShadowTreeForRecreation() { m_recreateTree = true; }
-    void updateStyle(Node::StyleChange);
-    virtual void updateFromElement();
-
-    Node* rootElement() const;
-
-private:
-    virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
-
-    bool m_recreateTree;
-    RefPtr<SVGShadowTreeRootElement> m_shadowRoot;
-};
-
-}
-
-#endif
-#endif
diff --git a/Source/WebCore/rendering/svg/RenderSVGShape.cpp b/Source/WebCore/rendering/svg/RenderSVGShape.cpp
index 31f15251b..c438d30b0 100755
--- a/Source/WebCore/rendering/svg/RenderSVGShape.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGShape.cpp
@@ -41,7 +41,7 @@
 #include "RenderSVGResourceSolidColor.h"
 #include "SVGPathData.h"
 #include "SVGPathElement.h"
-#include "SVGRenderSupport.h"
+#include "SVGRenderingContext.h"
 #include "SVGResources.h"
 #include "SVGResourcesCache.h"
 #include "SVGStyledTransformableElement.h"
@@ -168,7 +168,7 @@ void RenderSVGShape::layout()
     bool updateCachedBoundariesInParents = false;
 
     bool needsShapeUpdate = m_needsShapeUpdate;
-    if (needsShapeUpdate) {
+    if (needsShapeUpdate || m_needsBoundariesUpdate) {
         setIsPaintingFallback(false);
         m_path.clear();
         createShape();
@@ -182,13 +182,6 @@ void RenderSVGShape::layout()
         updateCachedBoundariesInParents = true;
     }
 
-    if (m_needsBoundariesUpdate) {
-        setIsPaintingFallback(false);
-        m_path.clear();
-        createShape();
-        updateCachedBoundariesInParents = true;
-    }
-
     // Invalidate all resources of this client if our layout changed.
     if (everHadLayout() && selfNeedsLayout()) {
         SVGResourcesCache::clientLayoutChanged(this);
@@ -340,9 +333,9 @@ void RenderSVGShape::paint(PaintInfo& paintInfo, const IntPoint&)
         childPaintInfo.applyTransform(m_localTransform);
 
         if (childPaintInfo.phase == PaintPhaseForeground) {
-            PaintInfo savedInfo(childPaintInfo);
+            SVGRenderingContext renderingContext(this, childPaintInfo);
 
-            if (SVGRenderSupport::prepareToRenderSVGContent(this, childPaintInfo)) {
+            if (renderingContext.isRenderingPrepared()) {
                 const SVGRenderStyle* svgStyle = style()->svgStyle();
                 if (svgStyle->shapeRendering() == SR_CRISPEDGES)
                     childPaintInfo.context->setShouldAntialias(false);
@@ -352,8 +345,6 @@ void RenderSVGShape::paint(PaintInfo& paintInfo, const IntPoint&)
                 if (svgStyle->hasMarkers())
                     m_markerLayoutInfo.drawMarkers(childPaintInfo);
             }
-
-            SVGRenderSupport::finishRenderSVGContent(this, childPaintInfo, savedInfo.context);
         }
 
         if (drawsOutline)
@@ -363,9 +354,9 @@ void RenderSVGShape::paint(PaintInfo& paintInfo, const IntPoint&)
 
 // This method is called from inside paintOutline() since we call paintOutline()
 // while transformed to our coord system, return local coords
-void RenderSVGShape::addFocusRingRects(Vector<LayoutRect>& rects, const LayoutPoint&)
+void RenderSVGShape::addFocusRingRects(Vector<IntRect>& rects, const LayoutPoint&)
 {
-    LayoutRect rect = enclosingLayoutRect(repaintRectInLocalCoordinates());
+    IntRect rect = enclosingIntRect(repaintRectInLocalCoordinates());
     if (!rect.isEmpty())
         rects.append(rect);
 }
diff --git a/Source/WebCore/rendering/svg/RenderSVGShape.h b/Source/WebCore/rendering/svg/RenderSVGShape.h
index 1a1ed447b..934a05d39 100644
--- a/Source/WebCore/rendering/svg/RenderSVGShape.h
+++ b/Source/WebCore/rendering/svg/RenderSVGShape.h
@@ -113,7 +113,7 @@ private:
 
     virtual void layout();
     virtual void paint(PaintInfo&, const LayoutPoint&);
-    virtual void addFocusRingRects(Vector<LayoutRect>&, const LayoutPoint&);
+    virtual void addFocusRingRects(Vector<IntRect>&, const LayoutPoint&);
 
     virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp
index 0a62f6885..ee4d74e24 100644
--- a/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.cpp
@@ -26,8 +26,8 @@
 
 #include "SVGNames.h"
 #include "SVGRenderSupport.h"
-#include "SVGShadowTreeElements.h"
 #include "SVGStyledTransformableElement.h"
+#include "SVGUseElement.h"
 
 namespace WebCore {
     
@@ -42,27 +42,33 @@ bool RenderSVGTransformableContainer::calculateLocalTransform()
 {
     SVGStyledTransformableElement* element = static_cast<SVGStyledTransformableElement*>(node());
 
-    bool needsUpdate = m_needsTransformUpdate;
-    m_didTransformToRootUpdate = m_needsTransformUpdate || SVGRenderSupport::transformToRootChanged(parent());
-    if (needsUpdate) {
-        m_localTransform = element->animatedLocalTransform();
-        m_needsTransformUpdate = false;
+    // If we're either the renderer for a <use> element, or for any <g> element inside the shadow
+    // tree, that was created during the use/symbol/svg expansion in SVGUseElement. These containers
+    // need to respect the translations induced by their corresponding use elements x/y attributes.
+    SVGUseElement* useElement = 0;
+    if (element->hasTagName(SVGNames::useTag))
+        useElement = static_cast<SVGUseElement*>(element);
+    else if (element->isInShadowTree() && element->hasTagName(SVGNames::gTag)) {
+        SVGElement* correspondingElement = element->correspondingElement();
+        if (correspondingElement && correspondingElement->hasTagName(SVGNames::useTag))
+            useElement = static_cast<SVGUseElement*>(correspondingElement);
     }
 
-    if (!element->hasTagName(SVGNames::gTag) || !static_cast<SVGGElement*>(element)->isShadowTreeContainerElement())
-        return needsUpdate;
-
-    SVGShadowTreeContainerElement* shadowElement = static_cast<SVGShadowTreeContainerElement*>(element);
-    FloatSize translation = shadowElement->containerTranslation();
-    if (!shadowElement->containerOffsetChanged() && !translation.width() && !translation.height())
-        return needsUpdate;
+    if (useElement) {
+        SVGLengthContext lengthContext(useElement);
+        FloatSize translation(useElement->x().value(lengthContext), useElement->y().value(lengthContext));
+        if (translation != m_lastTranslation)
+            m_needsTransformUpdate = true;
+        m_lastTranslation = translation;
+    }
 
-    // FIXME: Could optimize this case for use to avoid refetching the animatedLocalTransform() here, if only the containerTranslation() changed.
-    if (!needsUpdate)
-        m_localTransform = element->animatedLocalTransform();
+    m_didTransformToRootUpdate = m_needsTransformUpdate || SVGRenderSupport::transformToRootChanged(parent());
+    if (!m_needsTransformUpdate)
+        return false;
 
-    m_localTransform.translate(translation.width(), translation.height());
-    shadowElement->setContainerOffsetChanged(false);
+    m_localTransform = element->animatedLocalTransform();
+    m_localTransform.translate(m_lastTranslation.width(), m_lastTranslation.height());
+    m_needsTransformUpdate = false;
     return true;
 }
 
diff --git a/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h b/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h
index c9c607ba2..c10a08dc2 100644
--- a/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h
+++ b/Source/WebCore/rendering/svg/RenderSVGTransformableContainer.h
@@ -43,7 +43,9 @@ private:
     bool m_needsTransformUpdate : 1;
     bool m_didTransformToRootUpdate : 1;
     AffineTransform m_localTransform;
+    FloatSize m_lastTranslation;
 };
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp
index 3e0e3e4d9..0de95d551 100644
--- a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp
+++ b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.cpp
@@ -27,8 +27,10 @@
 
 #include "GraphicsContext.h"
 #include "RenderView.h"
+#include "SVGElementInstance.h"
 #include "SVGNames.h"
 #include "SVGSVGElement.h"
+#include "SVGUseElement.h"
 
 namespace WebCore {
 
@@ -65,6 +67,52 @@ void RenderSVGViewportContainer::calcViewport()
     SVGLengthContext lengthContext(element);
     m_viewport = FloatRect(svg->x().value(lengthContext), svg->y().value(lengthContext), svg->width().value(lengthContext), svg->height().value(lengthContext));
 
+    SVGElement* correspondingElement = svg->correspondingElement();
+    if (correspondingElement && svg->isInShadowTree()) {
+        const HashSet<SVGElementInstance*>& instances = correspondingElement->instancesForElement();
+        ASSERT(!instances.isEmpty());
+
+        SVGUseElement* useElement = 0;
+        const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
+        for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
+            const SVGElementInstance* instance = (*it);
+            ASSERT(instance->correspondingElement()->hasTagName(SVGNames::svgTag) || instance->correspondingElement()->hasTagName(SVGNames::symbolTag));
+            if (instance->shadowTreeElement() == svg) {
+                ASSERT(correspondingElement == instance->correspondingElement());
+                useElement = instance->directUseElement();
+                if (!useElement)
+                    useElement = instance->correspondingUseElement();
+                break;
+            }
+        }
+
+        ASSERT(useElement);
+        bool isSymbolElement = correspondingElement->hasTagName(SVGNames::symbolTag);
+
+        // Spec (<use> on <symbol>): This generated 'svg' will always have explicit values for attributes width and height.
+        // If attributes width and/or height are provided on the 'use' element, then these attributes
+        // will be transferred to the generated 'svg'. If attributes width and/or height are not specified,
+        // the generated 'svg' element will use values of 100% for these attributes.
+
+        // Spec (<use> on <svg>): If attributes width and/or height are provided on the 'use' element, then these
+        // values will override the corresponding attributes on the 'svg' in the generated tree.
+
+        SVGLengthContext lengthContext(element);
+        if (useElement->hasAttribute(SVGNames::widthAttr))
+            m_viewport.setWidth(useElement->width().value(lengthContext));
+        else if (isSymbolElement && svg->hasAttribute(SVGNames::widthAttr)) {
+            SVGLength containerWidth(LengthModeWidth, "100%");
+            m_viewport.setWidth(containerWidth.value(lengthContext));
+        }
+
+        if (useElement->hasAttribute(SVGNames::heightAttr))
+            m_viewport.setHeight(useElement->height().value(lengthContext));
+        else if (isSymbolElement && svg->hasAttribute(SVGNames::heightAttr)) {
+            SVGLength containerHeight(LengthModeHeight, "100%");
+            m_viewport.setHeight(containerHeight.value(lengthContext));
+        }
+    }
+
     if (oldViewport != m_viewport) {
         m_didTransformToRootUpdate = true;
         setNeedsBoundariesUpdate();
diff --git a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h
index b748fe6f0..eb7041a30 100644
--- a/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h
+++ b/Source/WebCore/rendering/svg/RenderSVGViewportContainer.h
@@ -42,7 +42,6 @@ public:
     virtual void setNeedsTransformUpdate() { m_needsTransformUpdate = true; }
 
 private:
-    virtual bool isSVGContainer() const { return true; }
     virtual bool isSVGViewportContainer() const { return true; }
     virtual const char* renderName() const { return "RenderSVGViewportContainer"; }
 
diff --git a/Source/WebCore/rendering/svg/SVGImageBufferTools.cpp b/Source/WebCore/rendering/svg/SVGImageBufferTools.cpp
index ef97a2847..899550055 100644
--- a/Source/WebCore/rendering/svg/SVGImageBufferTools.cpp
+++ b/Source/WebCore/rendering/svg/SVGImageBufferTools.cpp
@@ -60,7 +60,7 @@ bool SVGImageBufferTools::createImageBuffer(const FloatRect& targetRect, const A
         return false;
 
     IntSize clampedSize = clampedAbsoluteSize(paintRect.size());
-    OwnPtr<ImageBuffer> image = ImageBuffer::create(clampedSize, colorSpace, renderingMode);
+    OwnPtr<ImageBuffer> image = ImageBuffer::create(clampedSize, 1, colorSpace, renderingMode);
     if (!image)
         return false;
 
@@ -89,7 +89,7 @@ bool SVGImageBufferTools::createImageBufferForPattern(const FloatRect& absoluteT
     if (imageSize.isEmpty())
         return false;
 
-    OwnPtr<ImageBuffer> image = ImageBuffer::create(imageSize, colorSpace, renderingMode);
+    OwnPtr<ImageBuffer> image = ImageBuffer::create(imageSize, 1, colorSpace, renderingMode);
     if (!image)
         return false;
 
diff --git a/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp b/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp
index cdeec61ca..21a909224 100644
--- a/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp
+++ b/Source/WebCore/rendering/svg/SVGInlineFlowBox.cpp
@@ -29,7 +29,7 @@
 #include "RenderSVGInlineText.h"
 #include "RenderedDocumentMarker.h"
 #include "SVGInlineTextBox.h"
-#include "SVGRenderSupport.h"
+#include "SVGRenderingContext.h"
 
 using namespace std;
 
@@ -57,19 +57,15 @@ void SVGInlineFlowBox::paint(PaintInfo& paintInfo, const LayoutPoint&, LayoutUni
     RenderObject* boxRenderer = renderer();
     ASSERT(boxRenderer);
 
-    PaintInfo childPaintInfo(paintInfo);
-    GraphicsContextStateSaver stateSaver(*childPaintInfo.context);
-
-    if (SVGRenderSupport::prepareToRenderSVGContent(boxRenderer, childPaintInfo)) {
+    SVGRenderingContext renderingContext(boxRenderer, paintInfo, SVGRenderingContext::SaveGraphicsContext);
+    if (renderingContext.isRenderingPrepared()) {
         for (InlineBox* child = firstChild(); child; child = child->nextOnLine()) {
             if (child->isSVGInlineTextBox())
                 computeTextMatchMarkerRectForRenderer(toRenderSVGInlineText(static_cast<SVGInlineTextBox*>(child)->textRenderer()));
 
-            child->paint(childPaintInfo, LayoutPoint(), 0, 0);
+            child->paint(paintInfo, LayoutPoint(), 0, 0);
         }
     }
-
-    SVGRenderSupport::finishRenderSVGContent(boxRenderer, childPaintInfo, paintInfo.context);
 }
 
 FloatRect SVGInlineFlowBox::calculateBoundaries() const
diff --git a/Source/WebCore/rendering/svg/SVGRenderSupport.cpp b/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
index 7feb88fec..e262422ad 100644
--- a/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
+++ b/Source/WebCore/rendering/svg/SVGRenderSupport.cpp
@@ -27,12 +27,8 @@
 #if ENABLE(SVG)
 #include "SVGRenderSupport.h"
 
-#include "Frame.h"
-#include "FrameView.h"
-#include "ImageBuffer.h"
 #include "NodeRenderStyle.h"
 #include "RenderLayer.h"
-#include "RenderSVGPath.h"
 #include "RenderSVGResource.h"
 #include "RenderSVGResourceClipper.h"
 #include "RenderSVGResourceFilter.h"
@@ -80,106 +76,6 @@ void SVGRenderSupport::mapLocalToContainer(const RenderObject* object, RenderBox
     object->parent()->mapLocalToContainer(repaintContainer, false, true, transformState, wasFixed);
 }
 
-static inline bool isRenderingMaskImage(RenderObject* object)
-{
-    if (object->frame() && object->frame()->view())
-        return object->frame()->view()->paintBehavior() & PaintBehaviorRenderingSVGMask;
-    return false;
-}
-
-bool SVGRenderSupport::prepareToRenderSVGContent(RenderObject* object, PaintInfo& paintInfo)
-{
-    ASSERT(object);
-
-    RenderStyle* style = object->style();
-    ASSERT(style);
-
-    const SVGRenderStyle* svgStyle = style->svgStyle();
-    ASSERT(svgStyle);
-
-    // Setup transparency layers before setting up SVG resources!
-    bool isRenderingMask = isRenderingMaskImage(object);
-    float opacity = isRenderingMask ? 1 : style->opacity();
-    const ShadowData* shadow = svgStyle->shadow();
-    if (opacity < 1 || shadow) {
-        FloatRect repaintRect = object->repaintRectInLocalCoordinates();
-
-        if (opacity < 1) {
-            paintInfo.context->clip(repaintRect);
-            paintInfo.context->beginTransparencyLayer(opacity);
-        }
-
-        if (shadow) {
-            paintInfo.context->clip(repaintRect);
-            paintInfo.context->setShadow(IntSize(shadow->x(), shadow->y()), shadow->blur(), shadow->color(), style->colorSpace());
-            paintInfo.context->beginTransparencyLayer(1);
-        }
-    }
-
-    SVGResources* resources = SVGResourcesCache::cachedResourcesForRenderObject(object);
-    if (!resources) {
-#if ENABLE(FILTERS)
-        if (svgStyle->hasFilter())
-            return false;
-#endif
-        return true;
-    }
-
-    if (!isRenderingMask) {
-        if (RenderSVGResourceMasker* masker = resources->masker()) {
-            if (!masker->applyResource(object, style, paintInfo.context, ApplyToDefaultMode))
-                return false;
-        }
-    }
-
-    if (RenderSVGResourceClipper* clipper = resources->clipper()) {
-        if (!clipper->applyResource(object, style, paintInfo.context, ApplyToDefaultMode))
-            return false;
-    }
-
-#if ENABLE(FILTERS)
-    if (!isRenderingMask) {
-        if (RenderSVGResourceFilter* filter = resources->filter()) {
-            if (!filter->applyResource(object, style, paintInfo.context, ApplyToDefaultMode))
-                return false;
-        }
-    }
-#endif
-
-    return true;
-}
-
-void SVGRenderSupport::finishRenderSVGContent(RenderObject* object, PaintInfo& paintInfo, GraphicsContext* savedContext)
-{
-#if !ENABLE(FILTERS)
-    UNUSED_PARAM(savedContext);
-#endif
-
-    ASSERT(object);
-
-    const RenderStyle* style = object->style();
-    ASSERT(style);
-
-    const SVGRenderStyle* svgStyle = style->svgStyle();
-    ASSERT(svgStyle);
-
-#if ENABLE(FILTERS)
-    SVGResources* resources = SVGResourcesCache::cachedResourcesForRenderObject(object);
-    if (resources) {
-        if (RenderSVGResourceFilter* filter = resources->filter()) {
-            filter->postApplyResource(static_cast<RenderSVGShape*>(object), paintInfo.context, ApplyToDefaultMode, 0, 0);
-            paintInfo.context = savedContext;
-        }
-    }
-#endif
-
-    if (style->opacity() < 1 && !isRenderingMaskImage(object))
-        paintInfo.context->endTransparencyLayer();
-
-    if (svgStyle->shadow())
-        paintInfo.context->endTransparencyLayer();
-}
-
 void SVGRenderSupport::computeContainerBoundingBoxes(const RenderObject* container, FloatRect& objectBoundingBox, FloatRect& strokeBoundingBox, FloatRect& repaintBoundingBox)
 {
     bool isFirstChild = true;
diff --git a/Source/WebCore/rendering/svg/SVGRenderSupport.h b/Source/WebCore/rendering/svg/SVGRenderSupport.h
index c7b2fdcbf..51c9d1bc0 100644
--- a/Source/WebCore/rendering/svg/SVGRenderSupport.h
+++ b/Source/WebCore/rendering/svg/SVGRenderSupport.h
@@ -42,10 +42,6 @@ class TransformState;
 // SVGRendererSupport is a helper class sharing code between all SVG renderers.
 class SVGRenderSupport {
 public:
-    // Used by all SVG renderers who apply clip/filter/etc. resources to the renderer content
-    static bool prepareToRenderSVGContent(RenderObject*, PaintInfo&);
-    static void finishRenderSVGContent(RenderObject*, PaintInfo&, GraphicsContext* savedContext);
-
     // Shares child layouting code between RenderSVGRoot/RenderSVG(Hidden)Container
     static void layoutChildren(RenderObject*, bool selfNeedsLayout);
 
diff --git a/Source/WebCore/rendering/svg/SVGRenderingContext.cpp b/Source/WebCore/rendering/svg/SVGRenderingContext.cpp
new file mode 100644
index 000000000..0f13dcf3a
--- /dev/null
+++ b/Source/WebCore/rendering/svg/SVGRenderingContext.cpp
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2007, 2008 Rob Buis <buis@kde.org>
+ * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2009 Google, Inc.  All rights reserved.
+ * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ * Copyright (C) Research In Motion Limited 2009-2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "SVGRenderingContext.h"
+
+#include "Frame.h"
+#include "FrameView.h"
+#include "RenderSVGResource.h"
+#include "RenderSVGResourceClipper.h"
+#include "RenderSVGResourceFilter.h"
+#include "RenderSVGResourceMasker.h"
+#include "SVGImageBufferTools.h"
+#include "SVGResources.h"
+#include "SVGResourcesCache.h"
+
+namespace WebCore {
+
+static inline bool isRenderingMaskImage(RenderObject* object)
+{
+    if (object->frame() && object->frame()->view())
+        return object->frame()->view()->paintBehavior() & PaintBehaviorRenderingSVGMask;
+    return false;
+}
+
+SVGRenderingContext::~SVGRenderingContext()
+{
+    // Fast path if we don't need to restore anything.
+    if (!(m_renderingFlags & ActionsNeeded))
+        return;
+
+    ASSERT(m_object && m_paintInfo);
+
+#if ENABLE(FILTERS)
+    if (m_renderingFlags & EndFilterLayer) {
+        ASSERT(m_filter);
+        m_filter->postApplyResource(static_cast<RenderSVGShape*>(m_object), m_paintInfo->context, ApplyToDefaultMode, 0, 0);
+        m_paintInfo->context = m_savedContext;
+    }
+#endif
+
+    if (m_renderingFlags & EndOpacityLayer)
+        m_paintInfo->context->endTransparencyLayer();
+
+    if (m_renderingFlags & EndShadowLayer)
+        m_paintInfo->context->endTransparencyLayer();
+
+    if (m_renderingFlags & RestoreGraphicsContext)
+        m_paintInfo->context->restore();
+}
+
+void SVGRenderingContext::prepareToRenderSVGContent(RenderObject* object, PaintInfo& paintInfo, NeedsGraphicsContextSave needsGraphicsContextSave)
+{
+    ASSERT(object);
+
+#ifndef NDEBUG
+    // This function must not be called twice!
+    ASSERT(!(m_renderingFlags & PrepareToRenderSVGContentWasCalled));
+    m_renderingFlags |= PrepareToRenderSVGContentWasCalled;
+#endif
+
+    m_object = object;
+    m_paintInfo = &paintInfo;
+#if ENABLE(FILTERS)
+    m_filter = 0;
+#endif
+
+    // We need to save / restore the context even if the initialization failed.
+    if (needsGraphicsContextSave == SaveGraphicsContext) {
+        m_paintInfo->context->save();
+        m_renderingFlags |= RestoreGraphicsContext;
+    }
+
+    RenderStyle* style = m_object->style();
+    ASSERT(style);
+
+    const SVGRenderStyle* svgStyle = style->svgStyle();
+    ASSERT(svgStyle);
+
+    // Setup transparency layers before setting up SVG resources!
+    bool isRenderingMask = isRenderingMaskImage(m_object);
+    float opacity = isRenderingMask ? 1 : style->opacity();
+    const ShadowData* shadow = svgStyle->shadow();
+    if (opacity < 1 || shadow) {
+        FloatRect repaintRect = m_object->repaintRectInLocalCoordinates();
+
+        if (opacity < 1) {
+            m_paintInfo->context->clip(repaintRect);
+            m_paintInfo->context->beginTransparencyLayer(opacity);
+            m_renderingFlags |= EndOpacityLayer;
+        }
+
+        if (shadow) {
+            m_paintInfo->context->clip(repaintRect);
+            m_paintInfo->context->setShadow(IntSize(roundToInt(shadow->x()), roundToInt(shadow->y())), shadow->blur(), shadow->color(), style->colorSpace());
+            m_paintInfo->context->beginTransparencyLayer(1);
+            m_renderingFlags |= EndShadowLayer;
+        }
+    }
+
+    SVGResources* resources = SVGResourcesCache::cachedResourcesForRenderObject(m_object);
+    if (!resources) {
+#if ENABLE(FILTERS)
+        if (svgStyle->hasFilter())
+            return;
+#endif
+        m_renderingFlags |= RenderingPrepared;
+        return;
+    }
+
+    if (!isRenderingMask) {
+        if (RenderSVGResourceMasker* masker = resources->masker()) {
+            if (!masker->applyResource(m_object, style, m_paintInfo->context, ApplyToDefaultMode))
+                return;
+        }
+    }
+
+    if (RenderSVGResourceClipper* clipper = resources->clipper()) {
+        if (!clipper->applyResource(m_object, style, m_paintInfo->context, ApplyToDefaultMode))
+            return;
+    }
+
+#if ENABLE(FILTERS)
+    if (!isRenderingMask) {
+        m_filter = resources->filter();
+        if (m_filter) {
+            m_savedContext = m_paintInfo->context;
+            // Return with false here may mean that we don't need to draw the content
+            // (because it was either drawn before or empty) but we still need to apply the filter.
+            m_renderingFlags |= EndFilterLayer;
+            if (!m_filter->applyResource(m_object, style, m_paintInfo->context, ApplyToDefaultMode))
+                return;
+        }
+    }
+#endif
+
+    m_renderingFlags |= RenderingPrepared;
+}
+
+}
+
+#endif
diff --git a/Source/WebCore/rendering/svg/SVGRenderingContext.h b/Source/WebCore/rendering/svg/SVGRenderingContext.h
new file mode 100644
index 000000000..1dc3d6220
--- /dev/null
+++ b/Source/WebCore/rendering/svg/SVGRenderingContext.h
@@ -0,0 +1,105 @@
+/**
+ * Copyright (C) 2007 Rob Buis <buis@kde.org>
+ * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2007 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2009 Google, Inc.  All rights reserved.
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ * Copyright (C) 2012 Zoltan Herczeg <zherczeg@webkit.org>.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef SVGRenderingContext_h
+#define SVGRenderingContext_h
+
+#if ENABLE(SVG)
+#include "ImageBuffer.h"
+#include "LayoutTypes.h"
+#include "PaintInfo.h"
+
+namespace WebCore {
+
+class AffineTransform;
+class RenderObject;
+class FloatRect;
+class RenderSVGResourceFilter;
+
+// SVGRenderingContext 
+class SVGRenderingContext {
+public:
+    enum NeedsGraphicsContextSave {
+        SaveGraphicsContext,
+        DontSaveGraphicsContext,
+    };
+
+    // Does not start rendering.
+    SVGRenderingContext()
+        : m_renderingFlags(0)
+        , m_object(0)
+        , m_paintInfo(0)
+        , m_savedContext(0)
+#if ENABLE(FILTERS)
+        , m_filter(0)
+#endif
+    {
+    }
+
+    SVGRenderingContext(RenderObject* object, PaintInfo& paintinfo, NeedsGraphicsContextSave needsGraphicsContextSave = DontSaveGraphicsContext)
+        : m_renderingFlags(0)
+        , m_object(0)
+        , m_paintInfo(0)
+        , m_savedContext(0)
+#if ENABLE(FILTERS)
+        , m_filter(0)
+#endif
+    {
+        prepareToRenderSVGContent(object, paintinfo, needsGraphicsContextSave);
+    }
+
+    // Automatically finishes context rendering.
+    ~SVGRenderingContext();
+
+    // Used by all SVG renderers who apply clip/filter/etc. resources to the renderer content.
+    void prepareToRenderSVGContent(RenderObject*, PaintInfo&, NeedsGraphicsContextSave = DontSaveGraphicsContext);
+    bool isRenderingPrepared() const { return m_renderingFlags & RenderingPrepared; }
+
+private:
+    // To properly revert partially successful initializtions in the destructor, we record all successful steps.
+    enum RenderingFlags {
+        RenderingPrepared = 1,
+        RestoreGraphicsContext = 1 << 1,
+        EndOpacityLayer = 1 << 2,
+        EndShadowLayer = 1 << 3,
+        EndFilterLayer = 1 << 4,
+        PrepareToRenderSVGContentWasCalled = 1 << 5
+    };
+
+    // List of those flags which require actions during the destructor.
+    const static int ActionsNeeded = RestoreGraphicsContext | EndOpacityLayer | EndShadowLayer | EndFilterLayer;
+
+    int m_renderingFlags;
+    RenderObject* m_object;
+    PaintInfo* m_paintInfo;
+    GraphicsContext* m_savedContext;
+#if ENABLE(FILTERS)
+    RenderSVGResourceFilter* m_filter;
+#endif
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
+#endif // SVGRenderingContext_h
diff --git a/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp b/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
index ae495ec94..57146c90c 100644
--- a/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
+++ b/Source/WebCore/rendering/svg/SVGRootInlineBox.cpp
@@ -31,7 +31,7 @@
 #include "SVGInlineFlowBox.h"
 #include "SVGInlineTextBox.h"
 #include "SVGNames.h"
-#include "SVGRenderSupport.h"
+#include "SVGRenderingContext.h"
 #include "SVGTextPositioningElement.h"
 
 namespace WebCore {
@@ -57,18 +57,15 @@ void SVGRootInlineBox::paint(PaintInfo& paintInfo, const LayoutPoint&, LayoutUni
         }
     }
 
-    GraphicsContextStateSaver stateSaver(*childPaintInfo.context);
-
-    if (SVGRenderSupport::prepareToRenderSVGContent(boxRenderer, childPaintInfo)) {
+    SVGRenderingContext renderingContext(boxRenderer, paintInfo, SVGRenderingContext::SaveGraphicsContext);
+    if (renderingContext.isRenderingPrepared()) {
         for (InlineBox* child = firstChild(); child; child = child->nextOnLine()) {
             if (child->isSVGInlineTextBox())
                 SVGInlineFlowBox::computeTextMatchMarkerRectForRenderer(toRenderSVGInlineText(static_cast<SVGInlineTextBox*>(child)->textRenderer()));
 
-            child->paint(childPaintInfo, LayoutPoint(), 0, 0);
+            child->paint(paintInfo, LayoutPoint(), 0, 0);
         }
     }
-
-    SVGRenderSupport::finishRenderSVGContent(boxRenderer, childPaintInfo, paintInfo.context);
 }
 
 void SVGRootInlineBox::computePerCharacterLayoutInformation()
diff --git a/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp b/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp
deleted file mode 100644
index b1aa9a288..000000000
--- a/Source/WebCore/rendering/svg/SVGShadowTreeElements.cpp
+++ /dev/null
@@ -1,109 +0,0 @@
-/*
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "SVGShadowTreeElements.h"
-
-#include "CSSStyleSelector.h"
-#include "Document.h"
-#include "FloatSize.h"
-#include "RenderObject.h"
-#include "SVGNames.h"
-#include "SVGUseElement.h"
-
-namespace WebCore {
-
-// SVGShadowTreeContainerElement
-
-SVGShadowTreeContainerElement::SVGShadowTreeContainerElement(Document* document, ConstructionType constructionType)
-    : SVGGElement(SVGNames::gTag, document, constructionType)
-    , m_containerOffsetChanged(false)
-{
-}
-
-PassRefPtr<SVGShadowTreeContainerElement> SVGShadowTreeContainerElement::create(Document* document)
-{
-    return adoptRef(new SVGShadowTreeContainerElement(document));
-}
-
-void SVGShadowTreeContainerElement::setContainerOffset(const SVGLength& x, const SVGLength& y)
-{
-    m_containerOffsetChanged = true;
-    m_xOffset = x;
-    m_yOffset = y;
-}
-
-FloatSize SVGShadowTreeContainerElement::containerTranslation() const
-{
-    SVGLengthContext lengthContext(this);
-    return FloatSize(m_xOffset.value(lengthContext), m_yOffset.value(lengthContext));
-}
-
-PassRefPtr<Element> SVGShadowTreeContainerElement::cloneElementWithoutAttributesAndChildren()
-{
-    return adoptRef(new SVGShadowTreeContainerElement(document()));
-}
-// SVGShadowTreeRootElement
-
-inline SVGShadowTreeRootElement::SVGShadowTreeRootElement(Document* document, SVGUseElement* host)
-    : SVGShadowTreeContainerElement(document, CreateSVGShadowRoot)
-{
-    setParent(host);
-    setInDocument();
-}
-
-PassRefPtr<SVGShadowTreeRootElement> SVGShadowTreeRootElement::create(Document* document, SVGUseElement* host)
-{
-    return adoptRef(new SVGShadowTreeRootElement(document, host));
-}
-
-void SVGShadowTreeRootElement::attachElement(PassRefPtr<RenderStyle> style, RenderArena* arena)
-{
-    ASSERT(svgShadowHost());
-
-    // Create the renderer with the specified style
-    RenderObject* renderer = createRenderer(arena, style.get());
-    if (renderer) {
-        setRenderer(renderer);
-        renderer->setStyle(style);
-    }
-
-    // Set these explicitly since this normally happens during an attach()
-    setAttached();
-
-    // Add the renderer to the render tree
-    if (renderer)
-        svgShadowHost()->renderer()->addChild(renderer);
-}
-
-void SVGShadowTreeRootElement::clearSVGShadowHost()
-{
-    setParent(0);
-}
-
-PassRefPtr<RenderStyle> SVGShadowTreeContainerElement::customStyleForRenderer()
-{
-    return document()->styleSelector()->styleForElement(this, 0, true/*allowSharing*/);
-}
-
-}
-
-#endif
diff --git a/Source/WebCore/rendering/svg/SVGShadowTreeElements.h b/Source/WebCore/rendering/svg/SVGShadowTreeElements.h
deleted file mode 100644
index 5057150c8..000000000
--- a/Source/WebCore/rendering/svg/SVGShadowTreeElements.h
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef SVGShadowTreeElements_h
-#define SVGShadowTreeElements_h
-
-#if ENABLE(SVG)
-#include "SVGGElement.h"
-#include "SVGLength.h"
-
-namespace WebCore {
-
-class FloatSize;
-class SVGUseElement;
-
-class SVGShadowTreeContainerElement : public SVGGElement {
-public:
-    static PassRefPtr<SVGShadowTreeContainerElement> create(Document*);
-
-    FloatSize containerTranslation() const;
-    void setContainerOffset(const SVGLength& x, const SVGLength& y);
-
-    bool containerOffsetChanged() const { return m_containerOffsetChanged; }
-    void setContainerOffsetChanged(bool containerOffsetChanged) { m_containerOffsetChanged = containerOffsetChanged; }
-
-    virtual PassRefPtr<RenderStyle> customStyleForRenderer();
-
-protected:
-    SVGShadowTreeContainerElement(Document*, ConstructionType = CreateSVGElement);
-
-private:
-    virtual PassRefPtr<Element> cloneElementWithoutAttributesAndChildren();
-    virtual bool isShadowTreeContainerElement() const { return true; }
-
-    SVGLength m_xOffset;
-    SVGLength m_yOffset;
-    bool m_containerOffsetChanged;
-};
-
-class SVGShadowTreeRootElement : public SVGShadowTreeContainerElement {
-public:
-    static PassRefPtr<SVGShadowTreeRootElement> create(Document*, SVGUseElement* host);
-
-    void attachElement(PassRefPtr<RenderStyle>, RenderArena*);
-    void clearSVGShadowHost();
-
-private:
-    SVGShadowTreeRootElement(Document*, SVGUseElement* host);
-};
-
-}
-
-#endif
-#endif
diff --git a/Source/WebCore/rendering/svg/SVGTextMetrics.cpp b/Source/WebCore/rendering/svg/SVGTextMetrics.cpp
index 5174e6368..8d155d8f4 100644
--- a/Source/WebCore/rendering/svg/SVGTextMetrics.cpp
+++ b/Source/WebCore/rendering/svg/SVGTextMetrics.cpp
@@ -75,7 +75,7 @@ TextRun SVGTextMetrics::constructTextRun(RenderSVGInlineText* text, const UChar*
                 , 0 /* padding, only relevant for justified text, not relevant for SVG */
                 , TextRun::AllowTrailingExpansion
                 , style->direction()
-                , style->unicodeBidi() == Override /* directionalOverride */);
+                , isOverride(style->unicodeBidi()) /* directionalOverride */);
 
     if (textRunNeedsRenderingContext(style->font()))
         run.setRenderingContext(SVGTextRunRenderingContext::create(text));
diff --git a/Source/WebCore/svg/DOMWindowSVG.idl b/Source/WebCore/svg/DOMWindowSVG.idl
deleted file mode 100644
index cc907136b..000000000
--- a/Source/WebCore/svg/DOMWindowSVG.idl
+++ /dev/null
@@ -1,187 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-module window {
-
-    // FIXME: Most of this could/should be generated from make_names.pl/SVGNames.in
-    // to reduce the chance that we forget a constructor when adding a new element.
-    interface [
-        Conditional=SVG,
-        Supplemental=DOMWindow
-    ] DOMWindowSVG {
-
-        attribute SVGZoomEventConstructor SVGZoomEvent;
-
-        // Expose all implemented SVG 1.1 interfaces, excluding the SVG MI interfaces:
-        // SVGAnimatedPathData, SVGAnimatedPoints, SVGExternalResourcesRequired,
-        // SVGFilterPrimitiveStandardAttributes, SVGFitToViewBox, SVGLangSpace, SVGLocatable
-        // SVGStylable, SVGTests, SVGTransformable, SVGURIReference, SVGZoomAndPan
-        attribute SVGAElementConstructor SVGAElement;
-        attribute SVGAngleConstructor SVGAngle;
-        attribute SVGAnimatedAngleConstructor SVGAnimatedAngle;
-        attribute SVGAnimatedBooleanConstructor SVGAnimatedBoolean;
-        attribute SVGAnimatedEnumerationConstructor SVGAnimatedEnumeration;
-        attribute SVGAnimatedIntegerConstructor SVGAnimatedInteger;
-        attribute SVGAnimatedLengthConstructor SVGAnimatedLength;
-        attribute SVGAnimatedLengthListConstructor SVGAnimatedLengthList;
-        attribute SVGAnimatedNumberConstructor SVGAnimatedNumber;
-        attribute SVGAnimatedNumberListConstructor SVGAnimatedNumberList;
-        attribute SVGAnimatedPreserveAspectRatioConstructor SVGAnimatedPreserveAspectRatio;
-        attribute SVGAnimatedRectConstructor SVGAnimatedRect;
-        attribute SVGAnimatedStringConstructor SVGAnimatedString;
-        attribute SVGAnimatedTransformListConstructor SVGAnimatedTransformList;
-        attribute SVGCircleElementConstructor SVGCircleElement;
-        attribute SVGClipPathElementConstructor SVGClipPathElement;
-        attribute SVGColorConstructor SVGColor;
-        attribute SVGCursorElementConstructor SVGCursorElement;
-//      attribute SVGCSSRuleConstructor SVGCSSRule;
-        attribute SVGDefsElementConstructor SVGDefsElement;
-        attribute SVGDescElementConstructor SVGDescElement;
-        attribute SVGDocumentConstructor SVGDocument;
-        attribute SVGElementConstructor SVGElement;
-        attribute SVGElementInstanceConstructor SVGElementInstance;
-        attribute SVGElementInstanceListConstructor SVGElementInstanceList;
-        attribute SVGEllipseElementConstructor SVGEllipseElement;
-        attribute SVGForeignObjectElementConstructor SVGForeignObjectElement;
-        attribute SVGExceptionConstructor SVGException;
-        attribute SVGGElementConstructor SVGGElement;
-        attribute SVGGradientElementConstructor SVGGradientElement;
-        attribute SVGImageElementConstructor SVGImageElement;
-        attribute SVGLengthConstructor SVGLength;
-        attribute SVGLengthListConstructor SVGLengthList;
-        attribute SVGLinearGradientElementConstructor SVGLinearGradientElement;
-        attribute SVGLineElementConstructor SVGLineElement;
-        attribute SVGMarkerElementConstructor SVGMarkerElement;
-        attribute SVGMaskElementConstructor SVGMaskElement;
-        attribute SVGMatrixConstructor SVGMatrix;
-        attribute SVGMetadataElementConstructor SVGMetadataElement;
-        attribute SVGNumberConstructor SVGNumber;
-        attribute SVGNumberListConstructor SVGNumberList;
-        attribute SVGPaintConstructor SVGPaint;
-        attribute SVGPathElementConstructor SVGPathElement;
-        attribute SVGPathSegConstructor SVGPathSeg;
-        attribute SVGPathSegArcAbsConstructor SVGPathSegArcAbs;
-        attribute SVGPathSegArcRelConstructor SVGPathSegArcRel;
-        attribute SVGPathSegClosePathConstructor SVGPathSegClosePath;
-        attribute SVGPathSegCurvetoCubicAbsConstructor SVGPathSegCurvetoCubicAbs;
-        attribute SVGPathSegCurvetoCubicRelConstructor SVGPathSegCurvetoCubicRel;
-        attribute SVGPathSegCurvetoCubicSmoothAbsConstructor SVGPathSegCurvetoCubicSmoothAbs;
-        attribute SVGPathSegCurvetoCubicSmoothRelConstructor SVGPathSegCurvetoCubicSmoothRel;
-        attribute SVGPathSegCurvetoQuadraticAbsConstructor SVGPathSegCurvetoQuadraticAbs;
-        attribute SVGPathSegCurvetoQuadraticRelConstructor SVGPathSegCurvetoQuadraticRel;
-        attribute SVGPathSegCurvetoQuadraticSmoothAbsConstructor SVGPathSegCurvetoQuadraticSmoothAbs;
-        attribute SVGPathSegCurvetoQuadraticSmoothRelConstructor SVGPathSegCurvetoQuadraticSmoothRel;
-        attribute SVGPathSegLinetoAbsConstructor SVGPathSegLinetoAbs;
-        attribute SVGPathSegLinetoHorizontalAbsConstructor SVGPathSegLinetoHorizontalAbs;
-        attribute SVGPathSegLinetoHorizontalRelConstructor SVGPathSegLinetoHorizontalRel;
-        attribute SVGPathSegLinetoRelConstructor SVGPathSegLinetoRel;
-        attribute SVGPathSegLinetoVerticalAbsConstructor SVGPathSegLinetoVerticalAbs;
-        attribute SVGPathSegLinetoVerticalRelConstructor SVGPathSegLinetoVerticalRel;
-        attribute SVGPathSegListConstructor SVGPathSegList;
-        attribute SVGPathSegMovetoAbsConstructor SVGPathSegMovetoAbs;
-        attribute SVGPathSegMovetoRelConstructor SVGPathSegMovetoRel;
-        attribute SVGPatternElementConstructor SVGPatternElement;
-        attribute SVGPointConstructor SVGPoint;
-        attribute SVGPointListConstructor SVGPointList;
-        attribute SVGPolygonElementConstructor SVGPolygonElement;
-        attribute SVGPolylineElementConstructor SVGPolylineElement;
-        attribute SVGPreserveAspectRatioConstructor SVGPreserveAspectRatio;
-        attribute SVGRadialGradientElementConstructor SVGRadialGradientElement;
-        attribute SVGRectConstructor SVGRect;
-        attribute SVGRectElementConstructor SVGRectElement;
-        attribute SVGRenderingIntentConstructor SVGRenderingIntent;
-        attribute SVGScriptElementConstructor SVGScriptElement;
-        attribute SVGStopElementConstructor SVGStopElement;
-        attribute SVGStringListConstructor SVGStringList;
-        attribute SVGStyleElementConstructor SVGStyleElement;
-        attribute SVGSVGElementConstructor SVGSVGElement;
-        attribute SVGSwitchElementConstructor SVGSwitchElement;
-        attribute SVGSymbolElementConstructor SVGSymbolElement;
-        attribute SVGTextContentElementConstructor SVGTextContentElement;
-        attribute SVGTextElementConstructor SVGTextElement;
-        attribute SVGTextPathElementConstructor SVGTextPathElement;
-        attribute SVGTextPositioningElementConstructor SVGTextPositioningElement;
-        attribute SVGTitleElementConstructor SVGTitleElement;
-        attribute SVGTransformConstructor SVGTransform;
-        attribute SVGTransformListConstructor SVGTransformList;
-        attribute SVGTRefElementConstructor SVGTRefElement;
-        attribute SVGTSpanElementConstructor SVGTSpanElement;
-        attribute SVGUnitTypesConstructor SVGUnitTypes;
-        attribute SVGUseElementConstructor SVGUseElement;
-        attribute SVGViewElementConstructor SVGViewElement;
-//      attribute SVGViewSpecConstructor SVGViewSpec;
-
-        attribute SVGAnimateColorElementConstructor SVGAnimateColorElement;
-        attribute SVGAnimateElementConstructor SVGAnimateElement;
-        attribute SVGAnimateMotionElementConstructor SVGAnimateMotionElement;
-        attribute SVGAnimateTransformElementConstructor SVGAnimateTransformElement;
-        attribute SVGMPathElementConstructor SVGMPathElement;
-        attribute SVGSetElementConstructor SVGSetElement;
-
-#if defined(ENABLE_SVG_FONTS) && ENABLE_SVG_FONTS
-        attribute SVGAltGlyphDefElementConstructor SVGAltGlyphDefElement;
-        attribute SVGAltGlyphElementConstructor SVGAltGlyphElement;
-        attribute SVGAltGlyphItemElementConstructor SVGAltGlyphItemElement;
-//      attribute SVGDefinitionSrcElementConstructor SVGDefinitionSrcElement;
-        attribute SVGFontElementConstructor SVGFontElement;
-        attribute SVGFontFaceElementConstructor SVGFontFaceElement;
-        attribute SVGFontFaceFormatElementConstructor SVGFontFaceFormatElement;
-        attribute SVGFontFaceNameElementConstructor SVGFontFaceNameElement;
-        attribute SVGFontFaceSrcElementConstructor SVGFontFaceSrcElement;
-        attribute SVGFontFaceUriElementConstructor SVGFontFaceUriElement;
-        attribute SVGGlyphElementConstructor SVGGlyphElement;
-        attribute SVGGlyphRefElementConstructor SVGGlyphRefElement;
-        attribute SVGHKernElementConstructor SVGHKernElement;
-        attribute SVGMissingGlyphElementConstructor SVGMissingGlyphElement;
-        attribute SVGVKernElementConstructor SVGVKernElement;
-#endif
-
-#if defined(ENABLE_FILTERS) && ENABLE_FILTERS
-        attribute SVGComponentTransferFunctionElementConstructor SVGComponentTransferFunctionElement;
-        attribute SVGFEBlendElementConstructor SVGFEBlendElement;
-        attribute SVGFEColorMatrixElementConstructor SVGFEColorMatrixElement;
-        attribute SVGFEComponentTransferElementConstructor SVGFEComponentTransferElement;
-        attribute SVGFECompositeElementConstructor SVGFECompositeElement;
-        attribute SVGFEConvolveMatrixElementConstructor SVGFEConvolveMatrixElement;
-        attribute SVGFEDiffuseLightingElementConstructor SVGFEDiffuseLightingElement;
-        attribute SVGFEDisplacementMapElementConstructor SVGFEDisplacementMapElement;
-        attribute SVGFEDistantLightElementConstructor SVGFEDistantLightElement;
-        attribute SVGFEDropShadowElementConstructor SVGFEDropShadowElement;
-        attribute SVGFEFloodElementConstructor SVGFEFloodElement;
-        attribute SVGFEFuncAElementConstructor SVGFEFuncAElement;
-        attribute SVGFEFuncBElementConstructor SVGFEFuncBElement;
-        attribute SVGFEFuncGElementConstructor SVGFEFuncGElement;
-        attribute SVGFEFuncRElementConstructor SVGFEFuncRElement;
-        attribute SVGFEGaussianBlurElementConstructor SVGFEGaussianBlurElement;
-        attribute SVGFEImageElementConstructor SVGFEImageElement;
-        attribute SVGFEMergeElementConstructor SVGFEMergeElement;
-        attribute SVGFEMergeNodeElementConstructor SVGFEMergeNodeElement;
-        attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
-        attribute SVGFEOffsetElementConstructor SVGFEOffsetElement;
-        attribute SVGFEPointLightElementConstructor SVGFEPointLightElement;
-        attribute SVGFESpecularLightingElementConstructor SVGFESpecularLightingElement;
-        attribute SVGFESpotLightElementConstructor SVGFESpotLightElement;
-        attribute SVGFETileElementConstructor SVGFETileElement;
-        attribute SVGFETurbulenceElementConstructor SVGFETurbulenceElement;
-        attribute SVGFilterElementConstructor SVGFilterElement;
-#endif
-
-    };
-
-}
diff --git a/Source/WebCore/svg/SVGAElement.cpp b/Source/WebCore/svg/SVGAElement.cpp
index 7ec617ae0..f54906351 100644
--- a/Source/WebCore/svg/SVGAElement.cpp
+++ b/Source/WebCore/svg/SVGAElement.cpp
@@ -40,6 +40,7 @@
 #include "NodeRenderingContext.h"
 #include "PlatformMouseEvent.h"
 #include "RenderSVGInline.h"
+#include "RenderSVGText.h"
 #include "RenderSVGTransformableContainer.h"
 #include "ResourceRequest.h"
 #include "SVGElementInstance.h"
@@ -144,7 +145,7 @@ void SVGAElement::svgAttributeChanged(const QualifiedName& attrName)
 
 RenderObject* SVGAElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    if (static_cast<SVGElement*>(parentNode())->isTextContent())
+    if (parentNode() && parentNode()->isSVGElement() && static_cast<SVGElement*>(parentNode())->isTextContent())
         return new (arena) RenderSVGInline(this);
 
     return new (arena) RenderSVGTransformableContainer(this);
@@ -237,6 +238,19 @@ bool SVGAElement::childShouldCreateRenderer(const NodeRenderingContext& childCon
     return SVGElement::childShouldCreateRenderer(childContext);
 }
 
+void SVGAElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+{
+    SVGStyledTransformableElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+
+    if (changedByParser || !renderer())
+        return;
+
+    // Invalidate the TextPosition cache in SVGTextLayoutAttributesBuilder as it may now point
+    // to no-longer existing SVGTextPositioningElements and thus needs to be rebuilt.
+    if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(renderer()))
+        textRenderer->textDOMChanged();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGAElement.h b/Source/WebCore/svg/SVGAElement.h
index e3b8f2802..72afdec12 100644
--- a/Source/WebCore/svg/SVGAElement.h
+++ b/Source/WebCore/svg/SVGAElement.h
@@ -40,6 +40,9 @@ class SVGAElement : public SVGStyledTransformableElement,
 public:
     static PassRefPtr<SVGAElement> create(const QualifiedName&, Document*);
 
+protected:
+    virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0) OVERRIDE;
+
 private:
     SVGAElement(const QualifiedName&, Document*);
 
diff --git a/Source/WebCore/svg/SVGAnimateElement.cpp b/Source/WebCore/svg/SVGAnimateElement.cpp
index 13f7cf96b..cacf488e0 100644
--- a/Source/WebCore/svg/SVGAnimateElement.cpp
+++ b/Source/WebCore/svg/SVGAnimateElement.cpp
@@ -41,6 +41,7 @@ namespace WebCore {
 SVGAnimateElement::SVGAnimateElement(const QualifiedName& tagName, Document* document)
     : SVGAnimationElement(tagName, document)
     , m_animatedPropertyType(AnimatedString)
+    , m_aboutToStopAnimation(false)
     , m_fromPropertyValueType(RegularPropertyValue)
     , m_toPropertyValueType(RegularPropertyValue)
 {
@@ -230,6 +231,12 @@ void SVGAnimateElement::applyResultsToTarget()
     ASSERT(m_animatedPropertyType != AnimatedUnknown);
     ASSERT(m_animatedType);
 
+    if (m_aboutToStopAnimation) {
+        m_aboutToStopAnimation = false;
+        resetAnimationState(m_animatedType->valueAsString());
+        return;
+    }
+
     setTargetAttributeAnimatedValue(m_animatedType->valueAsString());
 }
     
@@ -260,5 +267,11 @@ SVGAnimatedTypeAnimator* SVGAnimateElement::ensureAnimator()
     return m_animator.get();
 }
 
+void SVGAnimateElement::endedActiveInterval()
+{
+    SVGAnimationElement::endedActiveInterval();
+    m_aboutToStopAnimation = true;
+}
+
 }
 #endif // ENABLE(SVG)
diff --git a/Source/WebCore/svg/SVGAnimateElement.h b/Source/WebCore/svg/SVGAnimateElement.h
index 69cb9a6ed..febc34d7c 100644
--- a/Source/WebCore/svg/SVGAnimateElement.h
+++ b/Source/WebCore/svg/SVGAnimateElement.h
@@ -65,6 +65,7 @@ protected:
     virtual void applyResultsToTarget();
     virtual float calculateDistance(const String& fromString, const String& toString);
 
+    virtual void endedActiveInterval();
     virtual void targetElementDidChange(SVGElement* targetElement) OVERRIDE;
 
 private:
@@ -72,6 +73,7 @@ private:
     
     virtual bool hasValidAttributeType();
     AnimatedPropertyType m_animatedPropertyType;
+    bool m_aboutToStopAnimation;
 
     AnimatedPropertyValueType m_fromPropertyValueType;
     AnimatedPropertyValueType m_toPropertyValueType;
diff --git a/Source/WebCore/svg/SVGAnimationElement.cpp b/Source/WebCore/svg/SVGAnimationElement.cpp
index 2659dd9df..dd6501b29 100644
--- a/Source/WebCore/svg/SVGAnimationElement.cpp
+++ b/Source/WebCore/svg/SVGAnimationElement.cpp
@@ -330,53 +330,90 @@ bool SVGAnimationElement::isTargetAttributeCSSProperty(SVGElement* targetElement
     return SVGStyledElement::isAnimatableCSSProperty(attributeName);
 }
 
-void SVGAnimationElement::setTargetAttributeAnimatedValue(const String& value)
+static inline void setTargetAttributeAnimatedCSSValue(SVGElement* targetElement, const QualifiedName& attributeName, const String& value)
 {
-    if (!hasValidAttributeType())
+    StylePropertySet* propertySet = targetElement->ensureAnimatedSMILStyleProperties();
+    if (value.isNull()) {
+        if (propertySet->removeProperty(cssPropertyID(attributeName.localName())))
+            targetElement->setNeedsStyleRecalc();
         return;
+    }
+
+    if (propertySet->setProperty(cssPropertyID(attributeName.localName()), value, false, 0))
+        targetElement->setNeedsStyleRecalc();
+}
+
+static inline void setTargetAttributeAnimatedXMLValue(SVGElement* targetElement, const QualifiedName& attributeName, const String& value)
+{
+    // FIXME: Detach animVal, if value.isNull() - once animVal support is enabled.
+    targetElement->setAttribute(attributeName, value);
+}
+
+void SVGAnimationElement::setTargetAttributeAnimatedValue(const String& value)
+{
     SVGElement* targetElement = this->targetElement();
-    QualifiedName attributeName = this->attributeName();
-    if (!targetElement || attributeName == anyQName() || value.isNull())
+    const QualifiedName& attributeName = this->attributeName();
+    ShouldApplyAnimation shouldApply = shouldApplyAnimation(targetElement, attributeName);
+    if (shouldApply == DontApplyAnimation)
         return;
 
-    // We don't want the instance tree to get rebuild. Instances are updated in the loop below.
     if (targetElement->isStyled())
         static_cast<SVGStyledElement*>(targetElement)->setInstanceUpdatesBlocked(true);
-        
-    bool attributeIsCSSProperty = isTargetAttributeCSSProperty(targetElement, attributeName);
-    // Stop animation, if attributeType is set to CSS by the user, but the attribute itself is not a CSS property.
-    if (!attributeIsCSSProperty && attributeType() == AttributeTypeCSS)
-        return;
 
-    ExceptionCode ec;
-    if (attributeIsCSSProperty) {
-        // FIXME: This should set the override style, not the inline style.
-        // Sadly override styles are not yet implemented.
-        targetElement->style()->setProperty(attributeName.localName(), value, "", ec);
-    } else {
-        // FIXME: This should set the 'presentation' value, not the actual 
-        // attribute value. Whatever that means in practice.
-        targetElement->setAttribute(attributeName, value);
-    }
-    
+    if (shouldApply == ApplyCSSAnimation)
+        setTargetAttributeAnimatedCSSValue(targetElement, attributeName, value);
+    else
+        setTargetAttributeAnimatedXMLValue(targetElement, attributeName, value);
+
     if (targetElement->isStyled())
         static_cast<SVGStyledElement*>(targetElement)->setInstanceUpdatesBlocked(false);
-    
-    // If the target element is used in an <use> instance tree, update that as well.
+
+    // If the target element has instances, update them as well, w/o requiring the <use> tree to be rebuilt.
     const HashSet<SVGElementInstance*>& instances = targetElement->instancesForElement();
     const HashSet<SVGElementInstance*>::const_iterator end = instances.end();
     for (HashSet<SVGElementInstance*>::const_iterator it = instances.begin(); it != end; ++it) {
         SVGElement* shadowTreeElement = (*it)->shadowTreeElement();
         if (!shadowTreeElement)
             continue;
-        if (attributeIsCSSProperty)
-            shadowTreeElement->style()->setProperty(attributeName.localName(), value, "", ec);
+
+        if (shouldApply == ApplyCSSAnimation)
+            setTargetAttributeAnimatedCSSValue(shadowTreeElement, attributeName, value);
         else
-            shadowTreeElement->setAttribute(attributeName, value);
-        (*it)->correspondingUseElement()->setNeedsStyleRecalc();
+            setTargetAttributeAnimatedXMLValue(shadowTreeElement, attributeName, value);
     }
 }
-    
+
+void SVGAnimationElement::resetAnimationState(const String& baseValue)
+{
+    // FIXME: This extra check will go away, once animVal is enabled.
+    SVGElement* targetElement = this->targetElement();
+    const QualifiedName& attributeName = this->attributeName();
+    ShouldApplyAnimation shouldApply = shouldApplyAnimation(targetElement, attributeName);
+    if (shouldApply == DontApplyAnimation)
+        return;
+
+    if (isFrozen() || shouldApply == ApplyXMLAnimation)
+        setTargetAttributeAnimatedValue(baseValue);
+    else // Only CSS animations support detaching previously animated properties so far, indicating by passing a null-string.
+        setTargetAttributeAnimatedValue(String());
+}
+
+SVGAnimationElement::ShouldApplyAnimation SVGAnimationElement::shouldApplyAnimation(SVGElement* targetElement, const QualifiedName& attributeName)
+{
+    if (!hasValidAttributeType() || !targetElement || attributeName == anyQName())
+        return DontApplyAnimation;
+
+    // Always animate CSS properties, using the ApplyCSSAnimation code path, regardless of the attributeType value.
+    if (isTargetAttributeCSSProperty(targetElement, attributeName))
+        return ApplyCSSAnimation;
+
+    // If attributeType="CSS" and attributeName doesn't point to a CSS property, ignore the animation.
+    if (attributeType() == AttributeTypeCSS)
+        return DontApplyAnimation;
+
+    return ApplyXMLAnimation;
+}
+
 void SVGAnimationElement::calculateKeyTimesForCalcModePaced()
 {
     ASSERT(calcMode() == CalcModePaced);
@@ -593,7 +630,7 @@ void SVGAnimationElement::startedActiveInterval()
     } else if (animationMode == PathAnimation)
         m_animationValid = calcMode == CalcModePaced || !fastHasAttribute(SVGNames::keyPointsAttr) || (m_keyTimes.size() > 1 && m_keyTimes.size() == m_keyPoints.size());
 }
-    
+
 void SVGAnimationElement::updateAnimation(float percent, unsigned repeat, SVGSMILElement* resultElement)
 {    
     if (!m_animationValid)
diff --git a/Source/WebCore/svg/SVGAnimationElement.h b/Source/WebCore/svg/SVGAnimationElement.h
index 495c1b244..73a331ab1 100644
--- a/Source/WebCore/svg/SVGAnimationElement.h
+++ b/Source/WebCore/svg/SVGAnimationElement.h
@@ -105,6 +105,8 @@ protected:
     virtual void startedActiveInterval();
     virtual void updateAnimation(float percent, unsigned repeat, SVGSMILElement* resultElement);
 
+    void resetAnimationState(const String& baseValue);
+
 private:
     virtual void attributeChanged(Attribute*) OVERRIDE;
 
@@ -122,6 +124,14 @@ private:
     float calculatePercentForFromTo(float percent) const;
     unsigned calculateKeyTimesIndex(float percent) const;
 
+    enum ShouldApplyAnimation {
+        DontApplyAnimation,
+        ApplyCSSAnimation,
+        ApplyXMLAnimation
+    };
+
+    ShouldApplyAnimation shouldApplyAnimation(SVGElement* targetElement, const QualifiedName& attributeName);
+
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGAnimationElement)
         DECLARE_ANIMATED_BOOLEAN(ExternalResourcesRequired, externalResourcesRequired)
     END_DECLARE_ANIMATED_PROPERTIES
diff --git a/Source/WebCore/svg/SVGElement.cpp b/Source/WebCore/svg/SVGElement.cpp
index 24adcf794..f0486a8a2 100644
--- a/Source/WebCore/svg/SVGElement.cpp
+++ b/Source/WebCore/svg/SVGElement.cpp
@@ -39,6 +39,7 @@
 #include "NodeRenderingContext.h"
 #include "RegisteredEventListener.h"
 #include "RenderObject.h"
+#include "ShadowRoot.h"
 #include "SVGCursorElement.h"
 #include "SVGDocumentExtensions.h"
 #include "SVGElementInstance.h"
@@ -77,6 +78,7 @@ SVGElement::~SVGElement()
         ASSERT(it != rareDataMap.end());
 
         SVGElementRareData* rareData = it->second;
+        rareData->destroyAnimatedSMILStyleProperties();
         if (SVGCursorElement* cursorElement = rareData->cursorElement())
             cursorElement->removeClient(this);
         if (CSSCursorImageValue* cursorImageValue = rareData->cursorImageValue())
@@ -109,6 +111,15 @@ SVGElementRareData* SVGElement::ensureRareSVGData()
 
 bool SVGElement::isOutermostSVGSVGElement() const
 {
+    if (!hasTagName(SVGNames::svgTag))
+        return false;
+
+    // If we're living in a shadow tree, we're a <svg> element that got created as replacement
+    // for a <symbol> element or a cloned <svg> element in the referenced tree. In that case
+    // we're always an inner <svg> element.
+    if (isInShadowTree())
+        return false;
+
     // Element may not be in the document, pretend we're outermost for viewport(), getCTM(), etc.
     if (!parentNode())
         return true;
@@ -331,13 +342,13 @@ bool SVGElement::haveLoadedRequiredResources()
     return true;
 }
 
-static bool hasLoadListener(Node* node)
+static bool hasLoadListener(Element* element)
 {
-    if (node->hasEventListeners(eventNames().loadEvent))
+    if (element->hasEventListeners(eventNames().loadEvent))
         return true;
 
-    for (node = node->parentNode(); node && node->isElementNode(); node = node->parentNode()) {
-        const EventListenerVector& entry = node->getEventListeners(eventNames().loadEvent);
+    for (element = element->parentOrHostElement(); element; element = element->parentOrHostElement()) {
+        const EventListenerVector& entry = element->getEventListeners(eventNames().loadEvent);
         for (size_t i = 0; i < entry.size(); ++i) {
             if (entry[i].useCapture)
                 return true;
@@ -351,9 +362,9 @@ void SVGElement::sendSVGLoadEventIfPossible(bool sendParentLoadEvents)
 {
     RefPtr<SVGElement> currentTarget = this;
     while (currentTarget && currentTarget->haveLoadedRequiredResources()) {
-        RefPtr<Node> parent;
+        RefPtr<Element> parent;
         if (sendParentLoadEvents)
-            parent = currentTarget->parentNode(); // save the next parent to dispatch too incase dispatching the event changes the tree
+            parent = currentTarget->parentOrHostElement(); // save the next parent to dispatch too incase dispatching the event changes the tree
         if (hasLoadListener(currentTarget.get()))
             currentTarget->dispatchEvent(Event::create(eventNames().loadEvent, false, false));
         currentTarget = (parent && parent->isSVGElement()) ? static_pointer_cast<SVGElement>(parent) : RefPtr<SVGElement>();
@@ -404,7 +415,7 @@ void SVGElement::attributeChanged(Attribute* attr)
 
     // When an animated SVG property changes through SVG DOM, svgAttributeChanged() is called, not attributeChanged().
     // Next time someone tries to access the XML attributes, the synchronization code starts. During that synchronization
-    // SVGAnimatedPropertySynchronizer may call NamedNodeMap::removeAttribute(), which in turn calls attributeChanged().
+    // SVGAnimatedPropertySynchronizer may call ElementAttributeData::removeAttribute(), which in turn calls attributeChanged().
     // At this point we're not allowed to call svgAttributeChanged() again - it may lead to extra work being done, or crashes
     // see bug https://bugs.webkit.org/show_bug.cgi?id=40994.
     if (isSynchronizingSVGAttributes())
@@ -466,10 +477,28 @@ void SVGElement::synchronizeSystemLanguage(void* contextElement)
 
 PassRefPtr<RenderStyle> SVGElement::customStyleForRenderer()
 {
-    if (correspondingElement())
-        return document()->styleSelector()->styleForElement(correspondingElement(), parentNode() ? parentNode()->renderer()->style() : 0, false/*allowSharing*/);
+    if (!correspondingElement())
+        return document()->styleSelector()->styleForElement(static_cast<Element*>(this), 0, true);
+
+    RenderStyle* style = 0;
+    if (Element* parent = parentOrHostElement()) {
+        if (RenderObject* renderer = parent->renderer())
+            style = renderer->style();
+    }
+
+    return document()->styleSelector()->styleForElement(correspondingElement(), style, false /*allowSharing*/);
+}
+
+StylePropertySet* SVGElement::animatedSMILStyleProperties() const
+{
+    if (hasRareSVGData())
+        return rareSVGData()->animatedSMILStyleProperties();
+    return 0;
+}
 
-    return document()->styleSelector()->styleForElement(static_cast<Element*>(this), 0, true);
+StylePropertySet* SVGElement::ensureAnimatedSMILStyleProperties()
+{
+    return ensureRareSVGData()->ensureAnimatedSMILStyleProperties();
 }
 
 #ifndef NDEBUG
diff --git a/Source/WebCore/svg/SVGElement.h b/Source/WebCore/svg/SVGElement.h
index 4735690b3..87b98351c 100644
--- a/Source/WebCore/svg/SVGElement.h
+++ b/Source/WebCore/svg/SVGElement.h
@@ -107,6 +107,9 @@ public:
     static bool isAnimatableAttribute(const QualifiedName&);
 #endif
 
+    StylePropertySet* animatedSMILStyleProperties() const;
+    StylePropertySet* ensureAnimatedSMILStyleProperties();
+
 protected:
     SVGElement(const QualifiedName&, Document*, ConstructionType = CreateSVGElement);
 
@@ -145,6 +148,12 @@ struct SVGAttributeHashTranslator {
     static bool equal(QualifiedName a, QualifiedName b) { return a.matches(b); }
 };
 
+inline SVGElement* toSVGElement(Element* element)
+{
+    ASSERT(!element || element->isSVGElement());
+    return static_cast<SVGElement*>(element);
+}
+
 }
 
 #endif
diff --git a/Source/WebCore/svg/SVGElementInstance.cpp b/Source/WebCore/svg/SVGElementInstance.cpp
index d23c2cfeb..b41400d33 100644
--- a/Source/WebCore/svg/SVGElementInstance.cpp
+++ b/Source/WebCore/svg/SVGElementInstance.cpp
@@ -130,8 +130,7 @@ void SVGElementInstance::invalidateAllInstancesOfElement(SVGElement* element)
         }
     }
 
-    // Be sure to rebuild use trees, if needed
-    element->document()->updateLayoutIgnorePendingStylesheets();
+    element->document()->updateStyleIfNeeded();
 }
 
 const AtomicString& SVGElementInstance::interfaceName() const
diff --git a/Source/WebCore/svg/SVGElementRareData.h b/Source/WebCore/svg/SVGElementRareData.h
index 501966241..ceec01cc9 100644
--- a/Source/WebCore/svg/SVGElementRareData.h
+++ b/Source/WebCore/svg/SVGElementRareData.h
@@ -74,6 +74,21 @@ public:
     CSSCursorImageValue* cursorImageValue() const { return m_cursorImageValue; }
     void setCursorImageValue(CSSCursorImageValue* cursorImageValue) { m_cursorImageValue = cursorImageValue; }
 
+    StylePropertySet* animatedSMILStyleProperties() const { return m_animatedSMILStyleProperties.get(); }
+    StylePropertySet* ensureAnimatedSMILStyleProperties()
+    {
+        if (!m_animatedSMILStyleProperties) {
+            m_animatedSMILStyleProperties = StylePropertySet::create();
+            m_animatedSMILStyleProperties->setStrictParsing(false);
+        }
+        return m_animatedSMILStyleProperties.get();
+    }
+
+    void destroyAnimatedSMILStyleProperties()
+    {
+        m_animatedSMILStyleProperties.clear();
+    }
+
 private:
     HashSet<SVGElementInstance*> m_elementInstances;
     SVGCursorElement* m_cursorElement;
@@ -81,6 +96,7 @@ private:
     SVGElement* m_correspondingElement;
     bool m_instancesUpdatesBlocked : 1;
     bool m_hasPendingResources : 1;
+    RefPtr<StylePropertySet> m_animatedSMILStyleProperties;
 };
 
 }
diff --git a/Source/WebCore/svg/SVGFontFaceElement.cpp b/Source/WebCore/svg/SVGFontFaceElement.cpp
index 98518de4d..93534e53b 100644
--- a/Source/WebCore/svg/SVGFontFaceElement.cpp
+++ b/Source/WebCore/svg/SVGFontFaceElement.cpp
@@ -298,8 +298,7 @@ void SVGFontFaceElement::rebuildFontFace()
 
     // Parse in-memory CSS rules
     CSSProperty srcProperty(CSSPropertySrc, list);
-    const CSSProperty* srcPropertyRef = &srcProperty;
-    m_fontFaceRule->declaration()->addParsedProperties(&srcPropertyRef, 1);
+    m_fontFaceRule->declaration()->addParsedProperties(&srcProperty, 1);
 
     if (describesParentFont) {    
         // Traverse parsed CSS values and associate CSSFontFaceSrcValue elements with ourselves.
diff --git a/Source/WebCore/svg/SVGGElement.cpp b/Source/WebCore/svg/SVGGElement.cpp
index 4f539f26f..13fa57181 100644
--- a/Source/WebCore/svg/SVGGElement.cpp
+++ b/Source/WebCore/svg/SVGGElement.cpp
@@ -110,7 +110,9 @@ RenderObject* SVGGElement::createRenderer(RenderArena* arena, RenderStyle* style
 
 bool SVGGElement::rendererIsNeeded(const NodeRenderingContext&)
 {
-    return parentNode() && parentNode()->isSVGElement(); 
+    // Unlike SVGStyledElement::rendererIsNeeded(), we still create renderers, even if
+    // display is set to 'none' - which is special to SVG <g> container elements.
+    return parentOrHostElement() && parentOrHostElement()->isSVGElement();
 }
 
 }
diff --git a/Source/WebCore/svg/SVGGElement.h b/Source/WebCore/svg/SVGGElement.h
index 6520fa6dd..851c6a7a1 100644
--- a/Source/WebCore/svg/SVGGElement.h
+++ b/Source/WebCore/svg/SVGGElement.h
@@ -37,8 +37,6 @@ class SVGGElement : public SVGStyledTransformableElement,
 public:
     static PassRefPtr<SVGGElement> create(const QualifiedName&, Document*);
 
-    virtual bool isShadowTreeContainerElement() const { return false; }
-
 protected:
     SVGGElement(const QualifiedName&, Document*, ConstructionType = CreateSVGElement);
 
diff --git a/Source/WebCore/svg/SVGImageElement.cpp b/Source/WebCore/svg/SVGImageElement.cpp
index 6f7fe9d1e..5a288fee6 100644
--- a/Source/WebCore/svg/SVGImageElement.cpp
+++ b/Source/WebCore/svg/SVGImageElement.cpp
@@ -91,11 +91,11 @@ bool SVGImageElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-bool SVGImageElement::isPresentationAttribute(Attribute* attr) const
+bool SVGImageElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name() == SVGNames::widthAttr || attr->name() == SVGNames::heightAttr)
+    if (name == SVGNames::widthAttr || name == SVGNames::heightAttr)
         return true;
-    return SVGStyledTransformableElement::isPresentationAttribute(attr);
+    return SVGStyledTransformableElement::isPresentationAttribute(name);
 }
 
 void SVGImageElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/svg/SVGImageElement.h b/Source/WebCore/svg/SVGImageElement.h
index fb1229e23..05be5cc90 100644
--- a/Source/WebCore/svg/SVGImageElement.h
+++ b/Source/WebCore/svg/SVGImageElement.h
@@ -50,7 +50,7 @@ private:
 
     bool isSupportedAttribute(const QualifiedName&);
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
diff --git a/Source/WebCore/svg/SVGLocatable.cpp b/Source/WebCore/svg/SVGLocatable.cpp
index b954ddad4..415f70c57 100644
--- a/Source/WebCore/svg/SVGLocatable.cpp
+++ b/Source/WebCore/svg/SVGLocatable.cpp
@@ -43,9 +43,9 @@ static bool isViewportElement(Node* node)
 SVGElement* SVGLocatable::nearestViewportElement(const SVGElement* element)
 {
     ASSERT(element);
-    for (ContainerNode* n = element->parentNode(); n; n = n->parentNode()) {
-        if (isViewportElement(n))
-            return static_cast<SVGElement*>(n);
+    for (Element* current = element->parentOrHostElement(); current; current = current->parentOrHostElement()) {
+        if (isViewportElement(current))
+            return static_cast<SVGElement*>(current);
     }
 
     return 0;
@@ -55,9 +55,9 @@ SVGElement* SVGLocatable::farthestViewportElement(const SVGElement* element)
 {
     ASSERT(element);
     SVGElement* farthest = 0;
-    for (ContainerNode* n = element->parentNode(); n; n = n->parentNode()) {
-        if (isViewportElement(n))
-            farthest = static_cast<SVGElement*>(n);
+    for (Element* current = element->parentOrHostElement(); current; current = current->parentOrHostElement()) {
+        if (isViewportElement(current))
+            farthest = static_cast<SVGElement*>(current);
     }
     return farthest;
 }
@@ -84,19 +84,16 @@ AffineTransform SVGLocatable::computeCTM(SVGElement* element, CTMScope mode, Sty
     AffineTransform ctm;
 
     SVGElement* stopAtElement = mode == NearestViewportScope ? nearestViewportElement(element) : 0;
+    for (Element* currentElement = element; currentElement; currentElement = currentElement->parentOrHostElement()) {
+        if (!currentElement->isSVGElement())
+            break;
 
-    Node* current = const_cast<SVGElement*>(element);
-    while (current && current->isSVGElement()) {
-        SVGElement* currentElement = static_cast<SVGElement*>(current);
-        if (currentElement->isStyled())
-            // note that this modifies the AffineTransform returned by localCoordinateSpaceTransform(mode) too.
+        if (static_cast<SVGElement*>(currentElement)->isStyled())
             ctm = static_cast<SVGStyledElement*>(currentElement)->localCoordinateSpaceTransform(mode).multiply(ctm);
 
         // For getCTM() computation, stop at the nearest viewport element
         if (currentElement == stopAtElement)
             break;
-
-        current = current->parentOrHostNode();
     }
 
     return ctm;
diff --git a/Source/WebCore/svg/SVGScriptElement.cpp b/Source/WebCore/svg/SVGScriptElement.cpp
index 39192e68a..8a4823999 100644
--- a/Source/WebCore/svg/SVGScriptElement.cpp
+++ b/Source/WebCore/svg/SVGScriptElement.cpp
@@ -144,8 +144,8 @@ void SVGScriptElement::insertedIntoDocument()
 
 void SVGScriptElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    ScriptElement::childrenChanged();
     SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    ScriptElement::childrenChanged();
 }
 
 bool SVGScriptElement::isURLAttribute(Attribute* attr) const
diff --git a/Source/WebCore/svg/SVGStyleElement.cpp b/Source/WebCore/svg/SVGStyleElement.cpp
index e32e93225..e00f66df2 100644
--- a/Source/WebCore/svg/SVGStyleElement.cpp
+++ b/Source/WebCore/svg/SVGStyleElement.cpp
@@ -148,8 +148,8 @@ void SVGStyleElement::removedFromDocument()
 
 void SVGStyleElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    StyleElement::childrenChanged(this);
     SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+    StyleElement::childrenChanged(this);
 }
 
 }
diff --git a/Source/WebCore/svg/SVGStyledElement.cpp b/Source/WebCore/svg/SVGStyledElement.cpp
index dd159a099..a573b8dce 100644
--- a/Source/WebCore/svg/SVGStyledElement.cpp
+++ b/Source/WebCore/svg/SVGStyledElement.cpp
@@ -59,7 +59,10 @@ using namespace SVGNames;
 
 void mapAttributeToCSSProperty(HashMap<AtomicStringImpl*, int>* propertyNameToIdMap, const QualifiedName& attrName)
 {
+    // FIXME: when CSS supports "transform-origin" the special case for transform_originAttr can be removed.
     int propertyId = cssPropertyID(attrName.localName());
+    if (!propertyId && attrName == transform_originAttr)
+        propertyId = CSSPropertyWebkitTransformOrigin; // cssPropertyID("-webkit-transform-origin")
     ASSERT(propertyId > 0);
     propertyNameToIdMap->set(attrName.localName().impl(), propertyId);
 }
@@ -82,33 +85,26 @@ String SVGStyledElement::title() const
 {
     // According to spec, we should not return titles when hovering over root <svg> elements (those
     // <title> elements are the title of the document, not a tooltip) so we instantly return.
-    if (hasTagName(SVGNames::svgTag)) {
-        const SVGSVGElement* svg = static_cast<const SVGSVGElement*>(this);
-        if (svg->isOutermostSVGSVGElement())
-            return String();
-    }
-    
+    if (isOutermostSVGSVGElement())
+        return String();
+
     // Walk up the tree, to find out whether we're inside a <use> shadow tree, to find the right title.
-    Node* parent = const_cast<SVGStyledElement*>(this);
-    while (parent) {
-        if (!parent->isSVGShadowRoot()) {
-            parent = parent->parentNodeGuaranteedHostFree();
-            continue;
-        }
-        
-        // Get the <use> element.
-        Element* shadowParent = parent->svgShadowHost();
-        if (shadowParent && shadowParent->isSVGElement() && shadowParent->hasTagName(SVGNames::useTag)) {
-            SVGUseElement* useElement = static_cast<SVGUseElement*>(shadowParent);
+    if (isInShadowTree()) {
+        Element* shadowHostElement = treeScope()->rootNode()->shadowHost();
+        // At this time, SVG nodes are not allowed in non-<use> shadow trees, so any shadow root we do
+        // have should be a use. The assert and following test is here to catch future shadow DOM changes
+        // that do enable SVG in a shadow tree.
+        ASSERT(!shadowHostElement || shadowHostElement->hasTagName(SVGNames::useTag));
+        if (shadowHostElement && shadowHostElement->hasTagName(SVGNames::useTag)) {
+            SVGUseElement* useElement = static_cast<SVGUseElement*>(shadowHostElement);
+ 
             // If the <use> title is not empty we found the title to use.
             String useTitle(useElement->title());
-            if (useTitle.isEmpty())
-                break;
-            return useTitle;
+            if (!useTitle.isEmpty())
+               return useTitle;
         }
-        parent = parent->parentNode();
     }
-    
+
     // If we aren't an instance in a <use> or the <use> title was not found, then find the first
     // <title> child of this element.
     Element* titleElement = firstElementChild();
@@ -132,7 +128,7 @@ bool SVGStyledElement::rendererIsNeeded(const NodeRenderingContext& context)
     // Spec: SVG allows inclusion of elements from foreign namespaces anywhere
     // with the SVG content. In general, the SVG user agent will include the unknown
     // elements in the DOM but will otherwise ignore unknown elements. 
-    if (!parentNode() || parentNode()->isSVGElement())
+    if (!parentOrHostElement() || parentOrHostElement()->isSVGElement())
         return StyledElement::rendererIsNeeded(context);
 
     return false;
@@ -201,6 +197,7 @@ int SVGStyledElement::cssPropertyIdForSVGAttributeName(const QualifiedName& attr
         mapAttributeToCSSProperty(propertyNameToIdMap, text_anchorAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, text_decorationAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, text_renderingAttr);
+        mapAttributeToCSSProperty(propertyNameToIdMap, transform_originAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, unicode_bidiAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, vector_effectAttr);
         mapAttributeToCSSProperty(propertyNameToIdMap, visibilityAttr);
@@ -292,11 +289,11 @@ bool SVGStyledElement::isAnimatableCSSProperty(const QualifiedName& attrName)
     return cssPropertyToTypeMap().contains(attrName);
 }
 
-bool SVGStyledElement::isPresentationAttribute(Attribute* attr) const
+bool SVGStyledElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (SVGStyledElement::cssPropertyIdForSVGAttributeName(attr->name()) > 0)
+    if (SVGStyledElement::cssPropertyIdForSVGAttributeName(name) > 0)
         return true;
-    return SVGElement::isPresentationAttribute(attr);
+    return SVGElement::isPresentationAttribute(name);
 }
 
 void SVGStyledElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
diff --git a/Source/WebCore/svg/SVGStyledElement.h b/Source/WebCore/svg/SVGStyledElement.h
index 7a400641c..64830e852 100644
--- a/Source/WebCore/svg/SVGStyledElement.h
+++ b/Source/WebCore/svg/SVGStyledElement.h
@@ -66,7 +66,7 @@ protected:
     virtual bool rendererIsNeeded(const NodeRenderingContext&);
 
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
diff --git a/Source/WebCore/svg/SVGTRefElement.cpp b/Source/WebCore/svg/SVGTRefElement.cpp
index 90b2d9985..82bc0e54d 100644
--- a/Source/WebCore/svg/SVGTRefElement.cpp
+++ b/Source/WebCore/svg/SVGTRefElement.cpp
@@ -32,7 +32,7 @@
 #include "RenderSVGInlineText.h"
 #include "RenderSVGResource.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "SVGDocument.h"
 #include "SVGElementInstance.h"
 #include "SVGNames.h"
@@ -165,7 +165,7 @@ void SVGTRefElement::updateReferencedText()
         textContent = target->textContent();
 
     ASSERT(hasShadowRoot());
-    ShadowRoot* root = shadowRootList()->oldestShadowRoot();
+    ShadowRoot* root = shadowTree()->oldestShadowRoot();
     if (!root->firstChild())
         root->appendChild(SVGShadowText::create(document(), textContent), ASSERT_NO_EXCEPTION);
     else
@@ -181,7 +181,7 @@ void SVGTRefElement::detachTarget()
     ExceptionCode ignore = 0;
 
     ASSERT(hasShadowRoot());
-    Node* container = shadowRootList()->oldestShadowRoot()->firstChild();
+    Node* container = shadowTree()->oldestShadowRoot()->firstChild();
     if (container)
         container->setTextContent(emptyContent, ignore);
 
diff --git a/Source/WebCore/svg/SVGTextContentElement.cpp b/Source/WebCore/svg/SVGTextContentElement.cpp
index 1efedac93..585f7ae63 100644
--- a/Source/WebCore/svg/SVGTextContentElement.cpp
+++ b/Source/WebCore/svg/SVGTextContentElement.cpp
@@ -228,11 +228,11 @@ bool SVGTextContentElement::isSupportedAttribute(const QualifiedName& attrName)
     return supportedAttributes.contains<QualifiedName, SVGAttributeHashTranslator>(attrName);
 }
 
-bool SVGTextContentElement::isPresentationAttribute(Attribute* attr) const
+bool SVGTextContentElement::isPresentationAttribute(const QualifiedName& name) const
 {
-    if (attr->name().matches(XMLNames::spaceAttr))
+    if (name.matches(XMLNames::spaceAttr))
         return true;
-    return SVGStyledElement::isPresentationAttribute(attr);
+    return SVGStyledElement::isPresentationAttribute(name);
 }
 
 void SVGTextContentElement::collectStyleForAttribute(Attribute* attr, StylePropertySet* style)
@@ -329,7 +329,7 @@ void SVGTextContentElement::childrenChanged(bool changedByParser, Node* beforeCh
         return;
 
     // Invalidate the TextPosition cache in SVGTextLayoutAttributesBuilder as it may now point
-    // to no-longer existing SVGTextPositioningElements and thus needs to be rebuild.
+    // to no-longer existing SVGTextPositioningElements and thus needs to be rebuilt.
     if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(renderer()))
         textRenderer->textDOMChanged();
 }
diff --git a/Source/WebCore/svg/SVGTextContentElement.h b/Source/WebCore/svg/SVGTextContentElement.h
index 91ae378f8..d9e350fb1 100644
--- a/Source/WebCore/svg/SVGTextContentElement.h
+++ b/Source/WebCore/svg/SVGTextContentElement.h
@@ -104,7 +104,7 @@ protected:
 
     bool isSupportedAttribute(const QualifiedName&);
     virtual void parseAttribute(Attribute*) OVERRIDE;
-    virtual bool isPresentationAttribute(Attribute*) const OVERRIDE;
+    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
     virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;
     virtual void svgAttributeChanged(const QualifiedName&);
 
diff --git a/Source/WebCore/svg/SVGUseElement.cpp b/Source/WebCore/svg/SVGUseElement.cpp
index e342ee4ad..bb691aaf2 100644
--- a/Source/WebCore/svg/SVGUseElement.cpp
+++ b/Source/WebCore/svg/SVGUseElement.cpp
@@ -34,7 +34,9 @@
 #include "NodeRenderStyle.h"
 #include "RegisteredEventListener.h"
 #include "RenderSVGResource.h"
-#include "RenderSVGShadowTreeRootContainer.h"
+#include "RenderSVGTransformableContainer.h"
+#include "ShadowRoot.h"
+#include "ShadowTree.h"
 #include "SVGElementInstance.h"
 #include "SVGElementRareData.h"
 #include "SVGElementInstanceList.h"
@@ -43,7 +45,6 @@
 #include "SVGNames.h"
 #include "SVGSMILElement.h"
 #include "SVGSVGElement.h"
-#include "SVGShadowTreeElements.h"
 #include "SVGSymbolElement.h"
 #include "XLinkNames.h"
 #include "XMLDocumentParser.h"
@@ -82,7 +83,6 @@ inline SVGUseElement::SVGUseElement(const QualifiedName& tagName, Document* docu
     , m_y(LengthModeHeight)
     , m_width(LengthModeWidth)
     , m_height(LengthModeHeight)
-    , m_updatesBlocked(false)
     , m_needsShadowTreeRecreation(false)
 {
     ASSERT(hasTagName(SVGNames::useTag));
@@ -93,7 +93,10 @@ inline SVGUseElement::SVGUseElement(const QualifiedName& tagName, Document* docu
 
 PassRefPtr<SVGUseElement> SVGUseElement::create(const QualifiedName& tagName, Document* document)
 {
-    return adoptRef(new SVGUseElement(tagName, document));
+    // Always build a #shadow-root for SVGUseElement.
+    RefPtr<SVGUseElement> use = adoptRef(new SVGUseElement(tagName, document));
+    use->ensureShadowRoot();
+    return use.release();
 }
 
 SVGElementInstance* SVGUseElement::instanceRoot()
@@ -167,12 +170,13 @@ void SVGUseElement::insertedIntoDocument()
     SVGStyledTransformableElement::insertedIntoDocument();
     ASSERT(!m_targetElementInstance || !isWellFormedDocument(document()));
     ASSERT(!hasPendingResources() || !isWellFormedDocument(document()));
+    buildPendingResource();
 }
 
 void SVGUseElement::removedFromDocument()
 {
     SVGStyledTransformableElement::removedFromDocument();
-    detachInstance();
+    clearResourceReferences();
 }
 
 void SVGUseElement::svgAttributeChanged(const QualifiedName& attrName)
@@ -184,48 +188,30 @@ void SVGUseElement::svgAttributeChanged(const QualifiedName& attrName)
 
     SVGElementInstance::InvalidationGuard invalidationGuard(this);
 
-    bool isXYAttribute = attrName == SVGNames::xAttr || attrName == SVGNames::yAttr;
-    bool isWidthHeightAttribute = attrName == SVGNames::widthAttr || attrName == SVGNames::heightAttr;
-
-    if (isXYAttribute || isWidthHeightAttribute)
+    RenderObject* renderer = this->renderer();
+    if (attrName == SVGNames::xAttr
+        || attrName == SVGNames::yAttr
+        || attrName == SVGNames::widthAttr
+        || attrName == SVGNames::heightAttr) {
         updateRelativeLengthsInformation();
-
-    if (SVGTests::handleAttributeChange(this, attrName))
-        return;
-
-    RenderObject* object = renderer();
-    if (!object)
-        return;
-
-    if (SVGURIReference::isKnownAttribute(attrName)) {
-        SVGDocumentExtensions* extensions = document()->accessSVGExtensions();
-        if (hasPendingResources() && extensions->isElementPendingResource(this, m_resourceId)) {
-            extensions->removePendingResourceForElement(m_resourceId, this);
-            m_resourceId = String();
-        }
-
-        m_targetElementInstance = 0;
-        invalidateShadowTree();
+        if (renderer)
+            RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
         return;
     }
 
-    if (isXYAttribute) {
-        updateContainerOffsets();
+    if (SVGTests::handleAttributeChange(this, attrName))
         return;
-    }
 
-    if (isWidthHeightAttribute) {
-        updateContainerSizes();
+    if (!renderer)
         return;
-    }
 
-    // Be very careful here, if svgAttributeChanged() has been called because a SVG CSS property changed, we do NOT want to reclone the tree!
-    if (SVGStyledElement::isKnownAttribute(attrName)) {
-        setNeedsStyleRecalc();
+    if (SVGURIReference::isKnownAttribute(attrName)) {
+        buildPendingResource();
         return;
     }
 
-    if (SVGLangSpace::isKnownAttribute(attrName) || SVGExternalResourcesRequired::isKnownAttribute(attrName)) {
+    if (SVGLangSpace::isKnownAttribute(attrName)
+        || SVGExternalResourcesRequired::isKnownAttribute(attrName)) {
         invalidateShadowTree();
         return;
     }
@@ -233,149 +219,15 @@ void SVGUseElement::svgAttributeChanged(const QualifiedName& attrName)
     ASSERT_NOT_REACHED();
 }
 
-static void updateContainerSize(SVGElementInstance* targetInstance)
-{
-    // Depth-first used to write the method in early exit style, no particular other reason.
-    for (SVGElementInstance* instance = targetInstance->firstChild(); instance; instance = instance->nextSibling())
-        updateContainerSize(instance);
-
-    SVGUseElement* useElement = targetInstance->directUseElement();
-    if (!useElement)
-        return;
-
-    SVGElement* correspondingElement = targetInstance->correspondingElement();
-    ASSERT(correspondingElement);
-
-    bool isSymbolTag = correspondingElement->hasTagName(SVGNames::symbolTag);
-    if (!correspondingElement->hasTagName(SVGNames::svgTag) && !isSymbolTag)
-        return;
-
-    SVGElement* shadowTreeElement = targetInstance->shadowTreeElement();
-    ASSERT(shadowTreeElement);
-    ASSERT(shadowTreeElement->hasTagName(SVGNames::svgTag));
-
-    // Spec (<use> on <symbol>): This generated 'svg' will always have explicit values for attributes width and height.
-    // If attributes width and/or height are provided on the 'use' element, then these attributes
-    // will be transferred to the generated 'svg'. If attributes width and/or height are not specified,
-    // the generated 'svg' element will use values of 100% for these attributes.
-    
-    // Spec (<use> on <svg>): If attributes width and/or height are provided on the 'use' element, then these
-    // values will override the corresponding attributes on the 'svg' in the generated tree.
-
-    if (useElement->hasAttribute(SVGNames::widthAttr))
-        shadowTreeElement->setAttribute(SVGNames::widthAttr, useElement->getAttribute(SVGNames::widthAttr));
-    else if (isSymbolTag && shadowTreeElement->hasAttribute(SVGNames::widthAttr))
-        shadowTreeElement->setAttribute(SVGNames::widthAttr, "100%");
-
-    if (useElement->hasAttribute(SVGNames::heightAttr))
-        shadowTreeElement->setAttribute(SVGNames::heightAttr, useElement->getAttribute(SVGNames::heightAttr));
-    else if (isSymbolTag && shadowTreeElement->hasAttribute(SVGNames::heightAttr))
-        shadowTreeElement->setAttribute(SVGNames::heightAttr, "100%");
-}   
-
-void SVGUseElement::updateContainerSizes()
+bool SVGUseElement::willRecalcStyle(StyleChange)
 {
-    if (!m_targetElementInstance)
-        return;
-
-    // Update whole subtree, scanning for shadow container elements, that correspond to <svg>/<symbol> tags
-    ASSERT(m_targetElementInstance->directUseElement() == this);
-    updateContainerSize(m_targetElementInstance.get());
-
-    if (RenderObject* object = renderer())
-        RenderSVGResource::markForLayoutAndParentResourceInvalidation(object);
-}
-
-static void updateContainerOffset(SVGElementInstance* targetInstance)
-{
-    // Depth-first used to write the method in early exit style, no particular other reason.
-    for (SVGElementInstance* instance = targetInstance->firstChild(); instance; instance = instance->nextSibling())
-        updateContainerOffset(instance);
-
-    SVGElement* correspondingElement = targetInstance->correspondingElement();
-    ASSERT(correspondingElement);
-
-    if (!correspondingElement->hasTagName(SVGNames::useTag))
-        return;
-
-    SVGElement* shadowTreeElement = targetInstance->shadowTreeElement();
-    ASSERT(shadowTreeElement);
-    ASSERT(shadowTreeElement->hasTagName(SVGNames::gTag));
-
-    if (!static_cast<SVGGElement*>(shadowTreeElement)->isShadowTreeContainerElement())
-        return;
-
-    // Spec: An additional transformation translate(x,y) is appended to the end
-    // (i.e., right-side) of the transform attribute on the generated 'g', where x
-    // and y represent the values of the x and y attributes on the 'use' element. 
-    SVGUseElement* useElement = static_cast<SVGUseElement*>(correspondingElement);
-    SVGShadowTreeContainerElement* containerElement = static_cast<SVGShadowTreeContainerElement*>(shadowTreeElement);
-    containerElement->setContainerOffset(useElement->x(), useElement->y());
-}
-
-void SVGUseElement::updateContainerOffsets()
-{
-    if (!m_targetElementInstance)
-        return;
-
-    // Update root container offset (not reachable through instance tree)
-    SVGElement* shadowRoot = m_targetElementInstance->shadowTreeElement();
-    ASSERT(shadowRoot);
-
-    ContainerNode* parentNode = shadowRoot->parentNode();
-    ASSERT(parentNode);
-    ASSERT(parentNode->isSVGElement());
-    ASSERT(parentNode->hasTagName(SVGNames::gTag));
-    ASSERT(static_cast<SVGGElement*>(parentNode)->isShadowTreeContainerElement());
-
-    SVGShadowTreeContainerElement* containerElement = static_cast<SVGShadowTreeContainerElement*>(parentNode);
-    containerElement->setContainerOffset(x(), y());
-
-    // Update whole subtree, scanning for shadow container elements, marking a cloned use subtree
-    updateContainerOffset(m_targetElementInstance.get());
-
-    if (RenderObject* object = renderer())
-        RenderSVGResource::markForLayoutAndParentResourceInvalidation(object);
-}
-
-bool SVGUseElement::willRecalcStyle(StyleChange change)
-{
-    // Eventually mark shadow root element needing style recalc
-    if ((change >= Inherit || needsStyleRecalc() || childNeedsStyleRecalc()) && m_targetElementInstance && !m_updatesBlocked) {
-        if (SVGElement* shadowRoot = m_targetElementInstance->shadowTreeElement())
-            shadowRoot->setNeedsStyleRecalc();
-    }
-    // Do not do style calculation during shadow tree construction because it may cause nodes to
-    // be attached before they should be. Style recalc will happen when the tree is constructed
-    // and explicitly attached.
-    if (m_updatesBlocked)
-        return false;
+    if (m_needsShadowTreeRecreation && renderer() && needsStyleRecalc())
+        buildPendingResource();
     return true;
 }
 
-void SVGUseElement::didRecalcStyle(StyleChange change)
-{
-    // Assure that the shadow tree has not been marked for recreation, while we're building it.
-    if (m_updatesBlocked && m_needsShadowTreeRecreation) {
-        // We are about to recreate the tree while in the middle of recreating the tree.
-        return;
-    }
-
-    RenderSVGShadowTreeRootContainer* shadowRoot = static_cast<RenderSVGShadowTreeRootContainer*>(renderer());
-    if (!shadowRoot)
-        return;
-    
-    if (m_needsShadowTreeRecreation) {
-        shadowRoot->markShadowTreeForRecreation();
-        m_needsShadowTreeRecreation = false;
-    }
-
-    shadowRoot->updateFromElement();
-    shadowRoot->updateStyle(change);
-}
-
 #ifdef DUMP_INSTANCE_TREE
-void dumpInstanceTree(unsigned int& depth, String& text, SVGElementInstance* targetInstance)
+static void dumpInstanceTree(unsigned int& depth, String& text, SVGElementInstance* targetInstance)
 {
     SVGElement* element = targetInstance->correspondingElement();
     ASSERT(element);
@@ -423,14 +275,46 @@ void dumpInstanceTree(unsigned int& depth, String& text, SVGElementInstance* tar
 }
 #endif
 
-static bool isDisallowedElement(Node* element)
+static bool isDisallowedElement(Node* node)
 {
-    // <foreignObject> should never be contained in a <use> tree. Too dangerous side effects possible.
-    if (element->hasTagName(SVGNames::foreignObjectTag))
-        return true;
-    if (SVGSMILElement::isSMILElement(element))
+    // Spec: "Any 'svg', 'symbol', 'g', graphics element or other 'use' is potentially a template object that can be re-used
+    // (i.e., "instanced") in the SVG document via a 'use' element."
+    // "Graphics Element" is defined as 'circle', 'ellipse', 'image', 'line', 'path', 'polygon', 'polyline', 'rect', 'text'
+    // Excluded are anything that is used by reference or that only make sense to appear once in a document.
+    // We must also allow the shadow roots of other use elements.
+    if (node->isShadowRoot() || node->isTextNode())
+        return false;
+
+    if (!node->isSVGElement())
         return true;
-    return false;
+
+    Element* element = static_cast<Element*>(node);
+
+    DEFINE_STATIC_LOCAL(HashSet<QualifiedName>, allowedElementTags, ());
+    if (allowedElementTags.isEmpty()) {
+        allowedElementTags.add(SVGNames::aTag);
+        allowedElementTags.add(SVGNames::circleTag);
+        allowedElementTags.add(SVGNames::descTag);
+        allowedElementTags.add(SVGNames::ellipseTag);
+        allowedElementTags.add(SVGNames::gTag);
+        allowedElementTags.add(SVGNames::imageTag);
+        allowedElementTags.add(SVGNames::lineTag);
+        allowedElementTags.add(SVGNames::metadataTag);
+        allowedElementTags.add(SVGNames::pathTag);
+        allowedElementTags.add(SVGNames::polygonTag);
+        allowedElementTags.add(SVGNames::polylineTag);
+        allowedElementTags.add(SVGNames::rectTag);
+        allowedElementTags.add(SVGNames::svgTag);
+        allowedElementTags.add(SVGNames::switchTag);
+        allowedElementTags.add(SVGNames::symbolTag);
+        allowedElementTags.add(SVGNames::textTag);
+        allowedElementTags.add(SVGNames::textPathTag);
+        allowedElementTags.add(SVGNames::titleTag);
+        allowedElementTags.add(SVGNames::trefTag);
+        allowedElementTags.add(SVGNames::tspanTag);
+        allowedElementTags.add(SVGNames::useTag);
+    }
+    return !allowedElementTags.contains<QualifiedName, SVGAttributeHashTranslator>(element->tagQName());
 }
 
 static bool subtreeContainsDisallowedElement(Node* start)
@@ -446,78 +330,51 @@ static bool subtreeContainsDisallowedElement(Node* start)
     return false;
 }
 
+void SVGUseElement::clearResourceReferences()
+{
+    // FIXME: We should try to optimize this, to at least allow partial reclones.
+    if (ShadowRoot* shadowTreeRootElement =  shadowTree()->oldestShadowRoot())
+        shadowTreeRootElement->removeAllChildren();
+
+    if (m_targetElementInstance) {
+        m_targetElementInstance->detach();
+        m_targetElementInstance = 0;
+    }
+
+    m_needsShadowTreeRecreation = false;
+}
+
 void SVGUseElement::buildPendingResource()
 {
-    // If we're called the first time (during shadow tree root creation from RenderSVGShadowTreeRootContainer)
-    // we either determine that our target is available or not - then we add ourselves to the pending resource list
-    // Once the pending resource appears, it will call buildPendingResource(), so we're called a second time.
-    String id;
-    Element* targetElement = SVGURIReference::targetElementFromIRIString(href(), document(), &id);
-    ASSERT(!m_targetElementInstance);
-    SVGDocumentExtensions* extensions = document()->accessSVGExtensions();
+    clearResourceReferences();
+    if (!inDocument())
+        return;
 
-    if (!targetElement) {
-        if ((hasPendingResources() && extensions->isElementPendingResource(this, id)) || id.isEmpty())
+    String id;
+    Element* target = SVGURIReference::targetElementFromIRIString(href(), document(), &id);
+    if (!target) {
+        if (hasPendingResources() || id.isEmpty())
             return;
 
-        m_resourceId = id;
-        extensions->addPendingResource(id, this);
+        ASSERT(!hasPendingResources());
+        document()->accessSVGExtensions()->addPendingResource(id, this);
         ASSERT(hasPendingResources());
         return;
     }
 
-    if (hasPendingResources()) {
-        ASSERT(!m_targetElementInstance);
-        m_resourceId = String();
-        invalidateShadowTree();
-    }
+    if (target->isSVGElement())
+        buildShadowAndInstanceTree(static_cast<SVGElement*>(target));
+    ASSERT(!m_needsShadowTreeRecreation);
 }
 
-void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowRoot)
+void SVGUseElement::buildShadowAndInstanceTree(SVGElement* target)
 {
-    struct ShadowTreeUpdateBlocker {
-        ShadowTreeUpdateBlocker(SVGUseElement* currentUseElement)
-            : useElement(currentUseElement)
-        {
-            useElement->setUpdatesBlocked(true);
-        }
-
-        ~ShadowTreeUpdateBlocker()
-        {
-            useElement->setUpdatesBlocked(false);
-        }
-
-        SVGUseElement* useElement;
-    };
-
-    // When cloning the target nodes, they may decide to synchronize style and/or animated SVG attributes.
-    // That causes calls to SVGElementInstance::updateAllInstancesOfElement(), which mark the shadow tree for recreation.
-    // Solution: block any updates to the shadow tree while we're building it.
-    ShadowTreeUpdateBlocker blocker(this);
-
-    Element* targetElement = SVGURIReference::targetElementFromIRIString(href(), document());
-    if (!targetElement) {
-        // The only time we should get here is when the use element has not been
-        // given a resource to target.
-        ASSERT(m_resourceId.isEmpty());
-        return;
-    }
+    ASSERT(!m_targetElementInstance);
 
     // Do not build the shadow/instance tree for <use> elements living in a shadow tree.
     // The will be expanded soon anyway - see expandUseElementsInShadowTree().
-    ContainerNode* parent = parentNode();
-    while (parent) {
-        if (parent->isSVGShadowRoot())
-            return;
-
-        parent = parent->parentNodeGuaranteedHostFree();
-    }
-
-    SVGElement* target = 0;
-    if (targetElement && targetElement->isSVGElement())
-        target = static_cast<SVGElement*>(targetElement);
-
-    detachInstance();
+    if (isInShadowTree())
+        return;
 
     // Do not allow self-referencing.
     // 'target' may be null, if it's a non SVG namespaced element.
@@ -543,7 +400,7 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
     // SVG specification does not say a word about <use> & cycles. My view on this is: just ignore it!
     // Non-appearing <use> content is easier to debug, then half-appearing content.
     if (foundProblem) {
-        detachInstance();
+        clearResourceReferences();
         return;
     }
 
@@ -554,42 +411,39 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
     ASSERT(m_targetElementInstance->directUseElement() == this);
     ASSERT(m_targetElementInstance->correspondingElement() == target);
 
+    ShadowRoot* shadowTreeRootElement = shadowTree()->oldestShadowRoot();
+    ASSERT(shadowTreeRootElement);
+
     // Build shadow tree from instance tree
     // This also handles the special cases: <use> on <symbol>, <use> on <svg>.
-    buildShadowTree(shadowRoot, target, m_targetElementInstance.get());
+    buildShadowTree(target, m_targetElementInstance.get());
 
     // Expand all <use> elements in the shadow tree.
     // Expand means: replace the actual <use> element by what it references.
-    expandUseElementsInShadowTree(shadowRoot);
+    expandUseElementsInShadowTree(shadowTreeRootElement);
 
     // Expand all <symbol> elements in the shadow tree.
     // Expand means: replace the actual <symbol> element by the <svg> element.
-    expandSymbolElementsInShadowTree(shadowRoot);
+    expandSymbolElementsInShadowTree(shadowTreeRootElement);
 
     // Now that the shadow tree is completly expanded, we can associate
     // shadow tree elements <-> instances in the instance tree.
-    associateInstancesWithShadowTreeElements(shadowRoot->firstChild(), m_targetElementInstance.get());
+    associateInstancesWithShadowTreeElements(shadowTreeRootElement->firstChild(), m_targetElementInstance.get());
 
     // If no shadow tree element is present, this means that the reference root
     // element was removed, as it is disallowed (ie. <use> on <foreignObject>)
     // Do NOT leave an inconsistent instance tree around, instead destruct it.
     if (!m_targetElementInstance->shadowTreeElement()) {
-        shadowRoot->removeAllChildren();
-        detachInstance();
+        clearResourceReferences();
         return;
     }
 
-    // Consistency checks - this is assumed in updateContainerOffset().
-    ASSERT(m_targetElementInstance->shadowTreeElement()->parentNode() == shadowRoot);
+    ASSERT(m_targetElementInstance->shadowTreeElement()->parentNode() == shadowTreeRootElement);
 
     // Transfer event listeners assigned to the referenced element to our shadow tree elements.
     transferEventListenersToShadowTree(m_targetElementInstance.get());
 
-    // Update container offset/size
-    updateContainerOffsets();
-    updateContainerSizes();
-
-    // Update relative length information
+    // Update relative length information.
     updateRelativeLengthsInformation();
 
     // Eventually dump instance tree
@@ -603,48 +457,15 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
 
     // Eventually dump shadow tree
 #ifdef DUMP_SHADOW_TREE
-    ExceptionCode ec = 0;
-
     RefPtr<XMLSerializer> serializer = XMLSerializer::create();
-
-    String markup = serializer->serializeToString(shadowRoot, ec);
-    ASSERT(!ec);
-
+    String markup = serializer->serializeToString(shadowTreeRootElement, ASSERT_NO_EXCEPTION);
     fprintf(stderr, "Dumping <use> shadow tree markup:\n%s\n", markup.latin1().data());
 #endif
 }
 
-void SVGUseElement::detachInstance()
-{
-    if (!m_targetElementInstance)
-        return;
-    m_targetElementInstance->detach();
-    m_targetElementInstance = 0;
-}
-
 RenderObject* SVGUseElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    return new (arena) RenderSVGShadowTreeRootContainer(this);
-}
-
-static void updateFromElementCallback(Node* node, unsigned)
-{
-    if (RenderObject* renderer = node->renderer())
-        renderer->updateFromElement();
-}
-
-void SVGUseElement::attach()
-{
-    SVGStyledTransformableElement::attach();
-
-    if (renderer())
-        queuePostAttachCallback(updateFromElementCallback, this);
-}
-
-void SVGUseElement::detach()
-{
-    SVGStyledTransformableElement::detach();
-    detachInstance();
+    return new (arena) RenderSVGTransformableContainer(this);
 }
 
 static bool isDirectReference(const Node* node)
@@ -770,23 +591,22 @@ bool SVGUseElement::hasCycleUseReferencing(SVGUseElement* use, SVGElementInstanc
     return false;
 }
 
-void SVGUseElement::removeDisallowedElementsFromSubtree(Node* subtree)
+static inline void removeDisallowedElementsFromSubtree(Node* subtree)
 {
     ASSERT(!subtree->inDocument());
-    ExceptionCode ec;
     Node* node = subtree->firstChild();
     while (node) {
         if (isDisallowedElement(node)) {
             Node* next = node->traverseNextSibling(subtree);
             // The subtree is not in document so this won't generate events that could mutate the tree.
-            node->parentNode()->removeChild(node, ec);
+            node->parentNode()->removeChild(node);
             node = next;
         } else
             node = node->traverseNextNode(subtree);
     }
 }
 
-void SVGUseElement::buildShadowTree(SVGShadowTreeRootElement* shadowRoot, SVGElement* target, SVGElementInstance* targetInstance)
+void SVGUseElement::buildShadowTree(SVGElement* target, SVGElementInstance* targetInstance)
 {
     // For instance <use> on <foreignObject> (direct case).
     if (isDisallowedElement(target))
@@ -802,14 +622,7 @@ void SVGUseElement::buildShadowTree(SVGShadowTreeRootElement* shadowRoot, SVGEle
     if (subtreeContainsDisallowedElement(newChild.get()))
         removeDisallowedElementsFromSubtree(newChild.get());
 
-    SVGElement* newChildPtr = 0;
-    if (newChild->isSVGElement())
-        newChildPtr = static_cast<SVGElement*>(newChild.get());
-    ASSERT_UNUSED(newChildPtr, newChildPtr);
-
-    ExceptionCode ec = 0;
-    shadowRoot->appendChild(newChild.release(), ec);
-    ASSERT(!ec);
+    shadowTree()->oldestShadowRoot()->appendChild(newChild.release());
 }
 
 void SVGUseElement::expandUseElementsInShadowTree(Node* element)
@@ -831,24 +644,17 @@ void SVGUseElement::expandUseElementsInShadowTree(Node* element)
 
         // Don't ASSERT(target) here, it may be "pending", too.
         // Setup sub-shadow tree root node
-        RefPtr<SVGShadowTreeContainerElement> cloneParent = SVGShadowTreeContainerElement::create(document());
+        RefPtr<SVGGElement> cloneParent = SVGGElement::create(SVGNames::gTag, document());
         use->cloneChildNodes(cloneParent.get());
 
         // Spec: In the generated content, the 'use' will be replaced by 'g', where all attributes from the
         // 'use' element except for x, y, width, height and xlink:href are transferred to the generated 'g' element.
         transferUseAttributesToReplacedElement(use, cloneParent.get());
 
-        ExceptionCode ec = 0;
         if (target && !isDisallowedElement(target)) {
             RefPtr<Element> newChild = target->cloneElementWithChildren();
-
-            SVGElement* newChildPtr = 0;
-            if (newChild->isSVGElement())
-                newChildPtr = static_cast<SVGElement*>(newChild.get());
-            ASSERT_UNUSED(newChildPtr, newChildPtr);
-
-            cloneParent->appendChild(newChild.release(), ec);
-            ASSERT(!ec);
+            ASSERT(newChild->isSVGElement());
+            cloneParent->appendChild(newChild.release());
         }
 
         // We don't walk the target tree element-by-element, and clone each element,
@@ -863,8 +669,7 @@ void SVGUseElement::expandUseElementsInShadowTree(Node* element)
 
         // Replace <use> with referenced content.
         ASSERT(use->parentNode()); 
-        use->parentNode()->replaceChild(cloneParent.release(), use, ec);
-        ASSERT(!ec);
+        use->parentNode()->replaceChild(cloneParent.release(), use);
 
         // Expand the siblings because the *element* is replaced and we will
         // lose the sibling chain when we are back from recursion.
@@ -892,11 +697,9 @@ void SVGUseElement::expandSymbolElementsInShadowTree(Node* element)
         svgElement->setAttributesFromElement(*toElement(element));
 
         // Only clone symbol children, and add them to the new <svg> element    
-        ExceptionCode ec = 0;
         for (Node* child = element->firstChild(); child; child = child->nextSibling()) {
             RefPtr<Node> newChild = child->cloneNode(true);
-            svgElement->appendChild(newChild.release(), ec);
-            ASSERT(!ec);
+            svgElement->appendChild(newChild.release());
         }
     
         // We don't walk the target tree element-by-element, and clone each element,
@@ -910,9 +713,7 @@ void SVGUseElement::expandSymbolElementsInShadowTree(Node* element)
         RefPtr<Node> replacingElement(svgElement.get());
 
         // Replace <symbol> with <svg>.
-        ASSERT(element->parentNode()); 
-        element->parentNode()->replaceChild(svgElement.release(), element, ec);
-        ASSERT(!ec);
+        element->parentNode()->replaceChild(svgElement.release(), element);
 
         // Expand the siblings because the *element* is replaced and we will
         // lose the sibling chain when we are back from recursion.
@@ -1013,10 +814,8 @@ SVGElementInstance* SVGUseElement::instanceForShadowTreeElement(Node* element, S
 
 void SVGUseElement::invalidateShadowTree()
 {
-    // Don't mutate the shadow tree while we're building it.
-    if (m_updatesBlocked)
+    if (!renderer() || m_needsShadowTreeRecreation)
         return;
-
     m_needsShadowTreeRecreation = true;
     setNeedsStyleRecalc();
 }
diff --git a/Source/WebCore/svg/SVGUseElement.h b/Source/WebCore/svg/SVGUseElement.h
index 0d9c06e46..953b7e253 100644
--- a/Source/WebCore/svg/SVGUseElement.h
+++ b/Source/WebCore/svg/SVGUseElement.h
@@ -33,7 +33,6 @@
 namespace WebCore {
 
 class SVGElementInstance;
-class SVGShadowTreeRootElement;
 
 class SVGUseElement : public SVGStyledTransformableElement,
                       public SVGTests,
@@ -65,21 +64,12 @@ private:
     virtual void svgAttributeChanged(const QualifiedName&);
 
     virtual bool willRecalcStyle(StyleChange);
-    virtual void didRecalcStyle(StyleChange);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual void attach();
-    virtual void detach();
-
     virtual void toClipPath(Path&);
 
-    static void removeDisallowedElementsFromSubtree(Node* element);
-
-    void setUpdatesBlocked(bool blocked) { m_updatesBlocked = blocked; }
-
-    friend class RenderSVGShadowTreeRootContainer;
-    friend class SVGElement;
-    void buildShadowAndInstanceTree(SVGShadowTreeRootElement*);
+    void clearResourceReferences();
+    void buildShadowAndInstanceTree(SVGElement* target);
     void detachInstance();
 
     virtual bool selfHasRelativeLengths() const;
@@ -89,7 +79,7 @@ private:
     bool hasCycleUseReferencing(SVGUseElement*, SVGElementInstance* targetInstance, SVGElement*& newTarget);
 
     // Shadow tree handling
-    void buildShadowTree(SVGShadowTreeRootElement*, SVGElement* target, SVGElementInstance* targetInstance);
+    void buildShadowTree(SVGElement* target, SVGElementInstance* targetInstance);
 
     void expandUseElementsInShadowTree(Node* element);
     void expandSymbolElementsInShadowTree(Node* element);
@@ -101,9 +91,6 @@ private:
     void transferUseAttributesToReplacedElement(SVGElement* from, SVGElement* to) const;
     void transferEventListenersToShadowTree(SVGElementInstance* target);
 
-    void updateContainerOffsets();
-    void updateContainerSizes();
-
     BEGIN_DECLARE_ANIMATED_PROPERTIES(SVGUseElement)
         DECLARE_ANIMATED_LENGTH(X, x)
         DECLARE_ANIMATED_LENGTH(Y, y)
@@ -118,9 +105,7 @@ private:
     virtual void synchronizeRequiredExtensions() { SVGTests::synchronizeRequiredExtensions(this); }
     virtual void synchronizeSystemLanguage() { SVGTests::synchronizeSystemLanguage(this); }
 
-    bool m_updatesBlocked;
     bool m_needsShadowTreeRecreation;
-    String m_resourceId;
     RefPtr<SVGElementInstance> m_targetElementInstance;
 };
 
diff --git a/Source/WebCore/svg/animation/SVGSMILElement.cpp b/Source/WebCore/svg/animation/SVGSMILElement.cpp
index dda170bf9..73c8785da 100644
--- a/Source/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/Source/WebCore/svg/animation/SVGSMILElement.cpp
@@ -192,11 +192,10 @@ void SVGSMILElement::reset()
 void SVGSMILElement::insertedIntoDocument()
 {
     SVGElement::insertedIntoDocument();
-#ifndef NDEBUG
+
     // Verify we are not in <use> instance tree.
-    for (ContainerNode* n = this; n; n = n->parentNode())
-        ASSERT(!n->isSVGShadowRoot());
-#endif
+    ASSERT(!isInShadowTree());
+
     m_attributeName = constructQualifiedName(this, fastGetAttribute(SVGNames::attributeNameAttr));
     SVGSVGElement* owner = ownerSVGElement();
     if (!owner)
@@ -222,14 +221,17 @@ void SVGSMILElement::removedFromDocument()
         m_timeContainer->unschedule(this);
         m_timeContainer = 0;
     }
-    if (m_targetElement) {
-        document()->accessSVGExtensions()->removeAnimationElementFromTarget(this, m_targetElement);
-        m_targetElement = 0;
-    }
     // Calling disconnectConditions() may kill us if there are syncbase conditions.
     // OK, but we don't want to die inside the call.
     RefPtr<SVGSMILElement> keepAlive(this);
     disconnectConditions();
+
+    // Clear target now, because disconnectConditions calls targetElement() which will recreate the target if we removed it sooner. 
+    if (m_targetElement) {
+        document()->accessSVGExtensions()->removeAnimationElementFromTarget(this, m_targetElement);
+        m_targetElement = 0;
+    }
+
     SVGElement::removedFromDocument();
 }
    
diff --git a/Source/WebCore/svg/animation/SVGSMILElement.h b/Source/WebCore/svg/animation/SVGSMILElement.h
index 9e1dfd014..400a7a6ba 100644
--- a/Source/WebCore/svg/animation/SVGSMILElement.h
+++ b/Source/WebCore/svg/animation/SVGSMILElement.h
@@ -116,11 +116,11 @@ protected:
 
     // Sub-classes may need to take action when the target is changed.
     virtual void targetElementDidChange(SVGElement*) { }
+    virtual void endedActiveInterval();
 
 private:
     virtual void startedActiveInterval() = 0;
     virtual void updateAnimation(float percent, unsigned repeat, SVGSMILElement* resultElement) = 0;
-    void endedActiveInterval();
 
     enum BeginOrEnd {
         Begin,
diff --git a/Source/WebCore/svg/graphics/SVGImage.cpp b/Source/WebCore/svg/graphics/SVGImage.cpp
index 7e1ce2854..585780fea 100644
--- a/Source/WebCore/svg/graphics/SVGImage.cpp
+++ b/Source/WebCore/svg/graphics/SVGImage.cpp
@@ -304,7 +304,7 @@ NativeImagePtr SVGImage::nativeImageForCurrentFrame()
     if (!m_frameCache) {
         if (!m_page)
             return 0;
-        OwnPtr<ImageBuffer> buffer = ImageBuffer::create(size());
+        OwnPtr<ImageBuffer> buffer = ImageBuffer::create(size(), 1);
         if (!buffer) // failed to allocate image
             return 0;
         draw(buffer->context(), rect(), rect(), ColorSpaceDeviceRGB, CompositeSourceOver);
diff --git a/Source/WebCore/svg/graphics/SVGImageCache.cpp b/Source/WebCore/svg/graphics/SVGImageCache.cpp
index cd901f4b4..0d97a0fec 100644
--- a/Source/WebCore/svg/graphics/SVGImageCache.cpp
+++ b/Source/WebCore/svg/graphics/SVGImageCache.cpp
@@ -133,7 +133,7 @@ Image* SVGImageCache::lookupOrCreateBitmapImageForRenderer(const RenderObject* r
     }
 
     // Create and cache new image and image buffer at requested size.
-    OwnPtr<ImageBuffer> newBuffer = ImageBuffer::create(size);
+    OwnPtr<ImageBuffer> newBuffer = ImageBuffer::create(size, 1);
     if (!newBuffer)
         return Image::nullImage();
 
diff --git a/Source/WebCore/svg/svgattrs.in b/Source/WebCore/svg/svgattrs.in
index 688f25034..c220b67b8 100644
--- a/Source/WebCore/svg/svgattrs.in
+++ b/Source/WebCore/svg/svgattrs.in
@@ -209,6 +209,7 @@ textLength
 title
 to
 transform
+transform-origin
 type
 u1
 u2
diff --git a/Source/WebCore/testing/InternalSettings.cpp b/Source/WebCore/testing/InternalSettings.cpp
index 2884e5661..87543824a 100644
--- a/Source/WebCore/testing/InternalSettings.cpp
+++ b/Source/WebCore/testing/InternalSettings.cpp
@@ -34,6 +34,7 @@
 #include "InspectorController.h"
 #include "Language.h"
 #include "Page.h"
+#include "RuntimeEnabledFeatures.h"
 #include "Settings.h"
 
 #if ENABLE(INPUT_COLOR)
@@ -79,27 +80,34 @@
 namespace WebCore {
 
 
-PassRefPtr<InternalSettings> InternalSettings::create(Frame* frame, InternalSettings* old)
+PassRefPtr<InternalSettings> InternalSettings::create(Frame* frame)
 {
-    return adoptRef(new InternalSettings(frame, old));
+    return adoptRef(new InternalSettings(frame));
 }
 
 InternalSettings::~InternalSettings()
 {
 }
 
-InternalSettings::InternalSettings(Frame* frame, InternalSettings* old)
+InternalSettings::InternalSettings(Frame* frame)
     : FrameDestructionObserver(frame)
-    , m_passwordEchoDurationInSecondsBackup(0)
-    , m_passwordEchoDurationInSecondsBackedUp(false)
-    , m_passwordEchoEnabledBackedUp(false)
-{
-    if (old && settings()) {
-        if (old->m_passwordEchoDurationInSecondsBackedUp)
-            settings()->setPasswordEchoDurationInSeconds(old->m_passwordEchoDurationInSecondsBackup);
-        if (old->m_passwordEchoEnabledBackedUp)
-            settings()->setPasswordEchoEnabled(old->m_passwordEchoEnabledBackup);
-    }
+    , m_originalPasswordEchoDurationInSeconds(settings()->passwordEchoDurationInSeconds())
+    , m_originalPasswordEchoEnabled(settings()->passwordEchoEnabled())
+#if ENABLE(SHADOW_DOM)
+    , m_originalShadowDOMEnabled(RuntimeEnabledFeatures::shadowDOMEnabled())
+#endif
+
+
+{
+}
+
+void InternalSettings::restoreTo(Settings* settings)
+{
+    settings->setPasswordEchoDurationInSeconds(m_originalPasswordEchoDurationInSeconds);
+    settings->setPasswordEchoEnabled(m_originalPasswordEchoEnabled);
+#if ENABLE(SHADOW_DOM)
+    RuntimeEnabledFeatures::setShadowDOMEnabled(m_originalShadowDOMEnabled);
+#endif
 }
 
 Settings* InternalSettings::settings() const
@@ -173,20 +181,12 @@ void InternalSettings::setMockScrollbarsEnabled(bool enabled, ExceptionCode& ec)
 void InternalSettings::setPasswordEchoEnabled(bool enabled, ExceptionCode& ec)
 {
     InternalSettingsGuardForSettings();
-    if (!m_passwordEchoEnabledBackedUp) {
-        m_passwordEchoEnabledBackup = settings()->passwordEchoEnabled();
-        m_passwordEchoEnabledBackedUp = true;
-    }
     settings()->setPasswordEchoEnabled(enabled);
 }
 
 void InternalSettings::setPasswordEchoDurationInSeconds(double durationInSeconds, ExceptionCode& ec)
 {
     InternalSettingsGuardForSettings();
-    if (!m_passwordEchoDurationInSecondsBackedUp) {
-        m_passwordEchoDurationInSecondsBackup = settings()->passwordEchoDurationInSeconds();
-        m_passwordEchoDurationInSecondsBackedUp = true;
-    }
     settings()->setPasswordEchoDurationInSeconds(durationInSeconds);
 }
 
@@ -220,6 +220,19 @@ void InternalSettings::setPerTileDrawingEnabled(bool enabled, ExceptionCode& ec)
     settings()->setPerTileDrawingEnabled(enabled);
 }
 
+void InternalSettings::setShadowDOMEnabled(bool enabled, ExceptionCode& ec)
+{
+#if ENABLE(SHADOW_DOM)
+    UNUSED_PARAM(ec);
+    RuntimeEnabledFeatures::setShadowDOMEnabled(enabled);
+#else
+    // Even SHADOW_DOM is off, InternalSettings allows setShadowDOMEnabled(false) to
+    // have broader test coverage. But it cannot be setShadowDOMEnabled(true).
+    if (enabled)
+        ec = INVALID_ACCESS_ERR;
+#endif
+}
+
 void InternalSettings::setTouchEventEmulationEnabled(bool enabled, ExceptionCode& ec)
 {
 #if ENABLE(TOUCH_EVENTS)
diff --git a/Source/WebCore/testing/InternalSettings.h b/Source/WebCore/testing/InternalSettings.h
index ef66c9959..a0bc0e820 100644
--- a/Source/WebCore/testing/InternalSettings.h
+++ b/Source/WebCore/testing/InternalSettings.h
@@ -43,7 +43,8 @@ class Settings;
 class InternalSettings : public RefCounted<InternalSettings>,
                          public FrameDestructionObserver {
 public:
-    static PassRefPtr<InternalSettings> create(Frame*, InternalSettings* old);
+    static PassRefPtr<InternalSettings> create(Frame*);
+
     virtual ~InternalSettings();
 
     void setInspectorResourcesDataSizeLimits(int maximumResourcesContentSize, int maximumSingleResourceContentSize, ExceptionCode&);
@@ -61,18 +62,22 @@ public:
     void setPageScaleFactor(float scaleFactor, int x, int y, ExceptionCode&);
     void setPerTileDrawingEnabled(bool enabled, ExceptionCode&);
     void setTouchEventEmulationEnabled(bool enabled, ExceptionCode&);
+    void setShadowDOMEnabled(bool enabled, ExceptionCode&);
+
+    void restoreTo(Settings*);
 
 private:
-    InternalSettings(Frame*, InternalSettings* old);
+    InternalSettings(Frame*);
 
     Settings* settings() const;
     Document* document() const;
     Page* page() const;
 
-    double m_passwordEchoDurationInSecondsBackup;
-    bool m_passwordEchoEnabledBackup : 1;
-    bool m_passwordEchoDurationInSecondsBackedUp : 1;
-    bool m_passwordEchoEnabledBackedUp : 1;
+    double m_originalPasswordEchoDurationInSeconds;
+    bool m_originalPasswordEchoEnabled;
+#if ENABLE(SHADOW_DOM)
+    bool m_originalShadowDOMEnabled;
+#endif
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/testing/InternalSettings.idl b/Source/WebCore/testing/InternalSettings.idl
index dd9519ec2..387b5b9ae 100644
--- a/Source/WebCore/testing/InternalSettings.idl
+++ b/Source/WebCore/testing/InternalSettings.idl
@@ -41,6 +41,7 @@ module window {
         boolean unifiedTextCheckingEnabled() raises (DOMException);
         void setPageScaleFactor(in float scaleFactor, in long x, in long y) raises(DOMException);
         void setTouchEventEmulationEnabled(in boolean enabled) raises(DOMException);
+        void setShadowDOMEnabled(in boolean enabled) raises(DOMException);
     };
 }
 
diff --git a/Source/WebCore/testing/Internals.cpp b/Source/WebCore/testing/Internals.cpp
index 84e9cf754..aafe9ade7 100644
--- a/Source/WebCore/testing/Internals.cpp
+++ b/Source/WebCore/testing/Internals.cpp
@@ -50,7 +50,7 @@
 #include "RenderTreeAsText.h"
 #include "Settings.h"
 #include "ShadowRoot.h"
-#include "ShadowRootList.h"
+#include "ShadowTree.h"
 #include "SpellChecker.h"
 #include "TextIterator.h"
 
@@ -119,6 +119,14 @@ Internals::Internals(Document* document)
     reset(document);
 }
 
+String Internals::address(Node* node)
+{
+    char buf[32];
+    sprintf(buf, "%p", node);
+
+    return String(buf);
+}
+
 bool Internals::isPreloaded(Document* document, const String& url)
 {
     if (!document)
@@ -146,14 +154,14 @@ Element* Internals::getElementByIdInShadowRoot(Node* shadowRoot, const String& i
     return toShadowRoot(shadowRoot)->getElementById(id);
 }
 
-bool Internals::isValidContentSelect(Element* contentElement, ExceptionCode& ec)
+bool Internals::isValidContentSelect(Element* insertionPoint, ExceptionCode& ec)
 {
-    if (!contentElement || !contentElement->isContentElement()) {
+    if (!insertionPoint || !isInsertionPoint(insertionPoint)) {
         ec = INVALID_ACCESS_ERR;
         return false;
     }
 
-    return toHTMLContentElement(contentElement)->isSelectValid();
+    return toInsertionPoint(insertionPoint)->isSelectValid();
 }
 
 bool Internals::attached(Node* node, ExceptionCode& ec)
@@ -203,7 +211,7 @@ Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::ensureShadowRoot(Eleme
     }
 
     if (host->hasShadowRoot())
-        return host->shadowRootList()->youngestShadowRoot();
+        return host->shadowTree()->youngestShadowRoot();
 
     return ShadowRoot::create(host, ec).get();
 }
@@ -225,7 +233,7 @@ Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::youngestShadowRoot(Ele
     if (!host->hasShadowRoot())
         return 0;
 
-    return host->shadowRootList()->youngestShadowRoot();
+    return host->shadowTree()->youngestShadowRoot();
 }
 
 Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::oldestShadowRoot(Element* host, ExceptionCode& ec)
@@ -238,7 +246,27 @@ Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::oldestShadowRoot(Eleme
     if (!host->hasShadowRoot())
         return 0;
 
-    return host->shadowRootList()->oldestShadowRoot();
+    return host->shadowTree()->oldestShadowRoot();
+}
+
+Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::youngerShadowRoot(Node* shadow, ExceptionCode& ec)
+{
+    if (!shadow || !shadow->isShadowRoot()) {
+        ec = INVALID_ACCESS_ERR;
+        return 0;
+    }
+
+    return toShadowRoot(shadow)->youngerShadowRoot();
+}
+
+Internals::ShadowRootIfShadowDOMEnabledOrNode* Internals::olderShadowRoot(Node* shadow, ExceptionCode& ec)
+{
+    if (!shadow || !shadow->isShadowRoot()) {
+        ec = INVALID_ACCESS_ERR;
+        return 0;
+    }
+
+    return toShadowRoot(shadow)->olderShadowRoot();
 }
 
 void Internals::removeShadowRoot(Element* host, ExceptionCode& ec)
@@ -248,7 +276,8 @@ void Internals::removeShadowRoot(Element* host, ExceptionCode& ec)
         return;
     }
 
-    host->removeShadowRoot();
+    if (host->hasShadowRoot())
+        host->shadowTree()->removeAllShadowRoots();
 }
 
 void Internals::setMultipleShadowSubtreesEnabled(bool enabled)
@@ -405,7 +434,10 @@ void Internals::reset(Document* document)
         return;
 
     observeFrame(document->frame());
-    m_settings = InternalSettings::create(document->frame(), m_settings.get());
+
+    if (m_settings)
+        m_settings->restoreTo(document->page()->settings());
+    m_settings = InternalSettings::create(document->frame());
     if (Page* page = document->page())
         page->setPagination(Page::Pagination());
 }
@@ -517,6 +549,16 @@ unsigned Internals::lengthFromRange(Element* scope, const Range* range, Exceptio
     return length;
 }
 
+String Internals::rangeAsText(const Range* range, ExceptionCode& ec)
+{
+    if (!range) {
+        ec = INVALID_ACCESS_ERR;
+        return String();
+    }
+
+    return range->text();
+}
+
 int Internals::lastSpellCheckRequestSequence(Document* document, ExceptionCode& ec)
 {
     SpellChecker* checker = spellchecker(document);
@@ -541,6 +583,16 @@ int Internals::lastSpellCheckProcessedSequence(Document* document, ExceptionCode
     return checker->lastProcessedSequence();
 }
 
+void Internals::setMediaPlaybackRequiresUserGesture(Document* document, bool enabled, ExceptionCode& ec)
+{
+    if (!document || !document->settings()) {
+        ec = INVALID_ACCESS_ERR;
+        return;
+    }
+
+    document->settings()->setMediaPlaybackRequiresUserGesture(enabled);
+}
+
 Vector<String> Internals::userPreferredLanguages() const
 {
     return WebCore::userPreferredLanguages();
diff --git a/Source/WebCore/testing/Internals.h b/Source/WebCore/testing/Internals.h
index ea2f8b8af..adaca34ed 100644
--- a/Source/WebCore/testing/Internals.h
+++ b/Source/WebCore/testing/Internals.h
@@ -55,6 +55,8 @@ public:
 
     String elementRenderTreeAsText(Element*, ExceptionCode&);
 
+    String address(Node*);
+
     bool isPreloaded(Document*, const String& url);
 
     size_t numberOfScopedHTMLStyleChildren(const Node*, ExceptionCode&) const;
@@ -68,13 +70,15 @@ public:
     ShadowRootIfShadowDOMEnabledOrNode* shadowRoot(Element* host, ExceptionCode&);
     ShadowRootIfShadowDOMEnabledOrNode* youngestShadowRoot(Element* host, ExceptionCode&);
     ShadowRootIfShadowDOMEnabledOrNode* oldestShadowRoot(Element* host, ExceptionCode&);
+    ShadowRootIfShadowDOMEnabledOrNode* youngerShadowRoot(Node* shadow, ExceptionCode&);
+    ShadowRootIfShadowDOMEnabledOrNode* olderShadowRoot(Node* shadow, ExceptionCode&);
     void removeShadowRoot(Element* host, ExceptionCode&);
     void setMultipleShadowSubtreesEnabled(bool);
     Element* includerFor(Node*, ExceptionCode&);
     String shadowPseudoId(Element*, ExceptionCode&);
     PassRefPtr<Element> createContentElement(Document*, ExceptionCode&);
     Element* getElementByIdInShadowRoot(Node* shadowRoot, const String& id, ExceptionCode&);
-    bool isValidContentSelect(Element* contentElement, ExceptionCode&);
+    bool isValidContentSelect(Element* insertionPoint, ExceptionCode&);
 
     bool attached(Node*, ExceptionCode&);
 
@@ -102,10 +106,13 @@ public:
     PassRefPtr<Range> rangeFromLocationAndLength(Element* scope, int rangeLocation, int rangeLength, ExceptionCode&);
     unsigned locationFromRange(Element* scope, const Range*, ExceptionCode&);
     unsigned lengthFromRange(Element* scope, const Range*, ExceptionCode&);
+    String rangeAsText(const Range*, ExceptionCode&);
 
     int lastSpellCheckRequestSequence(Document*, ExceptionCode&);
     int lastSpellCheckProcessedSequence(Document*, ExceptionCode&);
     
+    void setMediaPlaybackRequiresUserGesture(Document*, bool enabled, ExceptionCode&);
+
     Vector<String> userPreferredLanguages() const;
     void setUserPreferredLanguages(const Vector<String>&);
 
diff --git a/Source/WebCore/testing/Internals.idl b/Source/WebCore/testing/Internals.idl
index ba76d486d..394376e79 100644
--- a/Source/WebCore/testing/Internals.idl
+++ b/Source/WebCore/testing/Internals.idl
@@ -27,6 +27,8 @@ module window {
     interface [
         OmitConstructor
     ] Internals {
+        DOMString address(in Node node);
+
         DOMString elementRenderTreeAsText(in Element element) raises(DOMException);
         boolean isPreloaded(in Document document, in DOMString url);
 
@@ -37,11 +39,14 @@ module window {
         ShadowRoot shadowRoot(in Element host) raises (DOMException);
         ShadowRoot youngestShadowRoot(in Element host) raises (DOMException);
         ShadowRoot oldestShadowRoot(in Element host) raises (DOMException);
+        ShadowRoot youngerShadowRoot(in Node root) raises (DOMException);
+        ShadowRoot olderShadowRoot(in Node root) raises (DOMException);
 #else
         Node ensureShadowRoot(in Element host) raises (DOMException);
         Node shadowRoot(in Element host) raises (DOMException);
         Node youngestShadowRoot(in Element host) raises (DOMException);
         Node oldestShadowRoot(in Element host) raises (DOMException);
+        Node youngerShadowRoot(in Node root) raises (DOMException);
 #endif
         void setMultipleShadowSubtreesEnabled(in boolean enabled);
         Element includerFor(in Node node) raises (DOMException);
@@ -77,10 +82,13 @@ module window {
         Range rangeFromLocationAndLength(in Element scope, in long rangeLocation, in long rangeLength) raises (DOMException);
         unsigned long locationFromRange(in Element scope, in Range range) raises (DOMException);
         unsigned long lengthFromRange(in Element scope, in Range range) raises (DOMException);
+        DOMString rangeAsText(in Range range) raises (DOMException);
 
         long lastSpellCheckRequestSequence(in Document document) raises (DOMException);
         long lastSpellCheckProcessedSequence(in Document document) raises (DOMException);
 
+        void setMediaPlaybackRequiresUserGesture(in Document document, in boolean enabled) raises(DOMException);
+
 #if defined(ENABLE_VIDEO_TRACK) && ENABLE_VIDEO_TRACK
         void setShouldDisplayTrackKind(in Document document, in DOMString kind, in boolean enabled) raises (DOMException);
         boolean shouldDisplayTrackKind(in Document document, in DOMString trackKind) raises (DOMException);
diff --git a/Source/WebCore/webaudio/AudioBuffer.cpp b/Source/WebCore/webaudio/AudioBuffer.cpp
index 0515a34a2..0453fbc5d 100644
--- a/Source/WebCore/webaudio/AudioBuffer.cpp
+++ b/Source/WebCore/webaudio/AudioBuffer.cpp
@@ -33,6 +33,7 @@
 #include "AudioBuffer.h"
 
 #include "AudioBus.h"
+#include "AudioContext.h"
 #include "AudioFileReader.h"
 #include "ExceptionCode.h"
 #include <wtf/OwnPtr.h>
@@ -41,7 +42,7 @@ namespace WebCore {
 
 PassRefPtr<AudioBuffer> AudioBuffer::create(unsigned numberOfChannels, size_t numberOfFrames, float sampleRate)
 {
-    if (sampleRate < 22050 || sampleRate > 96000 || numberOfChannels > 10 || !numberOfFrames)
+    if (sampleRate < 22050 || sampleRate > 96000 || numberOfChannels > AudioContext::maxNumberOfChannels() || !numberOfFrames)
         return 0;
     
     return adoptRef(new AudioBuffer(numberOfChannels, numberOfFrames, sampleRate));
diff --git a/Source/WebCore/webaudio/AudioBufferSourceNode.cpp b/Source/WebCore/webaudio/AudioBufferSourceNode.cpp
index db9d3ed3b..4881131a4 100644
--- a/Source/WebCore/webaudio/AudioBufferSourceNode.cpp
+++ b/Source/WebCore/webaudio/AudioBufferSourceNode.cpp
@@ -126,6 +126,9 @@ void AudioBufferSourceNode::process(size_t framesToProcess)
         quantumFrameOffset = min(quantumFrameOffset, framesToProcess); // clamp to valid range
         size_t bufferFramesToProcess = framesToProcess - quantumFrameOffset;
 
+        for (unsigned i = 0; i < outputBus->numberOfChannels(); ++i) 
+            m_destinationChannels[i] = outputBus->channel(i)->mutableData();
+
         // Render by reading directly from the buffer.
         renderFromBuffer(outputBus, quantumFrameOffset, bufferFramesToProcess);
 
@@ -144,7 +147,7 @@ void AudioBufferSourceNode::process(size_t framesToProcess)
             
             if (isSafe) {
                 for (unsigned i = 0; i < outputBus->numberOfChannels(); ++i)
-                    memset(outputBus->channel(i)->mutableData() + zeroStartFrame, 0, sizeof(float) * framesToZero);
+                    memset(m_destinationChannels[i] + zeroStartFrame, 0, sizeof(float) * framesToZero);
             }
 
             m_isPlaying = false;
@@ -160,7 +163,7 @@ void AudioBufferSourceNode::process(size_t framesToProcess)
 }
 
 // Returns true if we're finished.
-bool AudioBufferSourceNode::renderSilenceAndFinishIfNotLooping(float* destinationL, float* destinationR, size_t framesToProcess)
+bool AudioBufferSourceNode::renderSilenceAndFinishIfNotLooping(AudioBus*, unsigned index, size_t framesToProcess)
 {
     if (!loop()) {
         // If we're not looping, then stop playing when we get to the end.
@@ -169,10 +172,8 @@ bool AudioBufferSourceNode::renderSilenceAndFinishIfNotLooping(float* destinatio
         if (framesToProcess > 0) {
             // We're not looping and we've reached the end of the sample data, but we still need to provide more output,
             // so generate silence for the remaining.
-            memset(destinationL, 0, sizeof(float) * framesToProcess);
-
-            if (destinationR)
-                memset(destinationR, 0, sizeof(float) * framesToProcess);
+            for (unsigned i = 0; i < numberOfChannels(); ++i) 
+                memset(m_destinationChannels[i] + index, 0, sizeof(float) * framesToProcess);
         }
 
         finish();
@@ -194,21 +195,11 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
     unsigned numberOfChannels = this->numberOfChannels();
     unsigned busNumberOfChannels = bus->numberOfChannels();
 
-    // FIXME: we can add support for sources with more than two channels, but this is not a common case.
-    bool channelCountGood = numberOfChannels == busNumberOfChannels && (numberOfChannels == 1 || numberOfChannels == 2);
+    bool channelCountGood = numberOfChannels && numberOfChannels == busNumberOfChannels;
     ASSERT(channelCountGood);
     if (!channelCountGood)
         return;
 
-    // Get the destination pointers.
-    float* destinationL = bus->channel(0)->mutableData();
-    ASSERT(destinationL);
-    if (!destinationL)
-        return;
-    float* destinationR = (numberOfChannels < 2) ? 0 : bus->channel(1)->mutableData();
-    
-    bool isStereo = destinationR;
-    
     // Sanity check destinationFrameOffset, numberOfFrames.
     size_t destinationLength = bus->length();
 
@@ -221,18 +212,15 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
     ASSERT(isOffsetGood);
     if (!isOffsetGood)
         return;
-        
+
     // Potentially zero out initial frames leading up to the offset.
     if (destinationFrameOffset) {
-        memset(destinationL, 0, sizeof(float) * destinationFrameOffset);
-        if (destinationR)
-            memset(destinationR, 0, sizeof(float) * destinationFrameOffset);
+        for (unsigned i = 0; i < numberOfChannels; ++i) 
+            memset(m_destinationChannels[i], 0, sizeof(float) * destinationFrameOffset);
     }
 
     // Offset the pointers to the correct offset frame.
-    destinationL += destinationFrameOffset;
-    if (destinationR)
-        destinationR += destinationFrameOffset;
+    unsigned writeIndex = destinationFrameOffset;
 
     size_t bufferLength = buffer()->length();
     double bufferSampleRate = buffer()->sampleRate();
@@ -264,10 +252,6 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
     if (m_virtualReadIndex >= endFrame)
         m_virtualReadIndex = startFrame; // reset to start
 
-    // Get pointers to the start of the sample buffer.
-    float* sourceL = m_buffer->getChannelData(0)->data();
-    float* sourceR = m_buffer->numberOfChannels() == 2 ? m_buffer->getChannelData(1)->data() : 0;
-    
     double pitchRate = totalPitchRate();
 
     // Get local copy.
@@ -276,6 +260,9 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
     // Render loop - reading from the source buffer to the destination using linear interpolation.
     int framesToProcess = numberOfFrames;
 
+    const float** sourceChannels = m_sourceChannels.get();
+    float** destinationChannels = m_destinationChannels.get();
+
     // Optimize for the very common case of playing back with pitchRate == 1.
     // We can avoid the linear interpolation.
     if (pitchRate == 1 && virtualReadIndex == floor(virtualReadIndex)) {
@@ -285,20 +272,17 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
             int framesThisTime = min(framesToProcess, framesToEnd);
             framesThisTime = max(0, framesThisTime);
 
-            memcpy(destinationL, sourceL + readIndex, sizeof(*sourceL) * framesThisTime);
-            destinationL += framesThisTime;
-            if (isStereo) {
-                memcpy(destinationR, sourceR + readIndex, sizeof(*sourceR) * framesThisTime);
-                destinationR += framesThisTime;
-            }
+            for (unsigned i = 0; i < numberOfChannels; ++i) 
+                memcpy(destinationChannels[i] + writeIndex, sourceChannels[i] + readIndex, sizeof(float) * framesThisTime);
 
+            writeIndex += framesThisTime;
             readIndex += framesThisTime;
             framesToProcess -= framesThisTime;
 
             // Wrap-around.
             if (readIndex >= endFrame) {
                 readIndex -= deltaFrames;
-                if (renderSilenceAndFinishIfNotLooping(destinationL, destinationR, framesToProcess))
+                if (renderSilenceAndFinishIfNotLooping(bus, writeIndex, framesToProcess))
                     break;
             }
         }
@@ -324,17 +308,17 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
                 break;
 
             // Linear interpolation.
-            double sampleL1 = sourceL[readIndex];
-            double sampleL2 = sourceL[readIndex2];
-            double sampleL = (1.0 - interpolationFactor) * sampleL1 + interpolationFactor * sampleL2;
-            *destinationL++ = narrowPrecisionToFloat(sampleL);
-
-            if (isStereo) {
-                double sampleR1 = sourceR[readIndex];
-                double sampleR2 = sourceR[readIndex2];
-                double sampleR = (1.0 - interpolationFactor) * sampleR1 + interpolationFactor * sampleR2;
-                *destinationR++ = narrowPrecisionToFloat(sampleR);
+            for (unsigned i = 0; i < numberOfChannels; ++i) {
+                float* destination = destinationChannels[i];
+                const float* source = sourceChannels[i];
+
+                double sample1 = source[readIndex];
+                double sample2 = source[readIndex2];
+                double sample = (1.0 - interpolationFactor) * sample1 + interpolationFactor * sample2;
+
+                destination[writeIndex] = narrowPrecisionToFloat(sample);
             }
+            writeIndex++;
 
             virtualReadIndex += pitchRate;
 
@@ -342,7 +326,7 @@ void AudioBufferSourceNode::renderFromBuffer(AudioBus* bus, unsigned destination
             if (virtualReadIndex >= endFrame) {
                 virtualReadIndex -= deltaFrames;
 
-                if (renderSilenceAndFinishIfNotLooping(destinationL, destinationR, framesToProcess))
+                if (renderSilenceAndFinishIfNotLooping(bus, writeIndex, framesToProcess))
                     break;
             }
         }
@@ -379,11 +363,17 @@ bool AudioBufferSourceNode::setBuffer(AudioBuffer* buffer)
     if (buffer) {
         // Do any necesssary re-configuration to the buffer's number of channels.
         unsigned numberOfChannels = buffer->numberOfChannels();
-        if (!numberOfChannels || numberOfChannels > 2) {
-            // FIXME: implement multi-channel greater than stereo.
+
+        if (numberOfChannels > AudioContext::maxNumberOfChannels())
             return false;
-        }
+
         output(0)->setNumberOfChannels(numberOfChannels);
+
+        m_sourceChannels = adoptArrayPtr(new const float* [numberOfChannels]);
+        m_destinationChannels = adoptArrayPtr(new float* [numberOfChannels]);
+
+        for (unsigned i = 0; i < numberOfChannels; ++i) 
+            m_sourceChannels[i] = buffer->getChannelData(i)->data();
     }
 
     m_virtualReadIndex = 0;
diff --git a/Source/WebCore/webaudio/AudioBufferSourceNode.h b/Source/WebCore/webaudio/AudioBufferSourceNode.h
index 49091c017..5ac54c60a 100644
--- a/Source/WebCore/webaudio/AudioBufferSourceNode.h
+++ b/Source/WebCore/webaudio/AudioBufferSourceNode.h
@@ -30,6 +30,7 @@
 #include "AudioGain.h"
 #include "AudioPannerNode.h"
 #include "AudioSourceNode.h"
+#include <wtf/OwnArrayPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Threading.h>
@@ -87,11 +88,16 @@ private:
 
     void renderFromBuffer(AudioBus*, unsigned destinationFrameOffset, size_t numberOfFrames);
 
-    inline bool renderSilenceAndFinishIfNotLooping(float* destinationL, float* destinationR, size_t framesToProcess);
+    // Render silence starting from "index" frame in AudioBus.
+    inline bool renderSilenceAndFinishIfNotLooping(AudioBus*, unsigned index, size_t framesToProcess);
 
     // m_buffer holds the sample data which this node outputs.
     RefPtr<AudioBuffer> m_buffer;
 
+    // Pointers for the buffer and destination.
+    OwnArrayPtr<const float*> m_sourceChannels;
+    OwnArrayPtr<float*> m_destinationChannels;
+
     // Used for the "gain" and "playbackRate" attributes.
     RefPtr<AudioGain> m_gain;
     RefPtr<AudioParam> m_playbackRate;
diff --git a/Source/WebCore/webaudio/AudioContext.cpp b/Source/WebCore/webaudio/AudioContext.cpp
index afc81130b..5f4905a3b 100644
--- a/Source/WebCore/webaudio/AudioContext.cpp
+++ b/Source/WebCore/webaudio/AudioContext.cpp
@@ -445,9 +445,15 @@ PassRefPtr<AudioGainNode> AudioContext::createGainNode()
 
 PassRefPtr<DelayNode> AudioContext::createDelayNode()
 {
+    const double defaultMaxDelayTime = 1;
+    return createDelayNode(defaultMaxDelayTime);
+}
+
+PassRefPtr<DelayNode> AudioContext::createDelayNode(double maxDelayTime)
+{
     ASSERT(isMainThread());
     lazyInitialize();
-    return DelayNode::create(this, m_destinationNode->sampleRate());
+    return DelayNode::create(this, m_destinationNode->sampleRate(), maxDelayTime);
 }
 
 PassRefPtr<AudioChannelSplitter> AudioContext::createChannelSplitter()
diff --git a/Source/WebCore/webaudio/AudioContext.h b/Source/WebCore/webaudio/AudioContext.h
index 7911519b3..b42a075f2 100644
--- a/Source/WebCore/webaudio/AudioContext.h
+++ b/Source/WebCore/webaudio/AudioContext.h
@@ -114,6 +114,7 @@ public:
     PassRefPtr<BiquadFilterNode> createBiquadFilter();
     PassRefPtr<WaveShaperNode> createWaveShaper();
     PassRefPtr<DelayNode> createDelayNode();
+    PassRefPtr<DelayNode> createDelayNode(double maxDelayTime);
     PassRefPtr<LowPass2FilterNode> createLowPass2Filter();
     PassRefPtr<HighPass2FilterNode> createHighPass2Filter();
     PassRefPtr<AudioPannerNode> createPanner();
@@ -172,6 +173,9 @@ public:
     // Returns true if this thread owns the context's lock.
     bool isGraphOwner() const;
 
+    // Returns the maximum numuber of channels we can support.
+    static unsigned maxNumberOfChannels() { return MaxNumberOfChannels;}
+
     class AutoLocker {
     public:
         AutoLocker(AudioContext* context)
@@ -303,6 +307,11 @@ private:
     bool m_isOfflineContext;
 
     AsyncAudioDecoder m_audioDecoder;
+
+    // This is considering 32 is large enough for multiple channels audio. 
+    // It is somewhat arbitrary and could be increased if necessary.
+    enum { MaxNumberOfChannels = 32 };
+
 };
 
 } // WebCore
diff --git a/Source/WebCore/webaudio/AudioContext.idl b/Source/WebCore/webaudio/AudioContext.idl
index ef6935526..c1ff8c6e7 100644
--- a/Source/WebCore/webaudio/AudioContext.idl
+++ b/Source/WebCore/webaudio/AudioContext.idl
@@ -28,10 +28,9 @@ module webaudio {
         Conditional=WEB_AUDIO,
         ActiveDOMObject,
         CustomConstructor,
+        ConstructorParameters=0,
         JSCustomMarkFunction,
-#if defined(V8_BINDING) && V8_BINDING
         EventTarget
-#endif        
     ] AudioContext {
         // All rendered audio ultimately connects to destination, which represents the audio hardware.
         readonly attribute AudioDestinationNode destination;
@@ -62,7 +61,7 @@ module webaudio {
 #endif
         // Processing nodes
         AudioGainNode createGainNode();
-        DelayNode createDelayNode();
+        DelayNode createDelayNode(in [Optional] double maxDelayTime);
         BiquadFilterNode createBiquadFilter();
         WaveShaperNode createWaveShaper();
         LowPass2FilterNode createLowPass2Filter();
diff --git a/Source/WebCore/webaudio/AudioNodeOutput.cpp b/Source/WebCore/webaudio/AudioNodeOutput.cpp
index e7176b6ec..77927b988 100644
--- a/Source/WebCore/webaudio/AudioNodeOutput.cpp
+++ b/Source/WebCore/webaudio/AudioNodeOutput.cpp
@@ -35,10 +35,6 @@
 
 namespace WebCore {
 
-// This is considering that 5.1 (6 channels) is the largest we'll ever deal with.
-// It can easily be increased to support more if the web audio specification is updated.
-const unsigned MaxNumberOfChannels = 6;
-
 AudioNodeOutput::AudioNodeOutput(AudioNode* node, unsigned numberOfChannels)
     : m_node(node)
     , m_numberOfChannels(numberOfChannels)
@@ -47,7 +43,7 @@ AudioNodeOutput::AudioNodeOutput(AudioNode* node, unsigned numberOfChannels)
     , m_isEnabled(true)
     , m_renderingFanOutCount(0)
 {
-    ASSERT(numberOfChannels <= MaxNumberOfChannels);
+    ASSERT(numberOfChannels <= AudioContext::maxNumberOfChannels());
 
     m_internalBus = adoptPtr(new AudioBus(numberOfChannels, AudioNode::ProcessingSizeInFrames));
     m_actualDestinationBus = m_internalBus.get();
@@ -55,7 +51,7 @@ AudioNodeOutput::AudioNodeOutput(AudioNode* node, unsigned numberOfChannels)
 
 void AudioNodeOutput::setNumberOfChannels(unsigned numberOfChannels)
 {
-    ASSERT(numberOfChannels <= MaxNumberOfChannels);
+    ASSERT(numberOfChannels <= AudioContext::maxNumberOfChannels());
     ASSERT(context()->isGraphOwner());
 
     m_desiredNumberOfChannels = numberOfChannels;
diff --git a/Source/WebCore/webaudio/AudioParamTimeline.cpp b/Source/WebCore/webaudio/AudioParamTimeline.cpp
index cd8f53676..63c2bb639 100644
--- a/Source/WebCore/webaudio/AudioParamTimeline.cpp
+++ b/Source/WebCore/webaudio/AudioParamTimeline.cpp
@@ -279,7 +279,7 @@ float AudioParamTimeline::valuesForTimeRangeImpl(float startTime,
                     // Exponential approach to target value with given time constant.
                     float targetValue = event.value();
                     float timeConstant = event.timeConstant();
-                    float discreteTimeConstant = AudioUtilities::discreteTimeConstantForSampleRate(timeConstant, controlRate);
+                    float discreteTimeConstant = static_cast<float>(AudioUtilities::discreteTimeConstantForSampleRate(timeConstant, controlRate));
 
                     for (; writeIndex < fillToFrame; ++writeIndex) {
                         values[writeIndex] = value;
@@ -329,7 +329,10 @@ float AudioParamTimeline::valuesForTimeRangeImpl(float startTime,
                     // Render the stretched curve data using nearest neighbor sampling.
                     // Oversampled curve data can be provided if smoothness is desired.
                     for (; writeIndex < fillToFrame; ++writeIndex) {
-                        unsigned curveIndex = static_cast<unsigned>(curveVirtualIndex);
+                        // Ideally we'd use round() from MathExtras, but we're in a tight loop here
+                        // and we're trading off precision for extra speed.
+                        unsigned curveIndex = static_cast<unsigned>(0.5 + curveVirtualIndex);
+
                         curveVirtualIndex += curvePointsPerFrame;
 
                         // Bounds check.
diff --git a/Source/WebCore/webaudio/DOMWindowWebAudio.idl b/Source/WebCore/webaudio/DOMWindowWebAudio.idl
index f17198f4b..ca8e50e5f 100644
--- a/Source/WebCore/webaudio/DOMWindowWebAudio.idl
+++ b/Source/WebCore/webaudio/DOMWindowWebAudio.idl
@@ -1,20 +1,27 @@
 /*
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 module window {
diff --git a/Source/WebCore/webaudio/DelayDSPKernel.cpp b/Source/WebCore/webaudio/DelayDSPKernel.cpp
index aeda189c5..fb31e2ddd 100644
--- a/Source/WebCore/webaudio/DelayDSPKernel.cpp
+++ b/Source/WebCore/webaudio/DelayDSPKernel.cpp
@@ -32,15 +32,13 @@
 #include <algorithm>
 
 using namespace std;
-  
-const float DefaultMaxDelayTime = 1;
+
 const float SmoothingTimeConstant = 0.020f; // 20ms
   
 namespace WebCore {
 
 DelayDSPKernel::DelayDSPKernel(DelayProcessor* processor)
     : AudioDSPKernel(processor)
-    , m_maxDelayTime(DefaultMaxDelayTime)
     , m_writeIndex(0)
     , m_firstTime(true)
 {
@@ -48,7 +46,8 @@ DelayDSPKernel::DelayDSPKernel(DelayProcessor* processor)
     if (!processor)
         return;
 
-    m_buffer.allocate(static_cast<size_t>(processor->sampleRate() * DefaultMaxDelayTime));
+    m_maxDelayTime = processor->maxDelayTime();
+    m_buffer.allocate(static_cast<size_t>(processor->sampleRate() * m_maxDelayTime));
     m_buffer.zero();
 
     m_smoothingRate = AudioUtilities::discreteTimeConstantForSampleRate(SmoothingTimeConstant, processor->sampleRate());
diff --git a/Source/WebCore/webaudio/DelayNode.cpp b/Source/WebCore/webaudio/DelayNode.cpp
index 2a525dd1a..59341abf5 100644
--- a/Source/WebCore/webaudio/DelayNode.cpp
+++ b/Source/WebCore/webaudio/DelayNode.cpp
@@ -30,10 +30,10 @@
 
 namespace WebCore {
 
-DelayNode::DelayNode(AudioContext* context, float sampleRate)
+DelayNode::DelayNode(AudioContext* context, float sampleRate, double maxDelayTime)
     : AudioBasicProcessorNode(context, sampleRate)
 {
-    m_processor = adoptPtr(new DelayProcessor(sampleRate, 1));    
+    m_processor = adoptPtr(new DelayProcessor(sampleRate, 1, maxDelayTime));
     delayTime()->setContext(context);
     setNodeType(NodeTypeDelay);
 }
diff --git a/Source/WebCore/webaudio/DelayNode.h b/Source/WebCore/webaudio/DelayNode.h
index 3d58a8913..92b1e0562 100644
--- a/Source/WebCore/webaudio/DelayNode.h
+++ b/Source/WebCore/webaudio/DelayNode.h
@@ -35,15 +35,15 @@ class AudioParam;
 
 class DelayNode : public AudioBasicProcessorNode {
 public:
-    static PassRefPtr<DelayNode> create(AudioContext* context, float sampleRate)
+    static PassRefPtr<DelayNode> create(AudioContext* context, float sampleRate, double maxDelayTime)
     {
-        return adoptRef(new DelayNode(context, sampleRate));      
+        return adoptRef(new DelayNode(context, sampleRate, maxDelayTime));      
     }
 
     AudioParam* delayTime();
 
 private:
-    DelayNode(AudioContext*, float sampleRate);
+    DelayNode(AudioContext*, float sampleRate, double maxDelayTime);
 
     DelayProcessor* delayProcessor() { return static_cast<DelayProcessor*>(processor()); }
 };
diff --git a/Source/WebCore/webaudio/DelayProcessor.cpp b/Source/WebCore/webaudio/DelayProcessor.cpp
index 8ed3e4337..b23e8ac1d 100644
--- a/Source/WebCore/webaudio/DelayProcessor.cpp
+++ b/Source/WebCore/webaudio/DelayProcessor.cpp
@@ -32,10 +32,11 @@
 
 namespace WebCore {
 
-DelayProcessor::DelayProcessor(float sampleRate, unsigned numberOfChannels)
+DelayProcessor::DelayProcessor(float sampleRate, unsigned numberOfChannels, double maxDelayTime)
     : AudioDSPKernelProcessor(sampleRate, numberOfChannels)
+    , m_maxDelayTime(maxDelayTime)
 {
-    m_delayTime = AudioParam::create("delayTime", 0.0, 0.0, 1.0);
+    m_delayTime = AudioParam::create("delayTime", 0.0, 0.0, maxDelayTime);
 }
 
 DelayProcessor::~DelayProcessor()
diff --git a/Source/WebCore/webaudio/DelayProcessor.h b/Source/WebCore/webaudio/DelayProcessor.h
index 15428ce75..43c5e0cbe 100644
--- a/Source/WebCore/webaudio/DelayProcessor.h
+++ b/Source/WebCore/webaudio/DelayProcessor.h
@@ -37,15 +37,17 @@ class AudioDSPKernel;
     
 class DelayProcessor : public AudioDSPKernelProcessor {
 public:
-    DelayProcessor(float sampleRate, unsigned numberOfChannels);
+    DelayProcessor(float sampleRate, unsigned numberOfChannels, double maxDelayTime);
     virtual ~DelayProcessor();
     
     virtual PassOwnPtr<AudioDSPKernel> createKernel();
         
     AudioParam* delayTime() const { return m_delayTime.get(); }
 
+    double maxDelayTime() { return m_maxDelayTime; }
 private:
     RefPtr<AudioParam> m_delayTime;
+    double m_maxDelayTime;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/webaudio/DynamicsCompressorNode.cpp b/Source/WebCore/webaudio/DynamicsCompressorNode.cpp
index 263755595..5afe2d683 100644
--- a/Source/WebCore/webaudio/DynamicsCompressorNode.cpp
+++ b/Source/WebCore/webaudio/DynamicsCompressorNode.cpp
@@ -43,9 +43,19 @@ DynamicsCompressorNode::DynamicsCompressorNode(AudioContext* context, float samp
 {
     addInput(adoptPtr(new AudioNodeInput(this)));
     addOutput(adoptPtr(new AudioNodeOutput(this, defaultNumberOfOutputChannels)));
-    
+
     setNodeType(NodeTypeDynamicsCompressor);
-    
+
+    m_threshold = AudioParam::create("threshold", -24, -100, 0);
+    m_knee = AudioParam::create("knee", 30, 0, 40);
+    m_ratio = AudioParam::create("ratio", 12, 1, 20);
+    m_reduction = AudioParam::create("reduction", 0, -20, 0);
+
+    m_threshold->setContext(context);
+    m_knee->setContext(context);
+    m_ratio->setContext(context);
+    m_reduction->setContext(context);
+
     initialize();
 }
 
@@ -59,7 +69,18 @@ void DynamicsCompressorNode::process(size_t framesToProcess)
     AudioBus* outputBus = output(0)->bus();
     ASSERT(outputBus);
 
+    float threshold = m_threshold->value();
+    float knee = m_knee->value();
+    float ratio = m_ratio->value();
+
+    m_dynamicsCompressor->setParameterValue(DynamicsCompressor::ParamThreshold, threshold);
+    m_dynamicsCompressor->setParameterValue(DynamicsCompressor::ParamKnee, knee);
+    m_dynamicsCompressor->setParameterValue(DynamicsCompressor::ParamRatio, ratio);
+
     m_dynamicsCompressor->process(input(0)->bus(), outputBus, framesToProcess);
+
+    float reduction = m_dynamicsCompressor->parameterValue(DynamicsCompressor::ParamReduction);
+    m_reduction->setValue(reduction);
 }
 
 void DynamicsCompressorNode::reset()
diff --git a/Source/WebCore/webaudio/DynamicsCompressorNode.h b/Source/WebCore/webaudio/DynamicsCompressorNode.h
index d718ab341..32d3cb173 100644
--- a/Source/WebCore/webaudio/DynamicsCompressorNode.h
+++ b/Source/WebCore/webaudio/DynamicsCompressorNode.h
@@ -26,31 +26,44 @@
 #define DynamicsCompressorNode_h
 
 #include "AudioNode.h"
+#include "AudioParam.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
 class DynamicsCompressor;
-    
+
 class DynamicsCompressorNode : public AudioNode {
 public:
     static PassRefPtr<DynamicsCompressorNode> create(AudioContext* context, float sampleRate)
     {
-        return adoptRef(new DynamicsCompressorNode(context, sampleRate));      
+        return adoptRef(new DynamicsCompressorNode(context, sampleRate));
     }
-    
+
     virtual ~DynamicsCompressorNode();
-    
+
     // AudioNode
     virtual void process(size_t framesToProcess);
     virtual void reset();
     virtual void initialize();
     virtual void uninitialize();
 
+    // Static compression curve parameters.
+    AudioParam* threshold() { return m_threshold.get(); }
+    AudioParam* knee() { return m_knee.get(); }
+    AudioParam* ratio() { return m_ratio.get(); }
+
+    // Amount by which the compressor is currently compressing the signal in decibels.
+    AudioParam* reduction() { return m_reduction.get(); }
+
 private:
     DynamicsCompressorNode(AudioContext*, float sampleRate);
 
     OwnPtr<DynamicsCompressor> m_dynamicsCompressor;
+    RefPtr<AudioParam> m_threshold;
+    RefPtr<AudioParam> m_knee;
+    RefPtr<AudioParam> m_ratio;
+    RefPtr<AudioParam> m_reduction;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/webaudio/DynamicsCompressorNode.idl b/Source/WebCore/webaudio/DynamicsCompressorNode.idl
index faad13e3c..60d64fda0 100644
--- a/Source/WebCore/webaudio/DynamicsCompressorNode.idl
+++ b/Source/WebCore/webaudio/DynamicsCompressorNode.idl
@@ -27,5 +27,9 @@ module audio {
         Conditional=WEB_AUDIO,
         JSGenerateToJSObject
     ] DynamicsCompressorNode : AudioNode {
+        readonly attribute AudioParam threshold; // in Decibels
+        readonly attribute AudioParam knee; // in Decibels
+        readonly attribute AudioParam ratio; // unit-less
+        readonly attribute AudioParam reduction; // in Decibels
     };
 }
diff --git a/Source/WebCore/webaudio/JavaScriptAudioNode.idl b/Source/WebCore/webaudio/JavaScriptAudioNode.idl
index 83e3e6285..97da0c16d 100644
--- a/Source/WebCore/webaudio/JavaScriptAudioNode.idl
+++ b/Source/WebCore/webaudio/JavaScriptAudioNode.idl
@@ -28,9 +28,7 @@ module audio {
         Conditional=WEB_AUDIO,
         JSGenerateToJSObject,
         JSCustomMarkFunction,
-#if defined(V8_BINDING) && V8_BINDING
         EventTarget
-#endif
     ] JavaScriptAudioNode : AudioNode {
         // Rendering callback
         attribute EventListener onaudioprocess;
diff --git a/Source/WebCore/workers/DOMWindowWorker.idl b/Source/WebCore/workers/DOMWindowWorker.idl
deleted file mode 100644
index 80bb93a39..000000000
--- a/Source/WebCore/workers/DOMWindowWorker.idl
+++ /dev/null
@@ -1,29 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-module window {
-
-    interface [
-        Supplemental=DOMWindow
-    ] DOMWindowWorker {
-        attribute [Conditional=WORKERS] WorkerConstructor Worker; // Usable with the new operator
-        attribute [Conditional=SHARED_WORKERS, JSCustomGetter, V8EnabledAtRuntime] SharedWorkerConstructor SharedWorker; // Usable with the new operator
-    };
-
-}
diff --git a/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp b/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp
index 4ae30e4e3..773ccd95d 100644
--- a/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp
+++ b/Source/WebCore/workers/DefaultSharedWorkerRepository.cpp
@@ -298,7 +298,7 @@ void SharedWorkerScriptLoader::load(const KURL& url)
 
     // Mark this object as active for the duration of the load.
     m_scriptLoader = WorkerScriptLoader::create();
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
     m_scriptLoader->setTargetType(ResourceRequest::TargetIsSharedWorker);
 #endif
     m_scriptLoader->loadAsynchronously(m_worker->scriptExecutionContext(), url, DenyCrossOriginRequests, this);
diff --git a/Source/WebCore/workers/SharedWorker.idl b/Source/WebCore/workers/SharedWorker.idl
index d2152720e..40ccdd403 100644
--- a/Source/WebCore/workers/SharedWorker.idl
+++ b/Source/WebCore/workers/SharedWorker.idl
@@ -35,7 +35,6 @@ module threads {
         Conditional=SHARED_WORKERS,
         ActiveDOMObject,
         JSCustomConstructor,
-        ConstructorParameters=2,
         Constructor(in DOMString scriptURL, in [Optional=DefaultIsNullString] DOMString name),
         CallWith=ScriptExecutionContext,
         ConstructorRaisesException,
diff --git a/Source/WebCore/workers/Worker.cpp b/Source/WebCore/workers/Worker.cpp
index ec965a4e7..1d440f548 100644
--- a/Source/WebCore/workers/Worker.cpp
+++ b/Source/WebCore/workers/Worker.cpp
@@ -70,7 +70,7 @@ PassRefPtr<Worker> Worker::create(ScriptExecutionContext* context, const String&
     worker->setPendingActivity(worker.get());
 
     worker->m_scriptLoader = WorkerScriptLoader::create();
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
     worker->m_scriptLoader->setTargetType(ResourceRequest::TargetIsWorker);
 #endif
     worker->m_scriptLoader->loadAsynchronously(context, scriptURL, DenyCrossOriginRequests, worker.get());
diff --git a/Source/WebCore/workers/Worker.idl b/Source/WebCore/workers/Worker.idl
index 867d36710..083353c04 100644
--- a/Source/WebCore/workers/Worker.idl
+++ b/Source/WebCore/workers/Worker.idl
@@ -31,7 +31,6 @@ module threads {
         Conditional=WORKERS,
         ActiveDOMObject,
         JSCustomConstructor,
-        ConstructorParameters=1,
         Constructor(in DOMString scriptUrl),
         CallWith=ScriptExecutionContext,
         ConstructorRaisesException,
diff --git a/Source/WebCore/workers/WorkerContext.cpp b/Source/WebCore/workers/WorkerContext.cpp
index 0d68c4d65..debbeba3f 100644
--- a/Source/WebCore/workers/WorkerContext.cpp
+++ b/Source/WebCore/workers/WorkerContext.cpp
@@ -31,13 +31,8 @@
 
 #include "WorkerContext.h"
 
-#include "AbstractDatabase.h"
 #include "ActiveDOMObject.h"
 #include "ContentSecurityPolicy.h"
-#include "Database.h"
-#include "DatabaseCallback.h"
-#include "DatabaseSync.h"
-#include "DatabaseTracker.h"
 #include "DOMTimer.h"
 #include "DOMURL.h"
 #include "DOMWindow.h"
@@ -68,25 +63,7 @@
 #include "NotificationCenter.h"
 #endif
 
-#if ENABLE(FILE_SYSTEM)
-#include "AsyncFileSystem.h"
-#include "DirectoryEntrySync.h"
-#include "DOMFileSystem.h"
-#include "DOMFileSystemBase.h"
-#include "DOMFileSystemSync.h"
-#include "ErrorCallback.h"
-#include "FileEntrySync.h"
-#include "FileError.h"
-#include "FileException.h"
-#include "FileSystemCallback.h"
-#include "FileSystemCallbacks.h"
-#include "LocalFileSystem.h"
-#include "SyncCallbackHelper.h"
-#else
 #include "ExceptionCode.h"
-#endif
-
-#include "IDBFactory.h"
 
 namespace WebCore {
 
@@ -266,7 +243,7 @@ void WorkerContext::importScripts(const Vector<String>& urls, ExceptionCode& ec)
 
     for (Vector<KURL>::const_iterator it = completedURLs.begin(); it != end; ++it) {
         RefPtr<WorkerScriptLoader> scriptLoader(WorkerScriptLoader::create());
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
         scriptLoader->setTargetType(ResourceRequest::TargetIsScript);
 #endif
         scriptLoader->loadSynchronously(scriptExecutionContext(), *it, AllowCrossOriginRequests);
@@ -321,42 +298,11 @@ void WorkerContext::addMessageToWorkerConsole(MessageSource source, MessageType
 NotificationCenter* WorkerContext::webkitNotifications() const
 {
     if (!m_notifications)
-        m_notifications = NotificationCenter::create(scriptExecutionContext(), m_thread->getNotificationPresenter());
+        m_notifications = NotificationCenter::create(scriptExecutionContext(), m_thread->getNotificationClient());
     return m_notifications.get();
 }
 #endif
 
-#if ENABLE(SQL_DATABASE)
-PassRefPtr<Database> WorkerContext::openDatabase(const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode& ec)
-{
-    if (!securityOrigin()->canAccessDatabase() || !AbstractDatabase::isAvailable()) {
-        ec = SECURITY_ERR;
-        return 0;
-    }
-
-    return Database::openDatabase(this, name, version, displayName, estimatedSize, creationCallback, ec);
-}
-
-void WorkerContext::databaseExceededQuota(const String&)
-{
-#if !PLATFORM(CHROMIUM)
-    // FIXME: This needs a real implementation; this is a temporary solution for testing.
-    const unsigned long long defaultQuota = 5 * 1024 * 1024;
-    DatabaseTracker::tracker().setQuota(securityOrigin(), defaultQuota);
-#endif
-}
-
-PassRefPtr<DatabaseSync> WorkerContext::openDatabaseSync(const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode& ec)
-{
-    if (!securityOrigin()->canAccessDatabase() || !AbstractDatabase::isAvailable()) {
-        ec = SECURITY_ERR;
-        return 0;
-    }
-
-    return DatabaseSync::openDatabaseSync(this, name, version, displayName, estimatedSize, creationCallback, ec);
-}
-#endif
-
 bool WorkerContext::isContextThread() const
 {
     return currentThread() == thread()->threadID();
@@ -377,93 +323,6 @@ EventTargetData* WorkerContext::ensureEventTargetData()
     return &m_eventTargetData;
 }
 
-#if ENABLE(FILE_SYSTEM)
-void WorkerContext::webkitRequestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
-{
-    if (!AsyncFileSystem::isAvailable() || !securityOrigin()->canAccessFileSystem()) {
-        DOMFileSystem::scheduleCallback(this, errorCallback, FileError::create(FileError::SECURITY_ERR));
-        return;
-    }
-
-    AsyncFileSystem::Type fileSystemType = static_cast<AsyncFileSystem::Type>(type);
-    if (!AsyncFileSystem::isValidType(fileSystemType)) {
-        DOMFileSystem::scheduleCallback(this, errorCallback, FileError::create(FileError::INVALID_MODIFICATION_ERR));
-        return;
-    }
-
-    LocalFileSystem::localFileSystem().requestFileSystem(this, fileSystemType, size, FileSystemCallbacks::create(successCallback, errorCallback, this), false);
-}
-
-PassRefPtr<DOMFileSystemSync> WorkerContext::webkitRequestFileSystemSync(int type, long long size, ExceptionCode& ec)
-{
-    ec = 0;
-    if (!AsyncFileSystem::isAvailable() || !securityOrigin()->canAccessFileSystem()) {
-        ec = FileException::SECURITY_ERR;
-        return 0;
-    }
-
-    AsyncFileSystem::Type fileSystemType = static_cast<AsyncFileSystem::Type>(type);
-    if (!AsyncFileSystem::isValidType(fileSystemType)) {
-        ec = FileException::INVALID_MODIFICATION_ERR;
-        return 0;
-    }
-
-    FileSystemSyncCallbackHelper helper;
-    LocalFileSystem::localFileSystem().requestFileSystem(this, fileSystemType, size, FileSystemCallbacks::create(helper.successCallback(), helper.errorCallback(), this), true);
-    return helper.getResult(ec);
-}
-
-void WorkerContext::webkitResolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
-{
-    KURL completedURL = completeURL(url);
-    if (!AsyncFileSystem::isAvailable() || !securityOrigin()->canAccessFileSystem() || !securityOrigin()->canRequest(completedURL)) {
-        DOMFileSystem::scheduleCallback(this, errorCallback, FileError::create(FileError::SECURITY_ERR));
-        return;
-    }
-
-    AsyncFileSystem::Type type;
-    String filePath;
-    if (!completedURL.isValid() || !AsyncFileSystem::crackFileSystemURL(completedURL, type, filePath)) {
-        DOMFileSystem::scheduleCallback(this, errorCallback, FileError::create(FileError::ENCODING_ERR));
-        return;
-    }
-
-    LocalFileSystem::localFileSystem().readFileSystem(this, type, ResolveURICallbacks::create(successCallback, errorCallback, this, filePath));
-}
-
-PassRefPtr<EntrySync> WorkerContext::webkitResolveLocalFileSystemSyncURL(const String& url, ExceptionCode& ec)
-{
-    ec = 0;
-    KURL completedURL = completeURL(url);
-    if (!AsyncFileSystem::isAvailable() || !securityOrigin()->canAccessFileSystem() || !securityOrigin()->canRequest(completedURL)) {
-        ec = FileException::SECURITY_ERR;
-        return 0;
-    }
-
-    AsyncFileSystem::Type type;
-    String filePath;
-    if (!completedURL.isValid() || !AsyncFileSystem::crackFileSystemURL(completedURL, type, filePath)) {
-        ec = FileException::ENCODING_ERR;
-        return 0;
-    }
-
-    FileSystemSyncCallbackHelper readFileSystemHelper;
-    LocalFileSystem::localFileSystem().readFileSystem(this, type, FileSystemCallbacks::create(readFileSystemHelper.successCallback(), readFileSystemHelper.errorCallback(), this), true);
-    RefPtr<DOMFileSystemSync> fileSystem = readFileSystemHelper.getResult(ec);
-    if (!fileSystem)
-        return 0;
-
-    RefPtr<EntrySync> entry = fileSystem->root()->getDirectory(filePath, 0, ec);
-    if (ec == FileException::TYPE_MISMATCH_ERR)
-        return fileSystem->root()->getFile(filePath, 0, ec);
-
-    return entry.release();
-}
-
-COMPILE_ASSERT(static_cast<int>(WorkerContext::TEMPORARY) == static_cast<int>(AsyncFileSystem::Temporary), enum_mismatch);
-COMPILE_ASSERT(static_cast<int>(WorkerContext::PERSISTENT) == static_cast<int>(AsyncFileSystem::Persistent), enum_mismatch);
-#endif
-
 WorkerContext::Observer::Observer(WorkerContext* context)
     : m_context(context)
 {
@@ -511,19 +370,6 @@ void WorkerContext::notifyObserversOfStop()
     }
 }
 
-#if ENABLE(INDEXED_DATABASE)
-IDBFactory* WorkerContext::webkitIndexedDB() const
-{
-    if (!securityOrigin()->canAccessDatabase())
-        return 0;
-    if (!m_idbFactoryBackendInterface)
-        m_idbFactoryBackendInterface = IDBFactoryBackendInterface::create();
-    if (!m_idbFactory)
-        m_idbFactory = IDBFactory::create(m_idbFactoryBackendInterface.get());
-    return m_idbFactory.get();
-}
-#endif
-
 WorkerEventQueue* WorkerContext::eventQueue() const
 {
     return m_eventQueue.get();
diff --git a/Source/WebCore/workers/WorkerContext.h b/Source/WebCore/workers/WorkerContext.h
index 25ca63b8a..f045a4819 100644
--- a/Source/WebCore/workers/WorkerContext.h
+++ b/Source/WebCore/workers/WorkerContext.h
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  */
 
@@ -47,16 +47,7 @@
 namespace WebCore {
 
     class Blob;
-    class DOMFileSystemSync;
     class DOMURL;
-    class Database;
-    class DatabaseCallback;
-    class DatabaseSync;
-    class EntryCallback;
-    class EntrySync;
-    class ErrorCallback;
-    class FileSystemCallback;
-    class IDBFactory;
     class NotificationCenter;
     class ScheduledAction;
     class WorkerInspectorController;
@@ -118,29 +109,9 @@ namespace WebCore {
         NotificationCenter* webkitNotifications() const;
 #endif
 
-#if ENABLE(SQL_DATABASE)
-        // HTML 5 client-side database
-        PassRefPtr<Database> openDatabase(const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode&);
-        PassRefPtr<DatabaseSync> openDatabaseSync(const String& name, const String& version, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode&);
-
-        // Not implemented yet.
-        virtual bool allowDatabaseAccess() const { return true; }
-        // Not implemented for real yet.
-        virtual void databaseExceededQuota(const String&);
-#endif
         virtual bool isContextThread() const;
         virtual bool isJSExecutionForbidden() const;
 
-#if ENABLE(FILE_SYSTEM)
-        enum FileSystemType {
-            TEMPORARY,
-            PERSISTENT,
-        };
-        void webkitRequestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback> successCallback, PassRefPtr<ErrorCallback>);
-        PassRefPtr<DOMFileSystemSync> webkitRequestFileSystemSync(int type, long long size, ExceptionCode&);
-        void webkitResolveLocalFileSystemURL(const String& url, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback>);
-        PassRefPtr<EntrySync> webkitResolveLocalFileSystemSyncURL(const String& url, ExceptionCode&);
-#endif
 #if ENABLE(INSPECTOR)
         WorkerInspectorController* workerInspectorController() { return m_workerInspectorController.get(); }
 #endif
@@ -169,9 +140,6 @@ namespace WebCore {
         void registerObserver(Observer*);
         void unregisterObserver(Observer*);
         void notifyObserversOfStop();
-#if ENABLE(INDEXED_DATABASE)
-        IDBFactory* webkitIndexedDB() const;
-#endif
 
     protected:
         WorkerContext(const KURL&, const String&, WorkerThread*, const String& contentSecurityPolicy, ContentSecurityPolicy::HeaderType);
@@ -219,12 +187,6 @@ namespace WebCore {
         HashSet<Observer*> m_workerObservers;
 
         OwnPtr<WorkerEventQueue> m_eventQueue;
-
-#if ENABLE(INDEXED_DATABASE)
-        mutable RefPtr<IDBFactory> m_idbFactory;
-        mutable RefPtr<IDBFactoryBackendInterface> m_idbFactoryBackendInterface;
-#endif
-
     };
 
 } // namespace WebCore
diff --git a/Source/WebCore/workers/WorkerContext.idl b/Source/WebCore/workers/WorkerContext.idl
index a5408d785..930c2d0ad 100644
--- a/Source/WebCore/workers/WorkerContext.idl
+++ b/Source/WebCore/workers/WorkerContext.idl
@@ -50,12 +50,6 @@ module threads {
         // WorkerUtils
         [Custom] void importScripts(/*[Variadic] in DOMString urls */);
                  attribute [Replaceable] WorkerNavigator navigator;
-#if defined(ENABLE_SQL_DATABASE) && ENABLE_SQL_DATABASE
-        [V8EnabledAtRuntime] Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize, in [Callback, Optional] DatabaseCallback creationCallback)
-            raises(DOMException);
-        [V8EnabledAtRuntime] DatabaseSync openDatabaseSync(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize, in [Callback, Optional] DatabaseCallback creationCallback)
-            raises(DOMException);
-#endif
 
         // Timers
         [Custom] long setTimeout(in TimeoutHandler handler, in long timeout);
@@ -104,18 +98,6 @@ module threads {
 
         attribute [Conditional=BLOB] DOMURLConstructor webkitURL;
 
-#if defined(ENABLE_FILE_SYSTEM) && ENABLE_FILE_SYSTEM
-        const unsigned short TEMPORARY = 0;
-        const unsigned short PERSISTENT = 1;
-        [V8EnabledAtRuntime=FileSystem] void webkitRequestFileSystem(in unsigned short type, in long long size, in [Callback, Optional] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
-        [V8EnabledAtRuntime=FileSystem] DOMFileSystemSync webkitRequestFileSystemSync(in unsigned short type, in long long size) raises (FileException);
-        [V8EnabledAtRuntime=FileSystem] void webkitResolveLocalFileSystemURL(in DOMString url, in [Callback, Optional] EntryCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
-        [V8EnabledAtRuntime=FileSystem] EntrySync webkitResolveLocalFileSystemSyncURL(in DOMString url) raises (FileException);
-
-                 attribute [V8EnabledAtRuntime=FileSystem] FileErrorConstructor FileError;
-                 attribute [V8EnabledAtRuntime=FileSystem] FileExceptionConstructor FileException;
-#endif
-
         attribute ArrayBufferConstructor ArrayBuffer; // Usable with new operator
         attribute Int8ArrayConstructor Int8Array; // Usable with new operator
         attribute Uint8ArrayConstructor Uint8Array; // Usable with new operator
@@ -127,20 +109,6 @@ module threads {
         attribute Float32ArrayConstructor Float32Array; // Usable with new operator
         attribute Float64ArrayConstructor Float64Array; // Usable with new operator
         attribute DataViewConstructor DataView; // Usable with new operator
-#if defined(ENABLE_INDEXED_DATABASE) && ENABLE_INDEXED_DATABASE
-        readonly attribute [V8EnabledAtRuntime] IDBFactory webkitIndexedDB;
-
-        attribute [V8EnabledAtRuntime] IDBCursorConstructor webkitIDBCursor;
-        attribute [V8EnabledAtRuntime] IDBDatabaseConstructor webkitIDBDatabase;
-        attribute [V8EnabledAtRuntime] IDBDatabaseErrorConstructor webkitIDBDatabaseError;
-        attribute [V8EnabledAtRuntime] IDBDatabaseExceptionConstructor webkitIDBDatabaseException;
-        attribute [V8EnabledAtRuntime] IDBFactoryConstructor webkitIDBFactory;
-        attribute [V8EnabledAtRuntime] IDBIndexConstructor webkitIDBIndex;
-        attribute [V8EnabledAtRuntime] IDBKeyRangeConstructor webkitIDBKeyRange;
-        attribute [V8EnabledAtRuntime] IDBObjectStoreConstructor webkitIDBObjectStore;
-        attribute [V8EnabledAtRuntime] IDBRequestConstructor webkitIDBRequest;
-        attribute [V8EnabledAtRuntime] IDBTransactionConstructor webkitIDBTransaction;
-#endif
     };
 
 }
diff --git a/Source/WebCore/workers/WorkerScriptLoader.cpp b/Source/WebCore/workers/WorkerScriptLoader.cpp
index 95476f878..3296f4e54 100644
--- a/Source/WebCore/workers/WorkerScriptLoader.cpp
+++ b/Source/WebCore/workers/WorkerScriptLoader.cpp
@@ -109,7 +109,7 @@ PassOwnPtr<ResourceRequest> WorkerScriptLoader::createResourceRequest()
 {
     OwnPtr<ResourceRequest> request = adoptPtr(new ResourceRequest(m_url));
     request->setHTTPMethod("GET");
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
     request->setTargetType(m_targetType);
 #endif
     return request.release();
diff --git a/Source/WebCore/workers/WorkerScriptLoader.h b/Source/WebCore/workers/WorkerScriptLoader.h
index d6e7de37b..85c4ea81f 100644
--- a/Source/WebCore/workers/WorkerScriptLoader.h
+++ b/Source/WebCore/workers/WorkerScriptLoader.h
@@ -72,7 +72,7 @@ namespace WebCore {
         virtual void didFail(const ResourceError&);
         virtual void didFailRedirectCheck();
 
-#if PLATFORM(CHROMIUM)
+#if PLATFORM(CHROMIUM) || PLATFORM(BLACKBERRY)
         void setTargetType(ResourceRequest::TargetType targetType) { m_targetType = targetType; }
 #endif
 
diff --git a/Source/WebCore/workers/WorkerThread.cpp b/Source/WebCore/workers/WorkerThread.cpp
index 34cf909ff..d2e23a87d 100644
--- a/Source/WebCore/workers/WorkerThread.cpp
+++ b/Source/WebCore/workers/WorkerThread.cpp
@@ -30,6 +30,7 @@
 
 #include "WorkerThread.h"
 
+#include "DatabaseContext.h"
 #include "DedicatedWorkerContext.h"
 #include "InspectorInstrumentation.h"
 #include "KURL.h"
@@ -96,7 +97,7 @@ WorkerThread::WorkerThread(const KURL& scriptURL, const String& userAgent, const
     , m_workerReportingProxy(workerReportingProxy)
     , m_startupData(WorkerThreadStartupData::create(scriptURL, userAgent, sourceCode, startMode, contentSecurityPolicy, contentSecurityPolicyType))
 #if ENABLE(NOTIFICATIONS)
-    , m_notificationPresenter(0)
+    , m_notificationClient(0)
 #endif
 {
     MutexLocker lock(threadCountMutex());
@@ -215,8 +216,9 @@ public:
         WorkerContext* workerContext = static_cast<WorkerContext*>(context);
 
 #if ENABLE(SQL_DATABASE)
+        // FIXME: Should we stop the databases as part of stopActiveDOMObjects() below?
         DatabaseTaskSynchronizer cleanupSync;
-        workerContext->stopDatabases(&cleanupSync);
+        DatabaseContext::stopDatabases(workerContext, &cleanupSync);
 #endif
 
         workerContext->stopActiveDOMObjects();
diff --git a/Source/WebCore/workers/WorkerThread.h b/Source/WebCore/workers/WorkerThread.h
index e3a11df00..cbe5a7178 100644
--- a/Source/WebCore/workers/WorkerThread.h
+++ b/Source/WebCore/workers/WorkerThread.h
@@ -39,7 +39,7 @@
 namespace WebCore {
 
     class KURL;
-    class NotificationPresenter;
+    class NotificationClient;
     class WorkerContext;
     class WorkerLoaderProxy;
     class WorkerReportingProxy;
@@ -63,8 +63,8 @@ namespace WebCore {
         static unsigned workerThreadCount();
 
 #if ENABLE(NOTIFICATIONS)
-        NotificationPresenter* getNotificationPresenter() { return m_notificationPresenter; }
-        void setNotificationPresenter(NotificationPresenter* presenter) { m_notificationPresenter = presenter; }
+        NotificationClient* getNotificationClient() { return m_notificationClient; }
+        void setNotificationClient(NotificationClient* client) { m_notificationClient = client; }
 #endif
 
     protected:
@@ -94,7 +94,7 @@ namespace WebCore {
         OwnPtr<WorkerThreadStartupData> m_startupData;
 
 #if ENABLE(NOTIFICATIONS)
-        NotificationPresenter* m_notificationPresenter;
+        NotificationClient* m_notificationClient;
 #endif
 
         // Track the number of WorkerThread instances for use in layout tests.
diff --git a/Source/WebCore/xml/DOMWindowXML.idl b/Source/WebCore/xml/DOMWindowXML.idl
deleted file mode 100644
index e527350ca..000000000
--- a/Source/WebCore/xml/DOMWindowXML.idl
+++ /dev/null
@@ -1,37 +0,0 @@
-/*
- * Copyright (C) 2012 Google Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-module window {
-
-    interface [
-        Supplemental=DOMWindow
-    ] DOMWindowXML {
-        // Mozilla has a separate XMLDocument object for XML documents. 
-        // We just use Document for this.
-        attribute DocumentConstructor XMLDocument;
-        attribute DOMParserConstructor DOMParser;
-        attribute XMLSerializerConstructor XMLSerializer;
-        attribute XMLHttpRequestConstructor XMLHttpRequest; // Usable with the new operator
-        attribute XMLHttpRequestUploadConstructor XMLHttpRequestUpload;
-        attribute XMLHttpRequestExceptionConstructor XMLHttpRequestException;
-        attribute XMLHttpRequestProgressEventConstructor XMLHttpRequestProgressEvent;
-        attribute [Conditional=XSLT] XSLTProcessorConstructor XSLTProcessor; // Usable with the new operator
-    };
-
-}
diff --git a/Source/WebCore/xml/XMLHttpRequest.cpp b/Source/WebCore/xml/XMLHttpRequest.cpp
index 7ed8212ee..e3fb9d1c0 100644
--- a/Source/WebCore/xml/XMLHttpRequest.cpp
+++ b/Source/WebCore/xml/XMLHttpRequest.cpp
@@ -23,6 +23,7 @@
 #include "XMLHttpRequest.h"
 
 #include "Blob.h"
+#include "BlobData.h"
 #include "ContentSecurityPolicy.h"
 #include "CrossOriginAccessControl.h"
 #include "DOMFormData.h"
@@ -262,12 +263,37 @@ Document* XMLHttpRequest::responseXML(ExceptionCode& ec)
 }
 
 #if ENABLE(XHR_RESPONSE_BLOB)
-Blob* XMLHttpRequest::responseBlob(ExceptionCode& ec) const
+Blob* XMLHttpRequest::responseBlob(ExceptionCode& ec)
 {
     if (m_responseTypeCode != ResponseTypeBlob) {
         ec = INVALID_STATE_ERR;
         return 0;
     }
+    // We always return null before DONE.
+    if (m_state != DONE)
+        return 0;
+
+    if (!m_responseBlob.get()) {
+        // FIXME: This causes two (or more) unnecessary copies of the data.
+        // Chromium stores blob data in the browser process, so we're pulling the data
+        // from the network only to copy it into the renderer to copy it back to the browser.
+        // Ideally we'd get the blob/file-handle from the ResourceResponse directly
+        // instead of copying the bytes. Embedders who store blob data in the
+        // same process as WebCore would at least to teach BlobData to take
+        // a SharedBuffer, even if they don't get the Blob from the network layer directly.
+        OwnPtr<BlobData> blobData = BlobData::create();
+        // If we errored out or got no data, we still return a blob, just an empty one.
+        if (m_binaryResponseBuilder.get()) {
+            RefPtr<RawData> rawData = RawData::create();
+            size_t size = m_binaryResponseBuilder->size();
+            rawData->mutableData()->append(m_binaryResponseBuilder->data(), size);
+            blobData->appendData(rawData, 0, BlobDataItem::toEndOfFile);
+            blobData->setContentType(responseMIMEType()); // responseMIMEType defaults to text/xml which may be incorrect.
+            m_binaryResponseBuilder.clear();
+        }
+        m_responseBlob = Blob::create(blobData.release(), m_binaryResponseBuilder.get() ? m_binaryResponseBuilder->size() : 0);
+    }
+
     return m_responseBlob.get();
 }
 #endif
@@ -287,10 +313,7 @@ ArrayBuffer* XMLHttpRequest::responseArrayBuffer(ExceptionCode& ec)
         m_binaryResponseBuilder.clear();
     }
 
-    if (m_responseArrayBuffer.get())
-        return m_responseArrayBuffer.get();
-
-    return 0;
+    return m_responseArrayBuffer.get();
 }
 
 void XMLHttpRequest::setResponseType(const String& responseType, ExceptionCode& ec)
@@ -530,7 +553,7 @@ void XMLHttpRequest::send(Document* document, ExceptionCode& ec)
     if (!initSend(ec))
         return;
 
-    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
+    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolIsInHTTPFamily()) {
         String contentType = getRequestHeader("Content-Type");
         if (contentType.isEmpty()) {
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -561,7 +584,7 @@ void XMLHttpRequest::send(const String& body, ExceptionCode& ec)
     if (!initSend(ec))
         return;
 
-    if (!body.isNull() && m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
+    if (!body.isNull() && m_method != "GET" && m_method != "HEAD" && m_url.protocolIsInHTTPFamily()) {
         String contentType = getRequestHeader("Content-Type");
         if (contentType.isEmpty()) {
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -588,7 +611,7 @@ void XMLHttpRequest::send(Blob* body, ExceptionCode& ec)
     if (!initSend(ec))
         return;
 
-    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
+    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolIsInHTTPFamily()) {
         // FIXME: Should we set a Content-Type if one is not set.
         // FIXME: add support for uploading bundles.
         m_requestEntityBody = FormData::create();
@@ -608,7 +631,7 @@ void XMLHttpRequest::send(DOMFormData* body, ExceptionCode& ec)
     if (!initSend(ec))
         return;
 
-    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
+    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolIsInHTTPFamily()) {
         m_requestEntityBody = FormData::createMultiPart(*(static_cast<FormDataList*>(body)), body->encoding(), document());
 
         // We need to ask the client to provide the generated file names if needed. When FormData fills the element
@@ -631,7 +654,7 @@ void XMLHttpRequest::send(ArrayBuffer* body, ExceptionCode& ec)
     if (!initSend(ec))
         return;
 
-    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolInHTTPFamily()) {
+    if (m_method != "GET" && m_method != "HEAD" && m_url.protocolIsInHTTPFamily()) {
         m_requestEntityBody = FormData::create(body->data(), body->byteLength());
         if (m_upload)
             m_requestEntityBody->setAlwaysStream(true);
@@ -1033,10 +1056,6 @@ void XMLHttpRequest::didFinishLoading(unsigned long identifier, double)
 
     m_responseBuilder.shrinkToFit();
 
-#if ENABLE(XHR_RESPONSE_BLOB)
-    // FIXME: Set m_responseBlob to something here in the ResponseTypeBlob case.
-#endif
-
     InspectorInstrumentation::resourceRetrievedByXMLHttpRequest(scriptExecutionContext(), identifier, m_responseBuilder.toStringPreserveCapacity(), m_url, m_lastSendURL, m_lastSendLineNumber);
 
     bool hadLoader = m_loader;
@@ -1106,7 +1125,11 @@ void XMLHttpRequest::didReceiveData(const char* data, int len)
 
     if (useDecoder)
         m_responseBuilder.append(m_decoder->decode(data, len));
-    else if (m_responseTypeCode == ResponseTypeArrayBuffer) {
+    else if (m_responseTypeCode == ResponseTypeArrayBuffer
+#if ENABLE(XHR_RESPONSE_BLOB)
+             || m_responseTypeCode == ResponseTypeBlob
+#endif
+             ) {
         // Buffer binary data.
         if (!m_binaryResponseBuilder)
             m_binaryResponseBuilder = SharedBuffer::create();
diff --git a/Source/WebCore/xml/XMLHttpRequest.h b/Source/WebCore/xml/XMLHttpRequest.h
index 26ee65ceb..1373fe7bf 100644
--- a/Source/WebCore/xml/XMLHttpRequest.h
+++ b/Source/WebCore/xml/XMLHttpRequest.h
@@ -106,7 +106,7 @@ public:
     Document* responseXML(ExceptionCode&);
     Document* optionalResponseXML() const { return m_responseDocument.get(); }
 #if ENABLE(XHR_RESPONSE_BLOB)
-    Blob* responseBlob(ExceptionCode&) const;
+    Blob* responseBlob(ExceptionCode&);
     Blob* optionalResponseBlob() const { return m_responseBlob.get(); }
 #endif
 
diff --git a/Source/WebCore/xml/parser/MarkupTokenBase.h b/Source/WebCore/xml/parser/MarkupTokenBase.h
index 986538b8d..2a0aa3050 100644
--- a/Source/WebCore/xml/parser/MarkupTokenBase.h
+++ b/Source/WebCore/xml/parser/MarkupTokenBase.h
@@ -27,7 +27,7 @@
 #ifndef MarkupTokenBase_h
 #define MarkupTokenBase_h
 
-#include "NamedNodeMap.h"
+#include "ElementAttributeData.h"
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
@@ -410,7 +410,7 @@ public:
         }
     }
 
-    AtomicMarkupTokenBase(typename Token::Type::Type type, AtomicString name, PassOwnPtr<NamedNodeMap> attributes = nullptr)
+    AtomicMarkupTokenBase(typename Token::Type::Type type, AtomicString name, PassOwnPtr<AttributeVector> attributes = nullptr)
         : m_type(type)
         , m_name(name)
         , m_attributes(attributes)
@@ -446,13 +446,13 @@ public:
         return m_attributes->getAttributeItem(attributeName);
     }
 
-    NamedNodeMap* attributes() const
+    AttributeVector* attributes() const
     {
         ASSERT(usesAttributes());
         return m_attributes.get();
     }
 
-    PassOwnPtr<NamedNodeMap> takeAttributes()
+    PassOwnPtr<AttributeVector> takeAttributes()
     {
         ASSERT(usesAttributes());
         return m_attributes.release();
@@ -516,7 +516,7 @@ protected:
     // For StartTag and EndTag
     bool m_selfClosing;
 
-    OwnPtr<NamedNodeMap> m_attributes;
+    OwnPtr<AttributeVector> m_attributes;
 };
 
 template<typename Token>
@@ -526,7 +526,7 @@ inline void AtomicMarkupTokenBase<Token>::initializeAttributes(const typename To
     if (!size)
         return;
 
-    m_attributes = NamedNodeMap::create();
+    m_attributes = AttributeVector::create();
     m_attributes->reserveInitialCapacity(size);
     for (size_t i = 0; i < size; ++i) {
         const typename Token::Attribute& attribute = attributes[i];
@@ -541,7 +541,7 @@ inline void AtomicMarkupTokenBase<Token>::initializeAttributes(const typename To
         ASSERT(attribute.m_valueRange.m_end);
 
         AtomicString value(attribute.m_value.data(), attribute.m_value.size());
-        m_attributes->insertAttribute(Attribute::create(nameForAttribute(attribute), value), false);
+        m_attributes->insertAttribute(Attribute::create(nameForAttribute(attribute), value));
     }
 }
 
diff --git a/Source/WebCore/xml/parser/XMLToken.h b/Source/WebCore/xml/parser/XMLToken.h
index d1bdc0e6b..1ed16ca9b 100644
--- a/Source/WebCore/xml/parser/XMLToken.h
+++ b/Source/WebCore/xml/parser/XMLToken.h
@@ -431,7 +431,7 @@ public:
         }
     }
 
-    AtomicXMLToken(XMLTokenTypes::Type type, AtomicString name, PassOwnPtr<NamedNodeMap> attributes = nullptr)
+    AtomicXMLToken(XMLTokenTypes::Type type, AtomicString name, PassOwnPtr<AttributeVector> attributes = nullptr)
         : AtomicMarkupTokenBase<XMLToken>(type, name, attributes)
     {
     }
diff --git a/Source/WebCore/xml/parser/XMLTreeBuilder.cpp b/Source/WebCore/xml/parser/XMLTreeBuilder.cpp
index 0c2b2d6a0..81793ed6d 100644
--- a/Source/WebCore/xml/parser/XMLTreeBuilder.cpp
+++ b/Source/WebCore/xml/parser/XMLTreeBuilder.cpp
@@ -301,7 +301,7 @@ void XMLTreeBuilder::processNamespaces(const AtomicXMLToken& token, NodeStackIte
     if (!token.attributes())
         return;
 
-    for (size_t i = 0; i < token.attributes()->length(); ++i) {
+    for (size_t i = 0; i < token.attributes()->size(); ++i) {
         Attribute* attribute = token.attributes()->attributeItem(i);
         if (attribute->name().prefix() == xmlnsAtom)
             stackItem.setNamespaceURI(attribute->name().localName(), attribute->value());
@@ -315,7 +315,7 @@ void XMLTreeBuilder::processAttributes(const AtomicXMLToken& token, NodeStackIte
     if (!token.attributes())
         return;
 
-    for (size_t i = 0; i < token.attributes()->length(); ++i) {
+    for (size_t i = 0; i < token.attributes()->size(); ++i) {
         Attribute* attribute = token.attributes()->attributeItem(i);
         ExceptionCode ec = 0;
         if (attribute->name().prefix() == xmlnsAtom)